Release notes

#2026

#release_v26.10.2

2026-10-30

• Documentation: new user docs covering install, first steps, products and assets, risk, audits and scanners, integrations, administration and DefectDojo migration
  • Contributors: active and inactive developers based on pushes in the last 30 days, with links to the full list; a developer’s page lists the findings they introduced; top developers can be filtered by latest push, branch and introduced findings.
  • Findings: location column in the list
  • Performance: faster finding queries and SLA filtering, better metrics caching, lighter list rendering, faster first navigation.
  • Install: Helm chart and install repository releases are published with each release tag; release images no longer need a registry login.
  • API docs: OpenAPI tags and endpoint summaries cleaned up, recommendations endpoints documented.
  • Fixes: tech radar license check, job reset in the pipeline dropdown, triage date for assigned unverified findings, swapped tasks in finding details, deduplication cards on mobile, timeouts in task tracker migrations.

#release_v26.10.1

2026-10-23

• Tech Radar: graph explorer connecting developers, assets, branches and technologies; counters and filters integrated into assets.
• Task trackers: added YouTrack alongside Jira; unified connections, integrations and status mappings; create or attach tasks from any finding status, detach or delete linked tasks.
• Asset page: redesigned tabs, linkable header tiles, developer stats and safer settings.
• Dashboard: compact layout with period KPIs, trends, SLA counters, triage and activity.
• Jobs: improved sequences, search and runtime estimates; scanner job lists; optional schedule sequences.
• DefectDojo: immediate imports with progress tracking; polling and dojo_helper removed.
• Background operations: notification-center progress for product deletion and creating task-tracker issues.
• Licenses: copyleft classification and filtering; dependency suggestions.
• Performance and UI: faster lists and counters, improved dark mode, bulk actions, navigation and bugfixes.
• API docs: moved from drf-yasg to drf-spectacular, with improved tags, descriptions and endpoint contracts.

#release_v26.08.1

2026-08-10

• Scopes now support selecting products, individual assets, or all assets of a specific type
• Minor bugfixes

#release_v26.07.1

2026-07-23

• Added comments for findings
• Added schedules for container registry scans
• Added date filters for audits
• Improved tags__not_in filter performance for findings
• Added run audit modal to pipelines list
• Full localization
• Added Uzbek locale

#release_v26.06.1

2026-06-19

• Improved sending assets to auditor
• Reworked roles list view, added more details

#release_v26.05.1

2026-05-22

• Add export to markdown everywhere
• Add lines highlight in editor and markdown
• Minor bug fixes

#release_v26.04.1

2026-04-22

• Reworked Scanner logic
• Drag n drop in sequences job items
• Added scan type field in rules instructions
• Virtual scroll in tables and lists
• Heatmap charts for findings activity
• Updated FAQ section
• Performance improvement
• Minor UI improvements

#release_v26.03.2

2026-03-30

• Setting: Unique assets across the entire portal
• Setting: Add comment when no findings are present in the quality gate
• UX: Display pipeline fields in asset and audit lists
• Feature: Merge asset tags when merging assets

#release_v26.03.1

2026-03-09

• Add scanner types for findings
• Global dashboard rework
• Extend logging for user related actions
• Add display of products and assets for selected findings
• Add export action by default to all tables

#release_v26.02.2

2026-02-15

• Added LLM proxy to portal.
• Minor bug fixes and UI improvements.

#release_v26.02.1

2026-02-05

• More logging for auth events
• Added possibility to disable reopening of resolved findings during basic deduplication
• Increased custom field max length for findings
• Minor bugfixes

#release_v26.01.1

2026-01-15

• Extended basic deduplication to get rid of already existing duplicates
• Removed subgroup and branch fields from repository URL config
• Minor UI improvements and bug fixes

#2025

#release_v25.12.2

2025-12-27

• Added reopen resolved duplicates on import
• Updated security headers

#release_v25.12.1

2025-12-13

• Added swagger schema and description for scan report import endpoint
• Improved workers distribution in db_helper service
• Minor bugfixes

#release_v25.11.3

2025-12-01

• Improved import performance
• Reworked swagger schema
• Removed legacy CI endpoints

