IBM SOAR Platform Update | July 2026 | v51.0.8.2
A behind-the-scenes update that makes your SOAR apps faster, more secure,
and better positioned for the future — with no changes required from most
customers.

WHAT CHANGED?
-------------
With the release of IBM SOAR v51.0.8.2, the base container image that
powers all SOAR apps has been updated from Python 3.11 to Python 3.12.
This is part of our ongoing commitment to keeping the platform current
with the latest stable, supported, and secure software foundations.
Every app that runs on IBM SOAR — whether it's one of our out-of-the-box
integrations or a custom app your team has built — runs inside a container.
That container is built on top of a base image that we maintain and publish.
This base image includes the Python runtime, the operating system layer, and
a set of supporting libraries.
In this release, we've moved that base image from Python 3.11 to Python 3.12.
We've also taken the opportunity to remove a number of web server packages
(such as httpd and its associated modules) that were present in the image but
are not needed by SOAR apps. Removing unnecessary software reduces the attack
surface and results in a cleaner, leaner container.

WHY PYTHON 3.12?
----------------
Python 3.12 brings meaningful improvements compared to 3.11, including better
error messages, faster execution, and continued security support from the
Python community. Python 3.11 remains supported for now, but updating ahead of
its end-of-life date ensures your platform stays on a secure, maintained
foundation without a last-minute scramble.
This update also sets us up for a future transition to Python 3.13 and a newer
Red Hat UBI base image (UBI 10), which we are actively working towards.

DOES THIS AFFECT ME?
--------------------
For the vast majority of customers, no action is required. Apps built using
the IBM SOAR SDK and published through our standard pipeline will automatically
pick up the updated base image. The Python 3.12 runtime is fully backwards
compatible with code written for Python 3.11.
  - Using IBM-provided out-of-the-box integrations?
    No action needed — updated images are published automatically.
  - Running custom apps built with the resilient-sdk?
    Rebuild your app container to pick up the new base image. The default
    base image tag (latest) now points to Python 3.12.
  - Pinned to the python-311 image tag?
    You can continue using that tag for now, but we recommend updating your
    Dockerfile to use python-312 or latest at your earliest opportunity, as
    the 3.11 image will not receive updates going forward.

WHAT ABOUT SECURITY?
--------------------
Alongside the Python version update, we've explicitly removed several web
server packages (httpd, mod_ssl, and related modules) from the app container
image. These packages were never used by SOAR apps, but their presence meant
that any vulnerabilities discovered in them could show up in security scans
of your environment. Their removal closes that gap and results in a cleaner
vulnerability profile.

LOOKING AHEAD
-------------
We are already planning for a subsequent move to Python 3.13 alongside a
Red Hat UBI 10 base operating system layer. This release is an intentional
stepping stone in that direction. We will communicate timelines for those
changes well in advance.

-----------------------------------------------------------------------
If you have questions about this change or need help updating custom app
containers, please reach out through your standard IBM SOAR support channel
or visit the SOAR developer documentation at: https://ibm.biz/soar-python-docs