What's Changed
- perf(audit-logs): skipCount query param to bypass count(*) on dashboard widget by @bdunncompany in #791
- Linux firewall detection: allow ufw lockfile + parse output on non-zero exit by @bdunncompany in #751
- Raise hard-coded submitChangesSchema.max(1000) to a configurable default of 50000 by @bdunncompany in #752
- chore(security): local preflight script mirroring CI Security Scanning gates by @bdunncompany in #700
- feat(api): keyset cursor pagination for GET /devices (#742 PR 3 — server) by @bdunncompany in #777
- perf: scale-readiness pack — Phase 1 jobs + Phase 2 indexes + RLS bug fix by @bdunncompany in #753
- feat(audit-ui): humanize action codes, details, fix viewer perf + modal overflow by @bdunncompany in #794
- perf(audit-logs): LATERAL per-org index scan when skipCount + no filters by @bdunncompany in #792
- feat(audit-logs): resolve agent actor to device hostname by @ToddHebebrand in #803
- fix(api): accept orgId on /sensitive-data/scans query schema (#806) by @bdunncompany in #810
- fix(software-policies): accept orgId from query string on POST (#808) by @bdunncompany in #813
- fix(event-bus): publish runs outside any active DB transaction context by @bdunncompany in #815
- fix(patches): accept orgId from query + serialize Dates as ISO in approval upsert (#805) by @bdunncompany in #814
- fix(sensitive-data): scope FindingsTab select-all to filtered rows (#809) by @bdunncompany in #819
- chore(deps): bump js-cookie to >=3.0.7 (CVE-2026-46625) by @bdunncompany in #824
- fix(discoveryWorker): serialize Date as ISO for sql-tag binding by @bdunncompany in #825
- fix(web): flip Devices row kebab dropdown direction when near viewport bottom by @bdunncompany in #786
- feat(dns): add AdGuard Home as a supported DNS filtering provider by @bdunncompany in #797
- fix(api,wol): iterate target subnet candidates + skip APIPA so Wake-on-LAN finds the real LAN by @bdunncompany in #784
- feat(devices): on-demand inventory refresh command + UI button by @bdunncompany in #788
- fix(roles): expose permission catalog endpoint and have UI consume it (#801) by @bdunncompany in #802
- fix(dns): serialize policy-sync domain mutations to prevent rule clobbering (#827) by @ToddHebebrand in #833
- feat(web): scope docs-iframe embedding with a frame-src CSP directive by @ToddHebebrand in #834
- fix(agent): bump golang.org/x/net to v0.55.0 for GO-2026-5026 by @ToddHebebrand in #837
- fix(migrations): backport 0040 target_type DROP NOT NULL for fresh installs (#807) by @bdunncompany in #812
- test(db): guard legacy migrations stay consistent with the baseline (#817) by @ToddHebebrand in #838
- fix(agent): deploy breeze-user-helper.exe on in-place upgrade (#816) by @ToddHebebrand in #845
- fix(agent): harden in-place upgrade — PS error handling + temp cleanup + doc fixes (#845 follow-up) by @ToddHebebrand in #848
- refactor(agent/updater): thread companion binaries via UpdateOptions parameter (#845 follow-up) by @ToddHebebrand in #849
- test(agent,api): close coverage gaps from #845 review (#845 follow-up) by @ToddHebebrand in #850
- fix(audit-logs): qualify agent-actor user column instead of showing bare hostname by @bdunncompany in #841
- fix(event-bus): structured logging for swallowed local-handler errors + regression tests for #815 by @bdunncompany in #842
- fix(roles): RolesPage adopts runAction + clone PATCH checked + role shape validated by @bdunncompany in #840
- fix(roles): RoleManager toggleExpand surfaces /roles/:id errors instead of blank matrix by @bdunncompany in #839
- feat(dns-security): raise alerts on dns.threat.blocked events with per-(device,category) cooldown by @bdunncompany in #846
- feat(snmp): built-in SNMP templates for Ubiquiti UniFi devices by @bdunncompany in #826
- feat(snmp): exhaustive multi-vendor SNMP template library (split out from #826) by @bdunncompany in #836
- test(snmp): GET /snmp/templates smoke (regression coverage for #726) by @bdunncompany in #844
- feat(asymmetry): server detects main-agent silence while watchdog stays online (#800 Layer C, server slice) by @bdunncompany in #851
- feat(api): severity-by-exit-code mapping for scripts (Feature #3) by @bdunncompany in #798
- feat(alerts): per-channel notification throttle with sliding-window cap by @bdunncompany in #796
- fix(heartbeat): accept pseudo-interface MAC addresses up to 64 chars by @bdunncompany in #790
- feat(web): smart wake toast — active status polling instead of "wait 5 min" by @bdunncompany in #789
- feat(watchdog): auto-restart on prolonged heartbeat silence (#799) by @ToddHebebrand in #852
Full Changelog: v0.66.1...v0.67.0