probo/cmd/probod/CHANGELOG.md

Changelog

All notable changes to probod (the server, including the bundled @probo/console, @probo/trust, and @probo/ui frontends) will be documented in this file.

Unreleased

[0.190.0] - 2026-05-20

Added

• Add a hierarchical risk assessment system with Risk Assessment, Scope, Node (ENTITY / BOUNDARY / ASSET / DATA), Process, Threat, and Risk Scenario entities, and render a Mermaid data-flow diagram per scope (nodes typed by shape, threats attached as dashed edges)
• Add 13 access-review connector providers (with PKCE, token-body extras, and AuthURL templating support in the OAuth2 driver), and wire them through the review engine, the name worker, and the Helm chart
• Add a tracker mapping worker that resolves detected trackers to third parties using initiator domain extraction (eTLD+1), pattern-glob analysis, and a Firecrawl-backed LLM agent fallback for unmapped patterns
• Add a shared common_third_parties / common_third_party_domains catalog with slug-based deduplication, allow a single domain to be associated with multiple third parties, and auto-create entries from OCD imports
• Introduce the proboctl CLI (replaces the standalone common-third-parties-import and common-tracker-patterns-import commands as proboctl seed ...), with data.json embedded in the binary

Changed

• Move the Firecrawl API key from the top-level config into Agents.Tools, hardcode the Firecrawl API endpoint (drop FIRECRAWL_ENDPOINT), and replace the SearXNG search backend with Firecrawl
• Split cookie names on both _ and - separators so cookies like __Secure-1PSID no longer collapse into a bogus ___* heuristic pattern

Fixed

• Filter SCIM-deactivated (INACTIVE) people from signature request recipient lists in both the multi-select dialog and the document signatures page

Removed

• Remove the deprecated snapshot system (the register/document model fully replaces it)
• Remove backend inactive-profile validation that incorrectly rejected newly-created users on first login

[0.189.0] - 2026-05-15

Changed

• Rename vendor to third party across the API surface (GraphQL, MCP), database schema (migration), webhook event types (vendor:* → third_party:*), snapshot type (VENDORS → THIRD_PARTIES), and console / trust URL paths (breaking)
• Log identity_id on every authenticated request (cookie session, API key, OAuth2 access token) so operators can correlate a request back to its user and credential

[0.188.0] - 2026-05-13

Changed

• Derive cookie consent mode dynamically from the visitor's country and applicable regulation at consent-recording time; the consent_mode column is dropped from cookie_banners and persisted on cookie_consent_records instead, defaulting to OPT_OUT when no regulation matches (breaking)
• Capture X-SDK-Version via middleware and include it as sdk_version on all cookie banner request logs
• Use distinct badge colors per resource type and tracker type instead of only highlighting scripts

Fixed

• Eliminate deadlocks when concurrent ReportDetectedTrackers calls update tracker_patterns.last_matched_at by replacing per-row updates with a single bulk update
• Stop generating bare * tracker patterns from separator-less cookie names; such names are kept as individual exact-match patterns for triage

Removed

• Drop the legacy cookies and cookie_patterns tables (superseded by tracker_patterns and detected_trackers)

[0.187.0] - 2026-05-12

Added

• Add a shared common_third_parties reference catalog, seeded from packages/vendors/data.json via a one-shot common-third-parties-import CLI, and back the CreateVendorDialog autocomplete with a new commonThirdParties(name) GraphQL query (server-side ILIKE search) instead of shipping the full vendor JSON bundle to the browser
• Self-host vendor logos in S3: at import time, fetch each site's HTML and pick the best icon (SVG, apple-touch-icon, large PNG, msapplication-TileImage) via the new pkg/webinspect package, then serve through the existing /api/files/v1/{id} endpoint instead of calling Google's favicon service per page load

Changed

• Sanitize MCP error responses so internal details (stack traces, wrapped errors) are no longer leaked to clients

Fixed

• Return a clean not-found error instead of a 500 when a membership lookup misses
• Upgrade mermaid to 11.15.0 to address GHSA-6m6c-36f7-fhxh (Gantt infinite-loop DoS), GHSA-xcj9-5m2h-648r and GHSA-87f9-hvmw-gh4p (CSS injection via classDef/configuration), and GHSA-ghcm-xqfw-q4vr (HTML injection via classDef in state diagrams)

[0.186.1] - 2026-05-12

Fixed

• Fix wrong entity types in tracker_patterns and detected_trackers GIDs: rows carried entity types of removed CookiePatternEntityType / CookieEntityType instead of TrackerPatternEntityType / DetectedTrackerEntityType

