• Migrated eBPF backend from BCC to libbpf with CO-RE; ships prebuilt manylinux wheels for x86_64 and aarch64
• Rewritten web UI with overview / explore / live / drilldown tabs
• Rebuilt TUI on a sidebar layout with improved usability, find filter, and live tab
• New picosnitch top command and live event feed
• systemd-aware CLI: status/start/stop/restart cooperate with systemctl
• No runtime PyPI dependencies (except optional SQL drivers), safer supply chain and simpler install
• Hardened log file opens, read-only SQLite for viewers, dropped-privilege subprocesses
• Reworked SQLite schema (v4): lookup tables for exes/conns, separate events table, address family / protocol / netns columns, send-byte capture on write/writev
• Track grandparent process for richer attribution; resolve correct exe path for multi-call hardlinked binaries
• New TOML config format and FHS-standard paths for config, data, logs, and cache