2026.75

• Add JSON field type
• Rank project search results to prioritize name and tag matches over content
• Allow image uploads in shared excalidraw notes
• Harden shared note event filtering
• Add design for OffSec OSAI certification
• Run post-update tasks after updating SysReptor via update.sh
• Fix broken check if crontab is available in install.sh
• Fix emoji rendering in PDFs
• AI agent: Enable AI agent by default in settings
• UI: Add color indicators for all retest statuses
• Markdown editor: Prevent browser from opening some links in markdown preview
• Plugin jira: Follow API pagination to list all available projects

Click here to go to the update instructions: https://docs.sysreptor.com/setup/updates/

2026.68

• This is a security release: fix 1 medium vulnerability
• Rotate session cookie after shared note password authentication
• Support downloading note files via an encrypted channel to prevent proxies from inspecting downloads (https://docs.sysreptor.com/reporting/notes#downloading-files)
• Render markdown preview content in iframes
• Add default note structures to HTB, OffSec and demo designs
• Remove deprecated excalidraw plugin
• AI agent: ask the user questions
• Fix empty Excalidraw canvas on read-only sharing links
• Fix redirect URL after creating new excalidraw note in personal notes
• Fix gpg encoding error
• AI agent: Fix wrong icon shown for reverting agent changes in UI
• UI: improve comment textfield dark theme
• UI: allow customizing retest status colors
• Plugin scanimport: Improve template translation selection logic

Click here to go to the update instructions: https://docs.sysreptor.com/setup/updates/

2026.61

• This is a security release: full fix 1 high vulnerability
• Security: implement multiple hardening measures
• Allow creating API tokens with/without superuser permissions
• Disable user after multiple failed MFA login attempts
• Remove PDF compression and COMPRESS_PDFS setting
• Rework plugin loading to make source code directory readonly in docker image
• Use redis as django cache
• Throttle sending password reset mails per email
• Validate initial status transition on create
• Send mention/assignee notifications only to project members
• Generate random postgres and redis passwords in install.sh
• backup/restorebackup command: allow reading AES key from stdin
• Harden PDF rendering
• Plugin scanimport: add Prowler and ScoutSuite importers

Click here to go to the update instructions: https://docs.sysreptor.com/setup/updates/

2026.58

• This is a security release: fix 2 high vulnerabilities
• Disable forgot password functionality via email if ALLOWED_HOSTS is unset (GHSA-9x2r-5pff-8w6c)
• Details for a second vulnerability have been temporarily withheld and will be disclosed at a later date
• Enable/disable plugins in settings web UI
• Enable some plugins by default
• Allow SSO identity API for API token auth
• Restore archive: different message filename per key
• AI agent: Confirm delete when reverting changes

Click here to go to the update instructions: https://docs.sysreptor.com/setup/updates/

2026.55

• Sign releases and docker images with cosign for verification (https://docs.sysreptor.com/setup/installation)
• Disable client infos and awareness in shared note collaborative editing
• Fix excalidraw note content not copied
• Enable (basic) spellcheck for additional languages
• Add filters from project/design/template name in list views
• Pass finding status to PDF rendering data
• Remove deprecated unload event handlers
• Markdown editor: Add save indicator to image editor
• UI: Add buttons to copy and download PDF password
• UI: Allow copying global designs to private design
• AI agent: Add virtual filesystem for project data
• AI agent: Add tool calls for searching project content
• AI agent: Support AI agent in notes
• AI agent: Show changes made by the agent and allow reverting

Click here to go to the update instructions: https://docs.sysreptor.com/setup/updates/

2026.50

• Move LLM configuration AI_AGENT_MODELS to web UI instead of env variables (https://docs.sysreptor.com/setup/configuration#llm-models)
• Support multiple LLM models and model selection in UI
• Rename configuration AUTOMATICALLY_DELETE_ARCHIVED_PROJECTS_AFTER to AUTOMATICALLY_DELETE_PROJECTS_AFTER (https://docs.sysreptor.com/setup/configuration#archiving)
• Configure auto delete for finished and archived projects via AUTOMATICALLY_DELETE_PROJECTS_AFTER
• Allow customizing delete date per project
• Fix bulk set status action disabled in UI
• UI: Improve template multi select in create finding dialog
• UI: Show note title in window title

Click here to go to the update instructions: https://docs.sysreptor.com/setup/updates/

2026.42

• Display all comments when no finding/section is selected
• Add information about superuser privileges when creating API tokens
• Migrate documentation from mkdocs to vitepress
• Support multi select and bulk actions in report sidebar
• Support bulk create findings from templates
• Highlight inactive users in project member selection
• Improve handling of short search terms in project search
• Add copy button for AI prompts and responses
• Markdown editor: improve code block highlighting in dark mode
• Fix marmaid incorrect HTML label rendering in PDF

Click here to go to the update instructions: https://docs.sysreptor.com/setup/updates/

2026.36

• Allow searching project contents in list view (https://docs.sysreptor.com/insights/project-search/)
• Image editor: fix image URLs not updated for HTML syntax in markdown
• Image editor: view original image in preview dialog
• Image editor: close dialog on save if opend via edit image button
• Markdown editor: support HTML attrs for code blocks
• Markdown editor: add copy button for code blocks in preview
• cleanupfiles command: delete unreferenced files from storage and database
• backup command: allow saving backups directly to S3
• Improve backup performance
• Fix note search virtual scroll jumps

Click here to go to the update instructions: https://docs.sysreptor.com/setup/updates/

2026.29

• Security: implement multiple hardening measures and code quality improvements
• SSO: make the user identifier claim configurable (https://docs.sysreptor.com/users/oidc-generic/)
• SSO: add require_email_verified setting to OIDC config
• SSO: migrate Entra ID and Google SSO settings to OIDC_AUTHLIB_OAUTH_CLIENTS setting
• Warning about non-members in project user fields
• Markdown editor: syntax highlight autolinks

Click here to go to the update instructions: https://docs.sysreptor.com/setup/updates/

2026.27

• Security: Fix personal note sharing permissions (GHSA-pcpr-q2qj-3v43)
• Image editor: add pixelation tool
• MDE: support toggling task list checkboxes in markdown preview
• MDE: support frontmatter highlighting
• MDE: prevent undo/redo while image editor is open

Click here to go to the update instructions: https://docs.sysreptor.com/setup/updates/