Patch Notes

2026-07-29

• The system now supports scan-bound remediation regeneration, allowing users to create new patch attempts while preserving the history of superseded drafts. Additionally, a durable dispatch recovery mechanism has been implemented to ensure idempotent republishing of queued remediation jobs.
• The assistant interface now includes a visible "Thinking…" text label during processing states. This update improves user feedback by pairing the status orb with a clear textual indicator.
• This update ensures the composing indicator remains visible during active process tasks. It replaces the static "thinking" text with a dynamic working indicator for improved user feedback.
• The system now provides structured remediation guidance when an automatic AI patch cannot be safely generated. This includes database updates to persist guidance and new logic to validate and render manual remediation steps.
• Introduced "thinking" and "working" visual orbs to the Assistant interface to improve state visibility during AI processing. Added comprehensive E2E and unit tests to ensure accessibility and theme compatibility across different viewports.
• The Aider adapter now implements strict validation to ensure AI-generated patches only modify approved target files. This update introduces a bounded target resolution system that supports multiple manifest families for dependency remediation.
• The platform now supports Bitbucket as a remediation source. This update introduces provider connection handling to enable secure repository cloning for Bitbucket-hosted projects.

2026-07-28

• The Bitbucket repository scope resolution has been refactored into a reusable method to ensure connection IDs are prepared before branch validation. This change prevents potential failures during the scan submission process for Bitbucket-hosted repositories.
• The CyfroSec platform has expanded its Bitbucket Cloud integration with improved repository discovery and a more robust sync mechanism. Updates include enhanced error handling for commit statuses and a new durable queue recovery system for synchronization tasks.

2026-07-23

• Improved the agent details interface by refining version state displays and enhancing the credential recovery workflow. Updated the UI to better handle "latest" and "unknown" version statuses and reorganized the overview layout for improved readability.

2026-07-21

• The rule catalog has been moved under the Settings section and is currently staged for rollout. Primary navigation and the Settings overview have been updated to hide the rules catalog while maintaining route-addressable access.

2026-07-18

• The security platform has expanded its capabilities with the introduction of Fingerprint Upload v2, featuring a more robust, additive data model for agent scans. This update includes new API endpoints for manifest-based uploads and enhanced administrative controls for managing agent capabilities.

2026-07-17

• The agent registration process was updated to use a public Keycloak URL instead of the internal admin transport URL. This change prevents the exposure of internal infrastructure addresses to remote agents.
• Implemented a new landing announcement feature allowing administrators to manage and deploy public banners and maintenance pages. The system includes a draft-to-publish workflow that synchronizes configurations to a static CDN.
• The platform has been expanded to include a secure same-agent credential recovery workflow and transactional Docker updates. These features ensure agent identity persistence and safe version transitions without requiring full re-registration.

2026-07-16

• Implemented a new account access error state to handle expired authentication tokens. This update improves user experience by providing a clear sign-in prompt when sessions expire.
• The remediation board's patch application checks have been decoupled from validation readiness to prevent unnecessary service unavailability errors. Permission enforcement now utilizes a scoped role matrix, allowing for more granular access control across different account groups.
• The code security board layout has been improved with a new command center for metrics and a refined filter panel. These changes enhance the visual organization and usability of the remediation workbench.

2026-07-15

• The update improves the handling of AI-generated patches that result in no code changes. Users will now see a specific "No reviewable patch was produced" message instead of a generic ready notification.
• The system now allows remediation drafts in specific states to be retrieved even if patch artifacts are missing. This prevents unnecessary errors for drafts that are queued, running, or failed.
• Implemented a new quota exceeded error handler for AI remediation to provide user-friendly messages and prevent workspace preparation on denial. Updated the usage reservation recovery system to integrate with the billing worker and include owner-aware recovery policies.
• The security scan prioritization system has been upgraded to v2, introducing more granular coverage reporting and a deterministic ranking window for findings. Additionally, KICS scanner handling was updated to normalize exit codes, ensuring findings are persisted even when the engine returns a non-zero result.

2026-07-14

• The assistant's visual accents have been updated to align with the core CyfroSec brand palette. This change replaces hardcoded hex values with shared brand design tokens for improved visual consistency.
• Standardized segmented controls across the frontend by introducing a dedicated CSS system for rails and controls. This update ensures visual consistency for tabs and filters across the code security, compliance, notifications, usage, and user management modules.
• The patch publish approval flow has been updated to support retries for failed exports on validated revisions. This includes new preflight checks for provider permissions and improved state-machine logic to prevent conflicting publish attempts.
• The patch review system now allows developers to edit any visible line within a result snapshot, including context lines. This update introduces editable regions and a unified hunk editor to improve the flexibility of manual patch revisions.
• The patch review timeline has been embedded directly into the review brief section for improved visibility. This update includes a redesigned layout and updated CSS for the timeline segments.
• This update hardens the Aider remediation pipeline by implementing explicit provider routing for OpenAI Responses models and a nonce-based confirmation signal for empty diffs. These changes prevent silent failures and ensure that empty outputs are only treated as "no changes" when explicitly confirmed by the model.

