Skip to content

Ghostwriter v7.2.1

Choose a tag to compare

View all tags
@chrismaddalena chrismaddalena released this 09 Jul 07:33
· 207 commits to master since this release
v7.2.1
ee81647
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Summary

This release introduces several quality of life changes for admins and users alike and some bug fixes.

CHANGELOG

[7.2.1] - 9 July 2026

Added

  • Added support for a new --required-only for loading seed data
    • Fixtures can now be flagged with "required": false
    • The loaddata command will not load fixtures marked as such when the flag is set
  • Added option to scope a service token by client
    • This works similarly to All Accessible Projects but filters the access by one or more clients
    • The token will have access to all current and future user-accessible projects under the selected client(s)
  • Added preview modals for findings and observations on reports
    • These now have Preview buttons in their dropdown menus
  • Added jinja2 rendering to field preview modals for finding, observation, report, and project fields
    • Continuing preview enhancements from v7.2.0, previews now render Jinja2 templating using the report context
    • Clicking the Preview buttons will now trigger the modal and a Rendering rich text preview... loading message
    • It will take a moment to generate the context and render any Jinja2
    • If there are syntax errors, rendering will fail and there will be an error message
  • Added configuration options to the General Settings to control maximum token lifetime and credential rotation
    • Maximum Token Lifetime in Days (default: 365) limits how far into the future a token expiry date may be set
    • Require Token Rotation to Extend Expiry (default: True) forces token rotation when extending expiry
  • Added the option to regenerate API and service tokens to immediately roll the credential and receive a new token

Changed

  • Updated Ghostwriter CLI Binaries: Updated the pre-built Ghostwriter CLI binaries to v1.0.1
  • Marked the starter templates as non-required so they will not re-appear during updates and container builds if deleted
  • Adjusted the Docker service configurations to cap log file size to 30MB (maximum of 3 files * 10MB each)
    • This caps the size of all logs to ~240MB
  • Preview modals for rich-text fields now render references, captions, and client logo objects
    • References will be represented by your figure label and a placeholder—e.g., Figure #
    • Captions will also use the configured caption label and prefix and show the caption text–e.g., Figure # — Caption Contents
    • Client logo objects will insert the client logo when available
      • Logos are set to a static 6.5" width to align with Office's default width and keep very large or wide logos under control
  • When editing an API token's expiration date, the form and back-end now enforce the Maximum Token Lifetime in Days setting
  • The whoami query now works with service tokens
  • Changed the Hasura GraphQL build to add a copy of BusyBox for health checks
    • The Hasura base image uses Ubuntu Jammy, and installing curl during emulated linux/arm64 builds can trigger libc-bin post-installation failures under QEMU
    • The Hasura image no longer runs apt-get just to provide a health check command
    • Hasura health checks now use the bundled BusyBox wget probe instead of curl

Fixed

  • Removed tags from autocomplete suggestions in filters so they work as expected when selecting them (Fixes #927)

Security

  • Adjusted WebSocket consumers to check object access to match access controls used elsewhere
Assets 3
Loading