Changelog

Changelog

The full changelog is maintained in the repository at CHANGELOG.md.

Version scheme

Releases are named IRIS-NG-v<major>.<minor>.<patch>, starting at IRIS-NG-v1.0.0:

IRIS-NG-v1.0.0
│         │
│         └─ iris-ng release version
└─ product name

Two things worth knowing about the change:

• The string is not SemVer-parseable, and 1.0.0 sorts below every release made under the old scheme. Tooling that compares versions will read the change as a downgrade.
• The upstream version this fork targets is no longer carried in the version string. It has not changed — the API compatibility range is reported on Settings → System as Min./Max. API version supported.

Earlier scheme. Releases before IRIS-NG-v1.0.0 used SemVer with build metadata: v2.5.0-beta.1+iris-ng.<build>, where the leading part was the upstream DFIR-IRIS version. Builds through .4 were tagged +iris-next.<build> (the fork's original working name); there is no .5 tag, the number was skipped during that rename. Those releases remain published, and their image tags substitute - for +, which is not a valid Docker tag character.

Releases

Published releases are listed on the Releases page. Rows below marked (milestone) are development milestones recorded for history, not published tags.

IRIS-NG-v1.0.3 was never released. The version was staged on main but no tag, release or container images were ever produced for it, so nothing shipped under that number. Its changes are included in IRIS-NG-v1.1.1.

