Changelog

All notable changes to servasec are documented here. Follows Keep a Changelog.

---

[2.3.0] - 2026-07-17

Added

• Onboarding tour - guided first-run experience for new users
• New parsers - Bandit, Gosec, kube-bench, Kubescape, npm-audit, OSV-Scanner, tfsec
• Soft delete - gorm.DeletedAt added to User, Group, Team models
• Foreign key constraints - proper FK relationships in database schema

Fixed

• Grype detection signature and Bandit CWE handling
• Database transactions, batch insert, file size limits
• Auth, finding, team, webhook, policy controller hardening
• Seeder: removed hardcoded fallback, fatal on missing admin

---

[2.2.0] - 2026-07-07

Changed

• Upgrade process reviewed and improved

Fixed

• Helm chart: Caddy removed; Traefik is now the official ingress controller

---

[2.1.4] - 2026-07-06

Fixed

• Backend JSON security hardening
• Opengrep false positive

Changed

• Final workflow triggers for CI/CD

---

[2.1.3] - 2026-07-06

Changed

• Use custom GitHub App for release workflow

---

[2.1.2] - 2026-07-06

Changed

• Workflow triggers scoped to version tags only

---

[2.1.1] - 2026-07-06

Fixed

• Docker image workflows

---

[2.1.0] - 2026-07-06

Added

• Helm chart - Kubernetes deployment with Traefik ingress (v0.1.0)

Fixed

• SQL unique version index
• Caddy service missing environment variable
• Dead environment variable removed

Changed

• Docker Pro workflow fixes and secret handling
• Security reports CI workflow
• GHCR image publishing

---

[2.0.0] - 2026-07-02

Breaking

• SSC_ADMIN_PASSWORD and CSRF_SECRET are now mandatory in production environment
• GORM AutoMigrate removed; replaced by Goose migrations

Added

• Goose migration system - structured database migrations with version tracking
• Upgrade script - ./scripts/upgrade.sh for version upgrades
• Migration documentation - backend/migrations/MIGRATIONS.md

Fixed

• Dashboard bar chart color

---

[1.0.0] - 2026-07-02

Breaking

• /applications/by-slug/:slug replaced by /groups/:groupPath/applications/:slug

Added

• SARIF parser - universal security report format support
• OpenAPI annotations - API documentation annotations for backend endpoints
• CI/CD ingest methods - better ingest processes for automated pipelines
• Group-scoped ingest - POST /api/groups/{id}/applications/{slug}/ingest

Fixed

• API ingest processes and user API key handling
• Scans and findings page filters rework
• Toast UI revamp

---

[0.3.0] - 2026-06-30

Added

• Audit log - tracks all write operations (Pro)
• Risk scoring - combined severity, EPSS, age, and asset criticality (Pro)
• MCP server - Model Context Protocol with SSE and Streamable HTTP (Pro)
• OAuth 2.0 authorization server - for MCP authentication (Pro)
• License-based feature gating - Pro feature enforcement
• Policies & webhooks frontend - full UI for managing policies and webhooks
• SSO implementation - GitHub, GitLab, OIDC single sign-on
• Podman Quadlet - systemd-integrated container management
• New parsers - Gitleaks, TruffleHog, Trivy, Nuclei (DAST)
• Deduplication - findings deduplicated via dedupe_hash
• Scanner type enable/disable - per-scanner toggle for administrators
• Caddy routing - OAuth, well-known, and MCP traffic routed through Caddy

Fixed

• Bearer token support for CheckPolicy and resource-level access middleware
• Dedup missing appVersion in criteria
• Global dark mode fix
• MCP and middleware security
• Seeder and ingest errors on build
• SSO controller

---

[0.2.0] - 2026-06-30

Changed

• CI workflow fixes and release automation

---

[0.1.0] - 2026-06-24

Changed

• Semantic version release automation

---

[0.0.4] - 2026-06-24

Changed

• Release process fixes

---

[0.0.3] - 2026-06-22

Changed

• Release workflow fixes

---

[0.0.2] - 2026-06-22

Added

• Complete base stack - initial release
  • Scanners: Semgrep, Grype, Snyk, Checkov
  • Findings management - severity, location, description, remediation, comments, assignment, timeline
  • Dashboard - KPIs, severity distribution, top findings
  • Applications & versions - project tracking with version comparison
  • Groups & teams - organizational structure with RBAC
  • API keys - user-level API access
  • Docker Compose - production deployment with Caddy
  • PostgreSQL - database with seeded defaults

---

Version compatibility

servasec	Backend	Database	Migration
2.3.x	Go 1.25 / Gin	PostgreSQL 17	Goose
2.0.x	Go 1.25 / Gin	PostgreSQL 17	Goose
1.0.x	Go 1.24 / Gin	PostgreSQL 17	GORM AutoMigrate
0.x	Go 1.24 / Gin	PostgreSQL 17	GORM AutoMigrate