What's Changed
- docs: v0.70.0 documentation sweep — PAM, identity console, event-log forwarding + security/patch/auth updates by @ToddHebebrand in #1304
- fix(agent): separate Windows OS version and build (#1302) by @bdunncompany in #1311
- fix(api): enqueue patch jobs outside the system DB transaction (#1105) by @bdunncompany in #1313
- feat(agent): surface failed systemd unit auto-heal to the fleet (#1201) by @bdunncompany in #1315
- chore(deps): bump esbuild override to >=0.28.1 (GHSA-gv7w-rqvm-qjhr, unblocks Trivy CI) by @ToddHebebrand in #1350
- fix(web): in-app Help docs iframe works on self-hosted/custom domains by @ToddHebebrand in #1341
- fix(web): in-flight feedback on alert acknowledge via runAction by @ToddHebebrand in #1336
- feat(web): pre-expand org switcher tree to the selected site by @ToddHebebrand in #1333
- fix(web): confirm before deleting a costed ticket part by @ToddHebebrand in #1331
- feat(web): add Monitoring + Backup left-nav sections by @ToddHebebrand in #1330
- feat(web): surface partner ticketing config on the Partner settings hub (#1327) by @ToddHebebrand in #1352
- fix(config-policy): remove dead Event Log toggles + clarify tab is tuning, not gating by @ToddHebebrand in #1337
- feat(patches): selectable page size + clickable header sorting by @ToddHebebrand in #1338
- feat(web): device overview polish + activity feed by @ToddHebebrand in #1306
- feat(devices): make every Devices-list column sortable by header click by @bdunncompany in #1284
- docs(pam): admin guide + security model + API reference (#1161) by @ToddHebebrand in #1358
- test(monitoring): de-flake TestApplyConfigRestopsAndRestarts by @ToddHebebrand in #1328
- test(e2e): app-layer seed routine for fresh-DB fixtures (#518) by @ToddHebebrand in #1353
- fix(agents): honor Org > General agent update policy in heartbeat by @ToddHebebrand in #1305
- fix(api): token-based fallback for AI cost tracking ($0.00 bug) by @ToddHebebrand in #1335
- fix(agent): honor software-update version pin on macOS and Linux (#993) by @ToddHebebrand in #1339
- fix(agent): reliable /run/breeze at boot via RuntimeDirectory= (#1297) by @ToddHebebrand in #1340
- feat(events): emit siteId on live-event payloads so site-restricted users get in-site events by @ToddHebebrand in #1347
- feat(auth): observability + status detail for inactive-tenant auth denials (#719) by @ToddHebebrand in #1348
- fix(auth): reconcile stranded pending partners on either activation ordering (#718) by @ToddHebebrand in #1349
- feat(ticketing): Phase 4 email-to-ticket ingest backend (PR 1) by @ToddHebebrand in #1360
- feat(agent/pam): wire ETW detection → dialog → decision → actuate (#1253) by @ToddHebebrand in #1363
- test(api): catch-block wiring coverage for SSRF sync errors — DNS + SentinelOne (#1035 item 2) by @ToddHebebrand in #1354
- feat(timezone): partner-tz default + shared resolver (#1318 phase 1) by @ToddHebebrand in #1345
- fix(warranty): gate alerts on assigned policy + suppress AppleCare rolling-expiry noise by @ToddHebebrand in #1344
- feat(audit): external append-only anchor for the audit hash-chain (#916) by @ToddHebebrand in #1351
- feat: process-level resource drill-down (Phase 1: CPU + RAM) by @ToddHebebrand in #1359
- fix(audit): green main's Integration Tests + complete #1351 erasure wiring by @ToddHebebrand in #1366
- security(mcp/oauth): fix scope-tier bypass, OAuth revocation gaps, site-axis leak by @ToddHebebrand in #1282
- feat(devices): unified Devices list surfaces network devices (#1322 phase 1) by @ToddHebebrand in #1356
- feat(discovery): honest subnet-grouped topology view, stop synthetic edges by @ToddHebebrand in #1343
- feat(patches): ring-owned auto-approval gate (phase 1 of #1317) by @ToddHebebrand in #1355
- fix(web): honor registration toggle at runtime, not build time (#1308) by @bdunncompany in #1312
