🚀 What’s New
- Audit-Ready XBOM Exports: Software-inventory documents now carry the metadata an audit asks for — root component identity, verified licences with SPDX canonicalisation, artefact checksums, supplier derivation, and complete dependency graphs. Duplicate entries are deduplicated automatically, so what you export is what the auditor sees: a clean, complete inventory.
- In-Product GitLab & Bitbucket Cloud Setup: You can now register GitLab and Bitbucket Cloud OAuth credentials directly from the Plexicus connector page — no reinstall required. The page shows the exact callback URL your application needs, and the connection takes effect within a minute on every replica.
- Forgejo Connector Profile Details: The Forgejo integration page now shows the connected user’s avatar, name, and email — the same profile experience you already get with GitHub.
🛠 Improvements
- AI Usage Cost Attribution: Every AI action — scans, remediations, imports — is now traced to the real user who triggered it, with per-model pricing and a category label (Regular Scan, AI SAST Scan, AI Pentest Scan, Remediation, etc.). Historical usage is backfilled, so your Dashboard ROI view reflects real costs from day one.
- Break-Glass Audit Trail: The SSO-bypass audit events now capture the operator who validated the token, the declared capabilities, and the source IP of the request — giving you a complete, attributable record of every break-glass use.
- Unified Audit Log: All audit entries — logins, 2FA, licence changes, credit packs — now share a single consistent schema, so the audit log renders every event type without error.
- Spanish In-App Notifications: Notification titles and messages are now fully translated and stay current with your selected language, instead of being frozen at the moment the event was written.
- Support Ticket Routing: Tickets submitted through the in-product support modal now create real CRM tickets in HubSpot alongside the existing Mautic funnel, with priority mapping and contact association.
- Contact Sales Funnel: The Contact Sales modal now enrolls leads in a dedicated sales campaign, includes a phone field, and offers trial users a direct path to the Scale plan.
- Findings Navbar Compactness: The Findings category tabs now size to their content instead of stretching across the row, and the subscription banner sits consistently below the Dashboard navbar.
🔒 Security
This release strengthens the platform’s authentication and audit surfaces:
- Rate limiting on authentication endpoints is now enforced with a hardened bypass guard
- Break-glass token validation now records the caller’s source IP for full traceability
- Audit-log write failures are now surfaced to monitoring instead of being silently dropped
🔧 Fixes
- Codex Remedium pull requests no longer delete real code: Creating a pull request from a remediation could silently delete a line of code that the review UI never showed as changed. Both new and previously stored diffs are now corrected, so existing remediations are safe to open PRs from.
- Codex Remedium button feedback: Clicking CreateAIRemediation now shows a loading state immediately, preventing accidental double-clicks. The PullRequest button in the review modal also shows a spinner while in flight.
- Codex Remedium code editor keyboard navigation: The inline diff editor now responds correctly to arrow keys, Page Up/Down, and Home/End — you can navigate the entire editing surface from the keyboard.
- Cleaner remediation failure notifications: When a remediation pull request fails, the in-app notification now shows an actionable reason instead of a raw stack trace.
- GitHub App creation restored for self-hosted installs: The in-product CreateGitHubAppautomatically flow no longer fails on self-hosted deployments, and the App’s permission set is correctly scoped at creation time.
- GitHub connector validity: Self-hosted installs that create a GitHub App through the product now correctly report GitHub as connected after the OAuth round trip.
- AI remediation scheduling on minimum-spec installs: On a self-hosted evaluator VM, Codex Remedium jobs now schedule and run reliably instead of sitting idle until timeout.
- XBOM crypto-asset accuracy: The CBOM pipeline no longer invents key sizes from algorithm names (Ed25519 is no longer 25519-bit), and previously invisible crypto assets are now correctly named and classified in the inventory.
- Assets page duplicate rows: A repository still being scanned no longer renders twice — once as a phantom queued row and once in its real state — on the Assets → Repo Scan page.
- Onboarding flow: New accounts are now kept in the onboarding flow until setup is complete, and the trial banner is compactly placed inside the scroll region.