Welcome to the November edition of the CVAT Digest, your monthly roundup of updates across Community, Online, and Enterprise editions, plus useful improvements for DevOps and ML teams.
This month focuses on secure token management, smoother Helm and infrastructure operations, and quality fixes that reduce friction in day-to-day annotation and review.
New
Helm charts on Docker Hub
You can now pull CVAT Helm charts directly from Docker Hub. This simplifies CI pipelines and mirrors alongside your existing container sources. Read more
Helm: Kvrocks storage controls
Added support for configuring Kvrocks PVC via annotations, plus VolumeAttributesClass support and automatic creation in the public chart. This gives operators more predictable storage behavior on managed Kubernetes.
Docs: Backblaze B2 (S3-compatible)
New documentation explains how to use Backblaze B2 as an S3-compatible cloud storage option.
Updates
Stronger privacy for API access tokens
- Admins no longer see other users’ tokens on the token management page.
- The Server API now returns only your own tokens for everyone, including admins, and removes owner filters from the tokens endpoint.
Result: safer token handling out of the box.
Server API simplification for data uploads
Removed the redundant storage parameter from POST /api/tasks/<id>/data. Storage location is now inferred from other parameters. This change also closes a security issue described in the linked advisory.
Backups cleanup
Files under data/tasks/<id> are no longer included in task backups or restored from them. Newer CVAT versions do not create or use these files, so backups are cleaner and smaller.
UI and Ops quality of life
- Token creation UI shows expiration dates in DD/MM/YYYY to match the token table.
- Cloud storage names in the UI now match their official names.
- Traefik updated to v3.6.x.
- Video manifest generation is more tolerant and can leverage keyframes even if the seek lands earlier.
Security updates
- Fixed a vulnerability that could allow writes to an attached network share.
- Token visibility changes (above) reduce risk of accidental disclosure.
Performance
- Lower memory usage for project dataset exports.
- Faster admin experience thanks to improved performance on the access token editing page.
Other updates
- Google Drive was removed from the list of accepted cloud storage providers in the Server API. It was never implemented.
- Python 3.9 support ended due to EOL. Use Python 3.10+.
Fixes
- Correct chunk creation for some video files after the FFmpeg update.
- Eliminated excessive
GET /api/usersrequests on the task page for each assigned job. - Prevented the Actions menu from opening twice across resource cards (Projects, Jobs, Cloud storages, and more).
- Consensus review now shows quality conflicts correctly in review mode.
- Cloud storage health: unavailable storages now report NOT_FOUND instead of 400 Bad Request.
- OpenAPI schema fixed for
retrieve_dataendpoints:typeis required for both tasks and jobs. - Job statistics no longer fail when a track has no keyframes.
PATCH /api/tasks/<id>/data/metanow updates the task’supdated_dateas expected.- Corrected retry handling for 429 TooManyRequests when uploading via TUS.
- An error message is now shown if data for the 3D canvas cannot be fetched.
Have suggestions or requests for what you'd like to see next? Open an issue on GitHub or contact us via Help Desk.
.svg)
.png)
.png)
.png)