Changes

• Fix service map connection label contrast in dark mode
  • PR: #3847
• fix(discovery): only offer "Show details" when a scan's status message is cut short
  • PR: #3846
• Rate limit status page api
  • PR: #3848
• Issue 3394
  • PR: #3849
• Add contextual AI insights for Real User Monitoring and services
  • PR: #3853
• Extend Ask AI insights to Kubernetes, Docker, Podman and infrastructure
  • PR: #3854
• Fix SCIM PatchOp user deactivation for Microsoft Entra ID
  • PR: #3852
• Fix metric event overlays to respect resource scope
  • PR: #3851
• Harden status page private-user data handling
  • PR: #3855
• fix(monitors): retry request and protocol failures consistently
  • PR: #3850
• test: fix SAML and metrics assertions failing on master
  • PR: #3857
• Fix Trust Center copy for immediate hard deletion
  • PR: #3856
• chore: declutter the repository root
  • PR: #3859
• Fix missing enterprise license instance activity timestamps
  • PR: #3860
• Make monitor root-cause and criteria messages easier to read
  • PR: #3858
• fix: remove monitor description length limit
  • PR: #3863
• Explain missing AI investigations on alerts and incidents
  • PR: #3862
• Improve navigation search with product keywords and acronyms
  • PR: #3861
• fix: stop shipped links from depending on repository file paths
  • PR: #3864
• chore: declutter the repository root (packages/, agents/)
  • PR: #3868
• fix(session-replay): play a whole visit without a click per tab
  • PR: #3870
• feat(monitor): offer "Test Monitor" on the monitor overview
  • PR: #3869
• Collect IP, serial number, make and model as default host inventory attributes
  • PR: #3871
• fix(ci): restore migration timestamp ordering and fix lint on master
  • PR: #3872
• fix(ci): let the Inventory naming guard cite the OTel util's test suite
  • PR: #3873
• fix(release): stop the npm availability poll reading a stale packument
  • PR: #3875
• fix(release): install Common's dependencies even when its publish is skipped
  • PR: #3878
• chore: npm audit fix
  • PR: #3876
• Fix shared on-call calendar feed status permissions
  • PR: #3880
• fix: restrict payment-method requirement to Free plans
  • PR: #3881
• Improve SLO overview summary and remove redundant cards
  • PR: #3884
• Organize SLO detail navigation by task
  • PR: #3883
• Security Events: explain how detection rules and threat intel work
  • PR: #3888
• fix(secops): grade Google SecOps custom-rule detections by their meta severity
  • PR: #3887
• Fix permission bypass in multi-tenant team-member reads
  • PR: #3890
• fix: honor postmortem visibility in status-page responses
  • PR: #3889
• feat(security-events): severity volume chart over time on the Security Events page
  • PR: #3894
• fix: enforce policy access before creating escalation configuration
  • PR: #3892
• Enforce delegation limits when removing permission blocks
  • PR: #3891
• Fix alert and incident timestamps in monitor summaries
  • PR: #3893
• Fix TypeScript types in monitor timestamp regression tests
  • PR: #3895
• docs(ssrf): drop stale per-project private-network webhook references
  • PR: #3896
• docs: limit agent linting to modified files
  • PR: #3897
• Improve burn rate modal and prefill alert and incident settings
  • PR: #3886
• test(security-events): fix explorer test spy typing so it compiles under ts-jest
  • PR: #3898
• fix(probe): honor allowPrivateNetworkMonitors on Helm and Compose probes (#3879)
  • PR: #3899
• fix(auth): refresh an expired session instead of showing a bogus authorization error
  • PR: #3900
• feat(on-call): week/month Schedule Timeline across all schedules (project + team views)
  • PR: #3901
• fix(dashboard): show real resource names instead of "Unnamed Monitor"
  • PR: #3902
• fix(public-dashboard): send widget list reads through the public dashboard client
  • PR: #3904
• fix(dashboard): count Podman hosts in the Resources Affected summary
  • PR: #3903
• fix(dashboard): keep saved entity filter selections past the 1000-row list cap
  • PR: #3906
• fix(permissions): enforce a table-wide block whichever block row comes first
  • PR: #3907
• fix(common): enforce tenant scoping of the project relation on writes
  • PR: #3908
• fix(dashboard): show a telemetry attribute value missing from its options
  • PR: #3909
• fix(dashboard): keep table group-by keys missing from the attribute list
  • PR: #3910
• fix(public-routes): treat an undecodable access token as anonymous on public dashboard and status page routes
  • PR: #3911
• fix(dashboard): keep affected resources the viewer cannot read on save
  • PR: #3905
• fix(database): ignore client-supplied ids and query operators in write data
  • PR: #3915