Release Notes

2026-08-28

backend v0.1382.0 / frontend v0.930.0

New features

• Remediation now checks that an endpoint’s agent is online before it dispatches work. A target on an offline endpoint reports “Endpoint Offline” right away and re-runs automatically once the agent checks back in. It previously sat in “Validating…” for up to an hour before timing out.

Improvements

• Asset correlation now requires a minimum confidence before it merges two records into one identity, so a weak match no longer collapses distinct assets together.

Bug fixes

• Targets: macOS software names no longer carry a .app or .pkg suffix, so the same application no longer appears under two names.
• Endpoints: recovery for an endpoint whose data collection has stalled now runs. Every attempt previously failed, leaving the endpoint stalled indefinitely.
• Integrations: a Rapid7 sync now handles incomplete solution data instead of failing the sync.
• Integrations: creating a ticket through a ticketing provider that has no project concept now succeeds.

2026-08-27

backend v0.1371.0 / frontend v0.928.0

New features

• Endpoints: an endpoint that no source reports any more is now labelled as such in the Source column. It previously showed an em dash for the day or more before retirement, which read as missing data rather than a lifecycle state.

Improvements

• Findings and Endpoints: the endpoint filter dropdowns now search as you type instead of loading the whole fleet up front. On a large fleet this was the slowest part of the Findings page load.
• Strategies and Settings: dates on these pages now display in a consistent format, and date columns can be filtered by range.
• Findings: On large fleets, findings and targets settle noticeably sooner after new scan data lands.

Bug fixes

• Integrations: a Vanta sync now refreshes its access token when it rotates, instead of failing with an authorization error until the integration was reconnected.
• Targets: invalid software catalog entries and their corresponding remediation targets have been removed.
• Remediations: deployment output display was cleaned up.

2026-08-26

backend v0.1356.0 / frontend v0.921.0

Improvements

• Software calculation: software records orphaned by a large integration refresh are now retired in one pass instead of across many sync cycles, so a large refresh settles sooner.
• Knowledge graph: an asset with no hostname is now labelled by its computer name or serial number instead of rendering without a title.

Bug fixes

• Sign-in: starting sign-in from your identity provider now signs you in. First-time users were previously stranded on the sign-in form.
• Integrations: an Apple Business Manager device whose detail lookup fails is now imported with the data Apple did return. Previously one failing device blocked the whole sync, so no Apple data landed.
• Integrations: Apple Business Manager MAC addresses are now stored lowercase and colon-separated like every other source, so a fleet no longer shows two formats.
• Integrations: Apple Business Manager’s friendly device name is now recorded as the computer name rather than the hostname, so it no longer takes part in hostname matching.

2026-08-24

backend v0.1349.0 / frontend v0.918.0

Improvements

• Endpoint correlation, asset retirement, and the datasource refresh pipeline are significantly faster, so integration syncs finish sooner.
• Targets: the columns dropdown is now sorted alphabetically.

Bug fixes

• Endpoints: machines that share a generic hostname are no longer merged into one endpoint. An asset whose hardware UUID or cloud instance ID proves it is a different machine now correlates to its own endpoint. Accounts affected by this, most commonly by the default EC2AMAZ- name on un-sysprepped Windows instances in AWS, will see those assets separate onto their own endpoints on the next refresh.
• Integrations: a Qualys asset that reports no serial number no longer records an empty one.
• Integrations: a transient enrichment failure during a sync now fails only the page it occurred on, leaving the asset’s identity data intact.
• Forge: a session interrupted mid-run resumes with the inputs it started with instead of re-deriving them.

2026-08-23

backend v0.1340.0 / frontend v0.917.0

Bug fixes

• Endpoints: sorting the table by MAC address now orders addresses correctly.
• Integrations: refreshing a datasource that is already refreshing no longer starts a second run alongside the first.
• Integrations: a refresh cut short by a service restart is now closed out in the datasource’s execution history, instead of sitting there as running with no results.

2026-08-22

backend v0.1336.0 / frontend v0.916.0

Improvements

• Scans and data refresh are substantially faster. Software calculation and the refresh pipeline now run sharded and incremental, skipping work for assets that have not changed, so new findings surface sooner after an integration syncs.
• Endpoints: an enrolled agent keeps its endpoint’s OS version current from live telemetry rather than only at enrollment.
• Integrations: Rapid7 InsightVM and Qualys imports are faster and no longer risk truncating a large asset or detection set.
• Findings: CVE details, CVSS scores, exploit maturity, and CISA Known Exploited Vulnerability status are now served from Furl’s own daily copy of the vulnerability data rather than looked up per request, so enrichment is faster and keeps working through an upstream vendor outage.
• Deploys and restarts now drain in-flight work before shutting down, so a release no longer interrupts a scan or an integration sync in progress.

Bug fixes

• A vendor that returns an incomplete response no longer causes assets to be marked absent and removed. An asset must be missing from two consecutive refreshes before it is retired.
• Integration syncs no longer stall or fail partway through a large paged import.
• Findings now pick up corrections to CVE data reliably, instead of occasionally missing a change.
• Findings that missed a scoring pass are now reconciled on the next cycle rather than staying stale, and that reconciliation now completes quickly on large accounts instead of running for hours.
• Forge: opening a session that has been deleted returns a clear not-found result instead of hanging.
• Software and vulnerability calculation now completes on accounts with very large finding backlogs. It previously ran out of memory and failed the pass on backlogs in the millions.
• Integrations: adding a datasource no longer fails when one of its checkbox settings is left unchecked.

