Skip to content

Huntable CTI Studio Versioning System

Huntable CTI Studio uses a combination of semantic versioning and planetary moon names for major releases.

Version Format

Major.Minor.Patch "Moon Name"

  • Major: Significant architectural changes or breaking changes
  • Minor: New features, backward compatible
  • Patch: Bug fixes, backward compatible
  • Moon Name: Named after prominent planetary moons

Current Version

v7.9.0 "Europa" - Current stable release v7.8.1 "Europa" - Previous stable release v7.8.0 "Europa" - Earlier stable release

Planetary Moon Naming System

Major versions are named after prominent planetary moons, honoring discovery, exploration, and planetary science achievements.

Why Planetary Moons?

  • Scientific Theme: Aligns with exploration and discovery in planetary science
  • Systematic: A rich set of well-known moons across the solar system
  • Memorable: Names are recognizable and distinctive
  • Meaningful: Ties releases to milestones in space exploration

Named After

Planetary moons recognized by the International Astronomical Union (IAU), honoring: - Astronomers, scientists, and explorers tied to the parent body - Mythological figures associated with the parent planet - Historic missions and discoveries

Available Planetary Moon Names

Fresh candidates for future major releases (not yet used): Triton, Titan, Enceladus, Phobos, Deimos, Oberon, Titania, Miranda, Ariel, Umbriel, Dione, Rhea, Tethys, Mimas, Hyperion, Iapetus, Phoebe

Used Names

  • Kepler (v4.x)
  • Callisto (v5.0 - v5.3)
  • Ganymede (v5.2)
  • Io (v6.0 - v6.2)
  • Europa (v7.0 - v7.8)

Version History

v7.9.0 "Europa" (2026-09-25)

  • Named After: Europa, one of Jupiter's four Galilean moons; minor release continues the Europa codename
  • Significance: Publisher-authored Sigma rules can now be imported directly from article text with enforceable provenance instead of only being generated, Sigma attack.* tags are validated against a real MITRE ATT&CK taxonomy instead of a character-set check, and per-model reasoning-effort/parameter compatibility becomes catalog-driven rather than a hardcoded name-prefix list. CI checks that were previously advisory became hard merge gates.
  • Features:
    • Publisher-authored Sigma passthrough: a deterministic, LLM-free scanner finds complete Sigma mappings directly in articles.content, preserves exact source YAML, attribution, and license evidence, and enforces fail-closed delivery policy; source rules bypass generation and batch dedup and remain immutable
    • Real MITRE ATT&CK validation for Sigma attack.* tags: unknown, revoked, or deprecated technique/group/software/mitigation/campaign IDs are now validation errors with actionable replacement guidance, backed by a committed config/attack_taxonomy.json (2,535 objects, ATT&CK v19.2)
    • Catalog-driven model parameter compatibility and per-agent reasoning effort: config/model_capabilities.json replaces the hardcoded name-prefix heuristic for supports_temperature/supports_top_p/effort_levels, closing the gap where Anthropic Opus 4.7+/Sonnet 5/Fable 5 silently rejected temperature
    • Eval runs can be launched and polled over MCP; CI checks that were advisory became hard merge gates
    • GitHub PR submission no longer persists PATs in Git remote configuration; backup freshness is now visible in Settings
    • Legacy manual /generate-sigma endpoint and the remaining observables-mode machinery (including its training subsystem and the unreferenced mobile annotation manager) removed
    • Intra-batch Sigma dedup compares matched values instead of condition syntax; out-of-class Sigma rules are re-homed to the group whose logsource they match instead of being dropped; queued Sigma YAML no longer leaks generation_phase
    • WF-CFG-PHANTOM-003 un-quarantined: autosave no longer drops a stored agent_models key whenever its own last-known value was blank
    • Full itemized list in docs/CHANGELOG.md under [7.9.0 "Europa"]

v7.8.1 "Europa" (2026-09-02)

