CHANGELOG

# ServiceRadar v1.1.3

Release hardening for web-ng MixRelease builds, plus GodView JS architecture/test cleanup.

## Whats New

**1.1.3**
- Hardened Bazel `mix release` packaging for web-ng, including dependency patching and improved Bun asset install behavior in remote release builds.
- Fixed Ash domain configuration drift by registering `ServiceRadar.Spatial` in core/web-ng configured domain lists used during release compilation.
- Added a local release preflight target (`make web-ng-release-check`) to validate `//elixir/web-ng:release_tar` before CI.
- Refactored GodView JS context APIs toward clearer namespacing/composition and expanded contract/drift tests for graph/layout/rendering behavior.
- Tightened JS quality workflow with Bun + Vitest + ESLint alignment across lint/test/precommit paths.

# ServiceRadar v1.1.2

Arancini-backed BMP ingest, BMP observability workflows, and EventWriter JetStream durability improvements.

## Whats New

**1.1.2**
- Switched BMP ingest to Arancini and aligned deployment/runtime defaults for `ghcr.io/carverauto/arancini:v0.7.2`.
- Added `bmp_events` SRQL support and a dedicated Observability BMP page for routing-focused investigation.
- Added/validated BMP routing investigative indexes and retention behavior for `platform.bmp_routing_events`.
- Hardened EventWriter JetStream durable consumer behavior for causal streams and reduced unhandled/default processor noise.
- Updated release/deployment defaults to use the corrected Arancini image label flow instead of transient branch tags.

# ServiceRadar v1.1.1

Mapper/DIRE robustness hardening, SNMP enrichment rule improvements, topology projection fixes, and device enrollment profile updates.

## Whats New

**1.1.1**
- Added SNMP fingerprint normalization and rule-driven enrichment improvements for vendor/type/model inference, including Ubiquiti-specific router/switch/AP detection refinements.
- Improved DIRE ingest behavior for duplicate-IP/device identity handling and strengthened test coverage for bulk upsert conflict recovery paths.
- Fixed Apache AGE topology projection compatibility issues and improved mapper interface/link graph ingestion reliability.
- Added robust tests for mapper topology confidence handling, stale-link pruning, and idempotent link updates.
- Improved device enrollment profile behavior and related platform integration paths for more consistent onboarding outcomes.

# ServiceRadar v1.1.0

DIRE device deduplication fixes, OpenTelemetry tracing, and gateway hardening.

## Whats New

**1.1.0**
- Fixed DIRE agent deduplication: `agent_id` is now registered in `device_identifiers` during both agent enrollment (`AgentGatewaySync`) and sync ingestion (`SyncIngestor`), preventing duplicate devices when agents restart with new IPs.
- Data cleanup migration consolidates duplicate agent devices (e.g. 37+ k8s-agent records) into a single canonical device and backfills missing `agent_id` identifiers.
- Fixed mapper interface ingestion: `lookup_device_uids_by_ip` now prefers `sr:` device UIDs when multiple devices share an IP, preventing interfaces from being assigned to the wrong device.
- Fixed binary UUID conversion in DIRE identity reconciler to prevent crashes during device resolution.
- Added OpenTelemetry tracing support for Elixir applications with trace summary refresh.
- Hardened gateway proxy authentication and authorization checks.
- Fixed sweep processor availability checks and missing sweep group ID handling.
- Fixed GRPC channel restart logic (`restart_channel/3`) for agent gateway connections.
- Fixed OTEL trace summary materialized view refresh failures.

# ServiceRadar v1.0.92

Performance and reliability improvements for the observability dashboard and RBAC system.

