Releases · northpolesec/santa

Release list

v2026.7 Latest

Latest

mlw released this 04 Aug 15:10

2026.7

885aaff

Notes

Security

The Santa codebase has been undergoing dedicated security review by folks with access to frontier AI security models. The issues fixed below were identified through that work, and we recommend updating. This is an ongoing investment to ensure Santa remains your most trusted endpoint security solution.

🔒 Fixed two issues related to Mach-O parsing that could prevent policy from being effectively enforced on specially crafted x86 binaries
🔒 Fixed a heap buffer overflow that could be triggered with certain EventLogType configurations when an execution contained an extremely large number of arguments
🔒 Improved tamper resistance handling to protect against local rule modification
🔒 Fixed a narrow issue with File Access rules where an exception applying to platform binaries only could be erroneously granted to unsigned x86 binaries
🔒 Fixed a narrow issue affecting CEL policies that conditionally returned ALLOWLIST_COMPILER after accessing a non-cacheable field

Full details for each issue are available in the published advisories.

Announcements

🎉 Get the most out of Santa with Workshop! Workshop is North Pole Security's official sync service, built to integrate deeply with Santa. It is fully featured, scalable, and enterprise ready. Learn more at northpole.security.

Fixed

❗ Dock icons no longer stick around when quickly closing stacked UI windows
❗ Fixed issue with file types being unexpectedly handled by Santa
❗ Workshop customers: CEL process ancestor data reliability greatly improved under load

Changed

↔️ Improved tamper resistance features protecting critical Santa components
↔️ Several small performance and memory improvements
↔️ Workshop customers: Users now receive a notification banner when temporary admin mode session ends (EPM)

Added

➕ The block dialog "open" button label can now be configured per-rule
➕ Workshop customers: Santa now supports queued commands that are delivered on the next sync, so commands issued while a host is offline still run
➕ Workshop customers: Signal matches on telemetry now include process tree and responsible process info in uploaded events
➕ Workshop customers: Signals can now be correlated across a time period, requiring a threshold before firing
➕ Workshop customers: Added new package inventory command to support scanning hosts for data about Homebrew, PyPI, Go, NPM, browser extensions, IDE extensions, and much more

The Santa Lite package is rarely the right choice. Install the standard package unless you have a specific reason not to. Workshop customers should not install lite since it omits many features. See the lite package documentation for details. Download at: santa-2026.7-lite.pkg.

Santa documentation can be found at northpole.dev.

What's Changed

santactl/status: Show filter count under telemetry section by @russellhancox in #1060
gui: Fix missing caret in TAM justification prompt by @sharvilshah in #1061
common: improve process tree reliability under load by @mlw in #1062
metrics: Allow metrics export to https by @russellhancox in #1063
processtree: use PROC_PIDT_SHORTBSDINFO to look up ppid during backfill by @mlw in #1064
gui: Delay restoring activation after last window close by @russellhancox in #1065
common: reduce per-evaluation copies in CEL activations by @mlw in #1066
build: split legacy grouped targets into one library per file by @mlw in #1067
gui: notify user when temporary admin session ends by @sharvilshah in #1068
common: take SantaCache keys by const reference by @mlw in #1071
Fix uninitialized stat use in SNTFileInfo by @tnek in #1073
Add ScopedMachPort and use it where task_name_for_pid is used by @russellhancox in #1074
Fix file writer buffer growth by @tnek in #1070
docs: Add category indexes by @russellhancox in #1076
santactl: report SIP status in doctor output by @sharvilshah in #1069
Protect tamper-resistant paths from clonefile by @tnek in #1075
Protect tamper-resistant paths from copyfile by @mlw in #1077
syncv2: report santanetd version by @sharvilshah in #1078
cel: cache compiled DB CEL plans instead of recompiling per exec by @mlw in #1079
santad: hold CEL fallback rules in an atomically-swapped batch by @mlw in #1081
common: use thread-safe getpwuid_r for passwd/group lookups by @sharvilshah in #1080
signals: Update proto import & SignalReport refs, pass persistence path to Sleigh by @russellhancox in #1083
common: reap process tree removals from a min-heap by @mlw in #1086
common: take a reader lock in ProcessTree::ReleaseProcess by @mlw in #1088
common: store process-tree cdhash as raw bytes by @mlw in #1089
status/sync: Count signal rules by @russellhancox in #1090
gui: Lower scope of CFBundleDocumentTypes to remove IPSW association by @russellhancox in #1091
common: reduce per-exec copies and duplicate work in the process tree by @mlw in #1087
Replace builtin casts with proto-specific casts for protobuf types. by @ClaytonKnittel in #1084
Reduce locks and copies on the process-tree ingest path by @mlw in #1092
Tighten and speed up NSString string conversions by @mlw in #1093
Bump Docusaurus to 3.10.2 and update docs dependencies by @mlw in #1094
Reduce work on the exec-decision and file-change regex paths by @mlw in #1095
SantaCache: strength-reduce hashing, avoid false sharing, template callables by @mlw in #1096
TimedSyncSession: fix lock_ <-> timer-queue deadlock by @sharvilshah in #1082
Add CLA workflow by @russellhancox in #1098
Add HTTP Santa commands, drained serially at the end of sync by @tburgin in #1097
docs: Update several dependencies by @russellhancox in #1100
santad: leave Temporary Monitor Mode when client mode changes by @sharvilshah in #1099
gui: Add event_detail_button_text support by @russellhancox in #1101
santad: make TAM's crash/restart reconciliation safe against directory outages, account deletion, and uid reuse by @sharvilshah in #1085
santactl: report build metadata from the embed label by @mlw in #1102
commands: Add package inventory command by @russellhancox in #1103
Revert "santactl: report build metadata from the embed label" by @mlw in #1105
workflows: Skip scheduled and deploy jobs outside this repo by @mlw in #1106
docs: Update deps, move to pnpm 11 by @russellhancox in #1107
santasyncservice: run binary uploads from the HTTP command queue by @tburgin in #1104
docs: Document binary_upload and package_inventory commands by @tburgin in #1108

New Contributors

@tnek made their first (northpolesec) contribution in #1073
@ClaytonKnittel made their first contribution in #1084

Full Changelog: 2026.6...2026.7

Contributors

russellhancox, mlw, and 4 other contributors

Assets 5

v2026.6

mlw released this 10 Jul 16:04

2026.6

7160884

Notes

Tip

See it in action. Watch demo videos and walk through examples of the major features in our release blog post: northpole.security/blog/release-20266.