2026-08-19

backend v0.1296.0 / frontend v0.915.0

Improvements

• Endpoints: when two candidate endpoints match an asset equally well, correlation now attaches it to the one backed by an enrolled agent, so third-party asset data lands on the machine Furl can actually remediate.
• Endpoints: CrowdStrike device MAC addresses now carry onto the asset record, giving correlation another signal to match on.
• Findings: the +N source badge on a finding’s source list renders as a circle, matching the individual source badges beside it.

Bug fixes

• Endpoints: assets with no hostname, serial number, or MAC address no longer collapse into one shared endpoint. They stay uncorrelated until they carry an identifying signal.
• Endpoints: hostnames that differ only in capitalization now resolve to a single endpoint instead of separate case-variant records.
• Deleting an endpoint now unenrolls its agent instead of leaving it enrolled against a removed endpoint.

2026-08-18

backend v0.1287.0

Bug fixes

• Fixed a database maintenance regression from the earlier deploy today that could cause intermittently slow page loads.

2026-08-18

backend v0.1286.0 / frontend v0.914.0

New features

• Integrations: Apple Business Manager. Connect with an API account to import your Apple device inventory and Managed Apple Account directory, with each device attributed to the person enrolled on it. It can also serve as the primary source of people in your organization.

Improvements

• Targets: approving a software recognition rule now replays the findings that prompted it, so newly recognized software becomes remediable without waiting for the next scan.
• Findings: CVE affected-version data refreshes daily, so upstream corrections to version ranges reach your findings within a day instead of a month.

Bug fixes

• Dashboard: newly created organizations show the real count of known CVEs instead of zero.
• Findings: source badge logos are cropped to the badge circle rather than overflowing it.

2026-08-17

backend v0.1279.0 / frontend v0.913.0

New features

• Remediation: strategies now prefer the package manager that owns the installed software, so Chocolatey-managed installs on Windows are remediated through Chocolatey rather than a generic installer.

Improvements

• Endpoints: Chocolatey detection on Windows is more reliable — it keys off the presence of choco.exe and resolves non-standard install roots from the registry, improving software inventory accuracy.

Bug fixes

• Targets: endpoints reported only by integrations, without agent inventory, are now included in reconciliation, so their targets stay current and close when resolved.
• Findings: findings are never created with a blank title.

2026-08-15

backend v0.1269.0 / frontend v0.912.0

New features

• Settings: a new organization setting turns off desktop notifications on endpoints. Pending approvals stay visible and actionable in the portal.
• Scopes: remediation now honors blackout windows. Work scheduled inside a blackout is held rather than run, and each held item shows the reason it was blocked. Blackout times follow the time zone stated in Settings.

Improvements

• Targets: a target closes on its own once every finding behind it has retired, so resolved work leaves the queue without manual cleanup.
• Findings: the Furl scanner pages through endpoints as it reports, so large environments finish a scan reliably.
• Findings: finding ingestion skips writes when nothing changed, cutting database load during large refreshes.

Bug fixes

• Targets: Debian and Ubuntu software discovered by the Furl scanner now forms remediation targets that apt can act on.
• Findings: the Furl scanner no longer retires vulnerability findings that belong to another source.
• Targets: probe details no longer show a validation reason made up only of punctuation.
• Scopes: date columns in scope tables no longer break on first render.

2026-08-14

backend v0.1246.0 / frontend v0.904.0

New features

• Strategies: strategy cards now show your own organization’s execution counts and success rate, rather than counts shipped with the strategy library.

Improvements

• Integrations: Tenable.io, Microsoft Defender, Qualys, Rapid7 InsightVM, Nucleus, and Vanta refreshes now ingest page by page, completing faster and more reliably on large datasets.

Bug fixes

• Integrations: Qualys and Rapid7 InsightVM refreshes no longer stop short on large result sets, so findings that were previously missed are now ingested.
• Integrations: Microsoft Defender refreshes no longer fetch the same page twice, cutting refresh time and log volume.
• Targets: targets created under an older identity scheme are retired automatically, clearing duplicate entries from the Targets list.
• Endpoints: agents too old to update themselves are no longer offered an auto-update they cannot apply.
• Endpoints: context graph controls stay inside the viewport instead of drifting off screen.

2026-08-13

backend v0.1239.0

New features

• Targets: failed targets in an activated scope are retried automatically under a capped, windowed threshold, so transient failures recover without a manual retry click.
• Targets: historical version-conflict findings now appear as Needs Review with their version evidence and rulings, instead of resting as plain failures.

Improvements

• Integrations: Rapid7 InsightVM and CrowdStrike Spotlight refreshes now ingest page by page, completing faster and more reliably on large datasets.
• Integrations: Qualys now recognizes Linux operating systems it previously could not fingerprint.
• Endpoints: agents can recover a wedged on-host scanner automatically when they check in.

Bug fixes

• Forge: approving a remediation on a long-idle session no longer risks the approval being dropped.
• Strategies: generated remediation strategies are validated more robustly, preventing malformed output from failing strategy creation.
• Endpoints: agent version pinning now respects per-platform version availability when the platforms differ.