  • Named After: Europa, one of Jupiter's four Galilean moons; patch release continues the Europa codename
  • Significance: The Sigma eval subsystem is removed as measuring the wrong quantity (superseded by Eval1/Eval2 and rule-validity enforcement), Sigma enrichment gains Codex support, and a broad correctness/security/accessibility hardening pass lands across /articles, /workflow, /diags, /sources, /settings, and Junk Filter Tuning, including two stored-XSS fixes and a race-free workflow-config version allocator
  • Features:
    • Sigma eval subsystem decommissioned: it measured resemblance to one analyst's rule set rather than detection quality; removed sigma_eval_scorer.py, sigma_eval_service.py, the /mlops/sigma-evals page, four API endpoints, the SigmaEvaluationTable model, and its eval fixtures
    • Two stored-XSS fixes (article body; dashboard/hunt-metrics/article-detail chunk dialogs) and Subresource Integrity restored on every remaining third-party script
    • Security response headers added, including a two-tier Content Security Policy; stored credentials no longer returned to the browser on Settings
    • agentic_workflow_config.version made unique and race-free via a Postgres sequence, closing a read-modify-write race that had produced 164 duplicate versions
    • PUT /api/workflow/config refuses configs whose enabled extractors have no prompt; Sigma rule validation no longer silently runs the wrong provider
    • /diags Queue Status and Job History attribution fixes; the false "TESSERACT missing" alarm replaced with an honest health signal
    • Keyboard operability restored on the Workflow Configuration tab, Junk Filter Tuning, and /sources filter chips; 30 redundant /api/validate-model requests eliminated from /workflow#config page load
    • Articles no longer silently dropped when re-scraping a known URL; eval scoring no longer grades a no-output extraction as 100% precision
    • Full itemized list in docs/CHANGELOG.md under [7.8.1 "Europa"]

v7.8.0 "Europa" (2026-08-19)

  • Named After: Europa, one of Jupiter's four Galilean moons; minor release continues the Europa codename
  • Significance: Role-specific Docker runtimes with the Docker socket confined to a token-authenticated maintenance service, a subscription-backed Codex workflow provider, Langfuse v4 trace-lookup migration off the endpoint Langfuse Cloud removes on 2026-11-16, and completion of the externalized-config-snapshot hydration across every remaining consumer
  • Features:
    • Role-specific runtime images (web / scheduler / ingest / workflow / semantic / maintenance) replacing the single monolithic image; the web container no longer ships a Docker CLI or socket, and backup/restore is proxied to an internal-only, shared-token maintenance service that allowlists fixed scripts - Docker socket confined to the maintenance service across every Compose stack, with a parametrized contract test failing any stack that mounts it elsewhere
    • Subscription-backed Codex workflow provider (WORKFLOW_CODEX_ENABLED) using a deployment-managed ChatGPT login, plus three gpt-5.6 quickstart presets
    • Langfuse trace lookup migrated from the deprecated GET /traces to GET /v2/observations; client.create_score() corrected for the v4 API; fallback host consolidated to one constant and corrected to the US region; langfuse pinned to 4.14.4
    • Externalized config snapshots hydrated by retry, age-based retention, exclude_evals, and the executions list/detail responses — an eval retry no longer degrades into a seven-extractor run, and the eval corpus keeps its age-purge protection
    • Evals2 item-level scoring restored for structured extractors, with a dry-run-first rescore of historical count-only rows
    • Per-group Sigma generation steered to its own logsource category, cutting rules discarded by the output-side class gate
    • Save-time prompt validation on the workflow config, and Sigma eval rejecting a config with missing enabled-extractor prompts before dispatch
    • Content-addressed workflow execution configuration snapshots with PostgreSQL advisory-lock serialization on config writes
    • 8 dormant/dead DB subsystems removed, plus completion of a 3-month-orphaned source-healing cleanup

v7.7.0 "Europa" (2026-08-06)

