# Changelog All notable changes to this project will be documented in this file. ## [Unreleased] ## [0.33.1] - 2025-06-13 ### Fixed - Fix localhost enforce at build time ## [0.33.0] - 2025-06-13 ### Added - Add backend fulltext search on controls, documents, risks and measures - Add `totalCount` field in `Connection` object - New console design ### Fixed - Use new enum for data classification ## [0.32.0] - 2025-06-07 ### Changed - Prevent publishing of document versions with no changes - Update AI prompt used for changelog generation ### Added - Add deadline on tasks - Add controls manual create, update, and delete ## [0.31.0] - 2025-06-04 ### Added - Add assets inventory - Add data inventory - Add title and owner id to document versions - Add automatic changelog ## [0.30.1] - 2025-06-02 ### Added - Added sort key `updated_at` for vendors ### Fixed - Fix 5xx on signature request - Fix sort key 5xx ## [0.30.0] - 2025-05-31 ### Changed - Change policies to documents ### Added - Add type to documents ### Fixed - Fix HIPAA import ## [0.29.0] - 2025-05-29 ### Added - HIPAA releated risks - Add framework import from json ### Changed - New add vendor UI ### Fixed - Add url input type for vendor assessement ## [0.28.0] - 2025-05-29 ### Added - Add automatic vendor assessment - Add vendor category fields - Add vendor business associate agreement url and subprocessors list url ### Fixed - Fix 5xx when create new vendor - Fix 5xx when update a vendor ## [0.27.1] - 2025-05-25 ### Fixed - Fix missing `position` field migration ## [0.27.0] - 2025-05-25 ### Changed - Rename severity into risk score - Add contract dates fields - Add people position field ### Fixed - Fix conflict http header fields ### [0.26.0] - 2025-05-20 ### Added - Add docker image security scan - Show latest risk updated date - Log error when GraphQL resolver failed ### Security - Update Golang dependencies - Update to latest Ubuntu LTS - Update to latest Golang version ### [0.25.0] - 2025-05-13 ### Changed - Allow data and text file for evidences ### Fixed - Fix missing people when inviting user already in other organization - Fix cannot upload organization logo ### [0.24.0] - 2025-05-06 ### Added - Task page list ### Changed - Task is now linked to organization ### Fixed - Fix cannot see vendor assessment note ### Security - Add filetype validation for end-user upload ## [0.23.1] - 2025-05-04 ### Fixed - Fix http cache etag - Fix cannot delete measure ## [0.23.0] - 2025-05-04 ### Added - Add ISO 27001 document header - Add policy downlaod ### Changed - Enable HTML support in Markdown renderer ## [0.22.0] - 2025-05-04 ### Added - Show owner of the policy in list - Show number of singatures in the policy list ### Changed - Link evidences to measure ## [0.21.0] - 2025-05-01 ### Changed - Add markdown table support - Explicit risk score calcul ## [0.20.1] - 2025-05-01 ### Changed - New vendors in the built-in lists ## [0.20.0] - 2025-05-01 ### Added - Add end-user confirmation before sending policy sign notification - Add assessed at in the vendor list ### Fixed - Fix not aligned button on policy list view ### Removed - Remove start and end service date of vendor ## [0.19.2] - 2025-05-01 ### Fixed - Fix 5xx when invite user in an organization ## [0.19.1] - 2025-05-01 ### Fixed - Evidence URL not set ## [0.19.0] - 2025-04-30 ### Changed - New vendors in the built-in lists ### Security - Update javascript dependencies - Fix open redirect when the redirect url use `//` ## [0.18.1] - 2025-04-30 ### Fixed Fix typo `mesure` instead of `measure` ## [0.18.0] - 2025-04-30 ### Added - Static files are served using GZip - Static fiels are served with ETag and Cache header fields ### Fixed - Entrypoint JS/CSS has no chunk hash ## [0.17.0] = 2025-04-29 ### Added - Add policy unlogged sign ## [0.16.0] = 2025-04-29 ### Added - Policy history - Policy signature - New vendors in the built-in lists ### Fixed - Fix cannot delete measure with linked risk ## [0.15.1] - 2025-04-27 ### Fixed - Fix SQL syntax error ## [0.15.0] - 2025-04-27 ### Added - Add delete measure in the UI and GraphQL API ### Removed - Remove `importance` field from measure as it's not used