708 lines
14 KiB
Markdown
708 lines
14 KiB
Markdown
# Changelog
|
|
|
|
All notable changes to this project will be documented in this file.
|
|
|
|
## [Unreleased]
|
|
|
|
## [0.38.1] - 2025-06-03
|
|
|
|
### Fixed
|
|
|
|
- Fix 5xx on document type order
|
|
|
|
## [0.38.0] - 2025-06-03
|
|
|
|
### Added
|
|
|
|
- Allow to change doucment order in the UI
|
|
|
|
### Change
|
|
|
|
- Change default document sorting order
|
|
|
|
## [0.37.5] - 2025-06-30
|
|
|
|
### Fixed
|
|
|
|
- Fix missing risk score on detail risk page
|
|
- Fix matrix risk score color on risk matrix
|
|
|
|
## [0.37.4] - 2025-06-30
|
|
|
|
### Fixed
|
|
|
|
- Fix SOA with risk
|
|
|
|
## [0.37.3] - 2025-06-30
|
|
|
|
### Fixed
|
|
|
|
- Fix missing framework controls
|
|
|
|
## [0.37.2] - 2025-06-30
|
|
|
|
### Changed
|
|
|
|
- Generate excel in memory instead of using fs
|
|
|
|
## [0.37.1] - 2025-06-30
|
|
|
|
### Added
|
|
|
|
- Add updated at and created at order for vendor
|
|
|
|
### Fixed
|
|
|
|
- Fix SOA filename
|
|
|
|
## [0.37.0] - 2025-06-30
|
|
|
|
### Added
|
|
|
|
- Add SOA generator
|
|
- Show last assessment date
|
|
|
|
## [0.36.0] - 2025-06-29
|
|
|
|
### Added
|
|
|
|
- Add URI evidence type
|
|
- Add link dialog for measure evidences
|
|
- Add default security header to API
|
|
- Add support for extra header
|
|
|
|
### Fixed
|
|
|
|
- Fix tasks deadline
|
|
- Fix order people by kind
|
|
- Fix missing people role order
|
|
|
|
### Security
|
|
|
|
- Remove all data after logout
|
|
- Enforce maximum password limit
|
|
- Mitigate timing attack on signin
|
|
|
|
### Changed
|
|
|
|
- Use httplogger on GraphQL error
|
|
- Returns internal error when error is known
|
|
|
|
## [0.35.0] - 2025-06-20
|
|
|
|
### Added
|
|
|
|
- Add forgot password pages
|
|
|
|
## [0.34.0] - 2025-06-17
|
|
|
|
### Added
|
|
|
|
- Pagination for people, vendors, documents, data and assets
|
|
|
|
### Fixed
|
|
|
|
- Fix 404 on email confirmation page
|
|
- Fix 404 on invitation confirmation page
|
|
- Fix login redirection
|
|
- Fix form not reset after submit
|
|
|
|
## [0.33.6] - 2025-06-15
|
|
|
|
### Fixed
|
|
|
|
- Fix filedrop upload too small file size
|
|
|
|
## [0.33.5] - 2025-06-14
|
|
|
|
### Fixed
|
|
|
|
- Fix framework view too many queries
|
|
- Fix image upload failed
|
|
|
|
## [0.33.4] - 2025-06-13
|
|
|
|
- Fix measure count
|
|
|
|
## [0.33.3] - 2025-06-13
|
|
|
|
### Fixed
|
|
|
|
- Fix 5xx on document count for risk
|
|
- Fix leaking pg connections
|
|
|
|
## [0.33.2] - 2025-06-13
|
|
|
|
### Fixed
|
|
|
|
- Fix API path contain undefined
|
|
|
|
## [0.33.1] - 2025-06-13
|
|
|
|
### Fixed
|
|
|
|
- Fix localhost enforce at build time
|
|
|
|
## [0.33.0] - 2025-06-13
|
|
|
|
### Added
|
|
|
|
- Add backend fulltext search on controls, documents, risks and measures
|
|
- Add `totalCount` field in `Connection` object
|
|
- New console design
|
|
|
|
### Fixed
|
|
|
|
- Use new enum for data classification
|
|
|
|
## [0.32.0] - 2025-06-07
|
|
|
|
### Changed
|
|
|
|
- Prevent publishing of document versions with no changes
|
|
- Update AI prompt used for changelog generation
|
|
|
|
### Added
|
|
|
|
- Add deadline on tasks
|
|
- Add controls manual create, update, and delete
|
|
|
|
## [0.31.0] - 2025-06-04
|
|
|
|
### Added
|
|
|
|
- Add assets inventory
|
|
- Add data inventory
|
|
- Add title and owner id to document versions