  • Named After: Europa, one of Jupiter's four Galilean moons; minor release continues the Europa codename
  • Significance: Three P1 security fixes (crontab command-injection, SSRF, stored DOM-XSS) land alongside a database-integrity audit that reconciled schema drift across 25 of 29 tables, MCP Gateway HTTP transport support, eval diagnosis moved off the server-side LLM call to an MCP + agent-skill-only path, and workflow execution configuration made immutable via content-addressed snapshots
  • Features:
    • Three P1 security fixes: crontab command-injection via PUT /api/cron closed (admin-only), SSRF in /api/scrape-url closed via a shared DNS-pinning fetch helper, and stored DOM-XSS in article annotations closed
    • Schema drift reconciliation: 25 of 29 tables had silently lost primary keys, foreign keys, and indexes because hand-rolled migrate_*.py scripts bypassed SQLAlchemy's create_all() reconciliation; applied 113 DDL statements (16 PKs, 84 indexes, 13 FKs) in production, with a new drift detector now checked at every startup
    • Data retention made real: cleanup_old_data had logged success while deleting nothing; new src/services/data_retention_service.py implements guarded, batched, dry-run-capable age-based retention for source checks, URL-tracking cache, and stale workflow executions
    • Eval diagnosis moved to MCP + agent-skill only, removing the server-side LLM call and its per-click provider billing; replaced by get_eval_diagnosis_context/save_eval_diagnosis MCP tools with fail-closed, caller-attested save confirmation
    • Workflow execution configuration made immutable via content-addressed, SHA-256-hashed snapshots resolved before dispatch, closing the gap where editing a live prompt, model, or threshold changed the behavior of runs already queued or in flight
    • MCP server reachable from Docker MCP Gateway over streamable-HTTP, via a bearer-token-authenticated ASGI wrapper that fails closed without a 32+ character token
    • Sync and async database managers unified on shared SQLAlchemy statement builders (src/database/statements.py), closing three-way query drift across sort order, filters, and a dead CLI search/export path
    • HTML-to-text extraction no longer invents whitespace between inline elements, fixing split process names, file paths, and IOCs produced by mid-token markup
    • escapeHtml consolidated into one canonical implementation in /static/js/utils.js, fixing attribute-context escaping across seven templates that previously carried eight mutually incompatible copies

v7.6.0 "Europa" (2026-07-10)

  • Named After: Europa, one of Jupiter's four Galilean moons; minor release continues the Europa codename
  • Significance: Route-authorization parity fix on GET reads for credential/admin-scoped routes, production trusted-header fail-closed hardening, NetworkIndicatorExtract sibling/boundary doc-sync, MCP ambient context resources, and enterprise-auth Chunk C completion (workflow trigger/retry audit + initiating-actor attribution)
  • Features:
    • SRF-2: SAFE_ROUTE_RULES now mirrors UNSAFE_ROUTE_RULES role gates for /api/settings*, /api/backup/*, /api/model/*, /api/observables/training/*, and /api/sigma-queue/*, closing a gap where any authenticated identity (any role) could read settings/credentials via GET /api/settings
    • SRF-1: production trusted_header mode now aborts startup on an empty AUTH_TRUSTED_PROXY_IPS allowlist unless ALLOW_INSECURE_PRODUCTION_TRUSTED_PROXY_OPEN=true is set; non-literal allowlist entries (*, CIDR ranges) rejected at startup
    • NetworkIndicatorExtract cross-listed as a sibling with reciprocal boundary rules across all six pre-existing extractor contracts; seventh drop-in prompt (docs/contracts/network-indicator-extract-dropin.md) added
    • docs/features/image-ocr-ingest.md feature page documenting the Tesseract ingest pre-pass (SSRF guard, OCR_INGEST_ENABLED, per-source override, ocr_status vocabulary)
    • MCP ambient context resources: huntable://sigma-queue/status, huntable://sigma-queue/recent-rules, huntable://workflow/active-config
    • Enterprise auth Chunk C completion: workflow trigger/retry audit events with initiated_by attribution
    • Risk-tiered MCP write tools (workflow retry/cancel, source toggle, article reviewed marker, annotation CRUD auto-executable; Sigma queue mutations and article deletion require human confirmation)
    • Dead-code cleanup: 8 orphan files + 49 zero-reference symbols removed (-2,203 lines)
    • Domains + Products classification dimensions (Phase D) removed as YAGNI cruft (zero functional consumer)

v7.5.0 "Europa" (2026-06-22)

