v0.9.4

0.9.4 (2026-10-30)

What's new

• Windows have one look. Each window has the dark blue head of the tables. In each window footer, Cancel is the plain button and the main action is the one filled button.
• Text boxes, dropdowns and search boxes have one look. Every screen uses it, also sign-in, Inspect, the time picker and the filter searches. Each box changes its fill and its line under the pointer, and shows a ring when it has the focus.
• Dashboard panels fit their content. On the read page and in edit mode, each panel is as tall as its content. No panel scrolls inside itself or cuts its shadow, and the space between the panels is the same everywhere. The preview in Add a panel has the same height as the panel on the dashboard.
• Smaller fixes. In Save this view, each label names its box, and the buttons are in the window footer. In a narrow dashboard panel, the Findings summary shows its counts in three columns.

Before you upgrade

• No mapping change, no new setting and no new permission. You do not need to do anything before the upgrade.
• The dashboard API now refuses only two panels that start on the same cell. It accepts a panel that starts higher than the rows of the panel above it.
• If you go back to 0.9.3 after an edit in 0.9.4, a saved dashboard can show panels on top of each other. 0.9.3 also refuses a dashboard file from 0.9.4 that has such a layout.

For contributors

• A lint rule refuses a raw input, select or textarea outside components/ui/. Use the kit pieces UiTextBox, UiTextArea, UiSelect and UiSearchBox.
• A Playwright walk compares the boxes and the window buttons of every screen with the kit.
• The STE linter is in the repository, at development/scripts/ste-lint.py. A test keeps each published page of docs/ at 0 findings.
• The /release-notes command writes this section. The Release notes workflow lints it each time a person opens, edits or reopens the release PR.

The list below shows each change of this release.

Features

• kit search box, small pager dropdown and a lint rule against raw form fields (#1059) (967580f)
• release notes with a What's new section, and an STE check for them and the docs pages (#1062) (c3ee84b), closes #1061

Bug Fixes

• a dashboard panel holds only the cells of its top row (#1046) (4007ff7), closes #1045
• dashboard panels take the height of their content, on the read page and in edit mode (#1048) (7713485), closes #1045
• every window box uses the one kit text box and dropdown style (#1052) (4e48cb2), closes #1050
• every window head takes the dark blue band of the table heads (#1051) (61100b1), closes #1049
• the kit box and one search box outside the windows, and one pair of window footer buttons (#1054) (d912a74)

v0.9.3

0.9.3 (2026-10-29)

Bug Fixes

• role names in words, and one height with a 1px edge in every screen head (#1041) (5feec35)

v0.9.2

0.9.2 (2026-10-29)

Bug Fixes

• a saved card opens its item from anywhere, and its hover keeps the card white (#1037) (b88e27a)
• deps: update dependency zensical to v0.0.73 (#1035) (dec7852)

v0.9.1

0.9.1 (2026-10-27)

Bug Fixes

• at a past time, a kev finding gets the kev sla deadline (#1026) (e5c5b55)
• each segmented control has a name for screen readers (#1029) (be6a7c6)

v0.9.0

0.9.0 (2026-10-26)

This release has no code changes after 0.8.9. It marks the changes of 0.8.9 as a minor release: composable dashboards, the Roles card and the can_export permission. The notes of 0.8.9 list each change.

Documentation

• the memory bank after release 0.8.9, and release 0.9.0 marks its changes (#1014) (425982a)

v0.8.9

0.8.9 (2026-10-26)

Features

• a catalog of dashboard panels, and each panel can get its own data (#996) (0553f29)
• dashboard files, an NDJSON export and an import with a result for each line (#1002) (7c9f896)
• edit a dashboard, add panels from the catalog, and share or remove it (#1010) (4c4625d)
• export controls stay visible but disabled, with the reason, for a role without can_export (#995) (230ac3b)
• owners read the role names they can share a dashboard with (#1007) (e8f6267)
• saved dashboards with sharing, revisions and the can_edit_dashboards permission (#1001) (7a2489e)
• the dashboards list and read page, with export and import of dashboard files (#1003) (78eb979)
• the export files need the can_export permission (#994) (268e778)
• the roles card is a table of each permission and the roles that have it (#993) (9713f1a), closes #990
• the roles route lists each permission with a name and what it allows (#991) (651ba95), closes #990

Bug Fixes

• dashboard sharing refuses a role name that no role has (#1008) (3f98e68)

v0.8.8

0.8.8 (2026-10-23)

Bug Fixes

• a value of a fixed filter list with no rows shows 0 (#982) (da320d3)
• findings names refused filters and keeps assignee and unassigned apart (#977) (5c75987), closes #975
• the audit log counts each of its actions (#985) (7d580bd), closes #983
• the backend refuses a decision expiry that has passed, and a rotation of a dead token (#986) (c95c371), closes #984
• the screens take no expiry that has passed, rotate only live tokens, and end a range today (#987) (1e94051)
• the unassigned count leaves out the assignee values that its click clears (#981) (69165ca)

v0.8.7

0.8.7 (2026-10-23)

Features

• findings image, cve and package filters take several typed values (#957) (190f538)
• findings namespace, package type and assignee filters take several values (#956) (de9f942)
• six findings filters take several values in the api (#953) (a003b62)
• the audit log and approvals filters take several values in the api (#960) (3886f70)
• the audit log and approvals screens take several values per filter (#963) (3df0424)
• the images filters accept several namespaces, images and tags (#951) (5a96102)

Bug Fixes

• a new username is lower case only, and sign-in accepts any case (#966) (b5c46f6)
• a picked username keeps its capitals in the filters (#964) (5d5323a)
• a saved view refuses the filter pairs that findings refuses (#974) (5875cd9), closes #969
• a scheduled export refuses the filter pairs that findings refuses (#970) (fa055cc), closes #962
• the helm test pod of javv-opensearch meets pod security restricted (#947) (174518c)
• the invite form says that a username is in lower case (#967) (40229b3)
• the scheduled export takes four more filters and names a blocked filter as the screen does (#971) (06adad5), closes #962

v0.8.6

0.8.6 (2026-10-20)

Bug Fixes

• the audit log names every action and shows the values of each settings change (#934) (e5d848f)

v0.8.5

0.8.5 (2026-10-19)

Bug Fixes

• audit changes show plain field names and the reason of each change to not affected (#932) (c9d3fb7)
• each release keeps its own docs on the docs site (#927) (463c066)
• the activity card shows a new reason as its plain label (#930) (5e507b5)
• the frontend server closes an idle backend connection before the backend does (#929) (89f8bf7)