#release_v25.11.2

2025-11-24

1. Added GitLab container registry integration
2. Reworked asset submission to audit workflow
3. Added custom field to automation instructions
4. Added option to delete associated findings when deleting assets
5. Added findings deduplication when moving assets between products
6. Code refactoring, UI improvements and minor bug fixes

#release_v25.11.1

2025-11-05

• Customization of basic deduplication
• Improved information in commit status in QG
• VCS support with self-signed certificate
• Refactoring, bug and UI fixes

#release_v25.10.1

2025-10-20

1. Reworked rules import/export
2. Added docker image tag field for findings
3. Minor fixes/improvements

#release_v25.09.2

2025-09-22

1. Custom importer improvements
2. Audit schedules now support asset clusters
3. Bulk change product for assets
4. Bug fixes and minor improvements

#release_v25.09.1

2025-09-01

— It’s now possible to create role from projects in SSO integrations from github and gitlab! — Empty reports are now allowed when importing findings — Added migration for creating a default product — Minor VCS bugfixes

#release_v25.08.1

2025-08-11

• BitBucket support
• Custom fields for webhook notifications
• Jira default assignee selection
• Improved jira description
• Added new IDE extensions for JetBrains and VSX-based editors
• Minor UI and bug fixes

#release_v25.07.1

2025-07-16

• Auditor in Portal
• Audit fields: branch, commit hash, commit author, duplicates counts
• Bulk jira issues creation
• Fields for Scanner table: autocloser action, autocloser enabled
• Sticky columns in tables
• Bugfixes: auto-tagging, custom import logging

#release_v25.06.1

2025-06-10

1. Fixed bulk triage bug
2. Improved sla violation performance
3. Django worker moved to container
4. Minor UI fixes

#release_v25.05.2

2025-05-26

• Added event log
• Updated celery dependencies
• Minor UI fixes

#release_v25.05.1

2025-05-08

1. Reworked VCS integration to be based on QualityGates.
2. Added AutoValidation on report import.
3. VCS integration can now change commit status.
4. UI/UX improvements.
5. Refactoring and bug fixes.

#release_v25.04.1

2025-04-07

• Fixed assignee for self-hosted JIRA
• Jobs, assets, rules lists are now open modal by clicking on the row
• Table inline editing for fields: severity, asset’s product, sequence
• Rule modals now have affected findings lists
• Buttons UI rework
• Open table row menu by right click
• Form validation errors are now less annoying

#release_v25.03.1

2025-03-17

• Reworked roles
• UI fixes

#release_v25.02.2

2025-02-27

• Added product scopes to notifications.
• Notifications added for findings import
• Notifications added for validator’s finished cycle
• Now all tables are able to switch between card / table modes
• UI fixes

#release_v25.02.1

2025-02-12

Bugfixes:

• It was not possible to add tags for products
• Finding filtering by tags was slow
• Sometimes it was not possible to remove products
• No more IPv6 in nginx config (the future will not come) Features:
• Configure statuses for WRT metric
• Rename products and custom scanners (yes, it was not possible, what a nice surprise for us)

#release_v25.01.2

2025-01-23

• Enable/disable automatic creation of Jira issues for verified vulnerabilities
• Deduplication and CWE fixes
• Minor UI fixes

#release_v25.01.1

2025-01-15

• New bulk actions for validation rules (remove, disable)
• Validation rules filtering by tag
• Validation rules regex support
• New fields for validation instructions (line number, severity)
• Close merge request for custom statuses with custom comment option
• UI: attention for sequences with same scanner
• UI: random avatars
• UI: Suggest variable names for job env variables
• UI: Suggest Scanner/Importer for SCAN_TYPE variable
• CWE findings filter now suggests CWE for filtered findings
• Minor UI fixes
• Some bugfixes

#2024

#release_v24.12.2

2024-12-23

• Business criticality in percents
• New UI filters (source line for finding, business criticality for products)
• Caching fixes
• New quick filters

#release_v24.12.1

2024-12-16

• Сustom importers
• GIT integrations healthcheck and error log
• Autovalidator, Deduplicator, CVSS launch frequency in seconds
• Improved metrics caching
• Minor UI and bug fixes