2026-08-12

backend v0.1225.0 / frontend v0.900.0

New features

• Targets: needs-review targets can now be explained and acted on directly — Furl explains why the target needs review and offers the actions to resolve it.
• Endpoints: endpoints from different sources now also correlate by MAC address and by fully qualified domain name in both directions, improving how multi-source assets unify into a single endpoint.

Improvements

• Endpoints: correlation now considers every physical network adapter MAC address, so sources that observe different adapters on the same machine unify into one endpoint instead of creating duplicates.
• Integrations: Nucleus assets now use their real hostnames and strong identifiers such as EC2 instance IDs and SentinelOne serial numbers, improving how they correlate with endpoints from other sources.
• Integrations: data source refreshes are faster and complete more reliably on large datasets.
• Findings: the Furl scanner now detects CVEs for software versions not yet catalogued in the vulnerability database, using verified attribution from neighboring catalogued versions.
• Findings: finding titles from the Furl scanner now follow the same style as vendor-reported findings.

Bug fixes

• Endpoints: an endpoint’s primary network interface is now detected reliably, so endpoints no longer appear without their main MAC address and IP.
• Findings: Nucleus findings now include the vendor’s recommended solution, and no longer show a CVSS score derived from the severity label when the scanner did not report one.
• Endpoints: software removed from an endpoint is now reconciled promptly and no longer lingers in the software inventory.
• Strategies: a check can now be deleted even after it has been used by a remediation pipeline, and a failed deletion shows an error message instead of failing silently.
• Targets: viewing probe details on a remediated SMB target no longer crashes the page.

2026-08-10

backend v0.1207.0 / frontend v0.895.0

New features

• Findings: each finding now links to its Context Graph node, so you can jump straight from a finding to the asset relationships behind it.
• Targets: a software version conflict detected during validation now lands the target in its own “Needs review” status — with the validation verdict shown — instead of being marked failed alongside genuine errors.

Improvements

• Integrations: the Google Admin integration is now called Google Workspace, matching the product it connects to.

Bug fixes

• Findings: CVE severity scores are more accurate. Furl now prefers the official NVD score when a CVE record carries more than one, falls back across CVSS versions when the latest isn’t available, and no longer creates blank findings from non-CVE placeholder identifiers.
• Findings: vulnerability findings from a removed integration no longer linger — deleting an integration recomputes the affected findings, and deduplication considers all active sources rather than only recently updated ones.
• Findings: the finding drawer’s target link now lands on the Targets page filtered to that target.
• Targets: the State filter can be cleared again.
• Tables: changing filters in quick succession no longer drops one of the changes.

2026-08-07

backend v0.1198.0 / frontend v0.887.0

New features

• Scopes: endpoints can now be filtered by the integrations that manage them. “Managed By” narrows a scope to endpoints managed by the integrations you choose, and “Not Managed By” excludes endpoints managed by others — so a scope can target, for example, endpoints managed by CrowdStrike but not by Automox.
• Targets: the Targets table can now be filtered by scope.
• Targets: when an endpoint’s OS inventory and its on-disk binaries disagree about a software version (for example, two versions of the same product installed side by side), validation now surfaces the conflict as “Needs review” with the option to continue anyway, instead of reporting a generic validation failure.

Improvements

• Integrations: disabling the furl scanner integration now immediately removes its imported data.

Bug fixes

• Findings: a finding that was resolved reopens automatically when a scanner observes it again.
• Targets: verdict overrides can no longer be applied while a target’s remediation pipeline is still in progress.
• Remediation preflight checks: a check whose endpoint query never returned no longer counts as a pass. Package-held, pending-reboot (Linux and Windows), runtime version pin, and runtime version manager checks now report a failure with the reason, so remediation stops instead of proceeding on a check that was never performed.
• Manual strategies: approving a manual strategy now hands its steps to the endpoint owner, instead of failing with a “no script template” error.
• Windows: winget is now found reliably on endpoints where the agent runs as a system service, so winget strategies are no longer skipped as unavailable — previously an endpoint could report winget unusable for up to 24 hours despite having it installed.
• Windows: winget upgrades now resolve against the winget source rather than the Microsoft Store, so they no longer fail on Store certificate errors or agreement prompts.
• Endpoint queries that fail to record their results now settle as failed with a reason instead of reporting completed with no data, and the waiting remediation step is notified right away rather than waiting for the dispatch-timeout sweep.
• Strategies: updates to content-library strategies now reliably refresh the data behind strategy matching, so recommendations reflect current strategy content.

2026-08-05

backend v0.1188.0 / frontend v0.881.0

Bug fixes

• Scopes: finding filters (finding types, minimum severity, minimum CVSS score) are now enforced when determining which targets belong to a scope. Filter criteria that had no effect — including a “vulnerability” finding-type checkbox the form locked on by default — are no longer stored or displayed.
• Findings: evidence text no longer lists a product as its own vendor when the data source doesn’t provide a vendor.
• Signing in after your active organization was deleted now returns you to the organization picker instead of a stuck session.

2026-08-04

backend v0.1181.0 / frontend v0.877.0

New features

• Forge can now open and read specific web pages when it needs information from one. The approval card lists the exact URLs it wants to fetch along with the query behind the request, and anything pulled from a page is marked as untrusted content so you can see what came from the open web.

Improvements

• Scans and datasource refreshes are significantly faster, most noticeably on repeat refreshes. Furl now recognizes when a refresh hasn’t actually changed anything and skips the redundant work instead of rewriting every record, and scope matching, remediation-target syncing, and software calculation now run in batches rather than record by record. The improvement grows with the size of your environment.