|
|
- Add automatic changelog
|
|
|
|
## [0.30.1] - 2025-06-02
|
|
|
|
### Added
|
|
|
|
- Added sort key `updated_at` for vendors
|
|
|
|
### Fixed
|
|
|
|
- Fix 5xx on signature request
|
|
- Fix sort key 5xx
|
|
|
|
## [0.30.0] - 2025-05-31
|
|
|
|
### Changed
|
|
|
|
- Change policies to documents
|
|
|
|
### Added
|
|
|
|
- Add type to documents
|
|
|
|
### Fixed
|
|
|
|
- Fix HIPAA import
|
|
|
|
## [0.29.0] - 2025-05-29
|
|
|
|
### Added
|
|
|
|
- HIPAA releated risks
|
|
- Add framework import from json
|
|
|
|
### Changed
|
|
|
|
- New add vendor UI
|
|
|
|
### Fixed
|
|
|
|
- Add url input type for vendor assessement
|
|
|
|
## [0.28.0] - 2025-05-29
|
|
|
|
### Added
|
|
|
|
- Add automatic vendor assessment
|
|
- Add vendor category fields
|
|
- Add vendor business associate agreement url and subprocessors list url
|
|
|
|
### Fixed
|
|
|
|
- Fix 5xx when create new vendor
|
|
- Fix 5xx when update a vendor
|
|
|
|
## [0.27.1] - 2025-05-25
|
|
|
|
### Fixed
|
|
|
|
- Fix missing `position` field migration
|
|
|
|
## [0.27.0] - 2025-05-25
|
|
|
|
### Changed
|
|
|
|
- Rename severity into risk score
|
|
- Add contract dates fields
|
|
- Add people position field
|
|
|
|
### Fixed
|
|
|
|
- Fix conflict http header fields
|
|
|
|
### [0.26.0] - 2025-05-20
|
|
|
|
### Added
|
|
|
|
- Add docker image security scan
|
|
- Show latest risk updated date
|
|
- Log error when GraphQL resolver failed
|
|
|
|
### Security
|
|
|
|
- Update Golang dependencies
|
|
- Update to latest Ubuntu LTS
|
|
- Update to latest Golang version
|
|
|
|
### [0.25.0] - 2025-05-13
|
|
|
|
### Changed
|
|
|
|
- Allow data and text file for evidences
|
|
|
|
### Fixed
|
|
|
|
- Fix missing people when inviting user already in other organization
|
|
- Fix cannot upload organization logo
|
|
|
|
### [0.24.0] - 2025-05-06
|
|
|
|
### Added
|
|
|
|
- Task page list
|
|
|
|
### Changed
|
|
|
|
- Task is now linked to organization
|
|
|
|
### Fixed
|
|
|
|
- Fix cannot see vendor assessment note
|
|
|
|
### Security
|
|
|
|
- Add filetype validation for end-user upload
|
|
|
|
## [0.23.1] - 2025-05-04
|
|
|
|
### Fixed
|
|
|
|
- Fix http cache etag
|
|
- Fix cannot delete measure
|
|
|
|
## [0.23.0] - 2025-05-04
|
|
|
|
### Added
|
|
|
|
- Add ISO 27001 document header
|
|
- Add policy downlaod
|
|
|
|
### Changed
|
|
|
|
- Enable HTML support in Markdown renderer
|
|
|
|
## [0.22.0] - 2025-05-04
|
|
|
|
### Added
|
|
|
|
- Show owner of the policy in list
|
|
- Show number of singatures in the policy list
|
|
|
|
### Changed
|
|
|
|
- Link evidences to measure
|
|
|
|
## [0.21.0] - 2025-05-01
|
|
|
|
### Changed
|
|
|
|
- Add markdown table support
|
|
- Explicit risk score calcul
|
|
|
|
## [0.20.1] - 2025-05-01
|
|
|
|
### Changed
|
|
|
|
- New vendors in the built-in lists
|
|
|
|
## [0.20.0] - 2025-05-01
|
|
|
|
### Added
|
|
|
|
- Add end-user confirmation before sending policy sign notification
|
|
- Add assessed at in the vendor list
|
|
|
|
### Fixed
|
|
|
|
- Fix not aligned button on policy list view
|
|
|
|
### Removed
|
|
|
|
- Remove start and end service date of vendor
|
|
|
|
## [0.19.2] - 2025-05-01
|
|
|
|
### Fixed
|
|
|
|
- Fix 5xx when invite user in an organization
|
|
|
|
## [0.19.1] - 2025-05-01
|
|
|
|
### Fixed
|
|
|
|
- Evidence URL not set
|
|
|
|
## [0.19.0] - 2025-04-30
|
|
|
|
### Changed
|
|
|
|