Version	Date	Highlights
IRIS-NG-v1.1.1	2026-08-05	Dependency modernisation across Python, npm, Docker base images and GitHub Actions — 22 Python packages including SQLAlchemy 2.0.51, alembic 1.18.5, celery 5.6.3, Flask-WTF 1.3.0 and graphene 3.4.3, plus 11 UI packages including ace-builds 1.44.0 and Vite 8.2.0. Correlation scoring rewritten: cluster confidence now weighs each shared indicator by rarity and credibility instead of counting them, and no longer moves when you change the Min shared IOCs control; decay scales the half-life by tag rather than the score, so it can no longer exceed 100%, and ages from the most recent sighting rather than the oldest — expect lower confidence figures than earlier releases, see IOC Correlation. Fixes: a cluster's shared-IOC count contradicted the threshold that created it; the Shared IOCs table ignored that threshold entirely; the update check crashed on the current version scheme because IRIS-NG-v<x.y.z> is not valid PEP 440 and packaging 22 removed the fallback that had tolerated it; AI suggesters timed out against slower backends at 60 s against a measured 28–34 s, now 180 s; every AI failure displayed the same JSON parse error instead of what the backend said; CSRF tokens were sent as a header on two endpoints where only the request body is read, so the notification bell could never clear and the timeline analysis panel never regenerated; and the sidebar printed the product name twice. Security: two high-severity advisories cleared in the UI dependency tree, both transitive and both resolved by a lockfile update — brace-expansion 1.1.18 (GHSA-mh99-v99m-4gvg and GHSA-rgw5-rvv9-x895, reached only through development tooling) and socket.io-parser 4.2.7 (GHSA-2m8v-j782-fhvr, not reachable here — the websocket server is Flask-SocketIO, and the browser client file ships prebuilt upstream). package.json is unchanged and the built bundle is byte-identical. Not taken: PostgreSQL 18, jQuery 4 and Node 25 — reasoning in Dependency Policy.
IRIS-NG-v1.0.2	2026-08-04	Correlation and CSRF fixes. A cluster linked because a pair of cases shared three indicators reported “1 shared IOC”, because the count included only indicators found exclusively inside the cluster. Two /api/v2/ POSTs sent the CSRF token as a header, which the validator never reads — the notification bell's acknowledge failed silently on every click, and the master-timeline AI panel never regenerated. Also relabels the Min shared IOCs control to state that it counts indicators a case pair must share, not cases an indicator must appear in.
IRIS-NG-v1.0.1	2026-08-01	Chart-only release — application code identical to v1.0.0. Fixes the Helm chart attached to IRIS-NG-v1.0.0, which was labelled appVersion: IRIS-NG-v1.0.0 but pinned v2.5.0-beta.1-iris-ng.7 for every image, so installing from that release asset deployed the previous release — without the Sponsor tab or IOC History. The published container images were correct throughout; only the chart asset was wrong. Cause was an ordering trap rather than a slip: a release's images do not exist until its tag has built, so hardcoded pins can only be corrected after tagging, which guarantees every packaged chart pins the previous release. Fixed structurally — chart image tags now default to the chart's appVersion (chart 0.4.0), so a packaged chart is self-consistent by construction. Pinning is still supported per component.
IRIS-NG-v1.0.0	2026-08-01	Version scheme changed to IRIS-NG-v<major>.<minor>.<patch>. Adds a Sponsor tab on Server Settings, reading the project's FUNDING.yml from GitHub at runtime — the only component that reaches the public internet on its own, and built to fail soft (loaded on first tab open, 5s timeout, cached 6h, honours configured proxies, empty panel when unreachable). Adds an IOC History panel: IOC create and update now write modification_history, which no earlier release did, and the modal surfaces it the way timeline events already did. Fixes: the four tag-driven workflows fired on v*.*.* and would have silently built nothing under the new scheme; the publish sanitizer's Bearer floor let real 40–79 character keys through; chart publishing had never produced a chart; and the Helm chart was brought forward to the current stack (see Kubernetes). Container images and the packaged chart are attached to the release.
v2.5.0-beta.1+iris-ng.7	2026-08-01	First release with published container images. ghcr.io/zach115th/iriswebapp_{app,db,nginx} are now on GHCR, multi-arch (amd64 + arm64). Every previously tagged release failed to publish because the image workflows hardcoded ghcr.io/dfir-iris/ — upstream's org — and GITHUB_TOKEN can only write packages for its own owner. The Docker tag replaces + with - (+ is not valid in a Docker tag), so pull iriswebapp_app:v2.5.0-beta.1-iris-ng.7. A new release workflow creates the GitHub Release on tag push, so the release entry and the images always describe the same commit. Also adds the Kubernetes page documenting the Helm chart's current gaps. This release contains everything listed below back to +iris-next.4 — builds .5 and .6 were version-string bumps that were never released.
(in iris-ng.7)	2026-07-31	Notifications: case-updates bell in the header, scoped to the case in context — switching case switches the feed, and acknowledging one case leaves every other case untouched. Reads the existing user_activity log, so it works retroactively over history predating the feature. case_notification_ack (Alembic f4a92c7e1b58) holds a durable per-(user, case) read watermark that survives logout; acknowledging carries the newest timestamp actually shown, so activity arriving mid-read stays unread, and the watermark only moves forward. Own interactive edits are filtered out while is_from_api rows still notify, so API and n8n changes surface. A never-acknowledged case falls back to a 14-day lookback rather than full history. See Case Notifications
(prior untagged)	2026-07-31	MISP: new IrisMISPCluster module — a Push to MISP button on each correlation cluster publishes it as a single campaign event. Narrative → Event Report, linked notes → analyst Notes on the indicator they document, ioc_description → attribute comment (every distinct per-case description), IOC tags → attribute tags, campaign name → misp-galaxy:campaign. Entity names redacted automatically from all free text, with terms derived on every push from client records and case names; IOC values never redacted. misp_cluster_link (Alembic e7c1a94d2f38) makes a repeat push return 409 rather than duplicate the event. See MISP Cluster Publishing
