Release notes

The sixty most recent releases, newest first. A release is cut every two hours when something has merged; feat entries raise the minor version, fix and the rest the patch.

v2.72.0

2026-10-15

• feat DLP-2376: portal release notes from release commits, published by the release job

v2.71.0

2026-10-15

• fix DLP-2256: keep the line break after a line drawn a glyph at a time
• feat DLP-2160: sign in to the console against Active Directory over LDAPS

v2.70.0

2026-10-15

• test DLP-2372: check the agent in and release through a second owner, so the e2e reaches step 20
• test DLP-2372: stop asserting a clean agent exit the run loop cannot yet promise
• fix DLP-2367: show the retention windows that are kept, not one stored under its floor
• feat DLP-2376: documentation portal for docs.dlp.erpona.app
• fix DLP-2365: read ID document labels that carry an Azerbaijani case or possessive ending
• feat DLP-2366: watch the Azerbaijani identity card in the personal identifiers template

v2.69.0

2026-10-15

• feat DLP-2222: record when housekeeping and anchor passes start and finish
• fix DLP-2369: refuse a credential in a change reason or a new policy's top-level description

v2.68.4

2026-10-15

• test DLP-2334: assert the refused value is in no row of the database
• test DLP-2334: refuse to run the free-text suite without pg_dump
• test DLP-2316: choose the kept saved view only once the page lists it
• fix DLP-2265: tell the operator a failed download is offered again, and how often
• test DLP-2316: prove the partial-page reorder rule with eleven policies, not sixty

v2.68.3

2026-10-15

• fix DLP-2304: stop psql | head -1 from reporting a committed write as failed
• docs DLP-2360: record how strikes a requested stop left are released
• test DLP-2361: fail the security gate when the analyst test scopes drift from the fixture
• fix DLP-2306: read a stored retention window back at the write-path floor
• fix DLP-2338: let the previous release write report exports after 0224
• test DLP-2316: give two dashboard tests a 60 s limit the host load was spending
• test DLP-2353: prove the coverage preview answers for the draft it is sent
• test DLP-2334: give the free-text suite's negative checks a positive control
• test DLP-2359: wait for the API against a 180 s wall-clock bound

v2.68.2

2026-10-15

• test DLP-2356: record incidents:mark_test for the three roles that hold it
• test DLP-2357: wait for a slow second start instead of killing it
• fix DLP-2319: a requested stop no longer counts the read it interrupted
• test DLP-2358: copy the security_analyst scopes from the fixture into App.test.tsx
• test DLP-2358: include incidents:mark_test, which the fixture now grants security_analyst

v2.68.1

2026-10-15

• test DLP-2345: record the answers for eight read routes the matrix never asked
• test DLP-2355: write the waiting state in the same statement as the status

v2.68.0

2026-10-15

• test DLP-2287: cover the watch tick that says a refused stick
• feat DLP-2198: link ingest to the explorer and pin the seven-day baseline edges

v2.67.0

2026-10-15

• fix DLP-2349: keep the Activity Explorer details title and destination on their lines
• feat DLP-2244: judge SMTP from the last test email

v2.66.0

2026-10-15

• feat DLP-2337: ask the server what a draft would warn about

v2.65.0

2026-10-15

• feat DLP-2348: rebuild Activity Explorer to the approved design

v2.64.1

2026-10-15

• fix DLP-2268: a stamp with a capitalised qualifier is a marking
• fix DLP-2339: keep a report's N-day window relative when its queue is reopened
• test DLP-2343: write the verification policy and gate its path selection
• ci DLP-2341: a required security gate that needs no server
• docs DLP-2341: describe the security-gate job that CI now runs
• docs DLP-2340: record the verification groups, failure table and owner decisions
• docs DLP-2340: cite the enforcer test that sets the no-decision default
• docs DLP-2340: point the undecided-behaviour item at all six rows
• test DLP-2346: stop the NotFound identity test comparing a value with itself
• docs DLP-2346: describe the cross-tenant check by what it now asserts

