Merge branch 'changelog' into 'master'

added changelog for 2026.11.0

See merge request CodeScoring/docs!639

Author: amaksimovv

docs/changelog/on-premise-changelog.en.md

@@ -5,6 +5,93 @@ hide:
 
 # Codescoring On-premise Changelog
 
+### 2026.11.0 – 2026-03-13
+
+#### Added
+
+- Added a dedicated alert page
+- Added Kaiten as a task manager integration
+- <span class="module-tag sca">SCA</span> Added EPSS data and related security policies to the vulnerability page
+- <span class="module-tag sca">SCA</span> Added CVSSv4 scores and related security policies to the vulnerability page
+- <span class="module-tag sca">SCA</span> Added the SSVCv2.0.3 score and related security policies to the vulnerability page
+- <span class="module-tag sca">SCA</span> Added protestware categories and related security policies to the vulnerability page
+- <span class="module-tag sca">SCA</span> Added publication, revocation, and update dates for vulnerabilities in a specific feed
+- <span class="module-tag sca">SCA</span> Added the ability to copy vulnerability identifiers on the vulnerability page
+- <span class="module-tag sca">SCA</span> Added a tooltip for the top description block on the vulnerability page
+- <span class="module-tag sca">SCA</span> Added a tooltip for the "Scan with hashes" field to the project settings
+- <span class="module-tag sca">SCA</span> Added the "Ignore note" field to the policy ignores table in the PDF report
+- <span class="module-tag sca">SCA</span> Added the "Note" column to the CSV export on the alerts page
+- <span class="module-tag sca">SCA</span> Added sorting by the "Found at" column in "Affected dependencies" on the vulnerability page
+- <span class="module-tag sca">SCA</span> Added display of the number of successful SCA analyses in a project group
+- <span class="module-tag sca">SCA</span> Added highlighting of the "VCS" and "Licenses" fields on the project dependency settings page when changed manually
+- <span class="module-tag sca">SCA</span> Added an image hash filter on the CLI project scan history page
+- <span class="module-tag sca">SCA</span> Added a licenses column on the dependency page
+- <span class="module-tag sca">SCA</span> Linked the "Environment" and "Technology" filters on the Dependencies page
+- <span class="module-tag sca">SCA</span> Added the "Blocking status" field for alerts in PDF and CSV reports
+- <span class="module-tag sca">SCA</span> Added a column with a link to the alert page in the alerts table on the SCA project page
+- <span class="module-tag osa">OSA</span> Linked the "Repository" and "Repository manager" filters on the requests and packages pages
+- <span class="module-tag osa">OSA</span> Added an "Available" filter to the "Repository managers" page
+- <span class="module-tag osa">OSA</span> Added a CodeScoring user filter on the OSA requests page
+- <span class="module-tag osa">OSA</span> Added a field to configure the timeout for checking image availability in the registry before analysis
+- <span class="module-tag osa">OSA</span> Added the last scan date to the container page
+- <span class="module-tag osa">OSA</span> Added logging of successful completion and container image load statistics in the audit log
+- <span class="module-tag osa">OSA</span> Added marking an image as “Outdated” when a scan fails due to a missing image and cleanup of outdated images in `periodic_cleanup_osa_components`
+- <span class="module-tag osa">OSA</span> Added the `USE_JSON_LOG_FORMAT` environment variable in the OSA API that controls log format (default `true`)
+- <span class="api-tag">API</span> Added the `projects_isnull` filter to `/api/policies/`, `/api/policy_alerts_v2/`, `/api/settings/policy_ignores/`
+- License and vulnerability update runs from the Index API now create an audit log entry
+
+#### Changed
+
+- <span class="module-tag secrets">Secrets</span> Updated the model for assessing secret validity
+- <span class="module-tag secrets">Secrets</span> Changed the fine-tuning sampling methodology
+- <span class="module-tag osa">OSA</span> Changed container image loading logic to use explicitly specified media types
+- <span class="module-tag sca">SCA</span> Renamed a field in PDF report filters
+- <span class="module-tag sca">SCA</span> Changed the numbering field to the alert identifier in the "Policy Ignores" table of the PDF report
+- <span class="module-tag sca">SCA</span> Changed CVSS scores, metrics, and severity display: data now comes from the source with the highest score for each CVSS version
