Taranac 1.2.0

Added

• Reports. A new reporting surface across AAA, NAC, and audit data. Save
  dataset presets over the built-in report templates, compose them into
  multi-page reports, and schedule periodic e-mail delivery of a report or
  dataset. Every view exports to CSV, XLSX, and PDF, with bar/line/pie/multiline
  charts and a catalogue of ready-made presets. PDF rendering is handled by a new
  internal rendering service. Reports and datasets support a read-only view,
  so you can grant look-but-don't-edit access.
• Reports on the dashboard. A dashboard widget surfaces your saved reports at
  a glance.
• Backend-driven password policy. Password length and complexity rules are
  enforced consistently everywhere a password is set or changed — the same rules
  in the web UI and on every login path.
• MFA push-expiry audit. An MFA_PUSH_EXPIRED event is now recorded when a
  push approval request expires unanswered.

Changed

• "Must change password" is enforced at device login. A local account flagged
  to change its password is now denied TACACS+/RADIUS/NAC sign-in until the
  password is changed, instead of only being blocked in the web UI.
• Faster configuration reloads on large deployments. The TACACS+/RADIUS/NAC
  config auto-reload skips a full regeneration when nothing config-relevant has
  changed, and generation no longer blocks the control-plane event loop — a large
  reduction in idle CPU on big device inventories.
• Correct timezone for scheduled jobs across nodes. The system timezone is
  resolved without stale caching, so scheduled reports and jobs fire at the right
  local time on every node.
• Faster selection in picker drawers. Choosing members, groups, devices,
  endpoints, or datasets in a selection drawer now takes effect on click, instead
  of requiring a separate "apply" step.

Fixed

• TACACS+ logging can no longer be wedged by one bad batch. A single poison
  log batch is dropped instead of stalling the entire authentication-log writer.
• Fresh-install backups. Creating a backup on a new install no longer fails
  with a 500 (the backups volume is initialised with correct ownership at boot).
• Auth settings form. Nested fields and zeroed values now persist correctly.