- New vendors in the built-in lists
|
|
|
|
### Security
|
|
|
|
- Update javascript dependencies
|
|
- Fix open redirect when the redirect url use `//`
|
|
|
|
## [0.18.1] - 2025-04-30
|
|
|
|
### Fixed
|
|
|
|
Fix typo `mesure` instead of `measure`
|
|
|
|
## [0.18.0] - 2025-04-30
|
|
|
|
### Added
|
|
|
|
- Static files are served using GZip
|
|
- Static fiels are served with ETag and Cache header fields
|
|
|
|
### Fixed
|
|
|
|
- Entrypoint JS/CSS has no chunk hash
|
|
|
|
## [0.17.0] = 2025-04-29
|
|
|
|
### Added
|
|
|
|
- Add policy unlogged sign
|
|
|
|
## [0.16.0] = 2025-04-29
|
|
|
|
### Added
|
|
|
|
- Policy history
|
|
- Policy signature
|
|
- New vendors in the built-in lists
|
|
|
|
### Fixed
|
|
|
|
- Fix cannot delete measure with linked risk
|
|
|
|
## [0.15.1] - 2025-04-27
|
|
|
|
### Fixed
|
|
|
|
- Fix SQL syntax error
|
|
|
|
## [0.15.0] - 2025-04-27
|
|
|
|
### Added
|
|
|
|
- Add delete measure in the UI and GraphQL API
|
|
|
|
### Removed
|
|
|
|
- Remove `importance` field from measure as it's not used anymore
|
|
|
|
### Fixed
|
|
|
|
- Fix delete evidence from task list does not work
|
|
- Fix cannot load attached measure risks
|
|
|
|
## [0.14.0] - 2025-04-24
|
|
|
|
### Added
|
|
|
|
- Risk can have note
|
|
- Cache static assets
|
|
|
|
## [0.13.2] - 2025-04-24
|
|
|
|
### Fixed
|
|
|
|
- Fix psql `generated_gid` returns padded base64
|
|
- Fix `user_id` not set when create new organization
|
|
- Fix `additional_email_addresses` not set when invite in organization
|
|
|
|
## [0.13.0] - 2025-04-23
|
|
|
|
### Added
|
|
|
|
- New "Risk assessments" tab for vendors that allows you to:
|
|
- View all risk assessments for a vendor in one place
|
|
- Create new risk assessments with data sensitivity and business impact ratings
|
|
- Track assessment expiration dates
|
|
- Automatic people record creation when accepting invitations
|
|
- New vendors in the built-in lists
|
|
- Introduced a connector framework enabling integration with external
|
|
services:
|
|
- Add OAuth2 connector implementation
|
|
|
|
### Changed
|
|
|
|
- Completely redesigned vendor list page
|
|
- Completely redesigned vendor detail page
|
|
- Improved compliance reports table with better file size formatting and date display
|
|
- People may be linked to user
|
|
|
|
## [0.12.0] - 2025-04-20
|
|
|
|
### Added
|
|
|
|
- New vendors in the built-in lists
|
|
|
|
### Changed
|
|
|
|
- Update risk library with new risks
|
|
|
|
### Security
|
|
|
|
- Upgrade Golang dependencies
|
|
- Upgrade Node dependencies
|
|
|
|
## [0.11.1] - 2025-04-15
|
|
|
|
### Changed
|
|
|
|
- New vendors in the built-in vendors list
|
|
|
|
## [0.11.0] - 2025-04-15
|
|
|
|
### Added
|
|
|
|
- New vendors in the built-in vendors list
|
|
|
|
### Changed
|
|
|
|
- More explicit scale, legend and score for risk matrix
|
|
|
|
## [0.10.1] - 2025-04-14
|
|
|
|
### Fixed
|
|
|
|
- Fix grammar for "people" in the navigation bar
|
|
- Fix editor change cursor position at each keystroke
|
|
- Fix editor does not display list icon
|
|
|
|
## [0.10.0] - 2025-04-14
|
|
|
|
### Changed
|
|
|
|
- Improve UI of the risk matrix
|
|
- Rename "Mitigation" in "Mesure"
|
|
|
|
## [0.9.0] - 2025-04-12
|
|
|
|
### Added
|
|
|
|
- Added business owner and security owner fields to vendors
|
|
|
|
### Changed
|
|
|
|
- Improved vendor detail page with organized sections
