What's new: October 2026
Release notes Safeguard published in October 2026.
Release 2026.10.27.154
2026.10.27.154 · 27 October 2026
This release improves user registration workflows and updates desktop security controls.
New features
- New workspace signups inform users that their administrator must approve the account before access is granted.
- Single sign-on requests now require administrator approval and follow streamlined routing rules.
Fixes
- The command line interface no longer gets stuck in recursive loops when processing self-referencing configurations.
Security
- Hardened desktop application security by disabling unauthorized node execution, restricting external URL forwarding, and isolating session storage.
- Added strict navigation guards and permission handlers to the desktop application session.
Release 2026.10.27.148
2026.10.27.148 · 27 October 2026
This release improves the accuracy and consistency of scanner findings across dependency and code analysis, cleans up stale results on rescans, and hardens the desktop application.
New features
- Dependency scans now distinguish your declared direct dependencies from packages added by resolution, giving a truer picture of direct versus transitive risk.
- SAST findings now include a CVSS v3.1 vector, score and matching severity.
- SAST and change-review findings now show their CWE category, source commit and fix state.
- Change-log findings now show the repository and commit they came from.
- Rescans now retire checks, provenance, postures and commits from the previous scan so results reflect only the latest state.
- Scanner findings are now normalised with consistent severity casing, location fields and source component information.
- Code quality now reports only metrics that were actually measured.
- Security Posture and Code Quality now list only their own checks.
- Project Details now shows identifiers in the CVE column, accurate CVSS values where they apply, and clear empty states where they do not.
- Rows where CVSS does not apply now explain why.
Fixes
- Transitive dependency resolution is now mapped onto the scanned inventory, preventing incorrect versions from appearing in results.
- Findings from your project's own code now keep their correct source component type.
- Previously retired checks, provenance, postures and commits no longer appear by default after a rescan.
- GitHub API responses are now cached across scans and revalidated, making scans faster.
Security
- Hardened the desktop application's runtime security configuration to prevent unauthorized code execution and debugging on Windows, Linux and macOS.
- Updated the desktop application's runtime components.
- External links opened from the desktop app are now restricted to allowed URL schemes.
- Added guards against untrusted redirects and frame navigation in the desktop app.
- Desktop app session permission requests are now checked before being granted.
- Hardened desktop app message handling and sandboxed the settings view.
- Development hooks are no longer enabled in production desktop builds.
- Removed the development deep link scheme from production desktop builds.
- The authenticated desktop app no longer loads third-party font stylesheets.