Prefect 3.7.5 - Cancellation Cleanup and Event Reliability

Prefect 3.7.5 was published on June 18, 2026, as a normal release for PrefectHQ/prefect, not a prerelease. The most operator relevant change is cancellation cleanup: this release adds a cleanup producer for runs that stay in cancelling state, then adds backend visibility for the worker channel and cleanup queue.

The full release notes and downloads are on the GitHub release page.

The release name is “No run left CANCELLING”, and the main scheduler signal is #22238. Prefect now has a cancelling timeout cleanup producer, which is aimed at runs that have entered cancellation but have not left that state. For operators, that matters because cancellation is often part of incident response: a stuck cancellation can leave worker capacity, automations, and user expectations out of sync.

#22310 adds backend observability for the worker channel and cleanup queue. The release notes do not expose the exact metric names, so treat this as an operational visibility change rather than a new public API. The practical value is simpler triage when a worker path, queue cleanup path, or cancellation path is lagging.

Several fixes target cases where orchestration metadata can mislead the user or the scheduler. #22287 fixes pending task runs in the flow run graph, while #22286 avoids subflow tracking key collisions. Those are small fixes on paper, but bad graph state and collided tracking keys can waste time during incident review.

Scheduling gets a narrow but useful correction in #22232, which preserves IANA timezone names in RRuleSchedule.from_rrule(). Pipelines that move around DST boundaries often fail in boring ways when timezone identity is flattened or lost. Prefect also handles RecursionError in Flow.serialize_parameters through #22245, and snapshots the block registry before auto registration iteration in #22297. Both reduce failure modes before a flow run has meaningful work to report.

The database maintenance items are the most concrete data layer changes in the release. #22250 adds an index on event_resources(occurred) for vacuum performance, and #22291 runs db_vacuum maintenance queries without the API statement timeout. That points at a familiar platform problem: event tables grow, maintenance gets slower, and a timeout meant for normal API traffic is a poor fit for cleanup work.

Event delivery also gets a reliability fix. #22241 degrades the events WebSocket on transient connection failures instead of treating every short network issue as terminal. For teams watching automations, artifacts, concurrency, and work pool events, this is a better failure shape than silent confusion around a broken socket.

SQLite and Postgres users both get smaller compatibility fixes. #22264 declares the ESCAPE character in LIKE expressions for SQLite, and #22089 URL encodes credentials in the asyncpg LISTEN and NOTIFY DSN path. The second one matters if database passwords contain characters that are legal in credentials but unsafe when pasted into a DSN without encoding.

Prefect 3.7.5 also keeps pace with dependency behavior. #22277 fixes FastAPI 0.137 compatibility by skipping route deletion when the router is referenced. #22309 supports the AnyIO 4.14 task group interface. #22265 bumps runtime uv image pins to 0.11.21. These are not feature work, but they matter in container images and API servers that pin dependency ranges tightly.

The security fix to note is #22252, which prevents SSRF through remote $ref values during JSON schema validation. This is the kind of boundary that data teams should care about, because schemas often arrive from integration code, partner payloads, or generated clients. The release also fixes profile inspect --output json emitting invalid JSON for the active profile in #22317. For automation that reads Prefect profile state, valid JSON is the difference between a stable check and a brittle shell workaround.

• Release page: Prefect 3.7.5 release
• Repository: PrefectHQ/prefect
• Tag: 3.7.5