  • Named After: Europa, one of Jupiter's four Galilean moons; minor release continues the Europa codename
  • Significance: Platform Telemetry Expansion phase one — the agentic workflow is no longer Windows-only. Entity-driven platform classification replaces the embedding OS detector, Linux articles generate reviewable Sigma, and the keyword/platform registry becomes the single scoring source of truth
  • Features:
    • Platform-aware extractor routing: Platform Detection (renamed from OS Detection) returns platform context instead of a hard gate; Windows-only extractors (RegistryExtract/ServicesExtract/ScheduledTasksExtract) are skipped on non-Windows evidence with structured reason records; every observable carries platform + telemetry metadata
    • Entity-driven platform classification: deterministic keyword-registry gate + LLM adjudicator for the low-confidence tail + reinforce-only ATT&CK technique signal; CTI-BERT/SEC-BERT embedding decider retired and its dead config removed end-to-end
    • Linux-aware Sigma generation guidance (additive per-platform prompt block) with per-platform/logsource rule groups and platform badges in the review queue
    • Unified keyword/platform scoring: config/keyword_registry.yaml (591 faceted entries) now derives HUNT_SCORING_KEYWORDS; hunt scoring made platform-complete with macOS/Linux perfect discriminators (perfect 92→114, good 89→94)
    • Server-side image OCR during article ingest (Tesseract, SSRF-guarded, enabled by default via OCR_INGEST_ENABLED=true in docker-compose.yml + per-source override flag)
    • Security dependency bumps: starlette 1.3.1, pydantic-settings 2.14.2, pypdf 6.13.3, langsmith 0.8.18, pip 26.1.2, msgpack 1.2.1

v7.4.1 "Europa" (2026-06-14)

  • Named After: Europa, one of Jupiter's four Galilean moons; patch release continues the Europa codename
  • Significance: Extractor de-laning completed across all six extractors (Complete-Artifact Rule ratified), keyword highlight preservation fixed, fallback surfaces retired
  • Features:
    • CmdlineExtract, ServicesExtract, ScheduledTasksExtract, RegistryExtract, ProcTreeExtract, and HuntQueriesExtract all de-laned from detection-logic source prohibition via fleet-wide Complete-Artifact Rule; each extractor contract updated with era-boundary notes
    • Article keyword highlights survive saved annotation restore; compound LOLBAS executables (e.g. cmd.exe) no longer fragment at overlap boundaries
    • Client-side localStorage secret fallbacks retired for OpenAI/Anthropic/Langfuse/GitHub; SigmaSim UI labels updated to "precomputed atom path" / "on-the-fly atom path"; Extract sub-agent model blanks reworded as inheritance from ExtractAgent; OS Detection LLM fallback display/docstrings removed

v7.4.0 "Europa" (2026-06-11)

  • Named After: Europa, one of Jupiter's four Galilean moons; minor release continues the Europa codename
  • Significance: Sigma dedup engine renamed from "semantic" to "atom" throughout (exact atom set-math, not embeddings); Langfuse trace tags for workflow filtering; Sigma enrich modal active-config indicator; cloud model catalog self-healing
  • Features:
    • sigma recompute-semantics CLI command renamed to sigma recompute-atoms; engine labels updated from "deterministic"/"legacy" to "precomputed"/"on-the-fly"; all seven rename slices are behavior-preserving
    • Langfuse workflow traces now propagate execution_id, article_id, and model tags; sigma_repair_attempts score emitted per trace
    • Sigma enrich modal shows Unsaved config / Preset: <name> - clean / Preset: <name> - modified state; save defaults to in-place update for loaded presets
    • Daily provider-model-catalog refresh fixed (was reading wrong env var for API key); localStorage catalog TTL added (6h); Sigma enrichment modal unified onto shared commercialModelCatalog
    • Sigma dedup Phase 0-5: canonical match schema locked, single ingress serializer, shared normalizeSimilarityData, unified Similar Rule modal, legacy in-app scorer retired

v7.3.1 "Europa" (2026-06-08)

