Changelog

All notable changes to servasec are documented here. Follows Keep a Changelog.

---

[2.0.0] - 2026-07-02

Breaking

• SSC_ADMIN_PASSWORD and CSRF_SECRET are now mandatory in production environment
• GORM AutoMigrate removed; replaced by Goose migrations

Added

• Goose migration system - structured database migrations with version tracking
• Upgrade script - ./scripts/upgrade.sh for version upgrades
• Migration documentation - backend/migrations/MIGRATIONS.md

Fixed

• Dashboard bar chart color

---

[1.0.0] - 2026-07-02

Breaking

• /applications/by-slug/:slug replaced by /groups/:groupPath/applications/:slug

Added

• SARIF parser - universal security report format support
• OpenAPI annotations - API documentation annotations for backend endpoints
• CI/CD ingest methods - better ingest processes for automated pipelines
• Group-scoped ingest - POST /api/groups/{id}/applications/{slug}/ingest

Fixed

• API ingest processes and user API key handling
• Scans and findings page filters rework
• Toast UI revamp

---

[0.3.0] - 2026-06-30

Added

• Audit log - tracks all write operations (Pro)
• Risk scoring - combined severity, EPSS, age, and asset criticality (Pro)
• MCP server - Model Context Protocol with SSE and Streamable HTTP (Pro)
• OAuth 2.0 authorization server - for MCP authentication (Pro)
• License-based feature gating - Pro feature enforcement
• Policies & webhooks frontend - full UI for managing policies and webhooks
• SSO implementation - GitHub, GitLab, OIDC single sign-on
• Podman Quadlet - systemd-integrated container management
• New parsers - Gitleaks, TruffleHog, Trivy, Nuclei (DAST)
• Deduplication - findings deduplicated via dedupe_hash
• Scanner type enable/disable - per-scanner toggle for administrators
• Caddy routing - OAuth, well-known, and MCP traffic routed through Caddy

Fixed

• Bearer token support for CheckPolicy and resource-level access middleware
• Dedup missing appVersion in criteria
• Global dark mode fix
• MCP and middleware security
• Seeder and ingest errors on build
• SSO controller

---

[0.2.0] - 2026-06-30

Changed

• CI workflow fixes and release automation

---

[0.1.0] - 2026-06-24

Changed

• Semantic version release automation

---

[0.0.4] - 2026-06-24

Changed

• Release process fixes

---

[0.0.3] - 2026-06-22

Changed

• Release workflow fixes

---

[0.0.2] - 2026-06-22

Added

• Complete base stack - initial release
  • Scanners: Semgrep, Grype, Snyk, Checkov
  • Findings management - severity, location, description, remediation, comments, assignment, timeline
  • Dashboard - KPIs, severity distribution, top findings
  • Applications & versions - project tracking with version comparison
  • Groups & teams - organizational structure with RBAC
  • API keys - user-level API access
  • Docker Compose - production deployment with Caddy
  • PostgreSQL - database with seeded defaults

---

Version compatibility

servasec	Backend	Database	Migration
2.0.x	Go 1.25 / Gin	PostgreSQL 17	Goose
2.0.x	Go 1.25 / Gin	PostgreSQL 17	Goose
1.0.x	Go 1.24 / Gin	PostgreSQL 17	GORM AutoMigrate
0.x	Go 1.24 / Gin	PostgreSQL 17	GORM AutoMigrate