google/timesketch 20261014 on GitHub

Release Announcements

Warning

Minimum Plaso Version (20260720): Starting with this release, Timesketch enforces a minimum Plaso version of 20260720 and migrates to direct Plaso storage reader APIs (#3905). If you maintain custom container images or worker deployments, you must upgrade plaso-tools to at least 20260720 before upgrading Timesketch.
Incompatible Legacy .plaso Files: .plaso files created with earlier Plaso versions are not compatible with Plaso 20260720 and will fail to import into Timesketch.
- Workaround: Use a matching older version of psort to export the storage file to JSONL and upload the resulting .jsonl file to Timesketch.
Renamed Plaso Fields: Plaso 20260720 renamed computer_name to hostname and body to message_body. Built-in Timesketch analyzers and graphs support both (#3943), but custom saved views or queries targeting those fields may need to be updated for new timelines.

change(plaso): Upgrades the minimum required version of Plaso to 20260720 + introduce tasks_test.py by @jaegeral in #3905
OIDC Group/Role-Based Access Control and Membership Sync by @sasirven in #3877
Transition Gunicorn WSGI Workers to Threaded Model (gthread) by @jkppr in #3874
Implement Sec-Gemini BYOT Log Analysis Support by @jkppr in #3878
Add optional OPENSEARCH_INDEX_PREFIX for new installations by @je4yfc & @jkppr in #3935

fix(analyzers): support Plaso 20260720 field names (backwards compatible) by @jkppr in #3943
feat(llm): update SecGemini provider to parse attached JSONL findings by @samomi-oss in #3907
Add dependencies to tagger analyzer by @jkppr in #3930
reuse existing sketch if name is given by @cvandeplas in #3868
Remove deprecated Sketch.store_aggregation() by @p-nowodzinski in #3738
cli_client: Narrow api_client type in TimesketchCli.init to satisfy Pytype by @jaegeral in #3897

fix: prevent unauthorized collaborators from modifying owner permissions by @jaegeral in #3911
fix(delete): Fix soft delete crash when sketch was soft_deleted by @jaegeral in #3860
Fix importing events with large string fields by @dfjxs in #3932
Fix SecGemini LogStore signature compatibility by @samomi-oss in #3903
Fix non-SecGemini log analyzer reports 🤖🤖🤖 by @dev-rehaann in #3899
fix(cli): add config_section and imports by @jaegeral in #3866
fix(cli_client): fix JSONL export double newline and Pyrefly type error by @jaegeral in #3898
fix(cli_client): fix type annotation for columns parameter by @jaegeral in #3892
fix(cli_client): cast variables and default value by @jaegeral in #3893
fix(tests): Plaso tested version to evtx_20260512.plaso, opentelemetry-resourcedetector-gcp==1.14.0 and TelemetryTest by @jaegeral in #3882

build(deps): fix frontend-ng and frontend-v3 dependency alerts by @jkppr in #3947
build(deps): bump shell-quote from 1.8.4 to 1.11.0 by @jkppr in #3946
build(deps): bump dompurify from 3.4.12 to 3.4.13 in /timesketch/frontend-ng in the npm_and_yarn group across 1 directory by @dependabot[bot] in #3894
build(deps): bump websocket-driver from 0.7.4 to 0.7.5 in /timesketch/frontend-ng in the npm_and_yarn group across 1 directory by @dependabot[bot] in #3879
build(deps): bump the npm_and_yarn group across 1 directory with 2 updates by @dependabot[bot] in #3880
build(deps): bump the npm_and_yarn group across 1 directory with 6 updates by @dependabot[bot] in #3883
build(deps): bump the npm_and_yarn group across 1 directory with 3 updates by @dependabot[bot] in #3884
build(deps): bump the npm_and_yarn group across 1 directory with 3 updates by @dependabot[bot] in #3908
build(deps): bump the pip group across 1 directory with 2 updates by @dependabot[bot] in #3886
build(deps): bump the npm_and_yarn group across 1 directory with 8 updates by @dependabot[bot] in #3933
build(deps): bump the npm_and_yarn group across 1 directory with 10 updates by @dependabot[bot] in #3934
build(deps): bump the pip group across 1 directory with 5 updates by @dependabot[bot] in #3936

Full Changelog: 2026063...2026101