One post tagged with "github"

Version	Release Date
2026.8.0	August 27, 2026

System Requirements Update​

Ensure your infrastructure meets the latest requirements for optimal performance and security:

Component	Minimum Version	Recommended Version
KOTS	1.117.3	Latest
Kubernetes	1.30	1.35
PostgreSQL	15	17
Redis	6	7
ggscout	0.19.0	Latest

Helm & Upgrade Considerations​

To ensure compatibility, please review Helm values updates from the previous version. Air gap deployment? Find all the images and tag names in the air gap install page.

Feature highlights​

• ClickHouse on Self-Hosted: a new optional, in-cluster column-oriented database that powers features needing fast analytics over large volumes of data, starting with Endpoint Protection. It is deployed as a single-node StatefulSet backed by object storage you provide (S3-compatible, with Azure Blob Storage and GCS in progress), ships a clickhouse-backup sidecar for scheduled backups, and is available on both Helm and KOTS installs. PostgreSQL remains the primary datastore for the rest of the application. ClickHouse is optional in 2026.8 and becomes mandatory in 2027.1.0. Learn more or read the customer notice.
• GitHub check runs page: a dedicated Check runs page in the Perimeter section brings every check run into the dashboard with its status, repository, commit, and linked pull request. Filter and search across hundreds of thousands of runs, re-run or skip a check without switching to GitHub, and jump straight to the incidents a run detected. Learn more.
• Mention members and teams in incident notes: type @ in an incident note or feedback to mention a member or a whole team and notify them by email, on both Internal Monitoring and Public Monitoring incidents. Learn more.
• Set your own validity status by API: run the validity check yourself on the internal systems GitGuardian cannot reach, then send valid or invalid back with one API call. Incidents display Custom validity with the date it was set, and the change is recorded in the incident activity log and your audit log. Learn more.
• A smarter search bar: the unified filter bar is now enabled on self-hosted, letting you find incidents by secret value, commit author, or file path. Plain-English search (AI Filters) is included for self-hosted, but it only becomes available once a workspace administrator turns on the External LLM toggle under Settings > Workspace > AI and an LLM provider is reachable. Learn more or see AI Settings.

Secrets Detection Engine​

• v2.167: 11 new detectors (Azure SQL Credentials, Azure Machine Learning Key, Azure Video Indexer Key, Azure Health Insights Key, Azure Fluid Relay Key, LiteLLM API Key, DashScope API Key, Apify Proxy Token, Authress Access Key, and two Gemfury token variants), 3 improved detectors (Datadog API Credentials, Snyk Key, Okta Token with Host), 6 new or upgraded checkers (LiteLLM Without Host, LaunchDarkly SDK Key, Llama Cloud API Key, New Relic APM License Key, npm Token, Hume AI API Key), 1 analyzer fix (Figma Personal Access Token).
• v2.168: 4 new detectors (Azure Immersive Reader Key, DashScope Coding Plan API Key, DashScope Token Plan API Key, Prefect Cloud API Key), 2 new checkers (Alibaba Cloud IAM, GitLab Deploy Token), 7 improved detectors (Generic High Entropy Secret, Okta Token with Host, and HTML/Markdown scanning extended to npm, GitHub Personal Access, GitHub OAuth, GitHub App and Slack Application tokens), 2 hardened checkers (Auth0 Keys, Microsoft Power Apps Webhook).
• v2.169: 7 new detectors (Slack Webhook Trigger URL, n8n API Key, Atlassian Auth Key, AWS Cognito Access Token, OpenAI Access Token, Vercel OIDC Token, OpenCode API Key), 1 new checker (Supabase Service Role JWT), 15 improved detectors (GitHub and npm format validation, Generic Password, Generic High Entropy Secret, AWS IAM Keys, PostgreSQL Credentials, Azure Event Hub and Service Bus checkers, and more), 4 analyzer fixes (GitHub Enterprise custom host URLs, Google API Key 403 handling), 1 removed (Grafbase Access Token) and 1 disabled (Amadeus OAuth Credentials) as both services were discontinued.
• v2.169.1: 2 new detectors (Lovable Access Token, Lovable Git Token), and 4 improved detectors, where values failing format validation are no longer reported by generic detectors for GitHub Personal Access, GitHub OAuth, GitHub App and npm tokens.

Enhancements​

• Fine-grained GitHub personal access for private members monitoring (Public Monitoring perimeter); removal of the Display as Tree view from integration source pages for better performance on large perimeters. Learn more.
• Personal Access Tokens and Service Account Tokens can now be created through the public API for automated rotation workflows, automatic monitoring and automatic scan toggles reached Jira Cloud, Jira Data Center, Confluence Cloud, Confluence Data Center and Microsoft Teams, and a new Azure DevOps extension adds a ggshield scan job to every pipeline in an organization with a single pipeline decorator. Learn more.
• The "Only use detectors with validators" option is now settable on custom sources through the public API, and tooltips on disabled source actions explain why monitoring, criticality, or team assignment is unavailable. Learn more.
• Self-Hosted: Added tunable emptyDir volume limits for the ml-secret-engine pod in the Helm chart.

Fixes​

• Multi-factor authentication emails now reach users who were globally unsubscribed in the email delivery system, push events no longer trigger a full repository clone when cached data is available, the Slack integration no longer monitors channels that were not manually added when auto-monitor is off, and incident feedback mentions display the member's name instead of a raw identifier. Learn more.
• Scans triggered via a Personal Access Token now emit an audit log event, the "Edit issue" dialog no longer closes unexpectedly, notifier team names are populated on workspaces with more than 100 teams, deactivated members no longer appear in the grant access dialog, a disabled detector can no longer block a pull request through GitHub check runs, the JFrog Container Registry reachability check now routes through ggbridge, GitLab sources marked as monitored are reflected in the perimeter view, and the decoded claims panel of a JWT secret no longer breaks on malformed claims. Learn more.
• A missing endpoint was added to the OpenAPI specification, incident IDs are displayed in the ID column again, an off-by-one issue in the dashboard date filter was corrected, and bulk scan requests no longer fail when enqueuing a very large number of sources at once. Learn more.
• Self-Hosted:
  • Celery worker pods failed their liveness and readiness probes on FIPS images and never reached a ready state, which blocked the deployment from completing.
  • The in-app analytics dashboards no longer query Public Monitoring data or report a monitored perimeter developer count on self-hosted instances, where neither is applicable.