Bug fixes

• Strategies: the delete action now appears for strategies your organization created that don’t come from the content library.

2026-08-03

backend v0.1174.0 / frontend v0.875.0

New features

• Targets: a Start time column shows when each remediation began.
• Targets: a header legend explains what each processed status means.
• Integrations: turning an integration off now asks whether to keep or delete the data it imported, instead of silently discarding it.

Improvements

• Integrations: Automox now appears under Endpoint Management and SentinelOne under Vulnerability Management; the unavailable Jamf, Intune, and Generic Webhook tiles have been removed, and the Cloud badge renamed.
• Strategies removed from the content library are now disabled rather than deleted, and any approvals they carried are revoked.
• Endpoints that no longer exist in any connected source are cleaned up automatically.
• Targets: the Asset Owner column is now named Endpoint Owner.
• First-time setup now lands on Endpoints.

Bug fixes

• Endpoints: an agent that is inactive is reported as inactive rather than unhealthy.
• Running a check while one is already in progress now returns a clear message instead of a generic error.
• Findings that no longer apply to an endpoint are closed correctly.
• Endpoint correlation clears source links that are no longer valid.
• Scopes: the ticketing section is always shown, and no longer claims there is no ticketing connection when one exists.

2026-07-31

backend v0.1160.0 / frontend v0.868.0

New features

• Remediation phase verdicts can now be corrected by a person. When the AI’s validation, preflight, or verification verdict is wrong, you can override it with a required justification — correcting validation or preflight re-runs the remediation from that phase, while correcting verification records the target’s final outcome directly. Each correction is linked to the run it causes, so it can be traced end to end.

Improvements

• Targets: the verification step shows when a phase’s outcome came from a human correction rather than the AI’s verdict, instead of crediting an overridden pass to the AI.
• Failures when submitting a verdict correction are now reported instead of appearing to succeed silently.

Bug fixes

• Targets: the probe results panel stays open while a target is running instead of closing itself every few seconds.
• Scopes: the target table’s columns no longer rebuild each time the page refreshes while a scope is running.
• Targets: a target whose software has since been removed no longer passes verification as though it had been remediated.
• Remediations parked awaiting a reboot keep their pending-reboot status instead of being overwritten by a later verdict correction.
• Fixed several cases where a remediation target could be advanced or finalized using state left over from an earlier run.
• Vanta: imported endpoints no longer fall back to the Vanta asset display name as the hostname.

2026-07-30

backend v0.1158.0 / frontend v0.866.0

New features

• Remediations that finish successfully but require a reboot are now tracked with a dedicated “succeeded — pending reboot” status instead of being marked failed; verification completes automatically after the endpoint reboots and re-inventories.
• The agent detects PowerShell execution policies enforced by Group Policy, giving remediation strategies accurate context on managed Windows endpoints.

Improvements

• Tenable.io: imported findings now use CVSSv3-based severity, distinguish the same vulnerability on different ports, and carry device serial numbers; Macs reported by Tenable merge correctly with agent-enrolled endpoints, and the integration icon renders cleanly in dark mode.
• Linux package vulnerabilities from vulnerability scanners (Tenable.io, Rapid7 InsightVM) now produce remediation targets for well-known software families — PostgreSQL, Vim, curl, GNU binutils, GnuTLS, and more — including the package manager to use for the fix on Ubuntu systems.
• Endpoints: hardware-UUID matching between sources is now case-insensitive, so the same machine reported by multiple integrations merges into a single endpoint instead of appearing twice.

Bug fixes

• Tenable.io: fixed the “Invalid request payload” error that prevented vulnerability imports when no tags filter was configured, and hardened tags-filter parsing against whitespace and colons in tag values.
• Fixed an issue where a single imported finding without CVE assignments could prevent all of an organization’s findings from appearing.
• CrowdStrike Falcon Spotlight: vendor, product, and install path are now extracted correctly from application data.

2026-07-27

backend v0.1137.0 / frontend v0.860.0

Improvements

• Forge: upgraded to a newer AI model (Claude Opus 5) for higher-quality analysis and strategy generation.
• Strategies: strategy changes now reliably trigger rematching of the targets they apply to.

Bug fixes

• Scopes: software product and vendor filters match targets regardless of which identity vocabulary their software data uses, so scopes no longer show zero matches for software they should cover.
• Findings: WinRAR vulnerabilities imported from Rapid7 InsightVM now extract the software vendor correctly, so they produce remediation targets instead of being silently dropped.
• Findings: the Furl scanner no longer records “n/a” as a software vendor for package-based findings.
• Checks: preflight no longer runs service and process probes for package-manager remediations, where they don’t apply.
• Page header actions wrap onto a new line instead of overlapping the page title on narrow windows.

2026-07-24

backend v0.1128.0 / frontend v0.859.0

New features

• Endpoints: search covers more fields, and every column in the endpoints tables can be filtered.
• Scopes: a new Copy Scope action duplicates an existing scope’s definition as a starting point for a new scope.
• Checks: checks now run nightly by default, and each check’s schedule can be viewed and adjusted.
• Forge: CVE research is more comprehensive, combining a dedicated CVE database lookup with recency-anchored web search, and distinguishes emerging-incident questions from established CVE research.
• Integrations: CrowdStrike endpoints are enriched with hardware identity details from the CrowdStrike Hosts API.

