forked from dfir-iris/iris-web
-
-
Notifications
You must be signed in to change notification settings - Fork 0
Changelog
zach115th edited this page Jul 19, 2026
·
22 revisions
The full changelog is maintained in the repository at CHANGELOG.md.
Versions follow SemVer 2.0 with +iris-next.<build> build
metadata appended to the upstream version this fork was cut from:
v2.5.0-beta.1+iris-next.4
│ │
│ └─ iris-ng build number
└─ upstream DFIR-IRIS version (API compatibility baseline)
| Version | Date | Highlights |
|---|---|---|
| (main, untagged) | 2026-07-18 | Correlation: STIX 2.1 bundle export per cluster — "Export STIX" button downloads a self-contained bundle (identity + TLP:GREEN marking + campaign + indicators + relationships) |
| (prior untagged) | 2026-07-18 | Timeline: exact + near-duplicate detection and resolution on master and working timelines ("Find duplicates" dropdown item + clone icon); working-timeline pending/promoted/rejected count display hidden from viewport |
| (prior untagged) | 2026-07-16 | Timeline: date sort toggle (oldest/newest first) on master and working timelines — separate violet pill next to the grey date pill; Inventory: sortable column headers on Drive inventory table (A→Z / Z→A, violet active indicator, numeric capacity sort); Dashboard: "Attributed open tasks" now excludes tasks from closed cases; Inventory: retention overdue clock anchored to case closure date (not drive assignment) — open cases are never flagged overdue |
v2.5.0-beta.1+iris-next.5 |
2026-07-15 | Dashboard: evidence drive status donut chart + stat tiles on Inventory tab; Settings: new Storage tab with configurable retention period — drives in use beyond the threshold receive an ⚠ Overdue badge in the table and an amber alert banner in the summary card |
v2.5.0-beta.1+iris-next.4 |
2026-07-04 | Ops: migrate_postgres_17.sh restore phase now auto re-issues role passwords as scram-sha-256 — pg17 defaults to scram-sha-256 auth; a pg12 dump stores passwords as MD5 hashes; without re-issue the app cannot connect after migration |
v2.5.0-beta.1+iris-next.3 |
2026-07-04 | Security: replace showdown with marked@18.0.5 (Dependabot #99 — ReDoS in link/anchor parser, no upstream fix); get_showdown_convert() wraps marked.parse() with identical .makeHtml() interface |
v2.5.0-beta.1+iris-next.2 |
2026-07-04 | Security + build: Vite 8/rolldown 1.1.4 compat (36 import-free JS files → ui/public/), picomatch 2.3.1→2.3.2 ReDoS + vite-plugin-static-copy 1.0.6→3.4.0 path-traversal, 8 Python Dependabot patches (urllib3/Flask/Werkzeug/PyJWT/…), CodeQL regex fix; perf: bulk IOC N+1 self-join fix (~25ms vs ~2.6s); bug fixes: User.user field name (HTTP 500 on all AI surfaces) |
v2.5.0-beta.1+iris-next.1 |
2026-06-28 | Native MISP integration, AI assistant layer (12+ surfaces), dual timeline (Hayabusa + EZ Tools/KAPE), Jira-style task linking, IOC↔Note + Asset↔Evidence linking, cross-case IOC correlation, dashboard metrics + inventory, case export/import (AES-256-GCM), analyst time tracking + skills + team building, async AI job queue |
v2.5.0-beta.1+iris-next.0 |
2026-04-28 | Initial fork from DFIR-IRIS v2.5.0-beta.1 |
Upstream DFIR-IRIS changes (versions ≤ v2.5.0-beta.1) are documented in upstream release notes.
Upstream bugfixes can be cherry-picked via the upstream-fixes branch when they land.
iris-ng uses the [ADD]/[FIX]/[IMP]/[DEL] commit prefix convention for cherry-pick
continuity.