0.93.0 (2026-06-29)
Added
- add a Simple mode to the New Schedule flow (#1495) (3bece54)
- add cron scheduling mode for image update checks (#1460) (7320a86)
- add node update alerts with changelog tab and skip-version handling (#1463) (315e8b6)
- add ON/OFF toggle for host threshold alerts (#1456) (b7dd9dc)
- add per-stack project env file selection for Docker Compose (#1457) (a698aaa)
- add posture reasons and review queue to Security overview (#1462) (0384c47)
- add Reduced motion setting and polish chrome, files, and stack-detail (#1501) (b5810a9)
- add syntax highlighting to .env editor tab (#1459) (3bf677a)
- appearance: add Calm/Signature visual style, readability mode, and chart palette (#1407) (8d9e657)
- files: copy & duplicate, bulk actions, disk-backed uploads, and an accessible file tree (#1409) (37e6e48)
- fleet: cross-node bulk label assign with authoritative label discovery (#1389) (d26ab58)
- make all security features available on every tier (#1502) (04e6902)
- per-stack storage inventory and portability guardrails (#1399) (9ea2864)
- purge scan data for deleted images and stacks (#1467) (26d557a)
- resources: render anonymous volume names readably in the volume browser (#1429) (401980f)
- scheduler: add helper text and risk badges to scheduled action picker (#1449) (7982251)
- scheduler: consistent action targeting in Scheduled Operations (#1431) (bc8c051)
- scheduler: flag one-shot tasks in the Scheduled Operations table (#1433) (2c70e11)
- scheduler: group schedule action picker by operator intent (#1446) (cc78873)
- security: action-posture Security dashboard with exploit intel and triage (#1424) (f794702)
- security: gate deploys on exploitation risk, not just severity (#1432) (6527bc9)
- security: prioritization-led Overview charts (posture + exploit intel) (#1427) (b163078)
- security: surface Compose internet-reachability exposure in posture (#1442) (3a22f59)
- show container name in structured log output (#1452) (f1f64ec)
- show node and fleet targets on schedule timeline pills (#1480) (5960c1e)
- sidebar: surface partial status for multi-container stacks (#1426) (bb4ddde)
- sortable resource tables and richer dashboard stack-health columns (#1498) (60536aa)
- split Host Alerts into Host Alerts, Container Alerts, and Stacks guardrails (#1461) (e9c262a)
- stacks: browse and edit mounted volume files in the explorer (#1403) (b9d8e9f)
- stacks: per-stack environment inventory and secret-safe guardrails (#1397) (57a0856)
Fixed
- always reconcile the scan banner with the current policy verdict (#1488) (3343630)
- bind fleet stop-by-label to the exact confirmed nodes and stacks (#1506) (1dc12f7)
- bind the node-update changelog to the advertised release version (#1492) (4cf0405)
- block file-explorer binds that overlap Sencho's application directory (#1479) (3e2f045)
- build: patch bundled Docker CLI golang.org/x/net to v0.55.0 (#1421) (7c5ba1c)
- classify degraded remote stacks as partial on the compatibility path (#1511) (e9c2c0c)
- clear stale node-update changelog notes when a refetch fails (#1494) (ed06900)
- clear structured log viewer rows on stack switch (#1448) (79f840a), closes #1444
- contain file-explorer binds into Sencho's system directories (#1484) (73f4bc2)
- contain file-explorer binds into Sencho's temporary and tool directories (#1487) (3386c63)
- contain file-explorer binds that reach dangling symlinked managed paths (#1490) (bee0dfd)
- contain file-explorer binds that reach symlinked Sencho-managed paths (#1489) (349ee1f)
- contain file-explorer writes and browse reachable out-of-base binds (#1465) (1c82e3e)
- containers: guard container and port reads with stack:read (#1416) (82cc139)
- copy the full finding set when reusing a cached scan for the deploy gate (#1476) (000a592)
- dependency-map: stop flagging env-var bind mounts as missing volumes (#1468) (5e2194f)
- deploy: preserve compose.override.yml when Mesh is enabled (#1420) (b753d2d)
- deploy: verify atomic-deploy backup integrity before restore (#1422) (96b3c49)
- differentiate security action links and add suppression editing (#1500) (083442d)
- distinguish failed image-update checks from "up to date" (#1470) (d9b7911)
- drift: reconcile the drift ledger on deploy and timestamp its history (#1405) (f9c6c5f)
- drift: stop flagging declared external networks as drift (#1402) (b611f41)
- editor: suppress global hotkeys while the code editor is focused (#1413) (1c5b271), closes #1410
- enforce the originating user's role on remote WebSocket connections (#1508) (ef164f0)
- enforce the signed-in user's role on cross-node proxied requests (#1505) (78a742f)
- explain why a failed pre-deploy scan blocks a deploy (#1477) (628400a)
- export the full vulnerability list to CSV (#1472) (e3b3c3b)
- fire a one-time schedule on the exact chosen date and time (#1497) (cf0db36)
- gate cross-node HTTP and stop-by-label on remote RBAC capability (#1509) (997a6bb)
- harden cross-node fleet label actions and guard container reads (#1503) (05c483f)
- honor suppressions in the informational scan policy evaluation (#1481) (7c12081)
- keep security posture accurate for secret-only scans and any-severity KEVs (#1475) (89a13f5)
- keep the scan banner consistent with the deploy gate after suppression changes (#1485) (04e9d18)
- keep the schedule's stack selected on prefill and edit (#1496) (a6d431f)
- load the full vulnerability list in the scan detail sheet (#1483) (1bca75a)
- make Reduced motion gate overlays, standardize the tab band, and polish fleet/snapshots (#1504) (d6ce60d)
- name matched risk inputs in policy block messages (#1471) (ca496c8)
- name matched risk inputs in policy scan banner and alerts (#1473) (1de49f8)
- networking: treat host-network services as host-exposed in summaries (#1430) (2eafee3)
- persist a one-time schedule's run time so edit and disable keep its year (#1499) (ba57c67)
- preflight: suppress node-state checks when the Docker snapshot is unavailable (#1423) (2ed0164)
- probe remote RBAC capability live and enforce exact stop-result membership (#1510) (a7144d4)
- rank exploit-risk findings before the cap and disclose truncation (#1482) (7c9c640)
- rank the exploit-risk cap by the same tiers the overview list shows (#1486) (c2b508e)
- rate-limit: key authenticated requests by verified JWT, not unverified decode (#1412) (9480cc9)
- reject atomic restore when a checksummed backup file is missing (#1466) (eaf0642)
- render node-update changelog notes as formatted markdown (#1474) (6256131)
- render node-update changelog only for the advertised release version (#1493) (dd49ef6)
- request registry tokens with the target repository scope (#1478) (2911ccf)
- require node:read for fleet topology reads and hide Fleet without it (#1507) (dd76b13)
- schedule the first image-update check on the cron cadence after a restart (#1491) (3ad807b)
- scheduler: reject 6-field cron in Scheduled Operations (#1435) (db8bb70)
- search: don't open the command palette via Cmd/Ctrl+K while typing (#1414) (f91227d)
- security: fix Security page table layouts and exploit-risk pagination (#1434) (330f9f1)
- skip Docker Compose $$ escaped variables in Anatomy parser (#1450) (ba1be3c)
- stack the volume browser panels on phones so the file preview is readable (#1512) (8bec32d)
- stacks: harden stack file path containment against symlink escapes (#1415) (69ba0e6)