+- <span class="module-tag sca">SCA</span> Changed publication/revocation/update date display on the vulnerability page: shows the earliest publication and revocation dates and the latest update date across sources. Policies with conditions on these properties will be updated on the next project, image, or package scan
+- <span class="module-tag sca">SCA</span> Changed the provider priority for vulnerability metadata: CVE.ORG, GHSA, Kaspersky, BDU, then others in alphabetical order
+- <span class="module-tag sca">SCA</span> Changed the color for the "critical" CVSS severity level
+- <span class="module-tag sca">SCA</span> Updated the "Impact" field text on the vulnerability page for the Kaspersky feed
+- <span class="module-tag sca">SCA</span> Improved criticality display on the vulnerability page
+- <span class="module-tag sca">SCA</span> <span class="module-tag osa">OSA</span> Simplified SBOM parameter editing for SCA projects and container images: settings open in edit mode by default and can be saved with a single action
+- <span class="api-tag">API</span> Changed the `impacts` field format for vulnerabilities in the relevant API methods to `pk-name`
+- Changed the release-date policy logic: only the date (no time) is now considered, and time is no longer shown in the UI
+- Updated base images for backend / tasks-*, judge, index-proxy, osa, and frontend (Alpine 3.23.3, nginx 1.29.5)
+- Removed default scopes when configuring OIDC
+
+#### Fixed
+
+- <span class="module-tag osa">OSA</span> Fixed scanning images with missing alerts
+- <span class="module-tag osa">OSA</span> Optimized security policies processing for requests with more than 100 packages
+- <span class="module-tag osa">OSA</span> Optimized OSA API: standardized access checks and request context handling, improved token and key caching
+- <span class="module-tag osa">OSA</span> Fixed desynchronization between the policy service and OSA when checking dependency policies
+- <span class="module-tag sca">SCA</span> Fixed dependency graph scaling
+- <span class="module-tag sca">SCA</span> Fixed saving vulnerability reachability results for existing projects
+- <span class="module-tag sca">SCA</span> Fixed vulnerability source names in SBOM export
+- <span class="module-tag sca">SCA</span> Fixed duplicate rows in the "Affected images" table on the vulnerability page
+- <span class="module-tag sca">SCA</span> Fixed counting vulnerabilities with missing CVSS3 severity on SCA project and project group pages
+- <span class="module-tag sca">SCA</span> Fixed dependency, vulnerability, and alert counts in project groups when no SCA analysis has been performed
+- <span class="module-tag sca">SCA</span> Fixed the missing `"language"` property for dependencies in SBOM export formats `1.6_ext` or `1.7_ext`
+- <span class="module-tag sca">SCA</span> Fixed OSS Index integration in SCA
+- <span class="module-tag sca">SCA</span> Fixed updating the "fixed version" field for vulnerabilities where the latest fixed version was revoked
+- <span class="module-tag sca">SCA</span> Fixed vulnerability counts for dependencies in SCA scan history
+- <span class="module-tag sca">SCA</span> Optimized dependency page loading
+- <span class="module-tag tqi">TQI</span> Fixed author count errors in audit reports when repositories returned 404
+- <span class="module-tag tqi">TQI</span> Optimized author comparison algorithm and reduced false negatives
+- <span class="module-tag secrets">Secrets</span> Fixed a secrets serialization bug when analyzing a project connected via the "Other Git VCS" integration
+- <span class="module-tag sca">SCA</span> Fixed SBOM export filters behavior that caused the file to be exported in full regardless of selected content
+- <span class="module-tag osa">OSA</span> Fixed image scanning via OSA API when the specified repository manager had not been created
+- <span class="module-tag osa">OSA</span> Fixed duplicate image tags appearing when loading images from the registry
+- <span class="api-tag">API</span> Fixed the `/api/commits` schema: the `author.id` field is now `nullable`
+- Fixed report file downloads getting stuck in the "In progress" status when a save request fails
+- Fixed group rule creation being blocked when LDAP is unavailable
+- Fixed incomplete audit logging for policy actions
+- Removed usage of the `public` schema in migrations, which caused errors when migrating to PostgreSQL 15+ with a non-`public` schema
+
+#### Removed
+
+- <span class="module-tag secrets">Secrets</span> Deleting a project now removes the secrets found in it
+
 ### [2026.3.3] - 2026-03-12
 
 #### Added