## Whats New

**1.0.92**
- RBAC permission lookups now use a tiered cache: in-memory ETS first, then database failover — eliminating redundant DB round-trips on every request.
- Observability page queries are dramatically faster: replaced coalesce(observed_timestamp, timestamp) with direct timestamp filtering, enabling TimescaleDB chunk exclusion and index usage instead of full sequential scans.
- Added NATS ingest notifier for live dashboard refresh: a lightweight GenServer subscribes to processed log/flow subjects and bridges notifications to PubSub with debounce, so the observability page updates automatically when new data arrives.
- Fixed device creation via the UI by removing the pre-read race and handling unique UID conflicts cleanly.
- Fixed device delete and restore actions (proper deleted_by/reason handling plus stale-record recovery).
- Added error logging for device create/delete/restore failures so issues show up in server logs.
- Updated the netflow collector to parser 0.9.0 with cached flows, capped pending flows, and refreshed test fixtures.

# ServiceRadar v1.0.91

Docker compose stability fixes for agent enrollment and core-elx builds.

## Whats New

**1.0.91**
- Docker compose agent now resolves the gateway consistently via `agent-gateway.serviceradar`, preventing enrollment failures.
- Core-elx Docker build includes the Rust workspace and updated toolchain so SRQL NIFs compile reliably.
- Startup migrations now set the database search_path before running and avoid changing ownership on AGE sequences owned by tables.

# ServiceRadar v1.0.90

Netflow visibility and log-to-event promotion are now live.

## Whats New

**1.0.90**
- Netflow ingestion and flow observability pipeline are enabled.
- Log promotion rules now generate OCSF events for analytics and alerting.

# ServiceRadar v1.0.89

Edge onboarding gateway defaults and mTLS SNI fixes.

## Whats New

**1.0.89**
- Edge onboarding bundles now derive gateway addresses from the base site URL (e.g., demo.serviceradar.cloud -> demo-gw.serviceradar.cloud:50052).
- Gateway TLS server_name defaults to serviceradar-agent-gateway to match the gateway certificate and avoid mTLS SNI failures.

# ServiceRadar v1.0.88

WASM plugin runtime fix for TinyGo-compiled plugins.

## Whats New

**1.0.88**
- Fixed WASI clock_time_get nil pointer crash when TinyGo plugins call time.Now(). The issue was caused by TinyGo's _start function calling proc_exit(0), which closed the module and cleared the Sys context before the plugin entrypoint could run.
- Module config now uses WithStartFunctions() to disable automatic _start execution, keeping WASI clock functions operational.

# ServiceRadar v1.0.87

Database connectivity and AGE graph permission fixes.

## Whats New

**1.0.87**
- Fixed PostgreSQL search_path configuration that caused "relation does not exist" errors for device tables. The search_path was incorrectly stored as a single quoted identifier instead of separate schema names.
- Added auto-detection and correction of misconfigured search_path on startup migrations.
- Fixed Apache AGE graph schema privileges so the app role can execute Cypher queries for interface topology.

# ServiceRadar v1.0.86

Docker startup reliability and TLS infrastructure improvements.

## Whats New

**1.0.86**
- Fixed Postgrex type compilation for Bazel builds (removed defmodule wrapper around Postgrex.Types.define/3).
- Startup migrations now sync Ecto schema_migrations to Ash ash_schema_migrations, fixing 503 errors after DB migrations complete.
- Wildcard TLS certificate infrastructure added for serviceradar.cloud subdomains, avoiding Let's Encrypt rate limits on namespace recreation.
- Helm ingress template now supports default SSL cert fallback when secretName is empty.
- Startup migrations refactored to satisfy Credo complexity rules.

# ServiceRadar v1.0.85

Edge onboarding reliability and packaging fixes.

## Whats New

**1.0.85**
- Edge onboarding now uses gateway-issued certs with URI SAN enforcement; missing SANs are rejected.
- Agent enrollment CLI now backs up existing config/certs, fixes ownership, and restarts the agent automatically.
- Edge package UI copy actions, live package status updates, and enroll command guidance improved.
- Agent systemd unit now logs to journald and starts only after enrollment assets exist.

# ServiceRadar v1.0.84

Credential hardening and Helm quality-of-life updates.