2026-07-13

• The remediation runtime ownership has been decoupled from the API container and moved to a dedicated worker role. This update introduces a Redis-backed health check system to verify the availability of AI patch and scanner runtimes.
• The build process was updated to ignore nested frontend dependencies and build artifacts. This ensures consistent Docker image sizes and prevents local state from leaking into containers.
• The patch review layout has been refined with a new dedicated decision panel and an improved evidence rail for better review ergonomics. UI updates include enhanced CSS animations, refined spacing, and a restructured workspace for code changes.
• The code security overview layout has been refreshed to improve visual hierarchy and user experience. Key updates include the introduction of a dedicated loading skeleton and a reorganized operational telemetry section.
• This update ensures that impersonation sessions are strictly bound to the target organization to prevent data loading errors. Additionally, the documentation has been enhanced with new screenshots and improved image styling.
• The patch diff viewer has been enhanced with improved visual semantics and a new legend for better readability. These changes include updated CSS variables for diff states and expanded test coverage for the viewer components.
• This update hardens the AI patch runtime by implementing strict environment variable validation and provider-specific credential checks. It also optimizes database session handling to prevent connection pinning during outbound I/O operations.
• The system now separates customer-facing AI failure messages from detailed operator diagnostics to improve debugging without exposing sensitive data. Additionally, OpenAI reasoning-capable models now correctly omit temperature settings when a reasoning effort is active.
• Updated AI Flex routing to include a 30-second buffer for orchestration and cleanup. This change aligns worker and graph-step timeouts with provider execution budgets to prevent premature termination.

2026-07-12

• The scanner subprocess environment has been transitioned from a blocklist to a strict allowlist of essential variables. This change prevents the accidental leakage of platform environment variables and restricts logger output to prevent stderr overflows.
• Implemented a file-backed adapter for Checkov to handle structured reports with a strict 8 MiB size limit. Added enhanced telemetry and metadata tracking for scanner subprocess output and execution metrics.
• Introduced a dense operational table and detailed drawer for viewing logic hypotheses. This update improves the traceability of deterministic attack paths and analysis coverage evidence.
• The scanner runtime now includes a mandatory preparation step to refresh the Trivy vulnerability database before workers start. This ensures scan executors fail fast during startup if stateful data is unavailable or corrupted.
• The CyfroCode worker targets have been split into granular components for orchestration, execution, AI, and remediation. A new supervisor script now manages these workers as a unified group to improve local development and debugging.
• Introduced CyfroCode business logic analysis, enabling the detection of logic vulnerabilities through first-party analyzers for Python and TypeScript. The update adds comprehensive API contracts, data models for threat modeling, and a hardened validation framework.

2026-07-11

• The code security tab navigation has been refreshed to improve layout consistency and visual styling. These changes include updated CSS classes for better responsiveness and a new active state indicator.

2026-07-10

• The update implements a deterministic evidence provenance system to ensure security scan results are accurately attributed to their respective sources. It also introduces a new development worker for the assistant to support hot-reloading during local engineering.
• The assistant workspace controls were refined to improve the desktop and mobile user experience. This includes updating the workspace panel's close mechanism and adjusting layout styles for better responsiveness.
• The LLM bridge now implements provider-neutral normalization for tool selection to ensure consistent behavior across different AI models. Additionally, internal tool acknowledgments are now excluded from customer-facing chat outputs to improve the user experience.

2026-07-09

• Implemented a new agentic experience for CyfroAssistant featuring a sanitized run timeline and durable queued follow-up functionality. The update includes a structured rollout plan and a database migration to enforce updated scanner policies.
• This update implements a strict commercial-use compliance framework for the CyfroCode toolchain, including hash-locked manifests and SBOM requirements. Several legacy scanners, including ScanCode and Semgrep, have been retired in favor of a streamlined, approved toolset.

2026-07-03

• Updated the quality gate UI to provide clearer messaging when release-readiness conditions are not met. Added a direct link to the quality gate policy settings for failed scans.

2026-07-02

• The quality gate system has been extended to support archiving and updating of gates. New database constraints ensure that only one active default gate exists per account group.
• The update fixes a bug where the mutation state was incorrectly set to loading during a reset. This ensures the API hook returns to a ready state and clears stale data.
• Implemented balanced sampling for project profile evidence to ensure diverse representation of architecture context and components. Added support for detecting and indexing architecture-related files such as Terraform, Dockerfiles, and CI/CD configurations.
• The splash screen has been modernized with updated CSS styling and a new branded layout. Improvements include better accessibility attributes and the addition of automated component tests.

2026-06-30

• Updated OpenTelemetry instrumentation and core libraries to resolve a crash during cross-origin preflight requests. This ensures proper handling of nested routing and prevents 500 errors before CORS processing.