Skip to content

v0.42.0

Choose a tag to compare

View all tags
@KIvanow KIvanow released this 04 Sep 11:35
· 50 commits to master since this release
v0.42.0
40639fa
This commit was signed with the committer’s verified signature.
KIvanow Kristiyan Ivanov
GPG key ID: 4BB27D5B662BC86B
Verified
Learn about vigilant mode.

Highlights

  • This release makes the monitor security-aware and retention-aware: a new Security page cross-references every connected instance against published CVEs, and self-hosted operators can finally configure how long locally stored data is kept.

Features

  • Inspect connected instances for published CVEs (#428). A new Security page answers, per connected instance (and per node for clusters), which published CVEs affect the running engine version and its loaded modules. A merged advisory corpus is refreshed every six hours from GHSA, NVD and MITRE, enriched with CISA KEV and FIRST EPSS, and findings are ranked by KEV/EPSS with the affected version range and upgrade guidance. Uncertainty is never hidden: quiet sources, unreachable nodes and unreadable module lists surface as caveats instead of a false "no CVEs" verdict. Egress-restricted installs can opt out with CVE_ENABLED, and CVE_GITHUB_TOKEN raises the GHSA quota.
  • Configurable local data retention for self-hosted deployments (#430). Self-hosted installs now keep all data unless the operator sets a retention window — via the settings page or the new LOCAL_RETENTION_DAYS environment variable (which seeds a fresh install only). Cloud mode keeps its tier-based windows (7/90/365 days). All swept stores, including hot keys and ACL audit entries, follow the single shared retention policy, and the setting round-trips correctly on both the SQLite and PostgreSQL backends.

Maintenance

  • Bump stream-json from 3.4.0 to 3.5.0 (#435).
  • Bump transformers from 5.9.0 to 5.10.1 in /packages/cache-benchmark (#429).

What's Changed

  • feature: inspect connected instances for published CVEs by @jamby77 in #428
  • feature: configurable local data retention for self-hosted deployments by @KIvanow in #430
  • chore(deps): bump transformers from 5.9.0 to 5.10.1 in /packages/cache-benchmark by @app/dependabot in #429
  • chore(deps-dev): bump stream-json from 3.4.0 to 3.5.0 by @app/dependabot in #435

Full Changelog: v0.41.0...v0.42.0

What's Changed

  • chore(deps): bump transformers from 5.9.0 to 5.10.1 in /packages/cache-benchmark by @dependabot[bot] in #429
  • feature: inspect connected instances for published CVEs by @jamby77 in #428
  • feature: configurable local data retention for self-hosted deployments by @KIvanow in #430
  • chore(deps-dev): bump stream-json from 3.4.0 to 3.5.0 by @dependabot[bot] in #435

Full Changelog: v0.41.0...v0.42.0

Contributors

jamby77, KIvanow, and dependabot
Assets 3
Loading