v2.64.0

2026-10-15

• feat DLP-2332: name the audit entry that recorded each policy revision
• fix DLP-666: say beside the directory scope that no endpoint can evaluate it
• fix DLP-2336: run the migration lint in CI and record the one applied break it finds
• fix DLP-2297: open a group's seven-day window as a preset, not a fixed instant

v2.63.2

2026-10-15

• test DLP-2327: prove a FIN table is read under its header in every archive shape
• test DLP-2327: check the zipped docx, xlsx and pptx at the twenty-row table
• test DLP-2334: name a changed description and user message by their field
• fix DLP-2265: re-offer a release to a device that reported busy

v2.63.1

2026-10-15

• fix DLP-2327: read every table in a text under its own header
• fix DLP-2335: record the four retention kinds the run row left out
• fix DLP-2334: refuse a credential typed into a policy's free text at save

v2.63.0

2026-10-14

• feat DLP-2328: the Owner manages a detector's sample list on its page

v2.62.0

2026-10-14

• feat(activity): distinguish unmonitored channels
• feat(activity): improve pagination controls
• refactor(activity): share enforcement badges
• fix(activity): complete keyboard accessibility
• Merge remote-tracking branch 'origin/main'
• fix(migrations): sequence activity explorer changes
• fix(activity): use shared download handling
• fix DLP-2163: gate revision links on policies:read, label deployment state
• test DLP-2331: assert the SSO panel's loading, error, denied and saved states
• Merge remote-tracking branch 'origin/main'
• fix DLP-2296: log every kind a retention pass counts
• fix(activity): tolerate agents without capability channels
• Merge remote-tracking branch 'origin/main'

v2.61.1

2026-10-14

• fix DLP-2326: read identity-card MRZ from spreadsheet pipes and HTML attributes
• test DLP-2158: the syslog collector reports a failed list read and an empty list
• fix DLP-2324: only the Owner can set a value aside with a detector's allowlist
• fix DLP-2327: read a docx, xlsx or pptx inside a zip as the document it is
• fix DLP-2325: a shipped rule deleted before 0221 stays deleted at the first start after it

v2.61.0

2026-10-14

• test DLP-2138: assert the named System Health panels render before the inset check
• fix DLP-2162: show the server's licence read and health evaluation times
• fix DLP-2158: drop the saved-collector success line when a test fails
• test DLP-2125: make policy lifecycle suite match the approval and coverage gates
• feat DLP-2162: preflight restore and certificate replacement before any host action
• fix DLP-2320: read xlsx cells whose reference attribute is omitted
• fix DLP-2319: a read the operator's stop interrupted is not a poison strike
• test DLP-2256: a FIN column in a cell-by-cell PDF table is counted, phones are not VÖEN
• fix DLP-2319: release strikes that no stop note backs
• fix DLP-2226: keep a refused in-place install visible and retry it
• fix DLP-2251: read passport MRZ from spreadsheet pipes and HTML attributes
• fix DLP-2318: a shipped activity rule a tenant deleted stays deleted
• fix DLP-2322: report a worksheet cell whose reference names no column
• test DLP-2324: prove only the exact allowlist value sets a sample FIN aside

v2.60.4

2026-10-14

• test DLP-2301: give the queue's time-window test room on a loaded host
• fix DLP-2314: audit coverage is per path, not per handler
• docs: reconcile minifilter decision history
• Merge pull request #40 from asafahmadov/codex/reconcile-minifilter-docs-20261014
• fix(agent): describe live minifilter capability
• Merge pull request #41 from asafahmadov/codex/live-minifilter-capability-copy-20261014
• fix DLP-2158: settings states say why a setting is unavailable
• fix DLP-2305: hold monitor tests' watchers one at a time
• fix DLP-2317: audit the start-up pass that changes shipped activity rules
• fix DLP-2158: say what the on-prem cards do not know, not that nothing is configured