[0.186.0] - 2026-05-12

Changed

• Update kit package

[0.185.0] - 2026-05-12

Added

• Add TrackerResource entity for detected scripts, iframes, images, beacons, fonts, fetches, media, and service workers, with full GraphQL, MCP, CLI, and frontend surface (list, view, create, update, delete, move-to-category); new "Resources" page under the cookie banner configuration tab
• Add GLOB match type for tracker patterns supporting prefix, suffix, and sandwich patterns (e.g. ph_phc_*_posthog), with duration-aware merging so trackers with materially different lifetimes are no longer collapsed into a single pattern
• Detect HTTP-header cookies via the Chromium CookieStore change event and expose a new http cookie source
• Add tracker-type filter and color-coded badges on the trackers page for quick visual scanning across Cookie / localStorage / sessionStorage / IndexedDB / Cache Storage
• Capture script initiator URL on detected trackers to enable per-vendor attribution for cookies and storage writes (column captured now, surfaced later)

Changed

• Replace PREFIX tracker pattern match type with GLOB across GraphQL, MCP, and the frontend; existing PREFIX rows are migrated to GLOB with a trailing * (breaking)
• Make tracker pattern displayName read-only across GraphQL, MCP, and the frontend — it is now derived from pattern + match type (breaking)
• Pattern analysis worker now detects UUID-like, hash-like, and long numeric tokens as variable parts even from a single observation, so site-specific identifiers no longer get treated as static text
• Rename the cookie banner "Detection" page to "Trackers" and drop the SCRIPT / IFRAME tracker types (replaced by TrackerResource) (breaking)
• Agent runs now treat ctx cancellation as a graceful suspend signal: supervisor shutdown maps to run ctx cancellation, and the previous WithStopSignal API is removed (breaking for in-process callers)

Fixed

• Fix empty country code being persisted on cookie consent records when IP geolocation returns no matching CIDR block
• Fix SQL corruption (HTTP 500 on /report) in FindMatchingPattern caused by fmt.Sprintf interpreting % characters in the LIKE escape clause
• Use @deleteEdge on the access review campaign delete mutation so the cached connection no longer surfaces a missing-data error when reopening the access reviews tab

[0.184.2] - 2026-05-08

Security

• Upgrade go to 1.26.3

[0.184.1] - 2026-05-08

Changed

• Microsoft 365 access review driver now fetches only internal members from Microsoft Graph ($filter=userType eq 'Member'), so guest (B2B) accounts are no longer pulled into access review
• SCIM settings page now hides the other IdP connector card once a bridge is connected; both remain listed when nothing is configured

Fixed

• Fix cookie banner opt-out button opening the preference panel instead of performing a one-click reject in OPT_OUT regulations

[0.184.0] - 2026-05-07

Added

• Allow editing approvers inline on SOA generated documents from the Statement of Applicability detail page (visible after first publish)

Fixed

• Fix Microsoft 365 SCIM bridge: register the MICROSOFT_365 connector provider, scope each Identity Provider card to its own bridge type so connecting one provider no longer marks others as connected, and filter Microsoft Graph users to home-tenant members (skip B2B guests)
• Fix cookie banner REST config endpoint compatibility for SDK versions ≤ 0.2.0
• Fix geolocation IP-to-country block imports

[0.183.0] - 2026-05-07

Added

• Add IP-to-country geolocation service with shadow-table swap import and CIDR-based lookups
• Detect the visitor's privacy regulation (GDPR, UK GDPR, FADP, CCPA, PIPEDA, LGPD, LFPDPPP, POPIA, PDPA, PIPL, PIPA, APPI, DPDP, PDPL) on the cookie banner config endpoint and adapt the banner UI and texts accordingly (opt-out notice for CCPA, simple notice when no regulation applies)
• Store regulation and country code on cookie consent records and expose both across GraphQL, MCP, CLI, and n8n
• Allow deleting access review campaigns from the UI (DRAFT or CANCELLED only, gated on core:access-review-campaign:delete)
• Support Google Cloud Identity in the SCIM bridge (in addition to Google Workspace)

Changed

• Access review campaigns no longer transition to FAILED when individual sources fail to fetch; the failure stays surfaced on the source fetch (status + last error) and reviewers can proceed on the sources that succeeded (breaking: removed FAILED from AccessReviewCampaignStatus)
• Allow editing metadata (title, document type, classification) on generated document versions; only content edits remain rejected

Fixed

• Fix cookie banner docs link to www.getprobo.com/docs

[0.182.0] - 2026-05-06

Added

• Add Microsoft 365 SCIM bridge and access review driver
• Add unified tracker detection backend with tracker_patterns and detected_trackers schema
• Add trackerType field on patterns to support tracking technologies beyond cookies

