v2.6

Risk inheritance, evidence retention, and security hardening

This release links risks across projects, vendors, and models so related risks can inherit from each other, and adds retention rules to the Evidence hub. It also tightens who can invite users and manage LLM keys, shows dates in your preferred format across the app, and fixes a broad set of issues found during release testing.

Highlights

• Risk inheritance: link project, vendor, and model risks as related or as parent and child, review suggested links, see when a parent risk's level changes, and explore the links on a new Risk inheritance page with reports on duplicates and control coverage
• Evidence hub retention: set a retention policy and expiry for evidence
• Dashboard: each recent activity row now opens the use case, risk, task, or other record it describes
• LLM API key prompt: when no LLM API key is set up, Start here offers to add one and takes admins straight to the key form, so the AI Advisor and reporting are ready to use
• Date format everywhere: dates on the dashboard, in tables, the AI Gateway, the inventory, and monitoring now follow your date format preference
• LLM Evals: a failed experiment now shows why it failed, with credentials removed from the error text
• Integrations: MLflow and Azure AI Foundry sync failures now show their reason, and MLflow applies its configured request timeout
• Invitations: invitation links stay valid for 30 days, and only Admins can invite users, into their own organization only
• Security hardening: only admins manage LLM keys, roles can only be assigned within your organization, every organization keeps at least one Admin, other organizations' user records stay hidden, and signing out clears cached data
• Deployment: separate liveness and readiness health checks, so an AI Gateway outage no longer restarts the backend
• Fixes: ISO 27001 clauses overview, Annex chart control counts, adding a risk from a use case, translated table pagination, clearer form validation for incidents and training, bias audit dataset uploads, and the Colorado AI Act citation (SB 24-205)

---

What's Changed

• refactor(ui): format simple view dates with useFormattedDate by @Innagl in #4771
• refactor(ui): format table dates with useFormattedDate by @Innagl in #4774
• feat(ai-gateway): format dates from the user's preference by @Innagl in #4776
• feat(ui): format dashboard dates from the user preference by @Innagl in #4780
• fix(seeder): demo data backfills next to real traffic and deletes only its own rows by @gorkem-bwl in #4801
• fix(ai-gateway): show every day in 7d/30d/90d spend charts by @gorkem-bwl in #4802
• docs: replace plugin docs with extensions and built-in frameworks by @gorkem-bwl in #4803
• deps(combined): batch-bump all 16 open dependabot updates (supersedes #4782–#4800) by @MuhammadKhalilzadeh in #4809
• feat(seeds): full AI Gateway demo data and consolidated demo seeders by @gorkem-bwl in #4804
• Fix ISO 27001 Clauses overview not showing up by @HarshP4585 in #4805
• refactor(ui): format inventory and monitoring dates with useFormatteDate by @Innagl in #4808
• fix(security): gate profile-photo upload/delete behind selfOnly (BOLA) — fixes #4723 by @MuhammadKhalilzadeh in #4814
• Evidence hub retention by @HarshP4585 in #4725
• VW 2.6 bug and issues (1) by @HarshP4585 in #4813
• fix: form validation UX (incident, training) + model external-key 409 handling — issues #4754, #4755, #4756 by @MuhammadKhalilzadeh in #4822
• Chore: Optimize CI Caching by @Br0wnHammer in #4821
• feat(roles): custom organization roles with configurable permissions (issue #4588) by @MuhammadKhalilzadeh in #4827
• feat(ui): format remaining table dates from the user preference by @Innagl in #4826
• fix(stats-card): show an empty state when no regulation is connected by @Innagl in #4829
• VW 2.6 bug and issues (2) by @HarshP4585 in #4832
• Fix/command palette close button by @Innagl in #4835
• feat(dashboard): open the record behind each recent activity row by @Innagl in #4838
• fix(i18n): translate table pagination footers by @gorkem-bwl in #4859
• fix(tests): bring the CI eval runner tests up to date with parse_results and the report format by @mfalkiewicz in #4816
• security(format-string): use a constant format string in the API request log by @mfalkiewicz in #4815
• fix(model-lifecycle): reject non-array orderedIds in the reorder endpoints by @mfalkiewicz in #4830
• fix(query): stop retrying failed mutations by @gorkem-bwl in #4860
• deps: consolidated dependabot batch — 18 PRs applied, 3 blocked-by-deepeval documented by @MuhammadKhalilzadeh in #4863
• chore: Prettier fix, drop unused PyJWT, source-map-js in remaining lockfiles by @gorkem-bwl in #4864
• feat(risk-inheritance): risk links, inheritance graph and de/fr/es translations by @haJ1t in #4833
• docs: correct docs that disagree with the code by @gorkem-bwl in #4878
• fix(evals): show why a failed experiment failed by @gorkem-bwl in #4876
• fix(users): only roles of the caller's organization can be assigned by @gorkem-bwl in #4875
• fix(bias-audits): send audit datasets as multipart, not JSON by @gorkem-bwl in #4873
• fix(deps): shell-quote 1.12.0 for GHSA-pqg4-j6r4-53mv by @gorkem-bwl in #4870
• fix(llm-keys): restrict creating, editing and deleting LLM keys to admins by @gorkem-bwl in #4874
• fix(test): stop Vitest relaying console output over RPC by @gorkem-bwl in #4879
• fix: hide foreign user ids, keep one Admin, redact eval errors everywhere by @gorkem-bwl in #4881
• fix(auth): clear the query cache on logout by @gorkem-bwl in #4871
• feat(invitations): keep invitation links valid for 30 days by @gorkem-bwl in #4869
• fix: split health probes; report MLflow and Azure AI Foundry sync failures by @gorkem-bwl in #4880
• fix(auth): only admins invite, into their own org, up to their own role by @gorkem-bwl in #4872
• ci: run each unit suite once instead of twice per push by @gorkem-bwl in #4882
• fix: guard invitation writes, hide user ids on photo endpoints, close eval redaction gaps by @gorkem-bwl in #4883
• feat(onboarding): prompt for an optional LLM API key on first setup by @Innagl in #4862
• ci(e2e): split Playwright across three parallel shards by @gorkem-bwl in #4885
• docs(whats-new): v2.6 release notes and latest blog posts on Start here by @gorkem-bwl in #4884
• Revert "fix(stats-card): show an empty state when no regulation is connected" by @Innagl in #4886
• revert(roles): remove custom organization roles UI from frontend by @MuhammadKhalilzadeh in #4887
• Merge develop into master (Oct 2) by @HarshP4585 in #4836
• update helm version for release by @HarshP4585 in #4889
• Merge develop into master (Oct 7) by @HarshP4585 in #4890
• Fix trivy scan issue by @HarshP4585 in #4891
• Merge develop into master (Oct 7) by @HarshP4585 in #4894

New Contributors

• @mfalkiewicz made their first contribution in #4816

Full Changelog: v2.5.2...v2.6