v2.60.3

2026-10-14

• fix DLP-2259: a term alone on its line labels only the value that opens the next line
• fix(api): keep update history in writable state
• Merge pull request #39 from asafahmadov/codex/agent-package-store-20261014

v2.60.2

2026-10-14

• fix DLP-2295: read no binary PDF stream as page text

v2.60.1

2026-10-14

• fix(api): audit failed email delivery tests
• Merge pull request #37 from asafahmadov/codex/audit-coverage-20261014
• fix(agent): keep pending decrement lint-clean on MSRV
• Merge pull request #38 from asafahmadov/codex/atomic-msrv-20261014

v2.60.0

2026-10-14

• fix(copy): remove garbled spacing from user messages
• Merge pull request #35 from asafahmadov/codex/prose-spacing-20261014
• fix DLP-2308: name the FltLib and Kernel32 import libraries in lower case
• feat DLP-2179: scope the System Health KPIs to what the reader may see
• fix DLP-2179: keep Endpoint coverage a link for readers who may not open the inventory
• fix DLP-2179: make the health tables' scroll regions reachable by keyboard
• fix(api): make forbidden responses complete the permission sentence
• Merge pull request #36 from asafahmadov/codex/forbidden-copy-20261014
• fix DLP-2309: link the Windows agent in the lint gate, as the release does
• fix DLP-2310: give four suites their own default ports
• docs DLP-2312: document the backup_run step-up in the confirmation table
• fix DLP-2313: clear the clippy errors that stop the management API's lint gate
• fix DLP-2311: read route modules and audit helpers in the audit check

v2.59.0

2026-10-14

• feat DLP-2294: read objects embedded in a TNEF message's RTF body
• fix DLP-2258: a blank cell between two tabs is a column, not nothing
• fix DLP-2293: read a plain-text TNEF body held only in MAPI properties
• fix DLP-2138: wrap System Health panel bodies in the card inset
• Merge origin/main into Windows minifilter and security review work
• Merge pull request #21 from asafahmadov/codex/windows-minifilter-b1-b2-20261009
• feat DLP-2287: decide the notice a person gets when Windows refuses a removable write
• fix DLP-2298: the Windows cross-check compiles again
• fix(dashboard): stabilize merged UI tests
• ci(security): distinguish synthetic secret fixtures
• Merge pull request #24 from asafahmadov/codex/post-merge-ci-fixes-20261014
• test(agent): align CPU ceiling with sysinfo
• Merge pull request #25 from asafahmadov/codex/ci-cpu-sampling-20261014
• ci(licences): admit bundled IBM Plex font
• Merge pull request #26 from asafahmadov/codex/font-license-notices-20261014
• ci(windows): document pinned action versions
• Merge pull request #27 from asafahmadov/codex/windows-action-pin-comments-20261014
• docs: repair paths after incident module split
• Merge pull request #28 from asafahmadov/codex/doc-paths-after-merge-20261014
• ci(security): decouple clean scans from artifact quota
• Merge pull request #29 from asafahmadov/codex/gitleaks-artifact-quota-20261014
• feat DLP-2287: tell the person when policy refuses removable writes as a device appears
• feat DLP-2084: keep which template a report came from, and ask before saving it twice
• fix DLP-2084: bind the template id column's placeholder in the report insert
• fix DLP-2303: renumber the unreleased policy migration to 0214
• fix DLP-2303: renumber six unreleased migrations off numbers a release already uses
• fix DLP-2303: refuse a migration directory where two files share a number
• fix DLP-2304: stop a head-piped psql helper from reporting a committed write as failed
• test DLP-2307: scope the badge count to the Main navigation
• test(detectors): align FIN suppression with validation floor
• Merge pull request #30 from asafahmadov/codex/fin-suppression-test-20261014
• fix(security): update ruzstd past RUSTSEC-2026-0344
• Merge pull request #31 from asafahmadov/codex/ruzstd-rustsec-20261014
• ci: run signing key expiry regression
• Merge pull request #32 from asafahmadov/codex/signing-key-expiry-ci-20261014
• docs(licenses): refresh notice for ruzstd 0.9.1
• Merge pull request #33 from asafahmadov/codex/ruzstd-notice-20261014
• ci: retain browser reports only on failure
• Merge pull request #34 from asafahmadov/codex/browser-artifact-quota-20261014

