Article Published Date: 9/3/2026
Updated Date: 9/23/2026
ZEDEDA Cloud versions
- ZEDEDA UI: 20.0.10
- ZEDEDA API: 20.0.19
New GA Features
- Tags are available for edge apps in the Marketplace. See Tagging.
- Search for existing user accounts with email address. See Manage Users.
Changed Behavior
Release 20.0 tightens input validation on several fields to close stored cross-site scripting vulnerabilities. These rules apply when you create an object and also when you update an existing one. Objects saved before this release keep their stored values, but an update fails until you bring the affected field into line with the new rule.
EdgeView permissions
Security improvements require a change in access rights for EdgeView. You must have, at minimum, the permissions indicated in the screenshot that follows.
Contact your enterprise administrator and request that the Operate permission be added for the enterprise. You will also need to log in again to enable the EdgeView session for remote access.
Object titles and descriptions reject seven special characters
The title and description fields now reject the following HTML/JS injection characters: <, >, &, ", ', `, and \.
Titles previously accepted every printable ASCII character. Descriptions were previously checked for length only, with no character restrictions.
The apostrophe is the most common character to hit this rule. A title or description such as Customer's Production Cluster is no longer accepted. Rewrite the value without the apostrophe, for example Customer Production Cluster.
Descriptions now accept Unicode letters, numbers, and marks, so accented and non-Latin characters that previously worked continue to work.
The following table lists the current rules.
| Field | Length | Allowed characters |
| title | 3 to 256 characters, starts with an alphanumeric character | Alphanumerics, spaces, and `! # $ % ( ) * + , - . / : ; = ? @ [ ] ^ _ { | } ~` |
| description | 0 to 256 characters | Unicode letters, numbers, marks, whitespace, and `! # $ % ( ) * + , - . / : ; = ? @ [ ] ^ _ { | } ~` |
These fields are validated on the following object types:
- Edge apps and edge app instances.
- Edge nodes, edge node clusters, and cluster groups.
- Projects and deployments.
- Networks and network instances.
- Datastores, images, volume instances, brands, and system models.
- ZEDEDA Edge Kubernetes Service instances and cluster instances.
- Application profiles and patch envelopes.
- Roles, realms, enterprises, authorization profiles, and data streams.
Edge app custom configuration names follow the standard object name rules
The name field inside an edge app manifest's customConfig block is now validated against the standard object name rules. The fieldDelimiter field in the same block is now validated against an allow-list.
Neither field was validated in previous releases, so a customConfig name that contains a space, a colon, a slash, or parentheses is no longer accepted.
| Field | Length | Allowed characters |
| customConfig.name | 3 to 256 characters, starts with an alphanumeric character | Alphanumerics, _, -, and . |
| customConfig.fieldDelimiter | 1 to 32 characters | Alphanumerics and `! # $ % ( ) * + , - . / : ; = ? @ [ ] ^ _ { \| } ~` |
Conventional delimiters such as ###, %%, ${, and {{ remain valid. Whitespace inside a delimiter is not valid.
If you update an edge app that was created before this release and the update fails with an invalid field error, check the customConfig name and field delimiter in the manifest before you retry.
Variable names inside customConfig variable groups are not affected by this change.
Edge app license and agreement URLs require an absolute HTTP or HTTPS address
The license URL and agreement URL fields on an edge app now require an absolute URL that uses the http or https scheme and names a resolvable DNS host. Previous releases accepted any value that parsed as a request URI, including relative paths and other schemes.
Replace any relative path with a full URL, for example https://example.com/license.txt.
API updates in 20.0.17 through 20.0.19
Missing installer images for Jetson, Raspberry Pi, and other platform-specific edge nodes
The Single-Use EVE-OS Installer wizard showed an empty image list when creating an installer for NVIDIA Jetson, Raspberry Pi, and other non-generic platforms. All applicable images now appear for every supported platform.
Edge nodes reporting large metrics payloads could get stuck in a Suspect state
Edge nodes sending large metrics uploads (typically those running many applications or network interfaces) had their uploads rejected, causing the node to appear Suspect in the UI even though it was healthy. The accepted upload size is now 512 KiB (previously 64 KiB), and uploads have more time to complete over slow or constrained links.
Single-Use EVE-OS Installer download failed for newly added devices
Downloading an installer or live image for a device that had not yet been onboarded failed with a server error, which is the normal case when preparing a first-time install. Downloads now succeed. Encrypted configuration values are applied automatically once the device completes onboarding.
Device metrics could stop updating
A fault in the metrics processing pipeline could cause device metrics to stop updating until the service recovered. Metrics now continue processing without interruption.
Known Issues
- Only one architecture (amd64 or arm64) can be marked as the default LTS image at a time.