Changelog: September 15, 2026

[zeyu2001]

• Date: September 15, 2026
• Commit: 9ef27ae3

Documentation TODOs

These shipped features still need docs. The changelog links only to pages that already exist - add or update these, then link them:

• OWASP Top 10:2025 category on findings: Document how to view and edit the OWASP category on a finding, where the picker appears (overflow menu), and what values are available.
• CWE ID and fix recommendation on findings: Document that findings now include a CWE identifier and a fix recommendation from the scan engine, and where to find them in the finding detail view.
• Revamped findings drawer and table: Update findings documentation with the new drawer layout, navigation controls, and consolidated overflow menu actions.
• Scan failure reason: Document that failed scans now show an engine failure message on the scan detail page.
• Bot PR review on GitHub: Document that Dependabot, Renovate, and GitHub Actions bot PRs are now reviewed on GitHub (no seat consumed; behavior matches GitLab/Bitbucket).
• Dashboard application filter: Document the Application filter on the PR Review dashboard tab, including that the security score and all widgets now respect it.
• GitLab tags and commits in Whitebox scan setup: Document the ability to pin a GitLab Whitebox scan to a specific tag or commit SHA.
• Linear triage status sync: Document outbound Linear status sync - which triage state changes push to Linear and what Linear workflow states they map to.
• Auto-retry stale-diff remediation: Document that remediation fix PRs now auto-retry up to 3 times when the target file changes between estimation and apply.
• Auto-close fix PRs: Document that open AI fix PRs are automatically closed (with a comment) when the engine detects the fix landed independently.
• API key management for every member: Update API key docs to note that all members (not just owners/admins) can create and rotate their own keys from personal settings.
• Consolidated personal settings: Update account/settings docs to reflect the new /personal-settings page and its six sections.
• Delete automations from detail page: Document the delete action on the automation detail page.
• Self-managed GitLab on on-prem appliances: Document how to connect a self-managed GitLab to an on-prem appliance, including required env vars (GITLAB_WEBHOOK_SECRET, GITLAB_WEBHOOK_URL).
• GHES connection via GitHub App on-prem: Document that on-prem appliances now support the GitHub App connection flow for GitHub Enterprise Server, alongside the existing PAT flow.
• License visibility and expiry warnings on-prem: Document the license details section in org settings, the expiry banner behavior (30-day warning, grace deadline, scan gate), and where to renew.

---

Note

Low Risk
Documentation-only change to changelog.mdx; no application code or runtime behavior is modified in this PR.

Overview
Publishes the September 15, 2026 product changelog and advances the workflow marker to production commit 9ef27ae.

The new <Update> block documents a broad release spanning findings UX (editable OWASP Top 10:2025 category, CWE and fix text, redesigned drawer/table), scan visibility (engine failure messages on failed scans), Code Review (GitHub bot PR reviews, dashboard Application filter on PR Review), Whitebox (GitLab tag/commit pinning), integrations (Linear triage status sync), remediation (auto-retry on stale diffs, auto-close fix PRs when fixes land elsewhere), account/settings (member API keys, unified /personal-settings), automations (delete from detail page), and on-prem (self-managed GitLab MR scanning, GHES via GitHub App, license details and expiry gating). Footer links point at existing platform docs pages.

^{Reviewed by Cursor Bugbot for commit 532b8ad. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-15T05:47:49.519399Z	532b8ad	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 532b8ada11

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Qualify bot reviews with the trust eligibility requirement

For a PR opened by one of these named bots that GitHub does not identify as trusted for the target repository, this categorical statement promises an automatic review even though code-review/config.mdx lines 80–84 says untrusted bots and outside contributors are not auto-scanned; the August changelog entry likewise limits this behavior to eligible same-repository PRs. Preserve that eligibility qualification here so users do not expect forked or untrusted bot PRs to be reviewed.

Useful? React with 👍 / 👎.

[zeyu2001]

Superseded by #73, which merges this entry with #71 into a single September 18, 2026 changelog entry. All three PRs were generated from the same baseline (c5f6cff) over a widening commit window, so they describe the same release. The GitLab tag/commit scan target and the personal-settings API key wording from this draft are carried over.