|
|
- Split information into logical sections (Basic Information, Ownership, Risk & Service, Documentation)
|
|
- Better visual organization of vendor information
|
|
|
|
## [0.8.0] - 2025-04-12
|
|
|
|
### Added
|
|
|
|
- New risk treatment strategy options: Mitigate, Accept, Avoid, Transfer
|
|
- Risk ownership functionality
|
|
|
|
## [0.7.0] - 2025-04-12
|
|
|
|
### Added
|
|
|
|
- Enhanced risk management with inherent and residual risk assessment capabilities
|
|
- Added new fields to track both inherent and residual likelihood/impact values
|
|
- Introduced risk severity calculation as the product of likelihood and impact
|
|
- Added visual risk matrix to view risk distribution by severity
|
|
- New risk-policy mapping functionality allowing risks to be linked to policies
|
|
- New risk-control mapping functionality enabling risks to be linked to controls
|
|
- Added edit functionality for risks with a new edit page
|
|
- New popover components for mitigation information on the mitigations list view
|
|
- Pre-populated risk templates from a JSON data source
|
|
|
|
### Changed
|
|
|
|
- Update vendors catalog.
|
|
- Updated risk creation form to include both inherent and residual risk parameters
|
|
- Improved risk list view with risk matrix visualization
|
|
- Enhanced breadcrumb navigation for risk detail pages
|
|
- Refactored risk-mitigation mapping to remove redundant probability/impact fields
|
|
- Renamed probability field to likelihood for better alignment with risk management terminology
|
|
|
|
### Fixed
|
|
|
|
- Improved license file formatting in vendors and risks data directories
|
|
- Fixed URL in attribution text (`getprobo.com` → `www.getprobo.com`)
|
|
|
|
## [0.6.0] - 2025-04-10
|
|
|
|
### Added
|
|
|
|
- Added vendors.json data file under Creative Commons Attribution-ShareAlike 4.0 license`
|
|
- New vendor data management system with comprehensive vendor information
|
|
- Pre-populated vendor database with 12 common SaaS vendors and their certifications
|
|
- Vendor details page with extended fields for improved vendor management:
|
|
- Legal name and headquarters address
|
|
- Website URL
|
|
- Certification tracking with tag-based interface
|
|
- Links to important vendor documents (SLA, DPA, security pages)
|
|
- Support for multiple compliance certifications per vendor
|
|
|
|
### Fixed
|
|
|
|
- Fix cannot create vendor when the name is too similar to suggested one
|
|
- Fix UI showing double button to close evidence preview modal
|
|
- Fix cannot delete vendor with compliance reports (added cascade delete constraint)
|
|
|
|
## [0.5.0] - 2025-04-10
|
|
|
|
### Added
|
|
|
|
- Add vendor compliance reports UI
|
|
- Controls can now be linked to policies, enabling better organization of compliance documentation and clearer traceability between policies and security controls
|
|
- New UI for viewing and managing policies related to a specific control
|
|
|
|
## [0.4.2] - 2025-04-09
|
|
|
|
### Changed
|
|
|
|
- Simplified policy data model by removing version field and optimistic concurrency
|
|
- Refactored policy update flow to load-modify-save pattern
|
|
|
|
### Fixed
|
|
|
|
- Added user-friendly error messages when importing frameworks that already exist
|
|
|
|
## [0.4.1] - 2025-04-09
|
|
|
|
### Changed
|
|
|
|
- Update ISO 27001 and SOC2 framework definition.
