Replicant v0.8.0 — security review closed, Node 18 dropped

The 2026-08 security review is fully closed, and one supported platform is dropped. Read the second half before upgrading if you build the web UI on Debian or Ubuntu.

One sending run per host, enforced (F-08)

The events-per-second cap is applied by a single process's emit loop, so two Replicant processes sending at once delivered twice the cap to your collector, and neither was doing anything wrong. Safety rule 4 exists to protect that collector; a cap any second invocation silently doubles is not protecting it.

A second sending run is now refused, and the refusal names the holding pid — "another process" is not actionable, and the holder is usually a forgotten web UI in another terminal. --no-send and --to-file never acquire the slot, because they cannot reach a collector and so cannot exceed anything.

A host-level lease keyed on collector destination was the alternative and was declined: leases expire, clocks drift, and a killed process orphans one. flock is released by the kernel on exit, kill -9 included, so there is no stale lock to clean up. It is a smaller promise, and unlike a lease it is one the code can keep.

What it does not cover is stated rather than implied: two hosts pointed at one collector are still two caps. Nothing on a single machine can see that.

Node 18 dropped, advisories cleared (F-14)

npm audit went from 6 advisories, one critical, to 0. vite 5 to 8, vitest 2 to 4. Node 18 left maintenance in April 2025, so the floor the installer declared was already behind the platform it named.

The cost is real, and here it is: Debian 12 and Ubuntu 24.04 ship Node 18 and can no longer build the web UI from their own repositories. Use --no-web for a CLI-only install, or install Node 20+ from NodeSource first. The CLI is unaffected on both. CI now covers debian:12 with --no-web and adds debian:13, which ships Node 20, for the full install.

jsdom is pinned to 26 rather than 30 deliberately: 30 requires Node 22.22+, above the floor this release declares, and a test-only dependency should not choose the supported platform.

The eighth golden line was never compared

All three vendor golden tests assert the reference contains eight golden lines, assert the fixtures match that count, and then byte-compare seven. The eighth line of FortiGate, PAN-OS and Check Point had never been compared to anything.

The lines were correct, so this was a coverage hole rather than a live defect. It is still worth stating plainly: this project's correctness story is the golden oracle, and the oracle was proving seven eighths of what its own test names claimed.

Smaller

• REP-018 carries TA0005 Defense Evasion alongside TA0008. T1078 and T1550 are both Defense Evasion, and using valid accounts and alternate authentication material to move laterally is the evasion.
• The test suite no longer reads and writes your real ~/.config/replicant. It had no conftest.py, so it was touching the saved collector profile and the persistent web token.
• An external 58-to-62 person-week feature roadmap was triaged; roughly 13 were adopted. Reasons for each rejection are in docs/10x-roadmap-triage.md so they can be argued with rather than rediscovered.

Verified

975 Python and 170 frontend tests, black / ruff / mypy / tsc clean, 11 CI checks including four installer containers and a real systemd unit. The wheel attached here was built from a clean checkout of this tag and smoke-tested in an empty virtualenv outside the repository.

Unchanged and still true: every timing and delivery claim in this project is loopback only. Replicant has not been tested against a live LogRhythm collector.