v2.58.0

2026-10-13

• fix DLP-2291: delete expired events by id, not ctid
• fix DLP-2290: sum every retention counter in enforce_all
• feat DLP-2253: read a TNEF message body held only as compressed RTF
• feat DLP-2254: read TNEF attachment data held in MAPI properties
• fix DLP-2292: key retention and housekeeping deletes on primary keys, not ctid
• test DLP-2289: cover the recorder heartbeat and the history stop it raises

v2.57.0

2026-10-13

• fix DLP-2233: let the health overview's theme tokens paint the dark page
• fix DLP-2180: name the endpoint table as a keyboard-reachable region
• fix DLP-2255: count a TNEF attachment as mail
• fix DLP-2233: keep the health route's other states on the page surface
• fix DLP-2247: report the health-event recorder when it stops
• feat DLP-2246: prune resolved health history after 90 days

v2.56.0

2026-10-13

• fix DLP-2288: a placeholder AWS key id of three or four distinct characters is not a secret
• feat DLP-2274: read LZX folders in a cabinet
• fix DLP-2248: read a workbook's print header and footer
• fix DLP-2249: read a Word watermark's text
• fix DLP-2250: read a slide master's and layout's text boxes
• fix DLP-2268: an HTML footer's classification stamp is a marking

v2.55.0

2026-10-13

• fix DLP-2282: a negative word on another line no longer drops a labelled VÖEN
• docs DLP-2283: decide the Windows enforcement path for Azerbaijani identifiers
• fix DLP-2268: a classification label with a title-case marking is a banner
• feat DLP-2286: ship a template for Windows' removable-write policy
• feat DLP-2269: detect the Azerbaijani ID card serial and passport number beside a label
• fix DLP-2267: a VÖEN label does not support a number labelled otherwise
• fix DLP-2261: a placeholder AWS key id and a masked connection password are not secrets

v2.54.0

2026-10-13

• fix DLP-2282: a negative term on another line no longer drops a labelled FIN
• fix DLP-2266: Cyrillic FIN and VÖEN labels, and Latin long names, support az.fin and az.voen
• test DLP-2282: name the test marker case for what it now asserts
• test DLP-2285: a kerned card above an IBAN is found on its joined copy
• fix DLP-2279: let the audit chain check cover the whole chain, not its first 20,000 entries
• fix DLP-2284: a multi-word term matches with each word capitalised
• feat DLP-2281: measure how long deferred classification choices take to write

v2.53.0

2026-10-13

• fix DLP-2137: do not space a kerned card number in the joined reading
• fix DLP-2280: hold a refused audit chain verdict in memory until it can be written
• feat DLP-2201: give Health its own read and manage permissions
• docs DLP-2201: the privacy register and the Health backlog name health:read

v2.52.0

2026-10-13

• feat DLP-2200: show the endpoints' classification queue on the Health page

v2.51.0

2026-10-13

• test DLP-2257: a FIN column supports every row in a slide, sheet and ODS table
• fix DLP-2275: stop the continuity banner calling accepted loss still missing
• feat DLP-2197: let an Owner download a redacted Health support bundle
• feat DLP-2199: verify each tenant's audit chain on a schedule and show the result
• docs DLP-2276: give sequence gaps and their acceptance reasons a privacy row

v2.50.0

2026-10-13

• feat DLP-2194: let an administrator accept a sequence gap's loss, with a reason
• fix DLP-2257: tab-separate table cells in Office and RTF text
• feat DLP-2195: group sequence gaps by endpoint and page them by cursor
• fix DLP-2256: read PDF table rows and cells as lines and tabs
• test DLP-2277: an MRZ printed to PDF by Chromium, and an ID card inside a docx