Improvements

• Strategies: updating the strategy for a remediation subject automatically rematches the targets it applies to.
• Ticketing: scope ticket creation is more resilient. Lost ticket announcements are retried, and duplicate tickets are never created.
• Endpoints: agent enrollment surfaces endpoint-linkage errors immediately, and a background sweep links agents that enrolled without an endpoint.

Bug fixes

• Targets: retrying a scope no longer leaves a target’s status showing the previous attempt’s Failed state while the retry is in progress.
• Approvals: approving or rejecting a remediation attempt that has already been replaced by a newer attempt is now safely rejected.
• Integrations: CrowdStrike vulnerability sync returns endpoints correctly, and a failed enrichment batch no longer affects the rest of the sync.
• Endpoints: the managed-by filter includes Cloud Infrastructure.
• Checks: preflight validation honors the AI verdict, and service checks pass when a service is expected to be absent and is absent.
• Targets: dependency targets are verified with real probes instead of being automatically confirmed.
• Targets: remediation of Homebrew cask installs resolves to the managed application correctly.
• Endpoints: software identification no longer overwrites a matched product identity when a later scan cannot identify the product.
• Findings: vulnerability detection recovers for software with capitalized product names (such as Mozilla Firefox on Windows). An upstream product-identification service became case-sensitive; product lookups are now normalized before matching, so affected software is identified and scanned again automatically.
• People: lookups and updates reference the correct person record and return a clear not-found error for unknown people.

2026-07-21

backend v0.1098.0 / frontend v0.849.0

New features

• Endpoints: delete an endpoint along with its vulnerability data, and choose to keep operational data when deleting an integration.
• Scopes: the scopes table now shows Active, Successful, and Failed target counts for each scope.

Improvements

• Endpoints: automatic recovery of stalled osquery data collection now works on Windows endpoints.
• Scopes: activating or resuming a scope now immediately re-evaluates its targets and starts remediation.
• Checks: probe checks use an upgraded AI model for higher-quality results.
• Strategies: strategy recommendations link directly to the corresponding strategy on the Strategies page.

Bug fixes

• Endpoints: deleting an endpoint no longer disrupts agent event processing or scope evaluation for remaining endpoints and targets.
• Approvals: an approval that fails to start remediation now restores the strategy’s previous state instead of leaving it superseded.
• Approvals: duplicate pending-approval entries no longer occur for the same target.

2026-07-16

backend v0.1088.0 / frontend v0.845.0

New features

• Dashboard: filter the summary metrics and trend graph by scanner source and time frame.
• Targets: a new Scope column shows which scope each target belongs to, and the status popup now shows how the target was attributed to that scope.

Improvements

• Strategies: strategy and remediation-subject generation now uses an upgraded AI model for higher-quality output.
• Strategies: lowering your approval confidence threshold automatically re-evaluates strategies that were previously blocked by it.
• Integrations: ticket updates in connected ticketing systems are now published durably after a remediation settles — a failed update is retried instead of silently dropped.

Bug fixes

• Strategies: script-based strategies can no longer be generated with a malformed script template.
• Approvals: approval counts and dispatches no longer include targets outside the approval’s scope.

2026-07-15

backend v0.1079.0 / frontend v0.838.0

New features

• Targets: a new Finished column shows when each target was remediated or closed, with 30/60/90-day quick filters.
• Scopes: pause and reactivate a scope directly from a row action on the scopes table.
• Scopes: the scope’s targets view now shows when each target entered the scope.

Improvements

• Strategies: the approval table is now sortable, and low-confidence entries show the strategy’s confidence score alongside the approval threshold.
• Targets: version-change verification results now appear as remediation evidence, showing how a fix was confirmed.

Bug fixes

• Scopes: creating or editing a scope now moves idle targets to their most specific matching scope.

2026-07-14

backend v0.1068.0 / frontend v0.832.0

New features

• Strategies: added an Approved/Unapproved column with filtering, so you can see and filter strategies by their approval status.
• Checks: probe check results now show timestamps.

Improvements

• Software matching: product editions (such as Developer Edition) now bind to their own subject rather than the base product, improving remediation accuracy.
• Endpoints: Furl now automatically recovers an agent whose osquery data collection has stalled, without manual intervention.
• Endpoints: updated the bundled osquery to 5.23.1.
• Remediation: job completions are now published durably, so a completed job no longer resolves with the wrong outcome after a transient failure.
• Knowledge Graph: neighbor counts are computed more efficiently.
• Scopes: added a Cancel button to the scope create and edit views.
• Integrations: removed Carbon Black from the integrations list.

Bug fixes

• Strategies: strategies disabled for your organization can no longer be approved or dispatched.
• Findings: product and vendor filters are now case-insensitive.
• Targets: the Status column now sorts by its displayed label.
• Targets: uncovered targets are counted per target rather than per finding.
• Targets: default filtering is only applied when you haven’t set any other filters.
• Targets & Dashboard: the Furl-remediated count now reconciles with its drill-in view.
• Rollouts: a lost ring-activation dispatch no longer stalls a rollout.
• Checks: a failed manual check-run dispatch no longer wedges the check.

2026-07-07

backend v0.1030.0 / frontend v0.823.0

New features

• Remediations that stall because an agent stops responding are now automatically detected and unblocked, so a dead agent no longer strands a remediation indefinitely.

