🔖 Release 0.5.9

What's New

• Migrate GoReleaser to dockers_v2 by @javuto in #1020
• Promote osctrl-api HTTP client from cmd/cli to pkg/apiclient by @javuto in #1021
• Add osctrl-mcp: read-only MCP server for fleet inspection by @javuto in #1022
• Serve MCP from osctrl-api at /api/v1/mcp by @javuto in #1023
• Add opt-in write tools to the MCP server (run_query, expire_query, complete_query, tag_node) by @javuto in #1024
• Enable audit logs for MCP actions by @javuto in #1026
• Adjusting permissions for osctrl-mcp operations by @javuto in #1027
• Build RPM packages on release by @javuto in #1029
• Building binary for osctrl-mcp on release by @javuto in #1030
• Updated README and added markdown files for context and project structure by @javuto in #1032
• Reject unknown user actions instead of silently returning 200 by @mehdi-shokohi in #1015
• Reject unknown actions with 400 bad request by @javuto in #1033
• Health system status for osctrl-api and osctrl-tls by @javuto in #1034
• Accept test tagged releases with 1.2.3-test by @javuto in #1035
• Bump golang version to 1.27.1 by @javuto in #1036
• Add i18n infrastructure with per-user language selection (en/es/fr/de) by @javuto in #1037
• Add pt/ca/it languages and locale-aware formatting by @javuto in #1038
• Add flag emojis, 6 new languages, and command palette i18n (i18n phase 3) by @javuto in #1039
• Complete locale formatting and page titles across all 13 languages by @javuto in #1040
• Complete i18n: translate all feature pages across 13 languages by @javuto in #1041
• Add cross-device preferred language by @javuto in #1042
• Prepare for release 0.5.9 by @javuto in #1043

Full Changelog: v0.5.8...v0.5.9

🔖 Release 0.5.8

What's New

• Refine frontend UI and query workflow by @seanqsun in #992
• Better error handling for cache connections by @javuto in #995
• Fixes to adapt provision.sh to Ubuntu 26.04 by @javuto in #994
• Small changes to colors and style to new UI by @javuto in #996
• Log sink categories: route different data classes to different sinks by @javuto in #998
• Add version field to the service configuration schema by @javuto in #1000
• Publish osctrl-frontend as a release docker image by @javuto in #1001
• Bump docker base image for all docker releases by @javuto in #1002
• Fix CI snapshot failure due to missing frontend files by @javuto in #1003
• New osctrl-cli functionality along with the new osctrl-api changes by @javuto in #1004
• Alerting system Stage 1: matching engine (pkg/alerts) + alertsEnabled service flag by @javuto in #1005
• Alerting system Stage 2: ingest hook — async dispatch pipeline in osctrl-tls by @javuto in #1006
• Alerting system Stage 3: notification channels (webhook + email) and dispatch fan-out by @javuto in #1007
• Alerting system Stage 4: management API, instant hot-reload, and CLI by @javuto in #1008
• Alerting system Stage 5: node-inactive / node-recovered watcher by @javuto in #1009
• Alerting system Stage 6: SPA 'Alerts' section by @javuto in #1010
• Alerting system Stage 7: retention sweep + ingest load hardening by @javuto in #1011
• Create alerts from node view by @javuto in #1012
• Fix for overlapping buttons in node actions by @javuto in #1013
• Fix node-scoped alert creation, and make the resulting rule visible by @javuto in #1014
• Test alert button in alerts channel creation modal + bugfixes by @javuto in #1016
• Mark a node when an alert covers it by @javuto in #1017
• Prepare for release 0.5.8 by @javuto in #1018
• Fix missing action in release pipeline by @javuto in #1019