#release_v24.11.3

2024-11-26

1. Added automation rules execution order
2. Added skip ssl verification flag for a message broker
3. Added assets and tags as parameters for automation rules
4. Added tags to scanners
5. Various importers bug fixes

#release_v24.11.2

2024-11-14

1. New asset creation logic on import. Now you can only add an asset with a scanner report and it will be added to the default product or not added if the asset already exists in one of the existing products. So, no need to use products for all our CI users. Those who use auditor - you are great, it’s nothing to worry about :smile:
2. Bulk audits run
3. Customizable UI tables. Now you can pick up your favourite columns and sort data by them

#release_v24.11.1

2024-11-05

1. Added multiple git instances
2. Added portal internal and external host urls
3. Added Misconfigurations case in trivy importer
4. Various bug fixes

#release_v24.10.2

2024-11-01

• Added token authorization for Jira
• Added job sequences for assets
• Reworked version control comments mode settings
• Support new auditor job settings
• Minor bugfixes

#release_v24.10.1

2024-10-01

• Improved version control systems integration: delayed comments, deletion of previous comments, including findings from other branches in pull requests
• Some notifications now include user information
• Small fixes in importers

#release_v24.09.1

2024-09-17

• Webhook based integration with GitHub and GitLab: push events trigger scans, merge requests trigger comments
• Reworked Assets table in product
• Added configuration of default job sequence
• Improved Job list in Auditor settings
• Minor UI bug fixes

#release_v24.08.2

2024-08-16

1. Added custom field for findings
2. Minor bugfixes

#release_v24.08.1

2024-08-05

1. New statuses: Temporarily Risk Accepted, Permanently Risk Accepted
2. Autovalidator actions for new findings statuses
3. Jira issue status mappings for new findings statuses
4. Configurable two way binding for Jira issue statuses
5. Added a status change event for notifications
6. Improved findings automation filters
7. Minor bug fixes

#release_v24.07.2

2024-07-09

1. UI improvements
2. Various bugs fixes

#release_v24.07.1

2024-07-03

1. Added grouping feature to auto validator
2. Minor bugfixes

#release_v24.06.3.1

2024-06-21

Minor bugfixes

#release_v24.06.3

2024-06-19

1. Added custom selection of items in tables
2. Added nessus importer
3. Minor fixes

#release_v24.06.1

2024-06-01

1. Added monthly risk trend line
2. Added recommendations
3. Added importers for Hadolint, Dependency-Track
4. Added filters for findings by tags of products and assets

#release_v24.05.1

2024-05-21

1. Added audits
2. Added cloud account asset
3. Added dashboard customization
4. Added moving assets with its findings between products
5. Minor bugfixes

#release_v24.04.1

2024-04-16

1. Added assets management
2. Minor bugfixes

#release_v24.03.3

2024-04-01

1. Added groups functionality
2. Added jira issues into reports
3. Added PHPCodeSniffer importer
4. Improved automation processes
5. Added copy button for auditor jobs
6. Added tags management screen

#release_v24.03.2

2024-03-25

1. Improved backend performance
2. Made concurrency setting available for db_helper

#release_v24.03.1

2024-03-13

1. Added jira due date field
2. Added affected by automation rules
3. Minor bugfixes + performance improvement

#release_v24.02.3

2024-02-23

1. Added notifications webhook for findings based on filters
2. Added search by title for roles
3. Using environmental score instead of base score for cvss 3.1
4. Minor bugfixes

#release_v24.02.2

2024-02-15

1. Added automatic product selection for scheduling based on tags
2. Added jira components
3. Added bilk jira issues link

#release_v24.02.1

2024-02-07

1. Added cvss
2. Added filter for findings by product business criticality
3. Minor bugfixes

#release_v24.01.1.1

2024-01-31

1. Bugs hotfixes

#release_v24.01.1

2024-01-16

1. Added sso roles mapping
2. Added django admin access for users
3. Added name filter for product types
4. Improved subgroups for repo url generation
5. Added basic deduplication settings
6. Fixed file path

#2023

#release_v23.12.4

2023-12-28

1. Load optimization
2. Added reject status for jira
3. Deduplicator fixed for assets
4. Reworked product filter by tags

#release_v23.12.3

2023-12-21

1. added affected products for repo url configs
2. added token auth for endpoints
3. added loading repos from gitlab and github

