Stop a running background job, faster saving of large pages, resource limits for Liquid filters

November 12, 2026

NEW

• Stop a running background job: The new admin_background_job_stop GraphQL mutation, and a stop button for running jobs in the pos-cli GUI, stop a job created with the background tag within a few seconds, wherever it is. Changes inside an unfinished transaction are rolled back, the job isn't retried, and the stop is logged. Deploys, data exports, data imports and other jobs platformOS runs for you can't be stopped. See Stopping a running background job.

IMPROVED

• Database queries stop when a request times out: A query started by a page or GraphQL request that runs past the request timeout is now cancelled instead of continuing in the background and slowing down later requests.
• Creating and updating pages with large content is much faster: For example, saving a page of several megabytes no longer takes seconds.
• Liquid filters handle empty input consistently: extract_url_params, expand_url_template, humanize, translate, translate_escape, video_params, querify, useragent and url_to_qrcode_svg now return an empty value for blank input instead of reporting an argument error. Many other filters now accept nil without failing.
• The parse_json tag treats an empty body as an empty hash: An empty body, including one made only of whitespace HTML entities, now returns an empty hash, the same way the parse_json filter does.
• Liquid filters now have limits on how much data they generate, so a single call can't exhaust resources:
  • advanced_format: the total of widths and precisions is capped at 1,000,000.
  • format_number and encrypt: precision and pad_payload_right are capped at 1,000,000.
  • random_string, pad_left and array_in_groups_of: arguments must be whole numbers up to 1,000,000.
  • gzip_decompress: output is capped at 50 MB.
  • hash_diff: very large comparisons are rejected with a hint to pass use_lcs: false.
• array_add, array_prepend and hash_add_key now also catch indirect self-references: For example, adding a hash that already contains the target. Previously these made rendering fail.
• Faster GPG key validation: is_gpg_valid and the GraphQL GpgKey validation return the same results, and validating many keys no longer slows them down.
• Clearer error messages for invalid arguments in force_encoding, encode, advanced_format, gzip_decompress, pad_left and digest: hash_dig now returns nil when called with invalid arguments.

FIXED

• pos-cli deploy shows an error when processing a deploy's assets fails: Previously the error wasn't passed on to pos-cli, so the failure went unreported.
• Deploys no longer lose a page that shares its URL with another file: When an app page was added on the same route as a module page, removing the app page later also removed the module page, and redeploying didn't bring it back.
• Asset URLs change after pos-cli data clean --include-schema: Previously, redeploying the same asset files could keep serving the old cached content.
• pos-cli sync now returns an error when a file can't be deleted because records still depend on it: Previously it reported success.
• Constants cache is cleared correctly after pos-cli data clean --include-schema: Previously, context.constants could still return the old values until adding a new constant.
• Nested parameters no longer cause a 500 error: Requests to form and API endpoints with nested parameters where a plain value is expected (for example, form_id[$ne]=1) now get a 4xx response instead of a 500 error.
• Parameter names in an incompatible encoding no longer cause a 500 error: Multipart requests whose parameter names use an incompatible character encoding (for example, UTF-16) now get a 400 Bad Request instead of a 500 error.