- fix(remote): tear down live remote sessions on revocation + AI-tool site scope by @ToddHebebrand in #1283
- feat(catalog): product catalog — items, per-org pricing, bundles (billing sub-project 1) by @ToddHebebrand in #1365
- feat(web): added profile theming section & font selection by @ramphex in #1307
- fix[web][api]: agent install and uninstall scripts are publicly available and cleaned up by @ramphex in #1310
- feat: Add self-hosted guided setup by @ramphex in #1140
- fix(installer): require --token in install.sh, demote --enrollment-secret to supplement by @ToddHebebrand in #1329
- feat(ticketing): Phase 4 email-to-ticket outbound — threading + autoresponder (PR 2) by @ToddHebebrand in #1361
- fix(scope): normalize org-scoping — page-aware selector, partner-wide catalog records, fleet-action safety by @ToddHebebrand in #1357
- feat(ticketing): Phase 4 email-to-ticket settings + review queue (PR 3) by @ToddHebebrand in #1362
- fix(ticketing): lazy returnQueueCols — unbreak main Test API (module-load schema deref) by @ToddHebebrand in #1370
- feat(client-ai): Breeze AI for Office — multi-host platform (Excel + Word; host-keyed server + shared core) by @ToddHebebrand in #1314
- feat(billing): Invoice Engine — invoices, lines, payments, PDF, portal (sub-project 2/4) by @ToddHebebrand in #1383
- fix(api): stop invoice routers leaking auth onto public routes (#1383 main smoke regression) by @bdunncompany in #1388
- fix(api): carve out 500MB body limit for software package uploads (#1377) by @bdunncompany in #1378
- chore(deps): bump node from
2bdb65etofb71d01in /apps/web by @dependabot[bot] in #1404 - chore(deps): bump node from
2bdb65etofb71d01in /apps/api by @dependabot[bot] in #1405 - chore(deps): bump node from
2bdb65etofb71d01in /docker by @dependabot[bot] in #1406 - chore(deps): bump the expo-sdk group with 5 updates by @dependabot[bot] in #1391
- chore(deps): bump @types/node from 25.9.2 to 25.9.3 in /e2e-tests by @dependabot[bot] in #1397
- chore(deps): bump astro from 6.4.5 to 6.4.7 in the astro group across 1 directory by @dependabot[bot] in #1394
- chore(deps): bump @playwright/test from 1.60.0 to 1.61.0 in /e2e-tests by @dependabot[bot] in #1398
- chore(deps): bump @hono/node-server from 2.0.4 to 2.0.5 in the hono group by @dependabot[bot] in #1395
- chore(deps): bump react-native-gesture-handler from 2.31.2 to 2.32.0 in the mobile group by @dependabot[bot] in #1392
- chore(deps): bump @types/node from 25.9.2 to 25.9.3 in the typescript-tooling group across 1 directory by @dependabot[bot] in #1393
- chore(deps): bump eslint from 10.4.1 to 10.5.0 in the linting group by @dependabot[bot] in #1400
- chore(deps): bump jose from 6.1.3 to 6.2.3 by @dependabot[bot] in #1401
- chore(deps): bump the testing group across 1 directory with 2 updates by @dependabot[bot] in #1396
- feat(authenticator): risk-tiered step-up approvals — full feature (P1 foundation → P4 enforcement) by @ToddHebebrand in #1369
- fix(auth): run last_login_at + pre-auth self-writes under system DB context (#1375) by @ToddHebebrand in #1376
- feat(observability): contextless-write guard + unified worker error reporting (#1379) by @ToddHebebrand in #1380
- feat(web): add delete control to Software Library catalog by @bdunncompany in #1381
- enhance(web): normalize device OS labels by @ramphex in #1385
- perf(ticketing): kill the per-action refetch cascade in the queue UI by @ToddHebebrand in #1414
- fix(ticketing): theme-aware assignee select (white on dark theme) by @ToddHebebrand in #1413
- feat(billing): Recurring Contracts — auto-generated invoices on a cadence (sub-project 3/4) by @ToddHebebrand in #1411
- feat(office-addin): runtime config.json — deployment-neutral add-in bundle by @ToddHebebrand in #1416
- fix(caddy): serve the Invoice Engine MSP page at /billing/invoices (#1417) by @ToddHebebrand in #1421
New Contributors
Full Changelog: v0.70.0...v0.80.0