(prior untagged)	2026-07-31	Fix: module config schemas were frozen at first registration — adding a parameter to any module never reached an existing install, and an incomplete stored entry raised KeyError on is_mod_configured(), surfacing as a 500 on /manage/modules/list and an opaque DataTables Ajax error. reconcile_module_configurations() now runs every boot, adding declared-but-missing parameters, dropping removed ones and refreshing metadata while preserving admin-set values
(prior untagged)	2026-07-31	AI: manual override of the AI cluster narrative on the Correlation tab — ✎ Edit button opens the campaign title and prose; provenance badge, "View AI original" and "Revert to AI"; confidence deliberately left non-editable. Corrections flow into the STIX 2.1 export (campaign.name / campaign.description), so partners receive the analyst's version. Re-run returns HTTP 409 unless discard_edit: true. No migration — reuses the summary's columns
(prior untagged)	2026-07-31	AI: manual override of the executive case summary — edit the generated Markdown in place, badge flips to "Edited by analyst" with who/when, original preserved for "View AI original" / "Revert to AI", advisory stale hint when case data changes after an edit. Regeneration guarded server-side with HTTP 409 (reason: manual_edit_present) so edits are never silently orphaned. Alembic d3b8f5a1c674 adds edited_content / edited_by_id / edited_at to case_ai_artifact
(prior untagged)	2026-07-30	Docs: repository and wiki branded as the Community Edition — LGPL-3.0, no feature gates, no license key or activation, no telemetry, self-hosted; new contributing and support guidance. Corrected stale develop branch references across README, CONTRIBUTING.md and FORK.md — develop is retired with unrelated history, main is the active development branch and the PR target
v2.5.0-beta.1+iris-ng.6	2026-07-29	UI: Help menu now links the iris-ng wiki (was upstream docs.dfir-iris.org); Settings → System version is now a link to the Releases page; version bumped +iris-ng.0 → +iris-ng.6. CI: image push namespace fixed (ghcr.io/dfir-iris/… → the repository owner — every tagged release previously failed with denied: permission_denied); build toolchain moved to Node 24
(prior untagged)	2026-07-29	Graph: knowledge-map layers on the case Graph tab — note and evidence nodes plus direct ioc_note_link / evidence_asset_link / ioc_asset_link edges, with per-layer toggles in the toolbar (client-side filtering, persisted in localStorage); redundant direct edges suppressed where a timeline event already joins the pair; removed an unused bootstrap-slider include that collided with jQuery UI's $.fn.slider and logged a namespace warning on every Graph page load
(prior untagged)	2026-07-25	Deps: brace-expansion 1.1.16 (exponential-expansion DoS) + eslint 9.39.5 + ajv 6.15.0 + eslint-plugin-svelte 3.22.0 — the plugin bump is required by any eslint ≥ 9.12, since 2.x wraps core no-inner-declarations without the blockScopedFunctions option and crashes lint; transitive postcss 8.5.23 (sourceMappingURL path traversal, build-time-only exposure)
(prior untagged)	2026-07-25	Deps: setuptools >= 83 (MANIFEST.in sdist-exclusion advisory) with a build-time pkg_resources shim — setuptools >= 81 removed pkg_resources, which docxcompose and graphene-sqlalchemy still import at module load; source/patches/depatch_pkg_resources.py rewrites both to importlib during the image build, changing no dependency versions. UI: restored the Generate-report button, whose handlers rolldown had tree-shaken out of case.summary.js
(prior untagged)	2026-07-19	Settings: fix 400 BAD REQUEST on save when retention/capacity-planning fields are blank ("" rejected by marshmallow Integer field — convert to null in JS before submit)
(prior untagged)	2026-07-19	Correlation: two STIX narrative lookup bugs fixed — art.content (not art.artifact_content) + .order_by(generated_at) (not created_at); STIX exports now actually enrich the campaign with AI narrative; cluster narrative prompt v2 — entity names prohibited so narratives are safe to share in STIX bundles
(prior untagged)	2026-07-18	Correlation: STIX 2.1 bundle export per cluster — "Export STIX" button downloads a self-contained bundle (identity + TLP:GREEN marking + campaign + indicators + relationships)
(prior untagged)	2026-07-18	Timeline: exact + near-duplicate detection and resolution on master and working timelines ("Find duplicates" dropdown item + clone icon); working-timeline pending/promoted/rejected count display hidden from viewport
(prior untagged)	2026-07-16	Timeline: date sort toggle (oldest/newest first) on master and working timelines — separate violet pill next to the grey date pill; Inventory: sortable column headers on Drive inventory table (A→Z / Z→A, violet active indicator, numeric capacity sort); Dashboard: "Attributed open tasks" now excludes tasks from closed cases; Inventory: retention overdue clock anchored to case closure date (not drive assignment) — open cases are never flagged overdue
(milestone)	2026-07-15	Dashboard: evidence drive status donut chart + stat tiles on Inventory tab; Settings: new Storage tab with configurable retention period — drives in use beyond the threshold receive an ⚠ Overdue badge in the table and an amber alert banner in the summary card
v2.5.0-beta.1+iris-next.4	2026-07-04	Ops: migrate_postgres_17.sh restore phase now auto re-issues role passwords as scram-sha-256 — pg17 defaults to scram-sha-256 auth; a pg12 dump stores passwords as MD5 hashes; without re-issue the app cannot connect after migration
v2.5.0-beta.1+iris-next.3	2026-07-04	Security: replace showdown with marked@18.0.5 (Dependabot #99 — ReDoS in link/anchor parser, no upstream fix); get_showdown_convert() wraps marked.parse() with identical .makeHtml() interface
v2.5.0-beta.1+iris-next.2	2026-07-04	Security + build: Vite 8/rolldown 1.1.4 compat (36 import-free JS files → ui/public/), picomatch 2.3.1→2.3.2 ReDoS + vite-plugin-static-copy 1.0.6→3.4.0 path-traversal, 8 Python Dependabot patches (urllib3/Flask/Werkzeug/PyJWT/…), CodeQL regex fix; perf: bulk IOC N+1 self-join fix (~25ms vs ~2.6s); bug fixes: User.user field name (HTTP 500 on all AI surfaces)
(milestone)	2026-06-28	Native MISP integration, AI assistant layer (12+ surfaces), dual timeline (Hayabusa + EZ Tools/KAPE), Jira-style task linking, IOC↔Note + Asset↔Evidence linking, cross-case IOC correlation, dashboard metrics + inventory, case export/import (AES-256-GCM), analyst time tracking + skills + team building, async AI job queue
(milestone)	2026-04-28	Initial fork from DFIR-IRIS v2.5.0-beta.1

Upstream

Upstream DFIR-IRIS changes (versions ≤ v2.5.0-beta.1) are documented in upstream release notes.

Upstream bugfixes can be cherry-picked via the upstream-fixes branch when they land. iris-ng uses the [ADD]/[FIX]/[IMP]/[DEL] commit prefix convention for cherry-pick continuity.