Security
- security(actions+integrations): Opt-in SSH/Ansible errors, SSRF/ReDoS (#4092)
- feat(infra): Log in to Redis with cloud IAM tokens (#4103)
- feat(infra): Add a Postgres role bootstrap and enforce-mode login check (#4107)
- feat(infra): Add a role upgrade command for existing installs (#4111)
- feat(infra): Set up database roles in the migrations container (#4113)
- security(infra): Drop the RLS bypass where the tenant is already known (#4135)
Case management
- feat(cases): Deliver case triggers through a Postgres outbox (#4068)
- fix(cases): Match tag event triggers on the event's tag (#4088)
- fix(tables+cases): Force row level security on dynamic tables (#4089)
- perf(cases): Start case-triggered runs in parallel (#4104)
Agents
- feat(agents): Add model lifecycle and opt-in retired model migration (#3949)
- feat(agents+ui): Agent session feed (#4065)
- feat(agents+api): Add session result types and API extension socket (#4067)
- feat(agents): Run workflow agent actions on the selected backend (#4081)
- fix(agents): Classify wrapped mid-stream rate limits as user errors (#4094)
- fix(agents): Stop LiteLLM cooldowns masking provider auth errors (#4096)
- fix(agents): Return the same workflow agent output on every backend (#4127)
- fix(agents): Set RLS context on public agent channel requests (#4133)
Integrations
- feat(integrations): Add Trend Vision One search, response, TI actions (#4098)
- feat(integrations): Add Swif actions and MCP server (#4106)
- fix(integrations): Fail MCP test cleanly if server is deleted mid-probe (#4122)
- feat(integrations): Add CrowdStrike batch RTR and quarantine actions (#4130)
Engine
- fix(engine): Retry actions interrupted by worker shutdown (#4095)
- fix(engine): Raise the executor shutdown drain to 10 minutes (#4099)
API
- feat(api): Name Git sync folders after resources instead of ids (#4101)
- feat(api): Store Git sync case tags in one file (#4124)
- feat(api): Sync workflow Python scripts as separate files (#4125)
- feat(api): Read OIDC client credentials from AWS Secrets Manager (#4136)
User interface
- feat(ui): Add Cmd+K command palette for navigation (#3959)
- feat(enterprise+ui): Gate forms on the entitlement only, no feature flag (#4087)
Infrastructure
- docs(infra): Add Redis sizing guidance to the scaling guide (#4097)
- feat(infra): Own dynamic tables with a configured DB role (#4102)
- fix(infra): Block disabling RLS on dynamic tables outside migrations (#4105)
- fix(infra): Exempt the RLS guard's function owner on RDS (#4114)
- fix(infra): Keep database role setup off for new Compose installs (#4123)
- fix(infra): Make TRACECAT__DB_ROLE_LOGIN the switch for role setup (#4126)
- feat(infra): Log in to Postgres with cloud IAM tokens (#4131)
Dependencies
- build(deps): Update DuckDB to 2.0.0 (#4093)
- build(deps): Bump follow-redirects, glob, and minimatch overrides (#4128)
- build(deps): Bump oauthlib and pyasn1 (#4129)
Fixes
- fix(build): Limit update-version to real version fields (#4086)
Full changelog: 1.5.0-alpha.1...1.5.0-alpha.2