Improvements

• Endpoints: agent health now reflects whether the endpoint’s osquery collection loop is actually running its assigned jobs, so an agent that is checking in but no longer collecting data no longer shows as fully healthy.
• Agent data reliability: agent events that fail to process are now retried and routed to a dead-letter queue instead of being silently dropped.

Bug fixes

• Targets: targets awaiting a reboot after a successful update now resolve as remediated.
• Windows remediations now report their real command exit codes and capture the full deployment output.
• Remediation verification now runs against the endpoint’s actual operating system, fixing incorrect package-manager verification on mixed-OS fleets.
• Nested tables now keep their pagination controls anchored at the bottom instead of floating mid-table.

2026-07-01

backend v0.1015.0 / frontend v0.819.0

Improvements

• Forge: you can now create scopes using tag-based filters.
• Forge: newly created remediation scopes start in a paused state, so you can review them before they take effect.

Bug fixes

• Forge: target queries are now limited to your in-scope targets.
• Windows winget remediations now reliably resolve winget on the system PATH.

2026-06-30

backend v0.1010.0 / frontend v0.818.0

Improvements

• Data tables: wide tables now have a floating horizontal scrollbar so you can scroll across columns without jumping to the bottom of the page.

Bug fixes

• Agent downloads: hardened the agent download redirect endpoints against path-traversal in encoded URLs.
• Scopes: the scope detail page now shows tag names instead of internal IDs.

2026-06-26

backend v0.1009.0 / frontend v0.814.0

Improvements

• Knowledge Graph: node detail loads faster
• General performance improvements

2026-06-25

backend v0.1007.0 / frontend v0.813.0

Improvements

• Knowledge graph: in-flight graph data requests are now cancelled when you navigate away or close the page, avoiding wasted work.

2026-06-24

backend v0.1003.0 / frontend v0.810.0

Improvements

• Security improvements from regular scans.

Bug fixes

• Endpoints: IP and MAC addresses now stay current as agents report changes, instead of occasionally going stale.
• Findings: endpoint names now display correctly even when an endpoint has no IP address.

2026-06-23

backend v0.997.0 / frontend v0.807.0

Improvements

• Findings: the Detected column is now sortable.

Bug fixes

• Sign-in and account screens now follow your dark-mode theme instead of always rendering in light mode.
• Forge: cancelling a single endpoint in a multi-endpoint batch now cancels only that endpoint — the batch resumes and still returns results from the others.
• Findings: when a data source stops reporting, its findings and targets are now closed on endpoints that other sources still report, instead of lingering as stale.
• Targets: asset-identity matching now prefers an exact name match when multiple candidates tie, so assets reported by multiple sources are correlated more accurately.

2026-06-23

backend v0.994.0 / frontend v0.805.0

Improvements

• Endpoints: the agent status column is now labeled “Agent health” and reports two distinct signals — whether the agent is active (checked in recently) and whether it is healthy (its two daemons are reporting in sync).
• Security improvements from regular scans.

Bug fixes

• Forge: osquery and script commands are no longer sent to endpoints whose agent is inactive — previously the job would silently queue and time out after about 15 minutes. Forge now declines up front and explains why, so you can choose an active endpoint.
• Forge: when a conversation’s messages fail to load, you now see an error you can retry instead of what looked like an empty conversation.

2026-06-22

backend v0.990.0 / frontend v0.802.0

Improvements

• Integrations: deleting an integration now cleans up its associated operational data.

2026-06-19

backend v0.986.0 / frontend v0.801.0

New features

• Forge: jobs can now dispatch across multiple endpoints in parallel, with a toggle to switch between parallel and sequential dispatch.
• Endpoints: a dedicated, filterable Source column shows where each endpoint’s data comes from.

Improvements

• Endpoints: the page header now shows an at-a-glance summary of your agent fleet.
• Endpoints: the +N source rollup now shows integration logos on hover, and the hostname column stays frozen in place as you scroll horizontally.

Bug fixes

• Endpoints: corrected the tooltip shown on the +N source rollup.

2026-06-17

backend v0.983.0 / frontend v0.794.0

New features

• Dashboard: KPI tiles are now clickable and drill into the matching page, pre-filtered — for example, Actively exploited opens Findings filtered to known-exploited vulnerabilities, Closed remediation targets opens Targets filtered to closed, and Agents deployed opens Endpoints filtered to agent-managed hosts.
• Endpoints: you can now export the Endpoints table to CSV.
• Integrations: each connection can have its own data-source refresh interval, so you can tune how often Furl pulls from each source independently.
• Dashboard: a new agent-coverage card shows how many endpoints don’t yet have an agent installed.
• Memory: the memory your agent forms during its dreaming phase is now visible in the Memory tab.

Improvements

• Dashboard: the remediation-target tiles are now labeled “Open remediation targets” and “Closed remediation targets” for clarity.
• Dashboard: clearer vulnerability tile labels (“Actively exploited vulnerabilities”, “Total vulnerabilities (all sources)”, “Furl-remediated targets”), a more logical tile order, and consistent alignment so values and trend graphs line up across each row.
• Dashboard: vulnerability stats are clearer — resolved targets are split into “Remediated by Furl” and “Closed”, and the deduplicated tile is renamed “Unique vulnerabilities”.
• Targets: the Validation column now uses clearer, consistent wording (unvalidated → validating → valid / not valid).