New Contributors

• @seanqsun made their first contribution in #992

Full Changelog: v0.5.7...v0.5.8

🔖 Release 0.5.7

What's New

• Revert log sinks to service configuration by @javuto in #982
• Frontend-editable authentication providers with auto-generated SAML keys by @javuto in #983
• Independent feature gates for service config, log sinks, and auth providers by @javuto in #984
• Posture checks stored in backend by @javuto in #985
• Interactive per-check risk score in the node posture tab by @javuto in #986
• Allow emails in usernames which facilitates SSO auth by @javuto in #987
• Replace the failed-enrolls counter with reported osquery errors by @javuto in #988
• Update service config UI for new parameters by @javuto in #989
• Fix console and file explorer timeouts from stale query-dispatch cache by @javuto in #990
• Add severity filter for status logs by @javuto in #991
• Prepare release 0.5.7 by @javuto in #993

Full Changelog: v0.5.6...v0.5.7

🔖 Release 0.5.6

What's New

• Updated READMEs with newer changes by @javuto in #939
• Upgrade golang version to 1.26.5 by @javuto in #940
• Change style for login page by @javuto in #941
• Accelerated-mode priming for console and file explorer by @javuto in #942
• S3-backed log reader for status, result, and on-demand query logs by @javuto in #943
• Refactor logger into exporters to allow multiple ones by @javuto in #944
• Remove osctrl-admin from settings in frontend by @javuto in #945
• ⚠️ Complete removal of osctrl-admin by @javuto in #946
• Improvements in fake_news_go to be able to test 10K clients by @javuto in #947
• Remove osctrl-dev.code-workspace file by @javuto in #948
• Cleanup settings and last osctrl-admin references by @javuto in #949
• Persistance in backend for each service configuration from YAML by @javuto in #950
• Frontend component to display service config values by @javuto in #951
• Ability to update service configuration values using osctrl-api by @javuto in #952
• Add editable capabilities to frontend for service config values by @javuto in #953
• Consume service configuration values from the DB stored ones by @javuto in #954
• YAML simplification and restart service when configuration changes by @javuto in #955
• Replace raw JSON editors with structured form UI for service config by @alvarofraguas in #956
• Ultimate optimization with redis and pending queries for nodes by @javuto in #957
• Multi-architecture enrolling packages by @javuto in #958
• Fixes for enrollment packages expiration time by @javuto in #959
• Fix for tagging nodes throwing a 500 error and updated default logo for tags by @javuto in #960
• Updated fake_news_go tool to simulate load by @javuto in #961
• Improvements to fake_news_go load testing tool by @javuto in #963
• Rate limits in osctrl-tls and osctrl-api are now configurable by @javuto in #964
• Service-dependant rate limit configuration values editable via frontend by @javuto in #965
• Implementation of service_commands to issue service restarts in osctrl-tls from osctrl-api by @javuto in #966
• Update README and OpenAPI documentation by @javuto in #967
• Annotated sample YAML configuration files by @javuto in #968
• More annotations for service config values and better UI by @javuto in #969
• Ability to write modified service configuration values to YAML by @javuto in #970
• Warning opening service configs to acknowledge it may break services by @javuto in #971
• Opt-in switch for the service configuration API and frontend by @javuto in #972
• Multi-factor authentication for password logins by @javuto in #973
• More commands in the console with a new help by @javuto in #974
• Service parameter to enable console independently from accelerated mode or file explorer by @javuto in #975
• Prepare release 0.5.6 by @javuto in #976
• DB-backed log sinks with hot reload capabilities per environment by @javuto in #977
• Catchall log sink in docker development environment by @javuto in #978
• Per-sink data tracking with zero-DB-impact hot path by @javuto in #979
• Updated README by @javuto in #980
• Fixed CICD pipeline for releases by @javuto in #981