Changed

• Replace publishMajor, publishMinor, and requestDocumentVersionApproval mutations with a unified publishDocument and bulkPublishDocuments accepting minor: Boolean! and a required changelog: String! (breaking)
• Rename cookie pattern API surfaces to tracker patterns across GraphQL, MCP, CLI, and n8n (breaking)

Removed

• Remove legacy cookie_patterns GraphQL schema, MCP tools, CLI commands, and n8n operations

Fixed

• Restore MCP cross-origin protection after go-sdk v1.6.0 bump

[0.181.0] - 2026-05-05

Added

• Add SCIM tools to MCP API
• Add SCIM commands to CLI
• Add cookie banner detection page for uncategorised patterns
• Add last_detected_at and last_matched_at tracking on cookie patterns
• Add uncategorisedPatterns GraphQL connection on CookieBanner

Changed

• Accept CIDR ranges in proxy trusted-proxies configuration
• Rename categories to consentCategories on cookie banner API surfaces
• Move cookie management from separate Cookies tab into the Display page
• Filter uncategorised category from cookie banner config and version snapshots

[0.180.0] - 2026-05-04

Fixed

• Use natural sort for SOA document export rows

Added

• Add risk publish to document system

[0.179.1] - 2026-05-02

Fixed

• Fix n8n cookieConsentRecord getAll operation

[0.179.0] - 2026-05-02

Added

• Add cookie banner operations to n8n node
• Add excluded flag to cookie patterns (GraphQL/MCP/CLI/n8n) with source badge in category table
• Validate cookie policy link in banner description

Changed

• Skip draft cookie banner version for uncategorised-only merges
• Exclude uncategorised category from consent contract
• Run cookie detection regardless of banner state
• Stop bumping cookie banner version on no-op updates
• Exclude translations from cookie banner version snapshots
• Allow clearing optional fields in n8n cookie updates
• Bump @probo/cookie-banner to 0.2.0

Fixed

• Clear pending cookie-consent queue before stopping on 404

[0.178.0] - 2026-05-01

Added

• Add MCP tools for cookie banner, category, pattern, version, and consent records
• Add CLI commands for cookie banner, category, pattern, and consent records

Fixed

• Fix auditor access to processing activities
• Fix contract end date field cut off in Add Person dialog

[0.177.1] - 2026-04-30

Fixed

• Reveal cookie banner sidebar entry in IAM organizations
• Render cookie-consent placeholders when no prior consent exists
• Fix cookie-consent placeholder sizing for absolutely or sticky positioned elements
• Allow OIDC and magic-link sessions to assume password-only organizations

[0.177.0] - 2026-04-30

Added

• Add cookie patterns to group detected cookies by URL prefix, with auto-detection worker and console management
• Add DurationInput component to @probo/ui

Changed

• Refactor cookie banner forms to react-hook-form
• Store cookie durations as max_age_seconds
• Update @probo/cookie-banner public exports and bump to 0.1.0

Fixed

• Filter browser-extension cookies from detection

[0.176.1] - 2026-04-29

Fixed

• Fix empty text nodes in generated documents

[0.176.0] - 2026-04-29

Added

• Add vendor publish to document system, replacing snapshot mode

[0.175.0] - 2026-04-29

Added

• Add processing activity, DPIA and TIA publish to document system, replacing snapshot mode

Changed

• Introspect OAuth2 refresh tokens per RFC 7662, honoring token_type_hint
• Invalidate other sessions on password change and all sessions on password reset
• Use forwarded headers for SCIM event client IP when running behind a load balancer
• Extract client IP from rightmost entry of X-Forwarded-For and Forwarded headers
• Update avatar initials colors

[0.174.0] - 2026-04-28

Added

• Add agent run supervisor with checkpoint persistence and resume across restarts
• Add finding and obligation publish to document system, replacing snapshot mode
• Add --state and --contract-ended filters to CLI/MCP/GraphQL user list
• Add Notion workspace name resolver for access review
• Add X-SDK-Version header to cookie banner SDK requests

Changed

• Rename excludeContractEnded to contractEnded (two-way) across MCP, GraphQL, CLI, frontend
• Remove auditor's ability to publish SoA
• Request Google customer directory scope for access-review name sync

Fixed

• Fix copy-paste in rich editor
• Fix long cookie name display and label colors in cookie banner
• Fix suspension checkpoint fallback in nested and parallel agent execution

[0.173.0] - 2026-04-27

Changed

• First per-package release. Prior history is in the archived monorepo CHANGELOG.archive.md.