Bug fixes

• Dashboard: the Open remediation targets tile now shows the same count as the Targets page.
• Validation: a finding is no longer marked invalid without corroborating evidence, preventing false negatives.

2026-06-15

backend v0.973.0 / frontend v0.783.0

New features

• Targets: a new Open/Closed State column lets you filter and sort targets by whether they’re still open or have been closed.

Improvements

• Targets: the Validation column is simplified — the Status now reflects only terminal outcomes, and the in-progress validating state is collapsed into a cleaner indicator. Scope-only validation shows a read-only status.
• Settings and in-app navigation load faster — fewer redirects reaching Settings and a cached user profile remove a round-trip on each navigation.

Bug fixes

• Vulnerability matching is more precise: CPE fallback matching now only applies to tokens that broaden the installed product, reducing false matches.
• Logging out from the user menu now works reliably.
• The app keeps its styling intact when an error page is shown.

2026-06-13

backend v0.968.0 / frontend v0.777.0

Improvements

• Pages now refresh their data more reliably, and background polling pauses while you’re on another view — keeping what you see current without unnecessary requests.
• Empty and error states across the app now show clear, plain-language messages instead of leaking internal technical text.

2026-06-12

backend v0.966.0 / frontend v0.774.0

Improvements

• Remediation preflight now detects packages that are held back from upgrades (apt holds) on Linux endpoints, so blocked upgrades are surfaced before a fix is attempted.
• Tables across the app use a consistent set of page-size options (10, 25, 50, 100).

Bug fixes

• Vulnerability matching identifies more products correctly: ambiguous vendor/product combinations now fall back to product-only matching, and product identifiers covered by known CVEs are preferred.
• Finding-to-target links are now recorded consistently during vulnerability processing.
• Forge: when multiple approvals are pending, each response is applied to the correct action.

2026-06-11

backend v0.963.0 / frontend v0.774.0

Improvements

• Targets: faster, more consistent loading for large target sets — target lists, filters, and counts are now served from purpose-built tables.
• Endpoints: software inventory reports are now processed by diffing against the previous snapshot instead of rewriting every record, reducing processing load for large fleets.
• Tables across the app share consistent page-size options (10, 25, 50, 100) and default to 10 rows per page.

Bug fixes

• Vulnerability matching now recognizes more product version formats, and targets are no longer incorrectly closed as removed when an upstream CVE lookup briefly returns no results.
• Vulnerability identity matching is more accurate: candidate software identities covered by the CVE are preferred, and vendor/product pairs with no match fall back to a product-only lookup.
• Findings are now recorded even when no remediation target exists yet, and a finding that affects several pieces of software on one endpoint is linked to all of them.

2026-06-10

backend v0.951.0 / frontend v0.772.0

New features

• A new overview dashboard surfaces KPI cards and a vulnerability/remediation trend at a glance.

Improvements

• Targets: the list now paginates, sorts, and filters on the server, so large target sets load quickly and every column stays sortable across pages.
• Findings: the table now has per-column filters and a Source column showing where each finding came from.
• Scopes: processed targets now distinguish targets you closed from those the remediation pipeline resolved, and the processed-targets CSV export includes the closed disposition and the time each target was closed.

Bug fixes

• Targets: the Urgency column now sorts in the correct order.

2026-06-08

backend v0.940.0 / frontend v0.766.0 / agent v1.2.0

New features

• The macOS agent (v1.2.0) now supports Intel-based (amd64) Macs running macOS Sequoia and later.

Improvements

• Findings: table columns now keep a fixed width while you sort, so the column headers no longer shift around.

Bug fixes

• Targets: furl-detected remediation targets now dedupe consistently, so duplicate entries no longer appear across calculation cycles.
• Vulnerability scanning now detects known CVEs for Windows applications whose version numbers carry extra trailing segments (such as 7-Zip), which were previously reported as having no known vulnerabilities.

2026-06-07

backend v0.935.0 / frontend v0.765.0

New features

• Authoring a remediation subject in Forge now automatically rematches previously-unmatched targets to it, so newly-defined subjects immediately pick up the software already in your inventory.

Improvements

• Targets now match to remediation strategies using their native CPE and package URL (purl) identifiers, so more software is correctly paired with the right strategy.
• Vulnerability scans run faster — identity resolution is batched and deduplicated, and probes are skipped for targets that can’t be remediated.

Bug fixes

• Known Exploited Vulnerability (KEV) indicators now render with the correct critical styling.

2026-06-06

backend v0.924.0 / frontend v0.764.0

Improvements

• Targets: the list now sorts by highest CVSS score first by default, so the most severe targets surface at the top.
• Severity and urgency indicators are now a single, consistent chip style across the app.

Bug fixes

• Fixed a sorted, filterable column header that was invisible in light mode.

2026-06-05

backend v0.923.0 / frontend v0.757.0

New features

• Findings: a high-level metrics header now summarizes key counts at the top of the Findings page.

Bug fixes

• Integrations: endpoints imported from Qualys now include their hardware UUID and serial number — and use the correct hardware identifier on macOS — so they correlate with agent-managed endpoints instead of appearing as duplicates.
• Forge: the size of a proposed reach change is now validated before it can be applied.

2026-06-04

backend v0.910.0 / frontend v0.756.0

New features

• Scopes: you can now retry remediation across a scope’s targets — retry all of them, just the failed or blocked ones, or an individual target.

