# Release notes 0.1.89 to 0.1.99

> Archived release notes, newest first: 0.1.99 (28 September 2026) back to 0.1.89 (22 September 2026).

_Release notes · Updated 2026-10-28 · Describes release 0.1.164_

## 0.1.99 — 28 September 2026 {#0-1-99-28-september-2026}

- **Compliance:** findings can be filtered by source. Missing Defender subscriptions are named; exclusions and older analysis are displayed consistently. Partial fixes require re-analysis and are not reported as verified recovery (`32263a98`, `ccdff382`, `ef1cf910`, `1542ba2c`, `692c2fdf`, `4bb8af5b`, `2c466e05`).
- **Changes:** the execution-plan step cap increases to 16 (`88a2406e`).

## 0.1.98 — 27 September 2026 {#0-1-98-27-september-2026}

- **Security:** runner-token minting requires a workspace seat, a reserved provisioner-token name is protected, SSO bearer validation checks client and domain, and invitations cannot target another organization's SSO account. Network-device read commands are allowlisted, and GCP token caching includes the service-account key (`db90a6eb`, `61c5ddaf`, `1bac7d4f`, `12a78a10`, `10bd399b`, `9e32616a`).
- **Security / platform:** workspace PII patterns are bounded and timed-out patterns fail closed. Password checks and PDF extraction move off the event loop; budgets are checked again after queueing, disabled workspaces cannot start runs, and estate scans enforce tenant run guards (`c8ea7e96`, `150746fd`, `538102d5`, `a8d331ef`, `7fd4b04c`, `fe52093b`, `9e0b2b69`).
- **Changes:** manual rollback verdicts enforce risk tiers; webhook detail alone cannot establish a last-known-good Git restore range (`a5b150e5`, `2c1748b0`, `dbec2b73`).
- **Platform / install:** artifacts gain a portal navigation entry; immutable release tags and chart publication support first customer installs (`2020032f`, `1ee94fee`, `6622323c`).

## 0.1.97 — 26 September 2026 {#0-1-97-26-september-2026}

- **Changes:** every command of a plan made stale by an exclusion is hidden; the portal clarifies the exclusion hint and status (`6710e376`, `ff70b1c2`).

## 0.1.96 — 26 September 2026 {#0-1-96-26-september-2026}

- **Compliance / changes:** typed remediation covers Azure Blob public access. Plans naming excluded resources are refused, partial exclusions trigger re-analysis and only executable plans offer a fix. Scanner findings show source/resources in one table; frameworks become a read-only report (`5df81fe4`, `b95aebc0`, `41e5f076`, `44b07bc0`, `6a827b35`, `6c40889d`, `9d3fe4a3`, `3c9ed0a7`).
- **Incidents:** escalated rows are labeled **Needs attention** and historical change lists use **Last known changes**, without claiming those states were good. Resolved incidents are not marked with a stale plan (`a2dd0399`, `8d2197f2`, `7e7cff97`).
- **Security / install:** Azure writer scope can patch storage; finding-origin execution respects exclusions. Runners receive region and auto-triage settings (`6af2fa77`, `29aa25f0`, `2cb1d015`, `6dfc6b7f`).

## 0.1.95 — 25 September 2026 {#0-1-95-25-september-2026}

- **Compliance:** operators can accept risk on the platform's own control findings and flagged resources. Decisions validate the newest observed exposure, expire, and distinguish accepted risk from a fix that held. Later releases label these decisions **exclusions** (`51c7b91d`, `e8aa22b6`, `36530b36`, `3ea8a2fa`, `534fb015`, `f77909b1`).
- **Knowledge:** a risk-accepted closure does not draft a skill claiming a successful repair (`4a37415d`).
- **Changes / platform:** revert drafts compile their own plan; security groups are keyed by ARN. Test Lab adds a last-known-good lane and strengthens its access, cleanup and scoring checks (`b05c422b`, `1152c24e`, `0f4c35e2`, `e07afbc3`, `7a5557c2`, `84663f18`).
- **Security:** Chaos Mesh updates to 2.7.3 with its control server disabled (`0df729ee`).

## 0.1.94 — 25 September 2026 {#0-1-94-25-september-2026}

- **Compliance / changes:** typed posture operations cover account-wide S3 public-access blocking (S3.1) and IAM password policy (IAM.7). Detective-service controls route as posture; account-setting fixes cannot weaken the estate (`10a2e7e6`, `b33204d3`, `df6e8e8c`).
- **Security:** password-policy fields remain readable through PII scrubbing (`e1eb4627`).

## 0.1.93 — 25 September 2026 {#0-1-93-25-september-2026}

- **Changes:** rollback paths are restored and merge evidence is optional (`4a34c5fa`).
- **Compliance:** Azure reads are scoped; Security Hub coverage is reported per region (`ba11da5b`).
- **Incidents:** change-card and correlation labels more accurately describe their evidence (`27297222`, `f36901b7`).

## 0.1.92 — 22 September 2026 {#0-1-92-22-september-2026}

- **Changes:** Azure network security group execution and rollback edge cases found in resource verification are corrected (`7421b999`).

## 0.1.91 — 22 September 2026 {#0-1-91-22-september-2026}

- **Changes:** dependent services are checked after a change, without letting their result replace the changed resource's verification verdict (`3ddcb4a5`).
- **Compliance / platform:** Test Lab adds a cloud-account compliance lane (`1ebdb852`).

## 0.1.90 — 22 September 2026 {#0-1-90-22-september-2026}

- **Changes:** compiled execution captures pre-change state per step and derives restore information from that evidence (`0ba1a1ed`). Missing or unusable pre-state is recorded honestly; it is not a guarantee that every change has an automatic inverse.

## 0.1.89 — 22 September 2026 {#0-1-89-22-september-2026}

Baseline for this release series (`d1d48e18`).

- **Compliance:** expanded resource coverage, finding suppression and reduced CloudTrail noise (`8452ed21`). Suppression evolved into the resource decision and exclusion workflow described in later entries.
- **Install:** initial dedicated customer-account deployment path and offline licence support (`4dfe7b1f`).


## Next steps

- [All What's new pages](/help/what-s-new/llms.txt)
- [Documentation home](/help/)