Releases v3.0.0
Compare
Sorry, something went wrong.
No results found
3.0.0 (2026-07-23)⚠ BREAKING CHANGES
zenarmor,syslog: close username-only auth bypass, bound receiver resourceszenarmor: the receiver no longer ships records describing its own ingest connection. Set --logs.zenarmor.drop-self-traffic=false to restore the old behaviour.logship: opnsense_exporter_logs_parse_errors_total and opnsense_exporter_logs_rejected_total gain a source label. Aggregations such as sum by (stage) / sum by (reason) are unaffected; only exact full-label-set matches need updating.pyroscope: --pyroscope.enable-mutex-block (default off) is replaced by --pyroscope.disable-mutex-block (default off = contention profiling ON), following the repo disable-* convention for default-on features. Env var is now OPNSENSE_EXPORTER_PYROSCOPE_DISABLE_MUTEX_BLOCK.logship: --logs.diaglog.enabled DEFAULTED TO TRUE, so this is not a quiet opt-in removal -- every existing log-shipping user loses the config-change/gateway/CARP/portal audit trail until they configure a syslog target on the firewall pointing at the exporter. --logs.firewall.enabled and --logs.scopes are removed with it.
Features
collector: add StatusTracker + RunCollector for web UI (33e4976 ), closes #302 collector: decouple serving from collection via internal poll scheduler (#336 phase 1) (ac86cb9 )collector: derive bounded counters from Zenarmor records (a632f14 ), closes #276 collector: flow volume metrics, flags, docs and dashboard (280dcb5 ), closes #346 collector: per-collector poll tiers + interval config (#336 phase 2) (165d400 )collector: poll-observability metrics + interval in status snapshot (#336 phase 3) (8edea9c )flow: bounded top-N rollup with monotone other folding (c266b48 ), closes #346 flow: correlator + DNS answer cache (#346 phase 3 seam) (8e35af9 )flow: DNS-domain enrichment, §9 metrics, Zenarmor conn attrs in place (#353 ) (8c1be6c )flow: interface topology and the NetFlow ifIndex map (b303514 )flow: NetFlow pipeline, metrics, flags, docs and dashboard (20d5684 )flow: NetFlow v5/v9 decoder and hardened UDP receiver (d56d1c6 )flow: normalized flow.Record seam and community-id join key (0f14ede ), closes #346 flow: OTLP flow-log emission path (#346 phase 3) (c00e524 )flow: VLAN de-dup, WAN egress correction and direction inference (06701db )flow: wire correlator -> OTLP flow logs, phase-4 dashboard + rules (#346 ) (c974d21 )grafana: comprehensive coverage — Zenarmor tab, mixed Prometheus+Loki panels, curated alerts/recording rules (8818c03 ), closes #301 grafana: overhaul OPNsense dashboard (659c98a ), closes #303 logship: add debug-capture mode for unmodelled receiver signals (f973082 ), closes #330 logship: add opnsense.action, a binary pass/block resource attribute (19d407b ), closes #276 logship: add the Zenarmor Elasticsearch receiver (02edcdc ), closes #276 logship: align syslog log attributes with OTel semantic conventions (f461953 ), closes #266 logship: map every lane's disposition onto opnsense.action (1060108 ), closes #276 logship: per-record source override for transport-agnostic sources (47c4476 )logship: replace the firewall and diaglog poll lanes with the syslog receiver (6f98b35 ), closes #238 #248 logship: source-label the receiver self-metrics (c990cc7 ), closes #276 logship: syslog receiver with OPNsense API log enrichment (174212d ), closes #248 metricsnap: passive last-scrape family recorder (7b815cc ), closes #302 opnsense: CacheSnapshot accessor for web UI freshness card (39d9323 ), closes #302 options: add --logs.zenarmor.transport selector (elasticsearch|syslog) (cf87f79 )options: require the syslog receiver for zenarmor transport=syslog (f6610a5 )options: web UI flags + redacted EffectiveConfig (53081ff ), closes #302 options: wire the Zenarmor receiver behind --logs.zenarmor.