  • Named After: Europa, one of Jupiter's four Galilean moons; patch release continues the Europa codename
  • Significance: Intel Mac (x86_64) compatibility restored; MCP semantic search fixed on all platforms; sigma embed OOM fix
  • Features:
    • torch, accelerate, sentence-transformers excluded via PEP 508 platform markers on macosx_x86_64; embedding_service and os_detection_service torch imports wrapped in try/except guards
    • MCP server now runs inside the Docker cli container so semantic search works on every platform (including Intel Mac where ML deps are absent from the host venv)
    • sigma index-embeddings OOM fix: fetch-encode-commit in chunks (default 64 rules/chunk, SIGMA_EMBED_RULES_PER_CHUNK override); setup.sh detects low Docker memory and passes a conservative chunk size; operation is now resumable after interrupt
    • run_cli.sh / manage_allure.sh detect Docker Compose v2 plugin vs. legacy docker-compose binary; no longer fails on modern Docker Desktop

v7.3.0 "Europa" (2026-06-03)

  • Named After: Europa, one of Jupiter's four Galilean moons; minor release continues the Europa codename
  • Significance: Security patch (pyjwt CVE), Sigma canonical class coverage expansion (+web/DNS/PowerShell/Sysmon/macOS classes), daily customer-repo index Celery task, claude-opus-4-8 added
  • Features:
    • pyjwt pinned to 2.13.0 (PYSEC-2026-175/177/178/179)
    • claude-opus-4-8 registered in catalog and MODEL_CONTEXT_TOKENS (1M context, no beta header required)
    • Speculative GPT-5.2-5.5 entries removed from catalog; re-added in v7.4.0 after live-API confirmation
    • Sigma canonical classes expanded: web.proxy, web.webserver, network.dns, windows.dns_query, windows.ps_script, windows.ps_module, windows.ps_classic_start, windows.process_access, windows.pipe_created, windows.create_remote_thread, windows.driver_load, windows.create_stream_hash, macos.process_creation; brings ~600 previously-classless rules into deterministic candidate pool
    • Daily index_customer_repo Celery beat task (04:30 schedule, Redis-locked); cli service mount added so manual runs work
    • MAE chart flags degraded eval runs in amber (subset runs, throttled/quota-exceeded, failed records)

v7.2.0 "Europa" (2026-05-29)

  • Named After: Europa, one of Jupiter's four Galilean moons; minor release continues the Europa codename established in v7.0.0
  • Significance: Forensic wire-truth observability across every LLM extract call (verbatim provider payload, endpoint URL, post-augmentation token count, and ordered orchestration-injection list now stamped on every last_result); drop-in extractor prompts that let the six extraction contracts run outside the Huntable pipeline; cmdline_attention_preprocessor precision overhaul (11 over-broad anchors removed, 15+ ATT&CK anchors added covering T1218.010 Squiblydoo, T1003.001 credential-access, .NET download cradles, and cmd.exe caret-escape obfuscation, plus 15 narrative-verb FP suppressors); and full removal of the per-extractor QA agent subsystem
  • Features:
    • Drop-in extractor prompts under docs/contracts/*-dropin.md for all six extractors (cmdline, proctree, registry, services, scheduled-tasks, huntquery) — flexible URL/text/PDF input, Markdown-table output by default, single-block copy-button friendly, linked from each contract page via a !!! tip admonition
    • Wire-truth forensic instrumentation: every run_extraction_agent invocation stamps _provider_payload_verbatim, _provider_url, _post_augmentation_prompt_tokens, and _orchestration_injected_sections on last_result; eval bundle llm_request envelope dehydrated via SHA cross-references (~197 KB → ~1.7 KB per bundle)
    • MCP execute_sql and list_tables tools: read-only SELECT-only enforcement (comment-stripping, multi-statement rejection, session-level SET TRANSACTION READ ONLY), 200-row × 300-char/cell cap, 42 unit tests
    • Playwright persistent browser profiles for JS-WAF-gated sources: PlaywrightScraper accepts user_data_dir, ContentFetcher resolves /app/logs/playwright-profiles/<source_identifier> when playwright_profile: true is set — cookies and localStorage (e.g. OVH/nginx JS-challenge tokens) survive between collection runs
    • Sigma novelty canonical-class coverage extended to windows.registry_event (Sysmon 12/13/14 + Security 4657), windows.service (System 7045/7036 + Security 4697), and windows.scheduled_task (Security 4698/4699/4700/4702), with matching FIELD_ALIAS_MAP expansions in sigma_novelty_service.py and atom_extractor.py
    • Hunt score negative-indicator penalty simplified to a single geometric_score(n, 15.0) call, replacing the dual hard-cap-plus-geometric mechanism and matching the documented intent
    • Path-traversal hardening on eval API: strict regex allowlist on subagent_key plus resolve() + prefix guard in _load_static_eval_articles (closes CodeQL path-traversal alert)