Bug fixes

• Targets: remediation targets and their findings now close automatically when the underlying software is removed from an endpoint — and reopen if it’s reinstalled — instead of lingering as active indefinitely.
• Remediation: when a remediation is blocked during preflight checks, the blocking reason now surfaces instead of the attempt failing without explanation.

2026-06-03

backend v0.906.0

Bug fixes

• Findings: improved CVE version matching so vulnerabilities are detected more accurately — affected software with open-ended version ranges, trailing-zero version numbers, and multi-segment versions now match correctly, reducing missed detections.

2026-06-02

backend v0.905.0 / frontend v0.755.0

New features

• Scopes: new scopes are created in a paused state so you can review their configuration before any remediation activity begins; activate or resume them when ready.
• Endpoints: the endpoint detail panel now includes a software inventory table listing the software installed on that endpoint.

Improvements

• Scopes: the Scopes page loads faster.
• Targets: the Targets page loads faster.
• Strategies: the strategies table now has a Created Date column.
• Security: updated platform and agent dependencies to address known vulnerabilities.

Bug fixes

• Forge: vulnerability research now anchors to the current date — web search results are treated as current and up to date rather than relying on the model’s training data.
• Forge: switching to a different session while one is running now prevents thrashing between them in the user interface.

2026-06-01

frontend v0.747.0

Bug fixes

• Sign-in now returns you to the page you originally requested, instead of dropping you on the default landing page.

2026-05-31

backend v0.891.0

Bug fixes

• Endpoints: agents are now matched by their hardware UUID, so two machines that share a hostname are tracked as separate endpoints instead of being merged into one.
• Targets: filtering remediation targets by multiple values no longer fails.
• Remediation: when a deployment step fails, the pipeline no longer runs verification against it.

2026-05-30

backend v0.888.0 / frontend v0.746.0

New features

• Endpoints: endpoints can now be tagged automatically from agent configuration, so you can group and target them by tags set on the agent itself.

Bug fixes

• People: only real user accounts from endpoint agents are ingested as people now — service and machine accounts are filtered out — and each person is correctly linked to their endpoint.
• Remediation: Windows preflight checks now correctly evaluate available disk space and pending-reboot status before a remediation runs.

2026-05-29

backend v0.885.0 / frontend v0.745.0

New features

• Scopes: a new Processed Targets table shows the targets a scope has run through, with a CSV export of the current view.
• Scopes: blocked targets now explain why they’re blocked, and admin approval gates can be approved inline without leaving the page.

Improvements

• Strategies: targets with no matched strategy now show a clear “No Strategy” pill instead of the misleading “Needs Review” label.

Bug fixes

• Targets: remediation targets that have no CVSS score now sort below those scored 0, rather than mixing in above them.
• Strategies: the subject picker in the Create Strategy flow is usable again.

2026-05-28

backend v0.876.0 / frontend v0.739.0

New features

• Scopes: an endpoint tags filter on the “Where to Remediate” step lets you target remediation by endpoint tag.

2026-05-27

backend v0.875.0 / frontend v0.738.0

New features

• Targets: a CSV export button on the Remediation Targets table downloads the current filtered view.

Improvements

• Findings: the search bar now filters results server-side, matching how search works on other tables.
• Endpoints and Findings: integration and scanner icons in table columns are right-aligned and collapse cleanly when many are present.
• Severity badges across the app now use the style guide’s color variants consistently.

Bug fixes

• Scopes: the ticketing destination dropdown handles Freshservice’s flat ticketing model correctly.

2026-05-26

backend v0.870.0 / frontend v0.733.0

New features

• Sidebar: a What’s New link now opens the release-notes page directly from the app.
• Forge: endpoints flash green when a command completes against them, making it easier to see which hosts just finished.

Bug fixes

• Forge: the reach panel refreshes after the assistant makes scope or strategy changes, so the affected-endpoints count stays in sync with the conversation.

2026-05-22

backend v0.862.0 / frontend v0.730.0

New features

• Desktop tray notifications for informational events, approval requests, and snoozed deferrals.
• Multi-select column filters across Targets, Findings, and Endpoints — pick more than one value at a time and see them as pills above the table.

Improvements

• Column-bound filters (CVE, VSI, CVSS Score, and others) now live in each table’s column headers rather than a separate toolbar.
• Tables remember column visibility, page size, and active filters across refreshes — each table has its own scoped settings.
• Active filters collapse to a summary pill when more than three values are selected.
• Targets: Coverage card moved above the toolbar for clearer reading.
• Strategies: enable/disable toggle moved into the secondary toolbar row alongside other table controls.
• Unified search behavior across tables — press Enter or click Apply to submit, with a Reset-to-default control.

Bug fixes

• Targets: Software Vendor and Software Name filters include targets that only have attribute-level vendor or product data.
• Tables: column-header filter dropdowns stay open across data refreshes.
• Endpoints: Columns dropdown shows up even when the global search bar is hidden.

2026-05-20

backend v0.856.0 / frontend v0.727.0

New features

• Forge streams the assistant’s response incrementally — text, tool calls, and approval state appear as they happen rather than after completion.

Bug fixes

• Forge: new user messages are now rejected while a tool call or interrupt is in flight, and when the last message isn’t from the assistant.
• Forge: reach-panel job state pills show human-readable labels.
• Endpoint owner lookup repaired (filters out stale and non-furl owners), restoring correct exception routing.