* (6d0cbae ), closes #276 pyroscope: collect all profile types by default incl. goroutine-leak (f5ab4d8 ), closes #269 syslog: add optional ProgramProcessor delegation hook (4d27493 )syslog: derive metrics from received logs, sample raw lines, and add TLS transport (18c2024 ), closes #258 #259 syslog: enrich every record, not just filterlog (+ parser registry) (310dd28 ), closes #261 syslog: optional program and severity filtering (269c7e9 ), closes #261 syslog: parse Suricata EVE alerts, and refuse to double-ship them (8ce1e9b ), closes #261 syslog: parse the residual unparsed tail (cron, radvd, kea-dhcp6, dnsmasq-dhcp, configd.py) (2d1a718 ), closes #335 syslog: parse unbound local-zone query log (fecf5e3 ), closes #332 syslog: structure unbound SERVFAIL resolution failures (b169933 ), closes #334 syslog: structured parsers for audit, sshd, DHCP and HAProxy + tunnel names (e829bf6 ), closes #261 webui: active-series, log-throughput and fleet trend charts (58e48bb ), closes #347 webui: cardinality suite (hub, drill-downs, label-values, export) (68cc734 ), closes #302 webui: connected-devices page with embedded OUI lookup (8211cce ), closes #302 webui: fold cardinality into status snapshot for the single-page tabs (#337 ) (1705605 )webui: per-collector interval/next-run/freshness on CollectorRow (#337 ) (e5f55b2 )webui: redacted /config page with kill switch (d37523d ), closes #302 webui: Run Now trigger endpoint + live-polling/filter/sort JS (6f2ce75 ), closes #302 webui: runtime-stats sampler for Overview parity (#337 ) (3f0e3bc )webui: show pretty + raw collector names on /config (d9ed4fd ), closes #302 webui: single inline tabbed console page (#337 ) (99630de )webui: status console page + /api/status.json + render core (5e7a5b1 ), closes #302 webui: wire operator console into main + passive metrics recorder (0d34fcd ), closes #302 zenarmor: derive flow.Record from conn documents (fbf51a1 ), closes #346 zenarmor: drive the shared processor from the syslog receiver (142575f )zenarmor: drop records describing our own ingest connection (b454b0e ), closes #278 zenarmor: handle _alias / _settings control-plane probes (b74523a ), closes #331 zenarmor: let operators exclude known-boring traffic from the log stream (d31296f ), closes #279 zenarmor: parse the daemon=zenarmor syslog message envelope (f2e1fba )
Bug Fixes
canary: exempt firmware upgrade_packages[].size as box state, not drift (47c8d9b )canary: triage the live-box drift, and stop plugin-gated 404s warning (1473097 ), closes #243 config: reject telemetry paths that collide with health/ready routes (f3a96b1 ), closes #291 deps: update module github.com/prometheus/client_golang to v1.24.0 (#339 ) (9b126b8 )deps: update module github.com/prometheus/common to v0.70.1 (#352 ) (1e60b7f )deps: update module google.golang.org/grpc to v1.82.1 (#273 ) (3eb0fac )logship,collector: bound sender-controlled derived metric cardinality (8dc167f ), closes #311 #326 #327 logship: actually rename subsystem to opnsense.subsystem on the wire (1ea8afd ), closes #266 logship: HAProxy status_class label was always empty (e312922 ), closes #277 logship: make OTLP delivery observable with in-memory at-least-once (736289b ), closes #290 logship: publish labelled counters at zero from startup (9f64c66 ), closes #280 logship: stop a permanently-refused batch wedging delivery, bound queue bytes (f697018 ), closes #304 #318 #325 opnsense: block credential-forwarding redirects, redact URL secrets, reject non-finite floats (2be2b4c ), closes #305 #306 #307 #321 #323 opnsense: drop the metadata.subsystems model; it exists on no release (80649b1 ), closes #284 pyroscope: always collect goroutine profiles, not just under mutex/block (31d2aa7 ), closes #268 pyroscope: cap backend response bodies and make the flush timeout bound shutdown (1bb8c2e ), closes #309 #310 server,otlp: bound scrape admission and stop echoing header secrets (342d15e ), closes #308 #313 #324 server: gate /-/ready on poll-scheduler warm-up (9d43334 ), closes #341 #338 syslog: reassemble multi-line messages, and put promotable keys on the resource (9763ebf ), closes #262 #263 syslog: satisfy errcheck and staticcheck (1788afb ), closes #248 zenarmor,syslog: close username-only auth bypass, bound receiver resources (4865dca ), closes #314 #315 #316 #317 #328 zenarmor: bound decompressed body size and request-body time (1605294 ), closes #288 #289 zenarmor: decode alertinfo arrays/number/string sid (9b2a0fb ), closes #297 zenarmor: log which endpoint an unhandled call hit (bc800b0 ), closes #285 zenarmor: match self-traffic against any bound syslog port (ccf8b9d ), closes #299
Performance
