All release notes
Platform
Correlation correctness and security hardening
Major correlation-correctness, security hardening, and reliability release. Scoped per-device and per-client correlation locks remove false contention, CPE and version matching accuracy is improved across seven areas, a broad set of security hardening changes is applied across authentication, tenant isolation, input handling, and network exposure, and the agent gains proof-of-possession key rotation with rotating log output.
New
- Engine auto-mitigation and reopen notifications: the correlation engine now records a system note on a risk whenever it automatically mitigates or reopens it, and notifies the assigned user on reopen.
- AGENT_CHANGE pattern scoring: change risks now receive deterministic severity scoring for recognised high-signal change categories, with SecAI-assisted classification when the pattern is ambiguous. A score breakdown is included in the risk detail view.
- Rotating log writer on Windows agent: log output is now bounded and rotated, replacing unbounded log file growth.
Improved
- Correlation locks are now scoped per device, per client, and globally. Non-conflicting scans run in parallel without producing false busy states.
- Product name normalisation rebuilt as an 8-step pipeline: handles trademark symbols, parenthetical noise, trailing semantic versions, Java-style update strings, trailing years, edition keywords, and vendor prefix stripping. Alias resolution runs after every step.
- Version parsing now accepts Windows-style alphanumeric build identifiers such as 21H2 and 22H2.
- Correlation key generation now sorts rules deterministically before selecting the primary rule, preventing key drift when enrichment updates arrive in a different order.
- Per-run normalisation cache prevents redundant fuzzy lookups for the same software names during a correlation pass.
- SecAI enrichment is now cached at the CVE level. Risks linked to the same CVE reuse the shared enrichment and CVEs enriched within the last 7 days are skipped on subsequent runs.
- EPSS scoring improvements: continuous proportional formula, de-escalation when EPSS drops significantly, multi-CVE risks use the highest linked EPSS score, UI label and bar scale corrected, last-sync state persisted for restart recovery.
- SecAI concurrency capped to prevent burst overload on the inference service, with bounded retry handling for transient processor errors.
- Agent inventory collection now tolerates partial data-source failures rather than aborting the full cycle.
- Queued local agent tasks expire after 24 hours so stale deferred work does not execute indefinitely.
- Session inactivity timeout is now enforced server-side in addition to client-side timeout behaviour.
- Improved logging when the rate limiter falls back to a local mode.
- Backend upstream DNS resolution refreshes automatically after a backend restart, without requiring a manual server reload.
Fixed
- Mitigation reopen verification now reads from correlation metadata instead of deleted risk asset rows, making reopen detection effective.
- False mitigation guard: recent-only and device-scoped correlation runs no longer close a correlated risk when historical contributions fall outside the current scan scope.
- Stale device contributions are pruned from correlation state before merge operations, preventing dead device references from polluting correlated risks.
- CPE hyphen wildcard (-) was treated as a literal version string in both CPE parsing paths; now correctly handled as not-applicable.
- In-memory rule constraint builder incorrectly treated keys with undefined values as present, producing empty constraint arrays and false-positive matches.
- Platform product family matching now enforces family-and-boundary token matching; a generic prefix no longer drifts across major versions or unrelated editions.
- Wildcard-only rules for older CVEs likely representing data-quality issues are now dropped and logged rather than matching everything in the same product family.
- CPE-first matching now falls through to name-based matching when CPE vendor and product do not align, preventing false negatives from heuristic agent-generated CPEs.
- Agent-supplied CPE data from inventory is now carried through the full backend path so the correlation engine can use it.
- Client detail page no longer crashes when a user record is missing a role value.
- Mitigated risk detail page no longer crashes when a related user record has a null name field.
Security
- Hardened authentication and session handling, including stronger two-factor verification and securely generated temporary credentials.
- Strengthened tenant isolation and access-scope enforcement across all request types, including privileged password resets.
- Reduced information disclosure on the authentication flow.
- Hardened report handling and data exports against server-side request and spreadsheet-formula abuse.
- Strengthened input sanitisation and database query handling.
- Tightened service-to-service access controls and network exposure.