## Whats New

**1.0.84**
- CNPG credentials are now generated and persisted (no static defaults); existing installs must seed/rotate secrets on upgrade.
- Docker Compose now stores CNPG credentials in a dedicated volume and keeps CNPG port binding loopback by default.
- Helm defaults now target latest ServiceRadar images to reduce manual tag churn.

# ServiceRadar v1.0.83

Compose stack reliability and schema hygiene improvements.

## Whats New

**1.0.83**
- Docker Compose core-elx healthcheck now tolerates long migrations to avoid cascading startup failures.
- flowgger and trapd are enabled in the default compose stack; faker moved to the dev profile only.
- discovered_interfaces timestamps are migrated to `timestamptz` to eliminate Timescale warnings.
- Oban schema validation and startup migration checks refactored for clearer diagnostics.
- CNPG credentials are now generated and persisted (no more static defaults); existing installs must seed/rotate secrets on upgrade.

# ServiceRadar v1.0.82

Release workflow fixes and packaging reliability improvements.

## Whats New

**1.0.82**
- Release workflow now prefers explicit GHCR credentials when provided, avoiding stale docker auth overrides.
- Bun tooling updated for lockfile compatibility and deterministic SSR bundling.
- Mix release bundling uses a clean React component base to avoid importing node_modules during SSR builds.
- CNPG rootfs export now uses the OCI layout helper to avoid crane layout parsing failures.
- ARC runner build image refreshed with missing build dependencies.
- Ash domain config warnings cleaned up in core-elx/test configs.

# ServiceRadar v1.0.80

Dusk blockchain monitoring is now embedded directly in the agent.

## Whats New

**1.0.79**
- Dusk monitoring merged into serviceradar-agent: the standalone `dusk-checker` binary is removed; monitoring is now an embedded service following the same pattern as sysmon and SNMP.
- Added `DuskProfile` Ash resource with SRQL-based device targeting for centralized dusk configuration management.
- Added `DuskCompiler` for config generation and delivery via the agent config distribution system.
- Agents with no dusk profile receive a disabled config by default (opt-in monitoring).
- Config hot-reload support: agents pick up profile changes without restart.
- New documentation: `docs/docs/dusk-profiles.md` covers profile management and migration.
- Fixed missing `otel_trace_summaries` materialized view that was breaking Analytics and Observability pages.
- Added database schema management rule: all schema changes must be in Elixir migrations only (db-event-writer is data ingestion only).
- Improved ArgoCD application configs with CNPG cluster protection to prevent accidental data loss.

# ServiceRadar v1.0.78

SNMP and network discovery configuration is now much easier to manage via the UI.

## Whats New

**1.0.78**
- Settings → Configuration Management now includes dedicated forms for `mapper` and `snmp-checker`, with JSON view still available for advanced fields.
- Poller check configuration now offers a “Check Kind” dropdown (e.g. Sysmon) and better mapper discovery UX (no more pasting raw JSON).
- Helm: kong-config images now honor configured tags/pull policy (no hardcoded `latest`), improving reproducibility for release pinning.

# ServiceRadar v1.0.77

Device Details metrics now stay fresh, and demo-staging canary iteration is faster.

## Whats New

**1.0.77**
- Device Details now auto-refreshes metrics/availability and keeps the “last 24h” window sliding, preventing stale ICMP/Sysmon timestamps when the page stays open.
- Device Details metrics queries now fetch newest-first (fixes “Latest ICMP RTT” showing an old “xh ago” while values change, and restores recent points in the timeline).
- Added `make demo-staging-canary`, `make demo-staging-web`, and `make demo-staging-core` helpers to speed up staging canary deploy/test loops.
- Helm secret generator now keeps `admin-password` and `admin-bcrypt-hash` consistent to prevent demo login failures.

# ServiceRadar v1.0.76

CNPG auth rotation resilience, telemetry reliability improvements, and Helm publish fixes.