collector: tier wholly-static collectors cold/slow, dedupe plugin-gated list (bcb5caf ), closes #344 runtime: bound concurrent OPNsense API fan-out during scrapes (8847e3f ), closes #294
Refactoring
remove per-collector Run Now (POST trigger + inflight guard + RunCollector plumbing) (#337 ) (0d4b061 )
zenarmor: extract shared docProcessor from handleDoc (6e8e988 )
Miscellaneous
deps: update actions/checkout action to v7.0.1 (#340 ) (527651d )deps: update actions/setup-go action to v7 (#275 ) (0896994 )deps: update actions/setup-python action to v7 (#333 ) (bbe5c45 )deps: update anthropics/claude-code-action action to v1.0.172 (#245 ) (260c8da )deps: update anthropics/claude-code-action action to v1.0.173 (#247 ) (373c8dc )deps: update anthropics/claude-code-action action to v1.0.174 (#265 ) (b4ae77e )deps: update anthropics/claude-code-action action to v1.0.175 (#272 ) (27eeb7a )deps: update anthropics/claude-code-action action to v1.0.176 (#287 ) (a334691 )deps: update anthropics/claude-code-action action to v1.0.177 (#300 ) (7e1fa25 )deps: update anthropics/claude-code-action action to v1.0.178 (#329 ) (84d20d2 )deps: update anthropics/claude-code-action action to v1.0.179 (#342 ) (892c72c )deps: update anthropics/claude-code-action action to v1.0.180 (#351 ) (842351d )deps: update anthropics/claude-code-action action to v1.0.181 (#354 ) (d20f894 )deps: update gcr.io/distroless/static-debian13:nonroot docker digest to f7f8f72 (#244 ) (047ef4e )deps: update module github.com/anchore/syft to v1.47.0 (#274 ) (c3bfe94 )deps: update module github.com/anchore/syft to v1.48.0 (#282 ) (b2a1da5 )deps: update module github.com/anchore/syft to v1.49.0 (#345 ) (9cc3f33 )deps: update module github.com/anchore/syft/cmd/syft to v1.47.0 (#281 ) (94a3eec )deps: update module github.com/anchore/syft/cmd/syft to v1.48.0 (#283 ) (98b3166 )deps: update module github.com/anchore/syft/cmd/syft to v1.49.0 (#348 ) (310c0c3 )deps: update opnsense-docs digest to aced3de (#355 ) (46f85a4 )deps: update opnsense-docs digest to c296d26 (#264 ) (12de5b4 )deps: update opnsense-docs digest to ee0a0c6 (#343 ) (92e8b7d )deps: update opnsense-docs digest to f9807ac (#349 ) (a8da466 )
Documentation
assets: replace the hub's social card with a real project card (efda35b )canary: record healthCheck subsystems and nginxVts cacheZones as box state (dfd73ee ), closes #271 claude: add box-state as the fifth canary drift verdict (5a5c62a )collector: document the poll model + fix stale references (#336 phase 4) (7ebc2cb )config: regenerate flag reference for the web UI flags (9b19a00 )correct two false claims left behind by #92 and #248 (c1ae453 )
deployment: document the web UI operator console (28ff317 ), closes #302 docker: show the receiver ports in the compose example (37a0e7f )nav: add the syslog receiver page to the site nav (7fd56da ), closes #248 readme,site: lead with OTLP, syslog and flow differentiators; add GitHub backlinks (ce54152 )security: fix distroless private-CA trust recipe (ea9b864 ), closes #292 syslog: align prose with the phase-4 receiver features (0dd307e ), closes #267 syslog: document the LogQL name mangling, and fix a duplicated bullet (69a7a62 )syslog: document the parsers, universal enrichment and filtering (cabb84a ), closes #261 syslog: setup guide, k8s manifests and dashboard panels for the receiver (f41a600 ), closes #248 telemetry: document the OTLP resource-attribute convention (eee3006 ), closes #270 voice + de-AI pass across the docs base (63fb0ef ), closes #267
webui: describe the single-page tabbed console; drop multi-page/Run-Now refs (#337 ) (eaa00c5 )zenarmor: document the elasticsearch|syslog transport selector (410b0f0 )zenarmor: document the receiver and add its dashboard panels (9e217a8 ), closes #276
Tests
cache: guard body TTLs against fast-polling collectors (e43abb4 )flow: fix flaky TestReplayRepair_VLANParentDuplicateSuppressed (06e5262 )flow: golden NetFlow v9 replay fixture from real capture (#346 ) (2d20aeb )syslog: benchmark the enrichment path and pin its allocations (54e62fc ), closes #286 zenarmor: cover the syslog-transport factory branch; note filter bypass (cf5f150 )zenarmor: end-to-end syslog transport across all five families (20ca1b7 )
CI/CD
You can’t perform that action at this time.