|
|
|
|
## [0.4.0] - 2025-04-09
|
|
|
|
### BREAKING CHANGES
|
|
|
|
- **BREAKING:** Renamed GraphQL mutations for control-mitigation mappings:
|
|
- `createControlMapping` → `createControlMitigationMapping`
|
|
- `deleteControlMapping` → `deleteControlMitigationMapping`
|
|
- Input and payload types have been updated accordingly
|
|
|
|
### Added
|
|
|
|
- Add import control <> mitigation mapping.
|
|
- Add mitigation tasks import.
|
|
- Add auto-scroll to opened category.
|
|
- Added support for mapping controls to policies:
|
|
- New GraphQL mutations `createControlPolicyMapping` and `deleteControlPolicyMapping`
|
|
- Controls can now be associated with both mitigations and policies
|
|
- New bidirectional relationships:
|
|
- Control objects now expose a `policies` field to list associated policies
|
|
- Policy objects now expose a `controls` field to list associated controls
|
|
- Added vendor compliance reports:
|
|
- New GraphQL types `VendorComplianceReport` and related connection types
|
|
- New GraphQL mutations `uploadVendorComplianceReport` and `deleteVendorComplianceReport`
|
|
- New `complianceReports` field on the Vendor type
|
|
- Support for uploading, viewing, and managing vendor compliance documentation
|
|
- Added pre-configured frameworks:
|
|
- Added ISO/IEC 27001:2022 and SOC 2 framework templates
|
|
- Improved framework import interface with dropdown menu for template selection
|
|
- Support for one-click import of standard compliance frameworks
|
|
|
|
### Changed
|
|
|
|
- Evidence can now be requested.
|
|
|
|
### Fixed
|
|
|
|
- Fix unfoldable mitigation category when open via the URI fragment.
|
|
- Fix ctrl+click on mitigation does not open new tab.
|
|
- Fix error handling in framework view when no controls are available.
|
|
|
|
## [0.3.0] - 2025-04-01
|
|
|
|
### Added
|
|
|
|
- Add sidebar to show a task.
|
|
- Add task estimate edition.
|
|
- Add control+framework auditor views.
|
|
- Add import mitigations support.
|
|
- Add import framework support.
|
|
- Add risk object management.
|
|
- Add risk template.
|
|
- Add mapping between control and risk.
|
|
|
|
### Changed
|
|
|
|
- Rename control in mitigation.
|
|
- Home page is now mitigations page.
|
|
|
|
### Fixed
|
|
|
|
- Fix panic in GraphQL resolver are not reported.
|
|
- Fix otal trace never started.
|
|
- Fix React.lazy chunck error.
|
|
- Fix login page show `unauthorized` error.
|
|
- Fix cannot delete task with evidences.
|
|
- Fix cannot download file with non-ASCII filename.
|
|
|
|
## [0.2.0] - 2025-03-24
|
|
|
|
### Added
|
|
|
|
- Add forget password.
|
|
- Allow evidence to be a link.
|
|
- Add task import support.
|
|
- Allow to create vendor when it not exist in the auto-complete.
|
|
- Add service account people kind.
|
|
|
|
### Changed
|
|
|
|
- Make task time estimate optional.
|
|
- Set invitation token to 12 hours.
|
|
- Order people by fullname.
|
|
- Order vendor by name.
|
|
- Allow to edit control state without going to edit page.
|
|
- Redirect on people list after people creation.
|
|
- New UI for the framework overview page.
|
|
|
|
### Fixed
|
|
|
|
- Fix flickering on hover on categories.
|
|
- Fix control order under a category.
|
|
- Fix UI does not refresh after importing a framework.
|
|
- Fix cannot create control.
|
|
- Fix missing include cookie on confirmation invit.
|
|
- Fix sign-in does not include cookie.
|
|
- Fix missing version when create task.
|
|
- Fix random order on framework overview.
|
|
- Fix change task state not visible on UI.
|
|
- Fix control card items alignement.
|
|
- Fix cannot delete task.
|
|
- Fix password managers misidentifying token fields as usernames in reset password and invitation confirmation forms.
|
|
|
|
## [0.1.0] - 2025-03-14
|
|
|
|
Initial release.
|