Full Changelog: v0.5.5...v0.5.6

🔖 Release 0.5.5

What's New

• Adding interactive console mode to osctrl-cli by @javuto in #884
• Dynamic title in all pages with environment by @javuto in #885
• Fixed bug when active nodes were showing as inactive by @javuto in #886
• Fixes for deploy scripts to include frontend service by @javuto in #887
• Activity tiles was not displaying data correctly in nodes table by @javuto in #888
• Extracting the correct IP address in dev env by @javuto in #889
• Using correct destination for install targets by @javuto in #890
• Make dashboard display node activity per environment by @javuto in #891
• Improvements in dashboard by @javuto in #892
• Frontend fixes and small changes by @javuto in #893
• Invalidate config cache and format status and result logs by @javuto in #894
• Environment icons and correct last seen times by @javuto in #895
• Adding install_frontend job to Makefile by @javuto in #896
• Use flag emojis to display country of IP address by @javuto in #897
• Adding security posture checks to schedule by @javuto in #898
• Display risk score based on security posture data using SOC2 and ISO27001 controls by @javuto in #899
• Full text area for all components of configuration by @javuto in #900
• Filter CICD to skip unnecessary triggers to pipeline by @javuto in #901
• Flag to activate the security posture capabilities by @javuto in #902
• Activate security posture in dev env by @javuto in #903
• Replace pseudo-cache for environments and settings with proper cache by @javuto in #904
• Adding posture queries using osctrl-cli by @javuto in #905
• Have security posture checks added on deployment of dev env by @javuto in #906
• Flag to enable accelerated mode in osquery distributed queries by @javuto in #907
• Replace pseudo-cache with proper cache in osctrl-api by @javuto in #908
• Node-scoped read-only console powered by hidden accelerated distributed queries by @javuto in #909
• Enable accelerated mode in dev env by @javuto in #910
• Fixed serialization error in /results for console by @javuto in #911
• Adding osquery mode to console to run queries directly by @javuto in #912
• Updated READMEs with newest changes by @javuto in #913
• Enforcement of admin access to utilize console by @javuto in #914
• Replace latest enrolled with endpoint health metrics by @javuto in #915
• Adds node uptime as posture-derived metadata in node view by @javuto in #916
• Adding more fields to the all nodes table by @javuto in #917
• Adding buttons for node operations by @javuto in #918
• Adding tool to convert JSON configuration into YAML by @javuto in #919
• Security posture adjusments for risk calculation by @javuto in #920
• Display spinner for active queries and carves by @javuto in #921
• Updated provision.sh to have the new frontend deployed by @javuto in #922
• Fixed bug in the 24h activity tile for all nodes table by @javuto in #923
• Cleanup refresh_envs from osctrl-tls, osctrl-api and frontend by @javuto in #924
• Hide posture results and only store latest data by @javuto in #925
• Added file explorer to nodes view, powered by accelerated queries by @javuto in #926
• Bump the npm_and_yarn group across 1 directory with 2 updates by @dependabot[bot] in #929
• Parameter in provision.sh to create admin user by @javuto in #930
• More fixes in provision.sh to stick to parameters by @javuto in #931
• Fix for authentication config in osctrl-api by @javuto in #932
• DB health canary and cached data served in osctrl-tls by @javuto in #933
• Resist backend outage via DB health canary in osctrl-api by @javuto in #934
• osctrl-tls: health endpoint reports backend degradation via HTTP 204 by @javuto in #935
• osctrl-api: health endpoint reports backend degradation via HTTP 204 by @javuto in #936
• Dependencies update before release by @javuto in #937
• Prepare release 0.5.5 and update OpenAPI YAML by @javuto in #938