v2.49.0

2026-10-13

• fix DLP-2263: count Activity Explorer events with formatCount and use a hyphen for empty cells
• feat DLP-2230: read CAB archives whose folders are MSZIP or stored

v2.48.0

2026-10-13

• feat DLP-2193: let an Owner choose and test health alert rules
• fix DLP-2251: find a passport or ID-card zone however its lines are separated
• test DLP-2251: a passport's lines drawn as PDF text runs are found

v2.47.0

2026-10-12

• feat DLP-2190: keep health issues as events from first reading to recovery
• fix DLP-2252: record the activity-events route in the access matrix
• feat DLP-2229: read Outlook winmail.dat (TNEF) body and attachments
• fix DLP-2245: read a workbook's cells in their columns so a FIN header outside column A labels its value
• docs DLP-2245: name the workbook tests that prove cells are read in their columns
• feat DLP-2191: show health event history with filters and owner triage
• feat DLP-2192: notify a chosen channel when a health fault stays open
• fix DLP-2227: an endpoint is sent the release its manifest declares, at that digest

v2.46.0

2026-10-12

• fix DLP-2228: read the end of extracted text, not only its head
• fix DLP-2233: paint the system health overview from theme tokens
• feat DLP-2181: add Activity Explorer and align navigation
• fix DLP-2243: refuse a tenant lookup that cannot be made, so saturated components takes one budget

v2.45.0

2026-10-12

• fix DLP-2180: show the refresh interval's value in the dark theme
• feat DLP-2221: report a correlation worker that has stopped finishing passes
• feat DLP-2187: judge licence and certificate expiry in the health components
• feat DLP-2188: judge external connections from what was recorded
• ci DLP-2188: run the connections integration suite in CI
• fix DLP-2231: make the backup page test assert the copy that renders
• test DLP-2189: prove the Health page judges backup and standby from the snapshot

v2.44.0

2026-10-12

• fix DLP-2220: bound the wait for a pooled connection before identity is read
• feat DLP-2180: refresh system health on a chosen interval and say when its data is stale

v2.43.0

2026-10-12

• feat DLP-2185: show every endpoint's drift and interruption history in the fleet list
• docs DLP-2225: accept the settle-second deletion gap and track the NTFS journal gap
• feat DLP-2186: let an agent report its own service, driver and tamper observations
• feat DLP-2196: let the fleet list ask an endpoint to re-sync or send diagnostics
• fix DLP-2218: record the answer for the routes the permission matrix asked about
• fix DLP-2220: a database that never frees a pooled connection is unavailable, not an internal error
• perf DLP-2224: reuse one syslog connection per delivery pass
• feat DLP-2162: queue operator-run on-prem backups
• fix DLP-2162: keep manual backup queue portable

v2.42.0

2026-10-12

• feat DLP-2182: keep resource samples and read them back as bounded history
• test DLP-2182: count the eight-day insert where it happens
• feat DLP-2183: show platform parts and resource trends on the health page
• docs DLP-2208: measure one destination's drain rate against a slow collector
• chore DLP-2224: refresh the register's absent-key file
• feat DLP-2184: list every endpoint with its state and its problems in one page list
• ci DLP-2184: run the fleet walk's timing gate in its own step

v2.41.0

2026-10-12

• feat: observe on-prem standby streams in System Health

v2.40.0

2026-10-12

• test DLP-2181: show what the health endpoints do when the pool is saturated
• feat DLP-2207: forward audit events to a CEF collector
• test DLP-2223: list the backup freshness endpoint as open to every role
• test DLP-2219: assert the queue's Export gate without the App shell

v2.39.0

2026-10-12

• fix DLP-2214: keep the SIEM event switches read-only until the saved collector is loaded
• test DLP-2215: give the Export CSV link assertion its own wait under CPU contention
• feat DLP-2181: report each part of the platform as its own verdict
• feat: surface on-prem backup freshness in System Health