v7.1.0 "Europa" (2026-05-22)

  • Named After: Europa, one of Jupiter's four Galilean moons; minor release continues the Europa codename established in v7.0.0
  • Significance: ContentFilter train/serve skew fixed end-to-end (v2/v3 feature extractors, sidecar metadata, dispatch-by-version), retrain quality gate with seed-corpus fallback and staging-promotion, junk-filter early termination wired into LangGraph routing, Sigma queue needs_review for inconclusive novelty, committed .mcp.json for project-aware MCP clients, and a full documentation accuracy pass
  • Features: ContentFilter v2 (19-feature) and v3 (20-feature) extractors aligned with the six ExtractAgent sub-agent contracts, with auto-aligned feature_version via content_filter.pkl.meta.json sidecar; retrain quality gate (recall_huntable >= 0.30, f1_huntable >= 0.30) writing to staging before live promotion; junk filter no_huntable_content short-circuit (new check_should_continue_after_junk_filter routing function) and matching Junk Filtered UI badge; Sigma queue needs_review status with behavioral_matches_found / total_candidates_evaluated evidence columns; canonical summarize_sources() helper for dashboard/sources widget parity; committed .mcp.json + scripts/run_mcp_server.sh launcher; CVE-2026-45134 (langsmith) pin and uv.lock reconciliation; source dedup fix with pg_insert ON CONFLICT (identifier) and UNIQUE constraint; restore scripts standardized on skip_unsupported_sets=True; stale "Version 4.0.0" diags card removed; docs accuracy pass across chunking.md, content-filtering.md, hunt-scoring.md, ml-features.md

v7.0.1 (2026-05-14)

  • Significance: ProcTreeExtract v2.0 contract closing four eval gaps and ProcTree attention preprocessor anchored to structural lineage evidence
  • Features: ProcTreeExtract v2.0 contract (arrow-notation chains, cross-chain dedup, self-referential hop skip, multi-hop json_example, .lnk exclusion) propagated to seed prompts, all 9 Quickstart presets, and docs/contracts/proctree-extract.md; ProcTree attention preprocessor P4/P5 patterns removed (no more bare PID / injection-only false positives); workflow.html extractor prompt validator now accepts plain role-persona strings; relaxed TestWorkflowConfig active-version assertion

v7.0.0 "Europa" (2026-05-12)

  • Named After: Europa, one of Jupiter's four Galilean moons and the sixth-largest moon in the solar system; prime candidate for extraterrestrial life due to its subsurface liquid ocean
  • Significance: Major refactor removing all per-extractor QA sub-agents, full extractor agent v2 contract standard upgrade, SigmaGenerate as a first-class prompt contract, and AI-powered eval bundle diagnosis
  • Features: Per-extractor QA agents removed (CmdlineQA, ProcTreeQA, HuntQueriesQA, RegistryQA, ServicesQA, ScheduledTasksQA); all 6 extractor seed prompts upgraded to v2 contract standard (fail-closed confidence gating, traceability fields); SigmaGenerate prompt contract with per-model-class overlays; ProcTree attention preprocessor (parallel to CmdlineExtract); AI-powered eval diagnosis via EvalDiagnosisService; item-level CmdlineExtract scoring; eval bundle slim mode (~60% token reduction); diagnosis run history; gpt-4.1-nano and o3 added to OpenAI allowlist; admin API key auth removed from all backup/cron/source endpoints; RegistryExtract schema consolidated to single key field

v6.2.1 "Io" (2026-05-02)