Full Changelog: v0.5.4...v0.5.5

🔖 Release 0.5.4

What's New

• Updated load testing tool fake_news by @javuto in #860
• Activity pkg to handle data from nodes and environments by @javuto in #861
• Disable osctrl-admin for docker development environment by @javuto in #862
• Updated activity pkg to store environment osquery activity by @javuto in #864
• build(deps-dev): bump vite from 8.0.13 to 8.0.16 in /frontend in the npm_and_yarn group across 1 directory by @dependabot[bot] in #863
• build(deps): bump the npm_and_yarn group across 1 directory with 2 updates by @dependabot[bot] in #865
• Potential path traversal found by codex security plugin by @javuto in #866
• Moving activity to main node view by @javuto in #867
• Prevent reboot loop in development environment by @javuto in #868
• Bump to all npm dependencies by @javuto in #869
• Bump to DOMpurify to satisfy dependabot alert by @javuto in #870
• Wire Redis activity rollups through to the frontend by @javuto in #871
• Dependencies update triggered by dependabot by @javuto in #872
• Saving schedule saves full configuration by @javuto in #873
• Display rendered configuration for environment by @javuto in #874
• Ad-hoc tool to test TLS endpoints using node_key from nodes by @javuto in #875
• Changes to node details view and surface node_key for admins by @javuto in #876
• Fixed distributed queries and status led by @javuto in #877
• Improved distributed query visibility and control across the query views by @javuto in #878
• Improved carves visibility and control across the carve views by @javuto in #879
• Redesigned view for carves and queries by @javuto in #880
• Lower intervals for the development environment and query in schedule by @javuto in #881
• Per-host filtering for the osctrl-tls HTTP debug dump by @javuto in #882
• Prepare release 0.5.4 and bump osquery to 5.23.1 by @javuto in #883

Full Changelog: v0.5.3...v0.5.4

🔖 Release 0.5.3

What's New

• docker-compose standalone is not the standard way to trigger docker c… by @ITJamie in #824
• osctrl: defensive hardening round — login timing, rate-limit XFF bypass, JWT rotation, info-disclosure closes by @alvarofraguas in #826
• Fix for goreleaser error when tagging a new release by @javuto in #827
• release: fix multi-arch Docker builds (manifest list export error) by @alvarofraguas in #828
• make: actionable errors for docker_dev + add docker_dev_certs target by @alvarofraguas in #834
• provision: fix yq and Go installer arch detection on x86_64 by @alvarofraguas in #838
• release: pass GOARCH build-arg to arm64 docker builds by @alvarofraguas in #839
• provision: auto-detect repo root instead of assuming ~/osctrl by @alvarofraguas in #835
• api: fine-grained permission control for service account creation by @alvarofraguas in #837
• auth: lift OIDC into reusable pkg/auth provider package by @alvarofraguas in #829
• auth: OIDC support for osctrl-api + React SPA by @alvarofraguas in #830
• auth: SAML 2.0 support for osctrl-api + React SPA by @alvarofraguas in #831
• frontend: SPA Users page — Add/Delete/Reset Password parity with legacy admin by @alvarofraguas in #832
• frontend: SPA UX polish — TargetSelector, audit fix, CSRF priming by @alvarofraguas in #833
• frontend: bump Node from 20 to 22 in Docker builds by @alvarofraguas in #840
• fix: OIDC/SAML logout, empty-target queries/carves, carve bulk actions, envless login by @alvarofraguas in #842
• security: fix 13 findings from security audit by @alvarofraguas in #843
• Adapt CI pipelines to have develop as default branch by @javuto in #844
• Annotations in osctrl-api to keep API documented by @javuto in #845
• Generator of swagger YAML and JSON using Makefile by @javuto in #846
• Up to date OpenAPI 3 YAML and tool to convert generated swagger by @javuto in #847
• Exposing frontend via nginx for TLS termination in docker dev environment by @javuto in #848
• Enrollment & config parity: per-OS flags, cert upload, assembled config + SPA tabs/sliders/forms/docs links by @alvarofraguas in #849
• Fix merge against main and update develop by @javuto in #850
• frontend: responsive sidenav — mobile drawer + desktop icon-rail collapse by @alvarofraguas in #851
• Banner to warn users about upcoming deprecation of osctrl-admin by @javuto in #852
• Updated README with notice about deprecation of osctrl-admin by @javuto in #853
• Removed legacy port from dev env by @javuto in #854
• Show permissions in profile page by @javuto in #855
• Reload frontend build when changes to code by @javuto in #856
• Prepare release 0.5.3 by @javuto in #857
• Makefile job to merge develop into main by @javuto in #858
• Fixed to error in release cicd pipeline by @javuto in #859