#release_v23.12.2

2023-12-11

1. Repository link logic optimization
2. UI improvements (for assets in general)
3. New finding fields (repository, docker image, domain, host)
4. Assets are passed to report generator

#release_v23.12.1

2023-12-07

1. Reworked assets and git repo url

#release_v23.11.2

2023-11-22

1. Auditor Schedules
2. Fixed sorting by date

#release_v23.11.1

2023-11-07

1. Auditor integrations
2. Findings file path fixed
3. Assign tags fixed
4. Added finding filters by product and product type

#release_v23.10.1

2023-10-11

1. Added new fields for sso configurations
2. Improved sso error handling
3. Reworked bulk actions
4. Added branch for findings
5. Added downloading risk overview in .csv
6. Importer fix

#release_v23.09.2

2023-09-15

1. Added SSO integrations
2. Added prowler importer
3. Minor bug fixes

#release_v23.09.1

2023-09-04

1. Added report generation

#release_v23.08.3

2023-08-31

1. Added global rules for Auto Validator and Deduplicator
2. Added new scanners: - GitLab Gemnasium - GitLab KICS - GitLab Gitleaks - GitLab OWASP Zap - GitLab Bandit - GitLab ESLint - GitLab Semgrep

#release_v23.08.2

2023-08-24

1. Added possibility to specify jira issue types
2. Added jira priority-severity mapping
3. Added jira status mapping
4. Added possibility to reopen a resolved finding

#release_v23.08.1

2023-08-08

1. Added findings grouping
2. Fixed incorrect work of basic deduplicator and autocloser with dependency and url fields

#release_v23.07.2

2023-07-25

1. Fixed big with default creation of products in common product type even when there’s no access to this product type
2. Fixed case-sensitive fields in severity mapping
3. Exp date for jwt token moved from body to cookies
4. Added slicing to metrics

#release_v23.07.1

2023-07-09

Resolved the issue causing the bug with autocloser closing false positive findings

#release_v23.06.2

2023-06-28

1. RBAC Support:
   • Role-Based Access Control (RBAC) is now supported, providing improved user management and access control.
   • A new “Users and Roles” tab has been added, allowing easy management of users and roles within the portal.
2. Affected Products field in Auto Validator and Deduplicator rules:
   • Auto Validator and Deduplicator rules now include an “Affected Products” field.
   • Users can associate specific products with rules, granting greater flexibility and customization.
   • Role-based permissions control user interactions with rules based on product availability:
   • Rule are hidden, if it has no available products for the user.
   • Rule are viewable and product association management allowed if at least one product in this rule is available for the user, but rule editing is restricted.
   • Full control granted if all products in a rule are available for the user.
3. Tag support for products:
   • Tags can now be added to products from the product’s “Options” page, allowing for better organization and categorization of application assets.
4. New filters on “Product” page:
   • Two new filters, “Tags” and “Not tags,” have been introduced on the “Product” page. These filters enable easy searching and filtering of products based on assigned tags, streamlining navigation and management.
5. AWS Security Hub importer:
   • We are excited to introduce the new AWS Security Hub importer, seamlessly integrating your AWS security ecosystem with the AppSec Portal.
   • Import security findings from AWS Security Hub directly into the portal, enhancing your vulnerability management process.
6. Enhanced SLA violation filtering:
   • The “SLA Violated” filter has been enhanced to allow filtering findings based on the type of SLA violation.
   • You can now filter findings by Verification SLA violated, Assign SLA violated, or Resolve SLA violated.
7. Auto Validator and Deduplicator enhancements:
   • The Auto Validator rules now supports searching findings based on specified values in the Vulnerable URL, Dependency fields and by Import Source (internal or external at your option).
   • Deduplicator rules have been enhanced with new criteria to determine the equality of original and duplicate findings — “Same dependency” and “Same vulnerable URL”.
   • Additionally, Deduplicator rules now offer the ability to search findings for specified values in the Vulnerable URL, Dependency fields, and by Import Source, with the option to choose internal or external finding’s sources.

#release_v23.06.1

2023-06-20

• added symkey deletion via
• changed entrypoint number of threads

#release_v23.05.3

2023-06-15

fixed product deletion bug