Changelog

Changelog

The full changelog is maintained in the repository at CHANGELOG.md.

Version scheme

Versions follow SemVer 2.0 with +iris-ng.<build> build metadata appended to the upstream version this fork was cut from:

v2.5.0-beta.1+iris-ng.6
│             │
│             └─ iris-ng build number
└─ upstream DFIR-IRIS version (API compatibility baseline)

Naming note. Builds through .4 were tagged +iris-next.<build> (the fork's original working name). From .6 onward the tag matches the version string reported by the application and shown in /manage/settings → System, which is +iris-ng.<build>. There is no .5 tag — the number was skipped during the rename.

Releases

Published releases are listed on the Releases page. Rows below marked (milestone) are development milestones recorded for history, not published tags.

Version	Date	Highlights
(main, untagged)	2026-07-31	AI: manual override of the AI cluster narrative on the Correlation tab — ✎ Edit button opens the campaign title and prose; provenance badge, "View AI original" and "Revert to AI"; confidence deliberately left non-editable. Corrections flow into the STIX 2.1 export (campaign.name / campaign.description), so partners receive the analyst's version. Re-run returns HTTP 409 unless discard_edit: true. No migration — reuses the summary's columns
(prior untagged)	2026-07-31	AI: manual override of the executive case summary — edit the generated Markdown in place, badge flips to "Edited by analyst" with who/when, original preserved for "View AI original" / "Revert to AI", advisory stale hint when case data changes after an edit. Regeneration guarded server-side with HTTP 409 (reason: manual_edit_present) so edits are never silently orphaned. Alembic d3b8f5a1c674 adds edited_content / edited_by_id / edited_at to case_ai_artifact
(prior untagged)	2026-07-30	Docs: repository and wiki branded as the Community Edition — LGPL-3.0, no feature gates, no license key or activation, no telemetry, self-hosted; new contributing and support guidance. Corrected stale develop branch references across README, CONTRIBUTING.md and FORK.md — develop is retired with unrelated history, main is the active development branch and the PR target
v2.5.0-beta.1+iris-ng.6	2026-07-29	UI: Help menu now links the iris-ng wiki (was upstream docs.dfir-iris.org); Settings → System version is now a link to the Releases page; version bumped +iris-ng.0 → +iris-ng.6. CI: image push namespace fixed (ghcr.io/dfir-iris/… → the repository owner — every tagged release previously failed with denied: permission_denied); build toolchain moved to Node 24
(prior untagged)	2026-07-29	Graph: knowledge-map layers on the case Graph tab — note and evidence nodes plus direct ioc_note_link / evidence_asset_link / ioc_asset_link edges, with per-layer toggles in the toolbar (client-side filtering, persisted in localStorage); redundant direct edges suppressed where a timeline event already joins the pair; removed an unused bootstrap-slider include that collided with jQuery UI's $.fn.slider and logged a namespace warning on every Graph page load
(prior untagged)	2026-07-25	Deps: brace-expansion 1.1.16 (exponential-expansion DoS) + eslint 9.39.5 + ajv 6.15.0 + eslint-plugin-svelte 3.22.0 — the plugin bump is required by any eslint ≥ 9.12, since 2.x wraps core no-inner-declarations without the blockScopedFunctions option and crashes lint; transitive postcss 8.5.23 (sourceMappingURL path traversal, build-time-only exposure)
(prior untagged)	2026-07-25	Deps: setuptools >= 83 (MANIFEST.in sdist-exclusion advisory) with a build-time pkg_resources shim — setuptools >= 81 removed pkg_resources, which docxcompose and graphene-sqlalchemy still import at module load; source/patches/depatch_pkg_resources.py rewrites both to importlib during the image build, changing no dependency versions. UI: restored the Generate-report button, whose handlers rolldown had tree-shaken out of case.summary.js
(prior untagged)	2026-07-19	Settings: fix 400 BAD REQUEST on save when retention/capacity-planning fields are blank ("" rejected by marshmallow Integer field — convert to null in JS before submit)
(prior untagged)	2026-07-19	Correlation: two STIX narrative lookup bugs fixed — art.content (not art.artifact_content) + .order_by(generated_at) (not created_at); STIX exports now actually enrich the campaign with AI narrative; cluster narrative prompt v2 — entity names prohibited so narratives are safe to share in STIX bundles
(prior untagged)	2026-07-18	Correlation: STIX 2.1 bundle export per cluster — "Export STIX" button downloads a self-contained bundle (identity + TLP:GREEN marking + campaign + indicators + relationships)
(prior untagged)	2026-07-18	Timeline: exact + near-duplicate detection and resolution on master and working timelines ("Find duplicates" dropdown item + clone icon); working-timeline pending/promoted/rejected count display hidden from viewport
(prior untagged)	2026-07-16	Timeline: date sort toggle (oldest/newest first) on master and working timelines — separate violet pill next to the grey date pill; Inventory: sortable column headers on Drive inventory table (A→Z / Z→A, violet active indicator, numeric capacity sort); Dashboard: "Attributed open tasks" now excludes tasks from closed cases; Inventory: retention overdue clock anchored to case closure date (not drive assignment) — open cases are never flagged overdue
(milestone)	2026-07-15	Dashboard: evidence drive status donut chart + stat tiles on Inventory tab; Settings: new Storage tab with configurable retention period — drives in use beyond the threshold receive an ⚠ Overdue badge in the table and an amber alert banner in the summary card
v2.5.0-beta.1+iris-next.4	2026-07-04	Ops: migrate_postgres_17.sh restore phase now auto re-issues role passwords as scram-sha-256 — pg17 defaults to scram-sha-256 auth; a pg12 dump stores passwords as MD5 hashes; without re-issue the app cannot connect after migration
v2.5.0-beta.1+iris-next.3	2026-07-04	Security: replace showdown with marked@18.0.5 (Dependabot #99 — ReDoS in link/anchor parser, no upstream fix); get_showdown_convert() wraps marked.parse() with identical .makeHtml() interface
v2.5.0-beta.1+iris-next.2	2026-07-04	Security + build: Vite 8/rolldown 1.1.4 compat (36 import-free JS files → ui/public/), picomatch 2.3.1→2.3.2 ReDoS + vite-plugin-static-copy 1.0.6→3.4.0 path-traversal, 8 Python Dependabot patches (urllib3/Flask/Werkzeug/PyJWT/…), CodeQL regex fix; perf: bulk IOC N+1 self-join fix (~25ms vs ~2.6s); bug fixes: User.user field name (HTTP 500 on all AI surfaces)
(milestone)	2026-06-28	Native MISP integration, AI assistant layer (12+ surfaces), dual timeline (Hayabusa + EZ Tools/KAPE), Jira-style task linking, IOC↔Note + Asset↔Evidence linking, cross-case IOC correlation, dashboard metrics + inventory, case export/import (AES-256-GCM), analyst time tracking + skills + team building, async AI job queue
(milestone)	2026-04-28	Initial fork from DFIR-IRIS v2.5.0-beta.1

Upstream

Upstream DFIR-IRIS changes (versions ≤ v2.5.0-beta.1) are documented in upstream release notes.

Upstream bugfixes can be cherry-picked via the upstream-fixes branch when they land. iris-ng uses the [ADD]/[FIX]/[IMP]/[DEL] commit prefix convention for cherry-pick continuity.