description	Latest features and enhancements added in this release.
icon	sparkles

What's New

{% hint style="info" %} Only significant new updates are listed here. To see the complete list of changes, refer to the NSO Changelog Explorer. {% endhint %}

Release Highlights

This release includes major enhancements in the following areas:

Improved systemd Integration

The NSO systemd service now starts NSO in foreground mode, allowing systemd to monitor the ncs.smp process directly and restart it after an unexpected failure. The service also uses improved startup logic that allows long-running model upgrade to complete without timing out.

Documentation Updates:

• Updated the System Install section with the new behavior.

Post-Quantum Cryptography Support

NSO adds support for Post-Quantum Cryptography (PQC) to help guard against "store now, decrypt later" attacks with future quantum computers, including:

• Implementation of post-quantum key exchange and signature algorithms, such as mlkem768x25519-sha256 and ML-DSA.
• Offering PQC algorithms for northbound TLS and SSH connections by default.
• Use of PQC algorithms southbound for built-in NETCONF client and NEDs, depending on support by the managed devices.
• Use of hybrid x25519mlkem768 key-exchange group with TLS 1.3 for connections between HA nodes.

The NED framework now uses the Apache MINA library in order to enable PQC support.

Documentation Updates:

• Updated the Secure Deployment and SSH Key Management pages to document PQC algorithms and their connection scope.
• Added a link from the NSO NETCONF Server guide to the configurable SSH algorithm settings.

Richer NACM Device Group Support

A re-implemented NETCONF Access Control Model (NACM) extension in NSO makes it possible to scope NACM rules to a model path and one or more device groups. For example, it is now possible to write a ruleset that allows some modifications to a device, but not others, for all devices in a device group.

Documentation Updates:

• Described supported usage in the AAA Infrastructure.

Nano Services Updates

NSO 6.8 introduces additional progress trace events when nano service execution is blocked waiting on a pre-condition, action invocation, or similar. This feature provides better insight into nano service state and simplifies troubleshooting.

Furthermore, the system now waits for outstanding commit queue items before marking nano service provisioning as completed (reaching the self/ready state), helping callers ensure changes are propagated to network devices.

Documentation Updates:

• Updated the Nano Services documentation.

Configurable Template Loading Mode

Template loading mode (strict/relaxed) can now be explicitly configured in the XML template or in the package meta data file, allowing developers to decide on how strict is the validation in multi-NED environments.

Documentation Updates:

• Expanded the Namespaces and Multi-NED Support section with information on loading mode configuration and default selection algorithm.

Web UI Updates

NSO 6.8 improves Web UI configuration and transaction workflows.

• The Config editor adds tree filters, a Metadata drawer, schema-driven actions, and clearer handling of lists, leaf-lists, choices, and defaults.
• The Transactions view replaces Export transaction with Show as and adds configuration formats and dry-run result views. Web UI search fields now use case-insensitive matching.
• The Web UI also adds a Packages sidebar category for loaded extension-package views and updates alarm, compliance-reporting, template, rollback-file, and High Availability guidance.
• The Web UI AI Assistant is provided through the cisco-nso-ai-assistant package. Administrators can configure a LiteLLM-compatible gateway or Crosswork AI backend, control user access, and optionally enable permitted MCP tools.

Documentation Updates:

• Updated the Web UI, Configuration Editor, Transactions, and Tools pages.
• Added a new page for Packages sidebar category.
• Added a new Web UI AI Assistant guide for administrators.