anymore ### Fixed - Fix delete evidence from task list does not work - Fix cannot load attached measure risks ## [0.14.0] - 2025-04-24 ### Added - Risk can have note - Cache static assets ## [0.13.2] - 2025-04-24 ### Fixed - Fix psql `generated_gid` returns padded base64 - Fix `user_id` not set when create new organization - Fix `additional_email_addresses` not set when invite in organization ## [0.13.0] - 2025-04-23 ### Added - New "Risk assessments" tab for vendors that allows you to: - View all risk assessments for a vendor in one place - Create new risk assessments with data sensitivity and business impact ratings - Track assessment expiration dates - Automatic people record creation when accepting invitations - New vendors in the built-in lists - Introduced a connector framework enabling integration with external services: - Add OAuth2 connector implementation ### Changed - Completely redesigned vendor list page - Completely redesigned vendor detail page - Improved compliance reports table with better file size formatting and date display - People may be linked to user ## [0.12.0] - 2025-04-20 ### Added - New vendors in the built-in lists ### Changed - Update risk library with new risks ### Security - Upgrade Golang dependencies - Upgrade Node dependencies ## [0.11.1] - 2025-04-15 ### Changed - New vendors in the built-in vendors list ## [0.11.0] - 2025-04-15 ### Added - New vendors in the built-in vendors list ### Changed - More explicit scale, legend and score for risk matrix ## [0.10.1] - 2025-04-14 ### Fixed - Fix grammar for "people" in the navigation bar - Fix editor change cursor position at each keystroke - Fix editor does not display list icon ## [0.10.0] - 2025-04-14 ### Changed - Improve UI of the risk matrix - Rename "Mitigation" in "Mesure" ## [0.9.0] - 2025-04-12 ### Added - Added business owner and security owner fields to vendors ### Changed - Improved vendor detail page with organized sections - Split information into logical sections (Basic Information, Ownership, Risk & Service, Documentation) - Better visual organization of vendor information ## [0.8.0] - 2025-04-12 ### Added - New risk treatment strategy options: Mitigate, Accept, Avoid, Transfer - Risk ownership functionality ## [0.7.0] - 2025-04-12 ### Added - Enhanced risk management with inherent and residual risk assessment capabilities - Added new fields to track both inherent and residual likelihood/impact values - Introduced risk severity calculation as the product of likelihood and impact - Added visual risk matrix to view risk distribution by severity - New risk-policy mapping functionality allowing risks to be linked to policies - New risk-control mapping functionality enabling risks to be linked to controls - Added edit functionality for risks with a new edit page - New popover components for mitigation information on the mitigations list view - Pre-populated risk templates from a JSON data source ### Changed - Update vendors catalog. - Updated risk creation form to include both inherent and residual risk parameters - Improved risk list view with risk matrix visualization - Enhanced breadcrumb navigation for risk detail pages - Refactored risk-mitigation mapping to remove redundant probability/impact fields - Renamed probability field to likelihood for better alignment with risk management terminology ### Fixed - Improved license file formatting in vendors and risks data directories - Fixed URL in attribution text (`getprobo.com` → `www.getprobo.com`) ## [0.6.0] - 2025-04-10 ### Added - Added vendors.json data file under Creative Commons Attribution-ShareAlike 4.0 license` - New vendor data management system with comprehensive vendor information - Pre-populated vendor database with 12 common SaaS vendors and their certifications - Vendor details page with extended fields for improved vendor management: - Legal name and headquarters address - Website URL - Certification tracking with tag-based interface - Links to important vendor documents (SLA, DPA, security pages) - Support for multiple compliance certifications per vendor ### Fixed - Fix cannot create vendor when the name is too similar to suggested one - Fix UI showing double button to close evidence preview modal - Fix cannot delete vendor with compliance reports (added cascade delete constraint) ## [0.5.0] - 2025-04-10 ### Added - Add vendor compliance reports UI - Controls can now be linked to policies, enabling better organization of compliance documentation and clearer traceability between policies and security controls - New UI for viewing and managing policies related to a specific control ## [0.4.2] - 2025-04-09 ### Changed - Simplified policy data model by removing version field and optimistic concurrency - Refactored policy update flow to load-modify-save pattern ### Fixed - Added user-friendly error messages when importing frameworks that already exist ## [0.4.1] - 2025-04-09 ### Changed - Update ISO 27001 and SOC2 framework definition. ## [0.4.0] - 2025-04-09 ### BREAKING CHANGES - **BREAKING:** Renamed GraphQL mutations for control-mitigation mappings: - `createControlMapping` → `createControlMitigationMapping` - `deleteControlMapping` → `deleteControlMitigationMapping` - Input and payload types have been updated accordingly ### Added - Add import control <> mitigation mapping. - Add mitigation tasks import. - Add auto-scroll to opened category. - Added support for mapping controls to policies: - New GraphQL mutations `createControlPolicyMapping` and `deleteControlPolicyMapping` - Controls can now be associated with both mitigations and policies - New bidirectional relationships: - Control objects now expose a `policies` field to list associated policies - Policy objects now expose a `controls` field to list associated controls - Added vendor compliance reports: - New GraphQL types `VendorComplianceReport` and related connection types - New GraphQL mutations `uploadVendorComplianceReport` and `deleteVendorComplianceReport` - New `complianceReports` field on the Vendor type - Support for uploading, viewing, and managing vendor compliance documentation - Added pre-configured frameworks: - Added ISO/IEC 27001:2022 and SOC 2 framework templates - Improved framework import interface with dropdown menu for template selection - Support for one-click import of standard compliance frameworks ### Changed - Evidence can now be requested. ### Fixed - Fix unfoldable mitigation category when open via the URI fragment. - Fix ctrl+click on mitigation does not open new tab. - Fix error handling in framework view when no controls are available. ## [0.3.0] - 2025-04-01 ### Added - Add sidebar to show a task. - Add task estimate edition. - Add control+framework auditor views. - Add import mitigations support. - Add import framework support. - Add risk object management. - Add risk template. - Add mapping between control and risk. ### Changed - Rename control in mitigation. - Home page is now mitigations page. ### Fixed - Fix panic in GraphQL resolver are not reported. - Fix otal trace never started. - Fix React.lazy chunck error. - Fix login page show `unauthorized` error. - Fix cannot delete task with evidences. - Fix cannot download file with non-ASCII filename. ## [0.2.0] - 2025-03-24 ### Added - Add forget password. - Allow evidence to be a link. - Add task import support. - Allow to create vendor when it not exist in the auto-complete. - Add service account people kind. ### Changed - Make task time estimate optional. - Set invitation token to 12 hours. - Order people by fullname. - Order vendor by name. - Allow to edit control state without going to edit page. - Redirect on people list after people creation. - New UI for the framework overview page. ### Fixed - Fix flickering on hover on categories. - Fix control order under a category. - Fix UI does not refresh after importing a framework. - Fix cannot create control. - Fix missing include cookie on confirmation invit. - Fix sign-in does not include cookie. - Fix missing version when create task. - Fix random order on framework overview. - Fix change task state not visible on UI. - Fix control card items alignement. - Fix cannot delete task. - Fix password managers misidentifying token fields as usernames in reset password and invitation confirmation forms. ## [0.1.0] - 2025-03-14 Initial release.