v2.1.0

2.1.0 (2026-07-13)

Features

• apidrift: live schema canary binary for the devel box (4c73097)
• apidrift: subtree-prefix exemptions and the cross-version compat ledger (e207e3f), closes #236
• auth: local user / group / API-key security-posture counts (97c4ac5), closes #222
• captiveportal: voucher inventory by state (fdec957), closes #207
• clamav: engine version and signature database freshness (e22020e), closes #204
• client: cache slow-moving API responses; cache firmware for 12h (9ec1801), closes #193
• core: config backup freshness + ZFS boot environment inventory (96174f0), closes #220
• crowdsec: hub component health (tainted/outdated) + engine version (8d7fca5), closes #205
• firewall: GeoIP database freshness + optional NAT rule inventory (c9b55c9), closes #221
• frr: BGP neighbor detail, OSPF/OSPFv3 interface parity, route volumes (c846f42), closes #197 #198 #199
• haproxy: stick-table occupancy + show-stat latency/health/capacity (77d94bf), closes #201
• hardware: DMI system identity (dmidecode) + Deciso PSU status (dechw) (27c3509), closes #217
• hostdiscovery: discovered-host inventory counts (0a22773), closes #223
• ids: Suricata service status, alert activity, ruleset and rule inventory (1be18bf), closes #203
• interfaces: LAGG member state, SFP/DOM optics, bridge membership (e62ddb8), closes #214
• ipsec: kernel SAD/SPD tables, per-lease detail, pending-config flag (6c7c946), closes #213
• kea: lease state/type breakdown, PD pool capacity, pool utilization (b68eadb), closes #208
• lldpd: LLDP neighbor table collector (8fa19ab), closes #216
• logship: crowdsec source — alert/decision records (opt-in) (402cc29), closes #232
• logship: firewall log source — digest-cursor tailing with rule labels (bacc16e), closes #229
• logship: generic diagnostics-log source — audit, gateway, CARP, portal, configd (0d4314a), closes #230
• logship: IDS source — full Suricata EVE alert records (opt-in) (0c6dcea), closes #231
• logship: log-shipping foundation — internal/logship pipeline (opt-in) (0a27446), closes #228
• logship: unbound source — per-query DNS log (opt-in, accepted loss) (55a49ab), closes #233
• metrics: cache hit/miss self-metrics for the response cache (884a849), closes #196
• metrics: minor extension candidates — ntpd GPS, siproxd, shaper last-match (3f29b3d), closes #224
• metrics: struct extensions from new 26.1.11/26.7 payload keys (f80174f), closes #237
• monit: per-check resource telemetry (a44ef75), closes #219
• netbird: management/signal connectivity, relays, per-peer telemetry (06c02f6), closes #211
• nginx: cache zones, latency counters, cache-status, reload timestamp + bans (555f59e), closes #200
• openvpn: per-session traffic counters and connected-since (5f6a9ce), closes #212
• relayd: virtual server / table / host health via status/sum (2b81bf9), closes #202
• schema: capture request bodies for every POST endpoint (5a7d74d)
• schema: committed golden schemas + make schemas staleness gate (dfc36d6)
• schema: endpoint→response-struct registry covering the full 107-endpoint manifest (2601327)
• schema: live-payload structural validator (93967a4)
• schema: reflection walker deriving structure-only schemas from response structs (aae08d2)
• system: export all system-status subsystems from the health payload (7ea8cb9), closes #218
• tor: circuit and stream telemetry from the control port (opt-in) (18da737), closes #206
• unbound: DNSBL query-stats totals and blocklist size (opt-in) (0289a3d), closes #209
• vnstat: persistent per-interface traffic accounting (opt-in) (8c71d6d), closes #215

Bug Fixes

• apidrift: fail fast when the box is unreachable (e4e1f95)
• apidrift: force HTTP/2 and retry transient transport failures (0ba9482), closes #236
• deps: update module github.com/grafana/pyroscope-go to v1.4.1 (#189) (58505a0)
• deps: update module github.com/prometheus/common to v0.70.0 (#191) (f9a28ee)
• grafana: regenerate dashboard artifacts to a fixed point (83e74cf)
• lint: stop misspell rewriting ECT as ETC (5a75f97), closes #236
• opnsense: gate unbound extended-statistics series on payload presence (f25dae2), closes #236
• opnsense: read per-subsystem health detail from metadata.subsystems (0bda657), closes #236
• opnsense: resolve the 26.1.11 jumbo-page mbuf key renames (bd06b50), closes #236
• opnsense: resolve the 26.1.11 tcp ECN counter renames (1b78b94), closes #236
• schema: model json.Number as 'numeric' (accepts number or numeric string) (d2edbb6)
• unbound: migrate off deprecated overview/isBlockListEnabled (a849c38), closes #210

Performance

• client: negative-cache plugin-absent 404s on POST endpoints too (5e9f561), closes #194
• client: negative-cache plugin-absent 404s; cache slow-moving endpoints (3b709ce), closes #194

Miscellaneous

• deps: update anthropics/claude-code-action action to v1.0.166 (#177) (3158c01)
• deps: update anthropics/claude-code-action action to v1.0.167 (#182) (e9d0532)
• deps: update anthropics/claude-code-action action to v1.0.168 (#183) (83457fe)
• deps: update anthropics/claude-code-action action to v1.0.169 (#186) (509bcb3)
• deps: update anthropics/claude-code-action action to v1.0.170 (#190) (ea3d2f8)
• deps: update anthropics/claude-code-action action to v1.0.171 (#192) (d9ed73e)
• deps: update gcr.io/distroless/static-debian13:nonroot docker digest to d29e660 (#184) (0e55c5b)
• deps: update mirror.gcr.io/library/golang:1.26-alpine docker digest to 0178a64 (#185) (c4b0f77)
• deps: update mirror.gcr.io/library/golang:1.26-alpine docker digest to 9097beb (#180) (fcf47a7)
• deps: update opnsense-docs digest to 5d84fe3 (#181) (25ce2dd)
• deps: update opnsense-docs digest to 77f33a4 (#187) (d6dfe82)
• deps: update opnsense-docs digest to 95acbed (#188) (904e3d0)
• deps: update step-security/harden-runner action to v2.20.0 (#179) (411ba8f)
• lint (a749c6b)

Documentation

• add the OPNsense compatibility policy page and canary triage recipe (feafbc6), closes #236
• add the schema-registry step to the new-collector recipe (f84963d)
• API-absent telemetry — no SSH channel, node_exporter + textfile recipe (c622632), closes #225
• native log-export recipe and exporter-vs-native decision matrix (33fe5b3), closes #234
• re-pin dashboard panel counts after #218 regeneration (ce7cfcb)
• record do-not-scrape API landmines and confirmed-empty modules (1341145), closes #226

Tests

• kea: regression fixtures from live dev-box captures (c6399a2), closes #208

CI/CD

• api-contract: run the endpoint-manifest canary daily (7c5a397), closes #195
• live-canary: adjust the metric-name floor for gated unbound extended stats (965f6fb), closes #236
• live-canary: close the drift issue on any clean run, not just scheduled (140ef06), closes #236
• live-canary: daily schema+smoke canary against the devel box over tailnet (6266019)
• live-canary: drop the stale 'scheduled' wording from the close comment (d9a0a83)
• live-canary: harden the tailnet-credentialed workflow (22704c2)
• live-canary: keep runner DNS after the tailnet join (34e19cf)
• live-canary: place the SC2016 directive where actionlint's shellcheck honours it (0ec4e83)