## Whats New

**1.0.76**
- DB event writer now prefers `CNPG_PASSWORD_FILE` and can reload the CNPG pool when the mounted secret changes, preventing OTEL ingestion outages after password rotations.
- Watcher snapshots no longer depend on per-key KV TTL; stale status is derived from snapshot timestamps, improving watcher telemetry reporting.
- Release workflow now installs Helm before publishing the OCI chart to GHCR (fixes `helm: command not found`).
- Helm chart now honors `global.imageTag` for db-event-writer and KV bootstrap jobs.

# ServiceRadar v1.0.75

Release staging automation and Helm OCI distribution.

## Whats New

**1.0.75**
- Release workflow now publishes the official Helm chart to GHCR as an OCI artifact (`oci://ghcr.io/carverauto/charts/serviceradar`).
- OCI images are tagged with the semantic version (`v1.0.75`) alongside `sha-<commit>` and `latest`.
- Added a demo-staging environment and post-release e2e smoke tests to validate deployments before promotion.
- Updated Helm deployment documentation to reference the published OCI chart.
- Reduced CI flakiness in KV watcher tests.

# ServiceRadar v1.0.70

Sysmon bare-metal mTLS defaults, edge onboarding fixes, and query/runtime hardening.

## Whats New

**1.0.70**
- Sysmon checker packages for RPM/deb installs now ship with mTLS defaults (instead of SPIFFE) and look for certs/config in standard bare‑metal paths.
- Edge onboarding for sysmon checkers fixed: defaults to mTLS when security mode is omitted, includes correct endpoint SANs, and installs certs with proper ownership/permissions.
- Core now ingests sysmon metrics from any gRPC service named `sysmon-*`, preventing UI‑configured checks from going stale.
- Sysmon checker implements `GetResults` (matching poller expectations) and builds from shared `monitoring.proto`.
- SRQL adds `process_metrics` entity so UI Process Details queries no longer 400.
- Bazel npm `__links` repos synced for React/Next CVE bumps; added `scripts/sync-npm-links.py` to automate future updates.
- Short Go test timeout raised to avoid race/coverage flakiness.

# ServiceRadar v1.0.69

Edge onboarding lint cleanup and test consolidation.

## Whats New

**1.0.69**
- Consolidated edge onboarding checker template fetch tests into table-driven coverage to remove duplication while keeping security-mode preference and fallback paths validated.
- Introduced a static sentinel error for component template listing tests to satisfy lint requirements without changing runtime behavior.
- `make lint` now passes cleanly across Go and Rust targets for this release.

# ServiceRadar v1.0.68

Docker Compose KV seeding restored and JetStream consumers hardened.

## Whats New

**1.0.68**
- Restored KV-backed configuration seeding in Docker Compose (including poller stack) so core/agent/poller/zen/db-event-writer bootstrap datasvc and surface in the UI; docs updated accordingly.
- Bundled a Compose-ready NATS context inside `serviceradar-tools` for local JetStream/KV inspection without pulling extra images.
- Hardened the db-event-writer JetStream consumer with retrying connection/setup logic to survive NATS restarts during Compose bring-up.
- Zen now ignores the initial KV watch event when CONFIG_SOURCE=kv to avoid spurious restarts on first sync.

# ServiceRadar v1.0.66

Rust edge onboarding improvements and build/deployment updates.

## Whats New

**1.0.66**
- Enhanced Rust edge onboarding library with improved mTLS bootstrap and configuration handling.
- Added Bazel build targets and RBE platform configuration for RHEL 9 (RH9).
- Fixed potential deadlock issues in core services.
- Updated Docker Compose configurations and container registry settings.
- Various Bazel build fixes for improved CI/CD reliability.

# ServiceRadar v1.0.65

Security patch release addressing multiple Dependabot alerts.

