Changelog

The newest release is first. Release notes also appear in the product under Settings > Licence and Updates.

0.1.7 (upcoming)

One-command install on Linux (curl -fsSL https://license.cerberon.dev/install.sh | sh) and on Windows 11 22H2 or newer (irm https://license.cerberon.dev/install.ps1 | iex). On Windows the installer sets up WSL 2, Ubuntu and Docker Engine, opens the firewall port and starts Cerberon with Windows.
The installer shows numbered steps with a timer on long steps, and writes the detail to an install log it names. It asks only for the licence key. Every install serves HTTPS on port 443 and builds the scanner tools (--no-tools skips them).
The licence key is hidden as you type and binds the licence to the host. Moving a licence to another host is done by Cerberon support.
Air-gapped installs: --fingerprint on the target, --fetch on a connected machine, --bundle on the target.
Settings > Licence and Updates shows the machine ID and accepts a licence key or file, including a renewal after expiry.
Every download is verified against Cerberon’s signature before use.
The installer stops with a plain reason before downloading anything on a host it cannot support: OpenSSL older than 3.0, Podman or rootless Docker, a port in use, an unsupported processor, or too little disk. Proxy settings reach the scanner build.

cerberon scan start|wait|status|gate|sarif runs CI scans from the Cerberon host, with exit codes a pipeline can act on. See CI/CD and quality gates.
Code scans started from the command line need --acknowledge-source. Host and web scans need --authorised.
An administrator can set a project’s quality gate policy under Settings > Scanning > Quality Gate. A pipeline can tighten it but never loosen it.

Update and restart for administrators. Users are notified, new scans pause, everyone is signed out and the update runs. A failed update rolls back automatically and the result is reported after the restart.
Check now finds newly published releases immediately.
Cerberon checks for a release once a day and notifies administrators once per release. Offline installs are not affected.
Each update keeps the newest three snapshots. Scanner tools are rebuilt only when a release changes them.
cerberon rollback asks before replacing your data with a snapshot.
An upgrade is no longer refused on an instance that has produced unsigned scan reports.

A daily clean-up removes unused Docker image layers, old build cache and stopped scanner containers. It never touches your data or the scanner tools.
cerberon uninstall removes Cerberon and keeps your data, licence, snapshots and settings, and prints where they are.

Reports use one layout and one severity palette, as a Standard or Summary report.
Settings > Data sets one retention window in months. Older scans are removed with their findings, reports and share links. The audit log is kept.
The notification bell shows one line per event, links to the related page and can be cleared per item.
A scan that does not fit the host’s free resources is refused with the reason instead of waiting.
Scans have time limits: 6 hours for SAST, 2 hours for DAST, penetration and mobile scans, and 24 hours for the others. Each scan can set its own, from 30 minutes to 48 hours.
Analysts can lower a finding’s severity with a written justification, never raise it.

The Core no longer fails to start when its built-in test catalogues are missing.
A rollback no longer puts the wrong image into the mobile analyser.
A Core that stopped during a scan no longer leaves the scan’s scratch volume behind.

The first release covered by this changelog.