Changelog

Changelog

The full changelog is maintained in the repository at CHANGELOG.md.

Version scheme

Versions follow SemVer 2.0 with +iris-next.<build> build metadata appended to the upstream version this fork was cut from:

v2.5.0-beta.1+iris-next.4
│             │
│             └─ iris-ng build number
└─ upstream DFIR-IRIS version (API compatibility baseline)

Releases

Version	Date	Highlights
(main, untagged)	2026-07-19	Correlation: two STIX narrative lookup bugs fixed — art.content (not art.artifact_content) + .order_by(generated_at) (not created_at); STIX exports now actually enrich the campaign with AI narrative; cluster narrative prompt v2 — entity names prohibited so narratives are safe to share in STIX bundles
(prior untagged)	2026-07-18	Correlation: STIX 2.1 bundle export per cluster — "Export STIX" button downloads a self-contained bundle (identity + TLP:GREEN marking + campaign + indicators + relationships)
(prior untagged)	2026-07-18	Timeline: exact + near-duplicate detection and resolution on master and working timelines ("Find duplicates" dropdown item + clone icon); working-timeline pending/promoted/rejected count display hidden from viewport
(prior untagged)	2026-07-16	Timeline: date sort toggle (oldest/newest first) on master and working timelines — separate violet pill next to the grey date pill; Inventory: sortable column headers on Drive inventory table (A→Z / Z→A, violet active indicator, numeric capacity sort); Dashboard: "Attributed open tasks" now excludes tasks from closed cases; Inventory: retention overdue clock anchored to case closure date (not drive assignment) — open cases are never flagged overdue
v2.5.0-beta.1+iris-next.5	2026-07-15	Dashboard: evidence drive status donut chart + stat tiles on Inventory tab; Settings: new Storage tab with configurable retention period — drives in use beyond the threshold receive an ⚠ Overdue badge in the table and an amber alert banner in the summary card
v2.5.0-beta.1+iris-next.4	2026-07-04	Ops: migrate_postgres_17.sh restore phase now auto re-issues role passwords as scram-sha-256 — pg17 defaults to scram-sha-256 auth; a pg12 dump stores passwords as MD5 hashes; without re-issue the app cannot connect after migration
v2.5.0-beta.1+iris-next.3	2026-07-04	Security: replace showdown with marked@18.0.5 (Dependabot #99 — ReDoS in link/anchor parser, no upstream fix); get_showdown_convert() wraps marked.parse() with identical .makeHtml() interface
v2.5.0-beta.1+iris-next.2	2026-07-04	Security + build: Vite 8/rolldown 1.1.4 compat (36 import-free JS files → ui/public/), picomatch 2.3.1→2.3.2 ReDoS + vite-plugin-static-copy 1.0.6→3.4.0 path-traversal, 8 Python Dependabot patches (urllib3/Flask/Werkzeug/PyJWT/…), CodeQL regex fix; perf: bulk IOC N+1 self-join fix (~25ms vs ~2.6s); bug fixes: User.user field name (HTTP 500 on all AI surfaces)
v2.5.0-beta.1+iris-next.1	2026-06-28	Native MISP integration, AI assistant layer (12+ surfaces), dual timeline (Hayabusa + EZ Tools/KAPE), Jira-style task linking, IOC↔Note + Asset↔Evidence linking, cross-case IOC correlation, dashboard metrics + inventory, case export/import (AES-256-GCM), analyst time tracking + skills + team building, async AI job queue
v2.5.0-beta.1+iris-next.0	2026-04-28	Initial fork from DFIR-IRIS v2.5.0-beta.1

Upstream

Upstream DFIR-IRIS changes (versions ≤ v2.5.0-beta.1) are documented in upstream release notes.

Upstream bugfixes can be cherry-picked via the upstream-fixes branch when they land. iris-ng uses the [ADD]/[FIX]/[IMP]/[DEL] commit prefix convention for cherry-pick continuity.