## Whats New

**1.0.65**
- Upgraded Tailwind CSS from v3 to v4.1.17 to remediate glob vulnerability; migrated to CSS-first configuration.
- Fixed brace-expansion vulnerability via pnpm override to force v1.1.12.
- Fixed js-yaml vulnerability via pnpm override to force v4.1.1.
- Removed xlsx dependency and ExportButton component to eliminate SheetJS vulnerability (no patched version on npm).
- Switched lodash.set to lodash/set from patched lodash 4.17.21 to fix prototype pollution vulnerability.
- Upgraded pprof from 0.14 to 0.15 in ebpf profiler to use patched protobuf 3.7.2.
- Cleaned up orphaned Cargo.lock files and fixed MODULE.bazel profiler lockfile path.
- Updated GitHub workflow to use pnpm instead of npm for web linting.

# ServiceRadar v1.0.64

Edge onboarding support for Rust sysmon checker.

## Whats New

**1.0.64**
- Added edge onboarding library (`rust/edge-onboarding`) for Rust-based checkers, mirroring the Go `pkg/edgeonboarding` package.
- Integrated mTLS bootstrap into the sysmon checker with `--mtls`, `--token`, `--host`, and `--cert-dir` CLI flags.
- Supports `ONBOARDING_TOKEN` environment variable for zero-touch token-based installation.
- Generates and persists checker configuration from onboarding packages with proper certificate permissions.
- Updated AGENTS.md with edge onboarding testing playbook for Docker mTLS Compose stack.

# ServiceRadar v1.0.63

Next.js/React security patch and AGE graph permissions fix.

## Whats New

**1.0.63**
- Updated the web UI to Next.js 16.0.7 with react-dom 19.2.1 to remediate December 2025 advisories; rebuilt/pushed images (`sha-a85eb7e52726a5471913d0ba61d20ceb2d4d35da`) and refreshed the demo release.
- Hardened AGE graph bootstrap migrations with explicit extension/sequence grants and idempotent search_path defaults so CNPG upgrades no longer fail on permissions.
- Bumped SPIRE controller-manager resources and kept helm/chart defaults aligned with the new image tag.

# ServiceRadar v1.0.62

sysmon-vm renamed to sysmon-osx and security updates.

## Whats New

**1.0.62**
- Renamed sysmon-vm to sysmon-osx to better reflect macOS-specific system monitoring functionality.
- Updated React and Next.js dependencies with latest security patches.

# ServiceRadar v1.0.61

Device registry backed by Apache AGE plus refreshed UI.

## Whats New

**1.0.61**
- Wired the device registry to Apache AGE, enabling graph-backed queries for neighborhood and capability traversal.
- Shipped UI updates to surface the new graph data and align the device views with the registry changes.

# ServiceRadar v1.0.60

mTLS compose sysmon canonicalization and release rebuild.

## Whats New

**1.0.60**
- Fixed sysmon ingestion to resolve canonical device IDs so UI/device sysmon CPU panels now show data for mTLS sysmon-osx checkers (e.g., `sr:88239dc2-7208-4c24-a396-3f868c2c9419`).
- Rebuilt/pushed all compose-mtls images with tag `sha-0bc21e5ee79be0eb143cddd6fc7601f739c39f21` and refreshed the stack.

# ServiceRadar v1.0.59

Identity reconciliation sweep merge and demo rollout.

## Whats New

**1.0.59**
- Merged sweep sightings directly into canonical devices when IPs map to strong-ID inventory, draining the ~50k backlog and surfacing sweep availability/port data on unified devices.
- Rebuilt and deployed demo images (app tag `sha-6a68e409931e4b148541b6a8eb221f4bfeb60a14`) with helm values updated and pods rolled in `demo`.
- Locked faker IP shuffle to fixed cardinality and adjusted short CI to skip long churn simulation to keep pipelines stable.

# ServiceRadar v1.0.57

Demo messaging/poller stability.

## Whats New

**1.0.57**
- Increased NATS defaults to 1Gi/4Gi and rebuilt the JetStream pod to avoid OOM loops during KV/events recovery in the demo release.
- Raised poller defaults to 512Mi/1Gi so sweep workloads streaming ~50k devices no longer OOMKill; chart values now persist the fix.