New Contributors

• @ITJamie made their first contribution in #824

Full Changelog: v0.5.2...v0.5.3

🔖 Release 0.5.2

What's New

• Redesigned CICD pipeline, simpler and using goreleaser by @javuto in #792
• Fix for Dockerfiles when building with GoReleaser by @javuto in #793
• Fix for goreleaser pushing multiarch images by @javuto in #794
• Default golang 1.26.1 by @javuto in #795
• Different fix for goreleaser pushing multiarch images by @javuto in #796
• Updated dockerfiles for snapshot images by @javuto in #797
• Copy static files building osctrl-admin docker image by @javuto in #798
• Configuration endpoints to receive osquery configuration from gitOps by @javuto in #799
• feat: add OIDC auth support for osctrl-admin by @jan-krueger in #801
• Dependencies update by @javuto in #802
• Replacing deprecated code in s3 aws sdk by @javuto in #803
• Dependencies update after refactor by @javuto in #804
• add new env to api by @mehdi-shokohi in #805
• Bug/fix remove api action by @mehdi-shokohi in #806
• Fix OSX quick-enroll: stop osqueryd before unload by @kimjune01 in #807
• Rebuild of docker dev environment on template/static changes by @javuto in #808
• Support for osquery 5.23.0 by @javuto in #809
• Fix race condition in IncExecution and IncError by @kimjune01 in #810
• Avoid cross environment queries/carves without permissions by @javuto in #811
• Verify node_key with environment to prevent unauthorized data by @javuto in #812
• osctrl-api: security hardening — auth bedrock, env secret containment, TLS-side rate-limit by @alvarofraguas in #813
• osctrl-api: API extensions for a React admin frontend (round 2 of 3) by @alvarofraguas in #814
• osctrl-frontend: React admin SPA at frontend/ (round 3 of 3) by @alvarofraguas in #815
• osctrl-tls: hardening — constant-time secrets, per-IP enroll rate-limit, audit-log on failed enrolls (round 1b of 3) by @alvarofraguas in #816
• osctrl: follow-up fixes for #813 — per-service --auth defaults + carve path SQL escape by @alvarofraguas in #817
• Bump esbuild from 0.21.5 to removed in /frontend in the npm_and_yarn group across 1 directory by @dependabot[bot] in #818
• Bumping nginx version for dev environment by @javuto in #819
• Prepare for release 0.5.2 by @javuto in #820
• Dependencies update before release by @javuto in #821

New Contributors

• @jan-krueger made their first contribution in #801
• @mehdi-shokohi made their first contribution in #805
• @kimjune01 made their first contribution in #807
• @alvarofraguas made their first contribution in #813

Full Changelog: v0.5.1...v0.5.2

🔖 Release 0.5.1

What's New

• Updated README with file structure and flowchart by @javuto in #783
• Bump github.com/russellhaering/goxmldsig from 1.5.0 to 1.6.0 in the go_modules group across 1 directory by @dependabot[bot] in #784
• Retrieving latest release metadata from osctrl.net in osctrl-admin by @javuto in #785
• Retrieving latest release metadata from stats.osctrl.net in osctrl-api by @javuto in #786
• Use goroutine for release check and fixed login in osctrl-admin by @javuto in #787
• Retrieving latest release metadata from stats.osctrl.net in osctrl-tls by @javuto in #788
• Support for osquery 5.22.1 by @javuto in #789
• Dependencies upgrade by @javuto in #790
• Prepare for release 0.5.1 by @javuto in #791

