Taranac 1.1.0

[1.1.0] — 2026-07-17

Added

• Configuration Tracker. Track the running configuration of your network
  devices over time. Point a tracked config at a device (SSH/Telnet, SCP/SFTP
  for binary blobs, or HTTP/HTTPS for API-driven gear), pick a recipe (which
  commands to run + scrub sets that mask secrets and strip volatile lines
  before storage), and Taranac captures a snapshot on a schedule or on demand.
  Every capture is versioned with a per-config version number and content-hash
  dedup, rendered in a side-by-side diff; tag any version pin / baseline /
  golden / approved or with your own label. A config-status column surfaces
  drift at a glance, and starter recipes + scrub sets ship for a range of vendors.
• Collectors. Collection runs through a collector — the unit of deployment
  that owns the devices it can reach. The built-in embedded collector needs no
  setup; for segmented or remote networks, deploy a standalone collector that
  dials out to the core (enroll with a reveal-once token, Ed25519-signed, with
  run-scoped just-in-time credentials and its own outbox) so there's no inbound
  path to secure. Collector health, enrollment, source IP and release/contract
  compatibility are visible in the UI, with two dashboard widgets and TOFU
  SSH host-key pinning.
• Credentials vault + just-in-time credentials. Device logins are stored
  encrypted and can be minted just-in-time for a single privileged collection run,
  then rotated — the long-lived secret never leaves the vault.
• References — "where used". Before you delete a group, network object,
  device, profile or credential (and more), Taranac shows where it's
  referenced and blocks the delete with an itemised list instead of failing
  opaquely or silently cascading. Deliberate delete-semantics span the Identity,
  Network, AAA, NAC and NCM domains.
• Bulk onboarding. Turn an address list into tracked configs in one pass, with
  an optional per-batch collector.
• Config change alerts. Subscribe recipient groups to a tracked config and get
  email on drift, collector-offline or failing collection, with per-config digests.
• Network Object fqdn type. Address objects — and collection sources — can
  now target a hostname, not just an IP / subnet / range.
• Update notifications. An opt-in, signed version check surfaces a "new release
  available" status on the dashboard and in Settings — no telemetry, you choose
  when to check.
• Localized date/time pickers across forms and log filters, with time-of-day
  range filtering on logs; multilingual notification email rendered per the
  configured language.

Changed

• Reworked the Configuration Tracker list and config-detail pages (inline
  version tagging, resizable split-pane diff, cleaner timeline); Collectors
  moved into Settings.
• Tracker and collector screens are fully localized (English, German, Spanish,
  French, Portuguese offered; Russian and Ukrainian opt-in).
• Daemon forensic logs now rotate with a monthly, size-aware archive view.

Fixed

• Config change-notification email and collect-now report the per-config
  version, not an internal global sequence.
• Snapshots dedup on content hash; a lapsed just-in-time credential lease
  self-heals; collect-now no longer blanks the page on refresh; percent-encoded
  secrets are masked in collector transport errors.
• NAC "last seen" comparison fixed for string-typed timestamps.
• Breadcrumbs restored on nine pages; date/time pickers gained a working clear
  button.
• Version display no longer drifts. The version shown in the dashboard, API
  and UI (footer / login / error pages) is now baked into the images at build
  time from a single source, so it always matches the deployed release. Previously
  a stale APP_VERSION carried over in an upgraded .env could make the app
  report an old version; that knob is gone — the image tag is the one version.