# ServiceRadar v1.0.56

Helm demo hardening: flowgger OpenSSL fix, agent/poller stability.

## Whats New

**1.0.56**
- Rebuilt flowgger on a Debian testing base so OpenSSL 3.2 symbols are present, removed the init-container hack, and switched probes to TCP on 50044. Published as `ghcr.io/carverauto/serviceradar-flowgger:1.0.56`.
- Bumped agent defaults to 200m/512Mi requests and 500m/1Gi limits to avoid OOMs during sweep workloads; poller probes now use TCP instead of netcat to drop libbsd dependency.
- Added CNPG app bootstrap job to create/own the `serviceradar` DB/user with charted credentials and grant privileges automatically on install/upgrade.
- Ensured poller ServiceAccount is rendered so the deployment can schedule cleanly.

# ServiceRadar v1.0.55

ARC runner and release hardening.

## Whats New

**1.0.55**
- Published a custom ARC runner image with cmake, flex/bison, perl, protoc, and OpenSSL headers so Bazel genrules no longer depend on GitHub runner OS packages.
- Wired TimescaleDB/AGE builds to use bundled toolchain binaries and resolved Bazel protoc selection in the rperf checker build script for reliable remote execution.
- Defaulted release builds to skip Turbopack and vendored OpenSSL to reduce host coupling on ephemeral runners.
- Re-cut release after stabilizing ARC runner autoscaling and exporting OpenSSL paths for RBE.

# ServiceRadar v1.0.54

TimescaleDB extension rebuild for CNPG image.

## Whats New

**1.0.54**
- Bundled a hermetic CMake into the TimescaleDB extension layer build so Bazel releases succeed even when executors lack cmake, re-cutting the v1.0.54 tag.
- Added Debian/Ubuntu GCC 11 built-in include directories to the BuildBuddy toolchain so protobuf/utf8_range builds stop failing with absolute include path checks during artifact publishing.

# ServiceRadar v1.0.54-pre6

Core admin UI polish and onboarding fixes.

## Whats New

**1.0.54-pre6**
- Added a sticky navigation rail plus mobile jump links for the Core Admin configuration form, and defaulted the heaviest panels (RBAC, Webhooks, Write Buffer) to collapsed view for faster scanning.
- Reworked edge onboarding to surface decoded key length/hex, support editing raw hex with automatic re-encoding, and generally structure default metadata inputs so operators can edit settings without dropping to JSON.
- Removed the SRQL editor in favor of the managed srql service; the integrations panel now only exposes MCP credentials with masked/copyable input.

# ServiceRadar v1.0.54-pre5

Release automation fixes (BuildBuddy remote execution).

## Whats New

**1.0.54-pre5**
- Release workflow now writes the full BuildBuddy remote cache/executor configuration so Bazel invocations run on the RBE cluster during artifact publishing.
- Applied the same remote defaults when seeding `.bazelrc.remote` to keep Docker image and package pushes off the GitHub runner.
- macOS sysmon VM package is now excluded automatically when the build host lacks the macOS toolchain, fixing Linux release runs.

# ServiceRadar v1.0.54-pre4

Release automation updates.

## Whats New

**1.0.54-pre4**
- Updated the GitHub release workflow to provide full BuildBuddy remote execution settings so release builds publish from the RBE cluster instead of the runner.
- Ensured supporting scripts respect remote BuildBuddy configuration during artifact packaging.

# ServiceRadar v1.0.54-pre2

UI and bug fixes.

## Whats New

**1.0.54-pre2*
- Refactored KV service -> DataService, added support for NATS JetStream object store
- UI bug fixes

# ServiceRadar v1.0.54-pre1

Dependency refresh and frontend framework upgrade ahead of the next stable cut.

## Whats New

**1.0.54-pre1**
- Upgraded the web UI stack to the latest Next.js/React release, unlocking faster builds and improved developer ergonomics.
- Refreshed Go and JavaScript dependencies across the services to pull in the latest security and bug-fix patches.