  • Named After: Io, innermost of Jupiter's four Galilean moons; most volcanically active body in the solar system
  • Significance: Test suite green-up, source auto-healing feature removal, and eval bulk export coverage
  • Features: all-no-ui suite restored to 0/0 (2949 tests); source auto-healing subsystem moved to feature branch (~7,400 lines removed); eval bulk export test coverage; 11 MkDocs strict-mode warnings resolved; dead test dependencies removed (faker, flake8, pytest-benchmark)

v6.2.0 "Io" (2026-04-30)

  • Named After: Io, innermost of Jupiter's four Galilean moons; most volcanically active body in the solar system
  • Significance: Extraction QA hardening, eval bundle completeness, and CodeQL static analysis cleanup
  • Features: RegistryQA explicit corrections.removed[] schema; eval bundle surfacing; traceability contract tests; exclude_evals filter; Sigma rule preview execution link; warnings key in assess_novelty(); null-guard hardening; 14 CodeQL alert groups resolved

v6.1.1 "Io" (2026-04-28)

  • Named After: Io, innermost of Jupiter's four Galilean moons; most volcanically active body in the solar system
  • Significance: Security hardening patch — two CodeQL alerts closed (ReDoS, stack-trace exposure), Vision LLM API key handling hardened, and browser extension MV3 compatibility fixes
  • Features: Vision LLM proxied through backend; image fetch moved to background service worker (MV3 fix); OCR block append-on-revisit; ReDoS fix; error messages no longer leak internals to HTTP clients

v6.1.0 "Io" (2026-04-27)

  • Named After: Io, innermost of Jupiter's four Galilean moons; most volcanically active body in the solar system
  • Significance: Agentic workflow hardening and infrastructure reliability
  • Features: Infra guard circuit breaker; ContextLengthExceededError fail-fast; workflow executions table sorting and filtering; cmdline attention preprocessor; multi-rule Sigma generation; OS Detection fallback preset fields

v6.0.0 "Io" (2026-04-23)

  • Named After: Io, innermost of Jupiter's four Galilean moons; most volcanically active body in the solar system
  • Significance: Major version introducing the Io codename — browser extension Vision LLM mode, source self-healing, SSRF protection, and large-scale UI overhaul
  • Features: Browser extension Vision LLM extraction mode; source healing trafilatura probe; eval concurrency throttle; GPT-5 family in model catalog; SSRF protection; workflow config v1->v2 migration; extractor contract runtime validators

v5.3.0 "Callisto" (2026-04-14)

  • Named After: Second-largest moon of Jupiter, one of the four Galilean moons
  • Significance: New extraction sub-agents and unified traceability schema
  • Features: ServicesExtract/ServicesQA; unified traceability envelope; cross-field Sigma similarity; Celery fork-safe DB pool fix; RegistryExtract/RegistryQA; release lock/unlock scripts

v5.2.0 "Ganymede" (2026-03-26)

  • Named After: Largest moon in the solar system (Jupiter)
  • Features: Read-only huntable_mcp MCP server; sigma_corpus embedding stats; multi-round source auto-healing; Langfuse from Settings; v3 deep probes

v5.1.0 "Callisto" (2026-03-13)

  • Named After: Second-largest moon of Jupiter, one of the four Galilean moons
  • Significance: Sigma deterministic semantic similarity engine, major test infrastructure overhaul
  • Features: Sigma deterministic precompute; Cron CLI and API; LMStudio made optional; eval articles repo-first; comprehensive test coverage (+38 tests)

v5.0.0 "Callisto" (2026-01-15)

  • Named After: Second-largest moon of Jupiter, one of the four Galilean moons
  • Significance: Represents stability, maturity, and advanced capabilities
  • Features: Stabilized agentic workflow and evaluation datasets, advanced Sigma rule management, AI-assisted editing and enrichment, GitHub repository integration

v4.0.0 "Kepler" (2025-11-04)

  • Named After: Johannes Kepler, known for planetary motion laws

Last updated: 2026-08-22 Last reviewed: 2026-09-01