v2.0.0

2.0.0 (2026-07-17)

⚠ BREAKING CHANGES

• the Wazuh-only alerts surface was removed (route /alerts, alerts API endpoints, the /dashboard/summary v1 Accept path, and the MCP list_integration_alerts tool). Use federated search (Investigations) + Detections instead. Sophos/Wazuh alert ingestion is unchanged.

Features

• add Wazuh detection mapping validation and fix missing seed definition (567ff40)
• implement node aggregation with +N expand functionality and update FlowCanvas layout constants (736f1f1)
• implement robust CSV export for federated search results and add i18n support for federated search labels (48699e1)
• replace raw condition operator labels with localized, human-friendly definitions in RouteConditionEditor (a6538e7)

Bug Fixes

• dispose DB pool on soft-timeout and initialize local variables early to prevent UnboundLocalError during pipeline failures (4dc3b33)
• let global admins scope live capture to a tenant via org selector (baaadae)
• prevent normalization engine from applying pre_cast and value_map to default values to avoid errors with non-string defaults (6f7c675)
• prevent session cookie boot crashes by handling empty environment variables and fixing OCSF resource path anchoring. (329b37a)
• resolve RedBeat starvation and crash-loops by increasing lock timeout, setting max loop interval, and enforcing idempotent scheduler registration. (29038a8)
• sanitize service account shim IDs to prevent foreign key violations in audit and mapping logs (cf43df8)

Performance Improvements

• batch ingestion metering with InVolumeAccumulator to reduce Redis I/O latency in pipeline (13e4cbc)

Code Refactoring

• document alerts surface removal as breaking (f424f36)