v2.38.0

2026-10-12

• fix DLP-2213: give the archive-unavailable case an unconfigured archive
• feat(health): compare event ingest with tenant baseline

v2.37.1

2026-10-12

• fix DLP-2211: make the console's copy and route tests match the code
• fix DLP-2209: drop the health input no rule reads
• ci DLP-2210: run the service-account suite in the test job
• fix DLP-2212: word the service-credential refusal as a clause that completes it

v2.37.0

2026-10-12

• feat DLP-2205: forward selected audit events to a syslog SIEM
• test DLP-2205: wait for the saved event checkboxes before asserting them
• feat(settings): download observed public TLS certificate

v2.36.0

2026-10-12

• feat DLP-2177: read each organisation's silence cutoff on every count
• test DLP-2177: prove the silence cutoff in real browsers
• fix(settings): bring service account credentials closer to reference

v2.35.3

2026-10-12

• fix(settings): align on-prem backup panel with reference layout

v2.35.2

2026-10-12

• fix DLP-2178: unify server health issues

v2.35.1

2026-10-12

• ops: publish public console certificate after renewal
• DLP-2161 improve settings responsive navigation UX
• fix DLP-2167: read standard-14 PDF fonts with no map through WinAnsi
• fix: stage SIEM forwarding changes until save

v2.35.0

2026-10-12

• feat DLP-2177: let each organisation set when silence is listed and alerted
• feat: expose public TLS certificate inventory in Settings

v2.34.0

2026-10-12

• fix DLP-2204: report image-only PDF pages
• fix DLP-2204: clear two clippy warnings in the PDF page walk
• feat DLP-2156: make the Settings rail the only Settings navigation
• feat DLP-2161: say what a settings save changes and when it applies
• feat DLP-2162: show when on-prem maintenance readings were last taken
• feat: add read-only service accounts with isolated credentials
• fix: align Settings shell with API Access reference
• fix: use console-standard punctuation in service accounts

v2.33.0

2026-10-12

• feat(settings): align system health shell with supplied design

v2.32.1

2026-10-12

• fix DLP-2176: unify endpoint state counts
• Merge pull request #23 from asafahmadov/codex/dlp-2176-health-counts-20261012

v2.32.0

2026-10-12

• fix DLP-2170: carry the encrypted flag through mail, embedded and archive-only nesting
• fix DLP-2147: read a Spring datasource password as a database credential
• test DLP-2142: an IBAN split into spans by spaces is found, not only a card
• fix DLP-2168: read RTF 'xx bytes in the code page the document names
• test DLP-2165: the wall-clock ceilings in detector_budget run only in the timing step
• test DLP-2202: a test marker on the line above sets a FIN label aside by design
• fix DLP-2171: name a refused entry by the chain of archives it was found in
• ci: run the live browser session suite, which no CI step named
• fix DLP-2154: a symbol escape in RTF is what it stands for, not the bare symbol
• feat(settings): build system health target overview from live signals

v2.31.0

2026-10-11

• fix DLP-2143: decode HTML 4 named references, so a label written with Ö reads as Ö
• fix DLP-2145: name a password-protected zip entry by its path and mark the file encrypted
• docs: map System Health audit to actionable backlog
• fix DLP-2139: a scanned PDF is not read in full because its metadata has text
• fix DLP-2144: read a table cell's label as the text beside its value
• feat(settings): configure signed endpoint update rollout

v2.30.0

2026-10-11

• docs: link Settings UX findings to MyDLP tickets
• docs: ground Settings UX review in accessibility and findability guidance
• fix DLP-2134: a glyph placed at its own text matrix joins the line
• fix DLP-2150: a GitHub fine-grained token is reported as a GitHub token
• fix DLP-2146: read a brace-quoted ADO.NET password as a connection string
• fix DLP-2137: read a word that a PDF splits by kerning or a move as one word
• fix DLP-2149: find title-case two-part markings and the Azerbaijani konfidensial
• fix DLP-2142: read a card whose digit groups are split by a space and an inline element
• feat: show live console sessions in Settings