v4.20.0

4.20.0 (2026-08-07)

Bug Fixes

• api: reject revision re-keying on in-place updates (5a9bfdf), closes bump-modified-throu#the-body
• migrations: make canonical domain backfill release agnostic (ee56510)
• release-tracks: allow ATT&CK-branded track names (fee3f8b)
• release-tracks: attest historical snapshot graphs (0a91329)
• release-tracks: capture in-place edits and revocations in revision sync (d4adfc0)
• release-tracks: capture technique conversions in revision sync (6ea2606)
• release-tracks: close deterministic graphs over members (85a011a)
• release-tracks: deduplicate virtual revisions deterministically (080930f)
• release-tracks: enable programmatic access to snapshot retrieval (cfc0371)
• release-tracks: enforce cross-tier revision uniqueness (af58596)
• release-tracks: enforce unique release versions (7fa26ed)
• release-tracks: enforce virtual materialization lifecycle (37f521e)
• release-tracks: freeze dynamic staged revisions (39d8e94)
• release-tracks: make release protection durable (a3734c1)
• release-tracks: persist scheduled materialization metadata (054678a)
• release-tracks: preserve materialized virtual graphs (8090dbc)
• release-tracks: protect destructive operations (256f86e)
• release-tracks: record virtual release provenance (dafdb64)
• release-tracks: reject unresolved primary revisions (aacfeff)
• release-tracks: repair deterministic bundle integrity (c2c017c)
• release-tracks: scope graph migration to active relationships (9ba3bb7)
• release-tracks: sync candidate and staged pins to new object revisions (9bccaba)
• release-tracks: validate virtual component identities (290ba19)
• release-tracks: validate virtual composition contracts (a50a78a)
• release-tracks: validate virtual object type filters (294e4e5)
• release-tracks: validate virtual snapshot schedules (029e33a)
• scheduler: recover scheduled virtual snapshots (e2dd402)
• validation-bypasses: make startup rule seeding idempotent (0db3407)

Features

• api: reject in-place mutation of members-pinned revisions (812d5bc)
• config: expose REST API build information (b2ea605)
• release-tracks: accept config when creating tracks (1cdc18f)
• release-tracks: add bidirectional refs between objects and tracks (a83c032)
• release-tracks: add editable snapshot notes (756a0c2)
• release-tracks: add into_candidates conflict resolution policy (21f6bdd)
• release-tracks: add releases-by-object lookup (6dc7cea)
• release-tracks: add STIX bundle output format for snapshot exports (18013d2)
• release-tracks: add track type to workspace.release_tracks backrefs (446b017)
• release-tracks: add workflow gate and modified-in-place status (ffedbbc)
• release-tracks: bound snapshot publication versions (b000e01)
• release-tracks: complete virtual release workflow (341d80d)
• release-tracks: make deterministic graphs opt in (e351ddf)
• release-tracks: make snapshot bundles deterministic (86d11ed)
• release-tracks: make snapshot retrieval routes explicit (c1d3ddb)
• release-tracks: persist snapshot bundle hashes (665876e)
• release-tracks: resolve virtual quarantine conflicts (ab36cdb)
• release-tracks: schedule virtual snapshot materialization (0c99b73)
• release-tracks: unify release operations and previews (a890704)