# ServiceRadar v1.0.53

Stability and packaging cleanup for the Compose stack.

## Whats New

**1.0.53**
- Republished every GHCR image and updated the release workflow to push containers before packages, eliminating `manifest unknown` pull failures.
- Refreshed Docker quick start guidance (explicit `docker compose pull`, removed `:local` override) to keep fresh installs aligned with published tags.

# ServiceRadar v1.0.53-pre20

GHCR manifest refresh and release automation updates.

## Whats New

**1.0.53-pre20**
- Republished every ServiceRadar container image so `latest` tags resolve correctly in Docker Compose.
- GitHub release workflow now authenticates to GHCR and pushes Bazel-built images before uploading packages.
- Docker quick start docs now require `docker-compose pull` to ensure deployments use the refreshed images.
- Removed the default compose override that forced `:local` tags, eliminating manifest errors for fresh installs.

# ServiceRadar v1.0.53-pre19

Bazel container fixes for runtime parity.

## Whats New

**1.0.53-pre19**
- Enforced pure Go mode in Bazel so every shipped binary is static and CGO-free.
- Layered Alpine ping, nmap, and netcat APKs into all OCI images that expect those tools at runtime.
- Rebuilt the Bazel OCI targets to match the previously working docker-compose images.

# ServiceRadar v1.0.53-pre18

Kong packaging automation and vendor refresh.

## Whats New

**1.0.53-pre18**
- Added `scripts/build-kong-vendor.sh` to clone the pinned Kong commit and build OSS RPM/DEB artifacts automatically.
- Release workflow now runs the helper so Kong binaries ship with every GitHub release.
- Documented the new flow in `packaging/kong/README.md` and clarified the expected versioned filenames.

# ServiceRadar v1.0.53-pre17

Release cut for the final GitHub upload fix.

## Whats New

**1.0.53-pre17**
- Prepare follow-up tag so the GitHub Actions release reruns with the Content-Length fix.
- Carry forward packaging/version metadata for automated publishing.

# ServiceRadar v1.0.53-pre16

Release publisher refinements for GitHub automation.

## Whats New

**1.0.53-pre16**
- Fix GitHub asset uploads by letting the client set `Content-Length` for large RPMs.
- Clean up release notes for prior prerelease entries.
- Bump VERSION to keep packaging outputs aligned with the tag.

# ServiceRadar v1.0.53-pre15

Release tooling alignment for GitHub publishing.

## Whats New

**1.0.53-pre15**
- Ensure GitHub release uploads rewrite Debian/RPM filenames with the tagged version.
- Harden Bazel runfile resolution so publishing works across Bazel 8+ layouts.

# ServiceRadar v1.0.53-pre14

Release automation improvements and packaging workflow updates.

## Whats New

**1.0.53-pre14**
- Automated GitHub release workflow builds and uploads Debian/RPM assets via Bazel.
- New `scripts/cut-release.sh` helper streamlines tagging and pushing releases.
- Release pipeline now validates assets through the GitHub API to ensure packages are published.
- GitHub release uploads now stamp Debian/RPM filenames with the release version.

# ServiceRadar v1.0.53-pre10

Release of ServiceRadar network management, observability, and stream processing platform.

## Whats New

**1.0.53**
- API Gateway (kong)
- New SRQL service
- Admin/Settings UI (WIP)
- Improved RBAC
- Kubernetes manifests (helm WIP)
- High performance TCP syn scanner (AF_PACKET/TPACKET_V3,FANOUT,+more)
- ICMP Scanner improvements
- Docker compose stack (arm64/amd64)
- Configurable sweep_modes per source for Armis integration
- Configurable batch sizes for Armis updater
- ServiceRadar Syslog messages now will end up in /var/log/serviceradar 

**1.0.52**
- Observability dashboard fixes

**1.0.51**
- Added Streaming OTEL logs/traces in the UI and new streaming APIs

**1.0.50**
- Auth bug fixed
- Debug logging cleanup

**1.0.49**
- Analytics dashboard hard refreshes fixed
- Sync service bug fixes
- Sync service now uses a HTTP Circuit Breaker for API requests