Full Changelog: v0.5.0...v0.5.1

🔖 Release 0.5.0

What's New

• Multiple fixes to CICD and dependencies update by @javuto in #764
• Multiple fixes for osctrl-api and api_tester tool by @javuto in #765
• Exclude tools directory from air configuration by @javuto in #766
• Fix all golangci-lint errors by @javuto in #767
• Order the list of osctrl-cli commands in alphabetical order by @javuto in #768
• Multiple fixes in osctrl-cli and osctrl-api by @javuto in #769
• Adding SECURITY.md policy by @javuto in #770
• Refresh README with emojis by @javuto in #771
• Bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 in the go_modules group across 1 directory by @dependabot[bot] in #775
• Small error in YAML config and ignoring md files by @javuto in #776
• Prevent unsanitized input when creating new environments in osctrl-admin by @javuto in #777
• Sanitized query in on-demand query list by @javuto in #778
• Support for osquery 5.21.0 by @javuto in #779
• Filter hostname on environment edit action by @javuto in #780
• Dependencies upgrade by @javuto in #781
• Prepare for release 0.5.0 by @javuto in #782

Full Changelog: v0.4.9...v0.5.0

🔖 Release 0.4.9

⚠️ This is a breaking release

The changes introduced in #754 makes this release NOT backwards compatible. Configuration for all services changed from using multiple JSON files, to a single YAML file. The env variables have not changed so it should not impact deployments where configuration is made via this method. More details in the documentation

What's New

• Fix for goreleaser CICD pipeline by @javuto in #743
• Fix for failing GHA pipelines to build on PR and release by @javuto in #744
• Fix for DEB package missing file by @javuto in #745
• Bump golang.org/x/crypto from 0.43.0 to 0.45.0 in the go_modules group across 1 directory by @dependabot[bot] in #747
• Preparation to have SAML config file by @javuto in #748
• Migrate aws sdk to v2 for the kinesis logger by @javuto in #749
• Migrate urfave/cli to v3 by @javuto in #750
• Support for osquery 5.20.0 by @javuto in #751
• Bump golang to 1.25.4 by @javuto in #752
• Dependencies upgrade by @javuto in #753
• Single YAML configuration file by @javuto in #754
• Generation of example configuration in osctrl-tls by @javuto in #755
• Generation of example configuration in osctrl-admin and osctrl-api by @javuto in #756
• Use single YAML file in provision.sh by @javuto in #757
• Cleaner install of go in provision.sh by @javuto in #758
• Adapt creation of deb packages to single YAML configuration by @javuto in #759
• Prevent crash in osctrl-api and other fixes around configuration by @javuto in #760
• Fix error in cicd pipeline due to DEB package creation error for cli by @javuto in #761
• Tool to test osctrl-api by @javuto in #762
• ⚠️ Prepare for release 0.4.9 by @javuto in #763

Full Changelog: v0.4.8...v0.4.9

🔖 Release 0.4.8

What's New

• Pagination and search in Datatables with serverside by @javuto in #723
• Customization of background and branding images by @javuto in #725
• Prevent query to overflow table by @javuto in #726
• Audit log for osctrl-admin by @javuto in #727
• Audit logs in osctrl-api and osctrl-cli by @javuto in #729
• Download distributed query results if > 100 by @javuto in #730
• Fix for left side menus for query results and carves by @javuto in #733
• Dependencies upgrade by @javuto in #735
• Implement deferred Select2 initialization for tag modal by @zhuoyuan-liu in #731
• Enhance pagination and search functionality for nodes in JSON endpoints by @zhuoyuan-liu in #734
• Skip tag creation for UUIDs, localnames and hostname by @javuto in #737
• Ensure go proxy settings to prevent dependencies error by @javuto in #739
• Implement node search functionality with Select2 integration and pagination support by @zhuoyuan-liu in #740
• Make optimized UI the default by @javuto in #741
• Prepare for release 0.4.8 by @javuto in #742

Full Changelog: v0.4.7...v0.4.8