Skip to content

Changelog: September 18, 2026 (consolidates #70, #71) #73

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
zeyu2001 merged 2 commits into from
Sep 18, 2026
Merged

Changelog: September 18, 2026 (consolidates #70, #71) #73

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
239052f
docs: add changelog entry for September 18, 2026
setlin-hacktron Sep 18, 2026
d844534
docs: consolidate Sept 15/16/18 changelog drafts into one entry
zeyu2001 Sep 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
51 changes: 50 additions & 1 deletion changelog.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,56 @@ description: "New features, improvements, and fixes to the Hacktron platform."
rss: true
---

{/* CHANGELOG:INSERT last-prod-sha=c5f6cff6fbfb06a5c12d2ab205dfde7737f1ed0d - the changelog workflow inserts new <Update> blocks directly below this line. Do not remove this marker. */}
{/* CHANGELOG:INSERT last-prod-sha=9321818700667bd798dc9b6013da4d4320dc625d - the changelog workflow inserts new <Update> blocks directly below this line. Do not remove this marker. */}

<Update label="September 18, 2026" tags={["Code Review","Whitebox","Integrations","Dashboard","Self-Hosting"]}>
## A rebuilt findings view, and fix PRs that close themselves

**New findings table and drawer**: The findings list and its detail drawer have a new layout. Severity, status, and the main actions - Remediate, Copy markdown, Mark as duplicate - now sit in one header tray, and previous/next arrows move you through findings without going back to the list. A collapse control opens the drawer as a full page.

**OWASP Top 10:2025 category on findings**: You can set or change a finding's OWASP Top 10:2025 category from the overflow menu. The category appears in the findings table and drawer, and you can filter the list by it.

**CWE ID and fix recommendation on findings**: Findings now carry a CWE identifier and a plain-language fix recommendation, where the scan engine supplies them. Both appear in the finding detail.

**Download a scan's context documents**: A download button in the triage header pulls the context the scan worked from - the threat model, architecture notes, and any files you uploaded - without leaving the findings view.

**Scan failure reason**: When a scan fails, the scan detail page now shows the reason the engine reported, instead of leaving you to guess.

**Severity in global search**: Findings in global search results show their severity badge, so you can pick out the Critical and High matches without opening each one.

**Fix PRs close when the fix lands elsewhere**: If Hacktron detects that a finding was fixed by a commit on your base branch, it closes any open fix PR for that finding and leaves a comment saying why, so you do not have to clear out stale fix PRs by hand.

**Fix PRs retry instead of failing on a stale diff**: If a file changes on the base branch while an AI fix is being generated, the fix no longer applies cleanly. Rather than surfacing a patch error, the automation re-runs against the updated file, up to three retries per chain.

**Remediation on Azure DevOps**: Automations open and track fix pull requests on Azure DevOps repositories, alongside GitHub and GitLab.

**Triage status syncs to Linear**: Triage a finding anywhere - the web app, Slack, a PR comment, or the API - and the linked Linear issue moves to the matching workflow state. Dispatching an AI fix moves it to In Progress. Findings already mirrored status to GitHub, GitLab, and Slack.

**Bot pull requests reviewed on GitHub**: Eligible bot pull requests - Dependabot, Renovate, and similar - were being skipped on GitHub. They are now reviewed, matching GitLab and Bitbucket. Trust rules and author filters are unchanged, so you can still exclude a bot with `exclude.authors`.

**Pin a GitLab scan to a tag or commit**: When you start a Whitebox Scan on a GitLab repository, you can target a specific tag or commit SHA rather than the tip of a branch.

**Application filter on the PR Review dashboard**: The Application filter now scopes every widget on the PR Review tab, including the security score card and the low-score banner, which previously stayed org-wide.

**One page for personal settings**: The separate Account and Settings pages are now a single Personal settings page, organized into Profile, Security, Connected accounts, Preferences, Sessions, and Organizations.

**API keys for every member**: Any organization member can create, rotate, and revoke their own API keys from personal settings, without an owner or admin doing it for them.

**Fuller pentest PDF reports**: Pentest PDF exports carry more detail on each finding, number findings in display order, and highlight code blocks in the right language.

**License details and expiry warnings on appliances**: Organization settings on an appliance show the installed license - who it is licensed to, expiry date, days remaining, seat count, and covered products. A banner appears 30 days before expiry. Once the grace deadline passes, new scans are blocked, while findings, reports, and exports stay readable.

**Scan quota on appliance licenses**: An appliance license can include a `max_scans` entitlement that caps how many full scans may start over the life of the license. The cap is checked when a scan starts, including restarts.

**Self-managed GitLab on appliances**: Appliances can connect a self-managed GitLab instance and scan merge requests. The Reviews link, PR Review dashboard tabs, and source control settings appear once the integration is configured.

**GitHub Enterprise Server via GitHub App**: Appliance operators can connect GitHub Enterprise Server through a GitHub App installation rather than a personal access token, which avoids long-lived tokens.

**Appliance onboarding**: First-time users on an appliance get a setup flow of their own - Welcome, Connect your code, You're all set - pre-filled for the configured Git host, in place of the hosted trial flow.

**[Explore findings 鈫抅(/code-review/findings-feedback)** 路 **[Set up remediation automations 鈫抅(/platform/automations/remediation)** 路 **[Connect Azure DevOps 鈫抅(/platform/repositories/azure-devops)** 路 **[Connect Linear 鈫抅(/platform/project-management/linear)** 路 **[Configure on-premises deployments 鈫抅(/platform/on-premises)**

</Update>

<Update label="August 19, 2026" tags={["Billing","Integrations","Whitebox","Self-Hosting"]}>
## Separate credit accounts and more on-premises scan options
Expand Down
Loading