**1.0.48**
- Dashboard improvements
- Sync/Armis integration authentication token caching/retry logic added
- Agent preserves config for sweep from FS, merges networks from KV
- SRQL Queries support new time parameters (show logs from yesterday)
- Filter networks from discovery with serviceradar-sync
- Fixed several SRQL queries (show interfaces, show sweep_results)
- Improved rendering SRQL query results in UI
- Model-Context-Protocol (MCP) server
- Improved companion prompt for MCP server

**1.0.47**
- Sysmon process metrics now available in UI
- (OTEL) Logs viewer now available in UI
- Schema cleanup - deprecated sweep_results
- Core cleanup - deprecated sweep_results
- Improved error handling/tracking in Device Discovery engine
- Device Discovery engine handles panics gracefully
- Armis/Netbox integration improvements
- Agent availability bug fixed
- Rust build improvements
- CICD build pipeline improvements
- Pagination bug fix for Web UI

**1.0.46**
- New logger package w/ OTEL support
- OTEL Logs and Traces Collector w/ TLS support (rust)
- Sync package / poller improvements
- SweepResults now written to DB in batches
- Streaming GRPC calls for large paylods from microservices
- Updated Zen consumer to support OTEL logs 

**1.0.45**

- Bug Fixes
- SNMP Dashboard updates
- Armis Integration improvements
- GRPC pipeline updates

**1.0.44**

- New UI
- Query Engine Updates
- SNMP Dashboard Updates
- Support for Partitions (manage overlapping IP space)
- NetBox and Armis Integration improvements
- New combined "show devices" in SRQL
- SNMP Trap Receiver (rust)
- Syslog receiver (rust)
- Zen Engine (GoRules Zen Engine - rust-based rule processor for events)

## Components
- serviceradar-snmp-checker: SNMP Poller, polls OIDs and graphs results for most counters
- serviceradar-sysmon-checker: SysMon collects host-based metrics (CPU, memory, filesystem)
- serviceradar-rperf-checker: RPerf (iperf3-based) bandwidth measurement tool (client)
- serviceradar-rperf: RPerf server (reflector)
- serviceradar-agent: Agent performs checks, collects information from external checkers
- serviceradar-poller: Network poller for collecting monitoring data from Agent
- serviceradar-core: Core service (API)
- serviceradar-web: Core service (UI)
- serviceradar-trapd: SNMP receiver trap service
- serviceradar-flowgger: SYSLOG receiver service
- serviceradar-zen: Zen Consumer
- serviceradar-otel: OTEL Collector
- servicceradar-event-writer: DB Writer
- serviceradar-mapper: Network Discovery Engine (Beta)
- serviceradar-cli: ServiceRadar CLI utility (local-auth password management)
- serviceradar-nats: NATS JetStream (message broker)
- serviceradar-datasvc: NATS JetStream KV API
- serviceradar-sync: KV integrations (NetBox, ARMIS, etc) -- Optional

## Installation
See the [README.md](README.md) for detailed installation instructions.

### Quick Start

ServiceRadar provides a simple installation script for deploying all components:

```bash
# All-in-One Installation (interactive mode)
curl -sSL https://github.com/carverauto/serviceradar/releases/download/1.0.53-pre5/install-serviceradar.sh | bash

# All-in-One Installation (non-interactive mode)
curl -sSL https://github.com/carverauto/serviceradar/releases/download/1.0.53-pre5/install-serviceradar.sh | bash -s -- --all --non-interactive

# Adding the `sysmon` metrics checker (CPU, memory, filesystem usage)
curl -sSL https://github.com/carverauto/serviceradar/releases/download/1.0.53-pre5/install-serviceradar.sh | bash -s -- --poller --skip-checker-prompts --checkers=sysmon
systemctl restart serviceradar-poller
```