What's New in Connect 2026.3

Version: 2026.3.1.4

Release Date: October 14, 2026

See the complete Connect 2026.3 Release Notes.

New Features

There are currently no new features for this release.

Security Updates

This release strengthens Connect’s upload validation, image processing, authentication error handling, response security headers, logout and cache behavior, and hostname protection.

Existing Customers Upgrading

A normal upgrade restores the existing Tomcat configuration. This preserves customer ports, SSL, and authentication settings, but it also means the new hostname protection in the packaged server.xml is not automatically applied.

To enable it, stop the Alteryx Connect service and back up C:\Program Files\AlteryxConnect\conf\server.xml (or the equivalent path for a custom installation). Edit the existing file. Do not replace the whole file, as it may contain customer-specific settings:

In the existing <Engine> opening tag, change only defaultHost to invalid.invalid:
```
<Engine name="Catalina" defaultHost="invalid.invalid">
```

Inside that Engine, before the existing localhost Host, add:

<Host name="invalid.invalid" appBase="blocked-webapps"
      deployOnStartup="false" autoDeploy="false">
  <Valve className="org.apache.catalina.valves.ErrorReportValve"
         showReport="false" showServerInfo="false" />
</Host>

Inside the existing <Host name="localhost" ...>, add an alias for each hostname Tomcat receives and add the error-report Valve if it is not already present:
```
<Alias>connect.example.com</Alias>
<Valve className="org.apache.catalina.valves.ErrorReportValve"
       showReport="false" showServerInfo="false" />
```
Mantieni tutte le altre voci esistenti all'interno di quell'Host. Aggiungi l'alias come un vero elemento XML, non all'interno di un commento. Utilizza solo il nome host, non https://, una porta o un percorso.
Separatamente, per adattarsi alla nuova configurazione di reindirizzamento HTTPS del pacchetto, aggiungi transportGuaranteeRedirectStatus="308" al tag di apertura esistente LockOutRealm, mantenendo le sue altre impostazioni:
```
<Realm className="org.apache.catalina.realm.LockOutRealm"
       transportGuaranteeRedirectStatus="308">
```
Questa impostazione non trasforma, da sola, un'installazione HTTP in un'installazione HTTPS.

Save the file and restart the service. Without steps 1–3, an upgraded installation should continue to operate, but the new Tomcat hostname protection will not be active. Step 4 applies the separate HTTPS-redirect setting included in this patch.

Nuovi clienti che installano questa patch

A fresh installation already contains the new Tomcat protection. Before users access Connect through a DNS name, stop the service and add that name inside the localhost Host in C:\Program Files\AlteryxConnect\conf\server.xml:

<Alias>connect.example.com</Alias>

Riavvia il servizio. Senza l'alias, l'accesso a localhost funziona, ma le richieste che utilizzano il nome host non configurato potrebbero restituire 404. Non cambiare defaultHost di nuovo in localhost.

Reverse-Proxy or Load-Balancer Deployments

Configure an alias for the hostname that the proxy sends to Tomcat. If the proxy replaces the public hostname with an internal one, add the internal hostname as an alias too.

If the immediate proxy connects to Tomcat from a non-local IP address, add that IP to the existing [global] section of C:\Program Files\AlteryxConnect\ac_work\alteryx_connect.properties. For example, if Tomcat sees the proxy as 10.20.30.40:

connect.trusted-proxies=127[.]0[.]0[.]1|::1|0:0:0:0:0:0:0:1|10[.]20[.]30[.]40

Replace 10.20.30.40 with the actual proxy IP; retain the loopback entries. This setting accepts an IP-matching regular expression, not a DNS hostname or an end-user IP. Direct-access installations, or proxies connecting from loopback, need no change. If a non-local proxy is not configured, valid logins can still succeed, but auditing and IP-based login controls may identify multiple users by the shared proxy IP.

Behavior Changes to Expect

I nuovi caricamenti di allegati e diagrammi possono essere rifiutati se superano il limite configurato o se hanno un tipo di file non supportato, non corrispondente o non sicuro. I file memorizzati esistenti non vengono modificati in blocco.
Le immagini appena salvate vengono elaborate per rimuovere i metadati. Le immagini insolite possono essere rifiutate o apparire leggermente diverse.
I messaggi di accesso non riuscito rivelano meno informazioni.
Attachment downloads are no longer intended to remain in the browser cache for one year, so repeated downloads may use more network traffic.
Le installazioni HTTP rimangono supportate; la patch non richiede un nuovo certificato SSL.

In questa sezione: