AIOps LEAP Plugin Upgrade Stalls for Hours — Pre-Upgrade Fix Required<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Symptom When installing or upgrading the AIOps LEAP plugin, the installation appears frozen or takes significantly longer than expected — typically anywhere from 2 to 18+ hours depending on your instance size. The plugin eventually completes successfully, but the duration makes it impractical for a controlled maintenance window. Root Cause The AIOps LEAP plugin ships a set of role containment records (sys_user_role_contains) — configuration that defines which roles automatically inherit permissions from other roles. When upgrading from a version where these records do not yet exist, the platform inserts them synchronously during the install. Each insertion triggers a recursive recalculation of role inheritance across all users. The platform updates the inheritance count on every matching row in sys_user_has_role — one database write per user per affected role. This process runs inline with the plugin installation, blocking completion until every update is written. On instances with a large number of users assigned to LEAP-related roles (such as itil, workflow_agent, leap_admin, leap_agent, or artifact_creator_agent), this can result in millions of row updates, bringing the upgrade to a near standstill. Affected Versions This issue affects upgrades targeting LEAP 2.4.0 through 4.0.0. Earlier versions may experience a milder form of the same issue limited to ITIL-heavy instances. The permanent fix ships in the July 2026 LEAP release. Instances on that version or later do not require any pre-upgrade steps. Resolution — Pre-Upgrade Steps These steps must be completed before starting the LEAP plugin upgrade. If the upgrade has already completed on your instance, see Already Upgraded? below. Step 1 — Download the fix update set Download the attached update set file: LEAP-UpgradePreFix-RoleContainment.xml Step 2 — Import the update set Navigate to System Update Sets → Retrieved Update Sets.Click Import Update Set from XML and upload the downloaded file.Once imported, open the update set record and click Preview Update Set.Resolve any preview errors if prompted (none are expected under normal conditions).Click Commit Update Set. Step 3 — Run the fix script Navigate to System Definition → Fix Scripts.Search for the fix script named LEAP-RoleContainmentUpgrade.Open the record and click Run Script in Background. Note: Use the background option, not Run Script — this prevents session timeouts and ensures the script completes uninterrupted.The script typically completes in 2–10 minutes. Duration scales with the number of users on your instance. Step 4 — Verify the fix completed successfully Navigate to System Logs → locate the most recent execution of LEAP-RoleContainmentUpgrade.Confirm the log output ends with: validate() ... PASSEDIf the output shows FAILED or lists unexpected results, do not proceed with the upgrade. Open a support case and reference this article. Step 5 — Proceed with the LEAP upgrade Once the fix script has completed with a PASSED result, proceed with your LEAP plugin upgrade as normal. What the Fix Script Does The script pre-creates a set of role containment records using the exact system IDs that the LEAP upgrade package would otherwise insert during installation. When the upgrade runs, it finds those records already present and performs only a lightweight metadata refresh — the cascade never fires. All operations are idempotent — the script checks whether each record already exists before acting and skips anything already in the correct state. It is safe to run multiple times and safe to run regardless of which LEAP version you are upgrading to. Already Upgraded? If the slow upgrade has already completed, no remediation is needed. The data on your instance is correct — the upgrade finished successfully, it simply took longer than expected. There is no data integrity risk. The fix in this article is a pre-upgrade preventive measure only and should not be applied to an instance that has already successfully upgraded to the target version. The permanent fix ships in the July 2026 LEAP release. Once your instance is on that version or later, no pre-upgrade steps are required for future upgrades.