Skip to content

Release Notes

Release 1.2.0

Enhancements:

  • Novelty now integrates directly with Quine Enterprise. A Quine Enterprise standing query can send graph data straight to Novelty, with all Novelty-side setup handled automatically, and scores flow back into the Quine graph as observation nodes, so anomalies sit right alongside the data that produced them. Requires Quine Enterprise 2.2.1, with one Quine Enterprise cluster per Novelty instance.
  • Rescores keep novelty scores current: as new data shifts what counts as normal, Novelty revisits earlier observations and sends updated scores, so downstream systems, including Quine Enterprise graphs, always act on the latest assessment. Rescores are turned on per model, with their own permissions and adjustable sensitivity.
  • Breaking change. Novelty can skip snapshots for nodes that have barely changed, cutting storage writes on large, slowly changing graphs. Data stores written by 1.2.0 cannot be read by 1.1.x, so downgrading is not possible after upgrading.
  • Exploration UI result tables are easier to read, with resizable columns and values labeled by type, so a number is never mistaken for a string.
  • Result cards from quick queries are titled by quick query and node, so comparing several nodes side by side stays easy.
  • The Plots page refreshes automatically by default, so charts always show the latest scores.
  • New metrics pinpoint the individual nodes behind a bottleneck, so slowdowns can be traced to their source quickly.
  • Webhook outputs reach higher throughput with larger default connection limits, so scored results reach downstream systems faster.
  • Novelty's API documentation now reflects exactly what Novelty supports, and requests using an Enterprise-only option fail fast with a clear error, so integrations are built right the first time.

Security:

  • The Jackson JSON library and Logback logging library are updated to fix known vulnerabilities, including two denial-of-service vulnerabilities in Jackson.
  • Square Wire, OpenTelemetry, HdrHistogram, and OkHttp are pinned to patched versions, clearing vulnerabilities in bundled client libraries.
  • The bundled web UI ships patched versions of the zod validation library and the API documentation viewer.
  • Avro ingest is hardened against malformed input, so a bad record cannot exhaust memory.

Bugfixes:

  • Novelty Docker images report healthy, so orchestration tools that gate on container health start dependent services on time.
  • Breaking change. The max-catch-up-sleep-millis setting is retired. Remove it from configuration before upgrading, since startup rejects it.
  • Long-running API requests now run to completion and return their results in a single call.
  • Graphs on Cassandra recover on their own from incomplete snapshots, and paced snapshot writes protect storage during heavy load, keeping Novelty available without operator intervention.
  • Server-Sent Events ingests run alongside other HTTP traffic without slowing it.
  • Work paused on a node that shuts down is released immediately, so nothing stalls on a node that is gone.
  • Saved Exploration UI sessions restore fully, even when a result card cannot be read, so in-progress investigations are preserved.
  • File ingest errors clearly distinguish a missing file from an access policy denial, so problems are quicker to resolve.
  • Warnings about undecodable records name the ingest they came from, so data quality issues are easy to trace.
  • API documentation shows the correct default retry backoff.
  • Dragging a panel in the Exploration UI shows a grabbing cursor.

Updates:

  • AWS SDK to 2.55.8
  • Amazon Kinesis client to 3.5.3
  • Apache Pekko to 1.7.0
  • API framework (Tapir) to 1.13.32
  • endpoints4s API libraries (OpenAPI 5.1.0, JSON Schema 1.13.0 and 2.7.0, Pekko HTTP server 2.1.0)
  • Circe JSON library to 0.14.17
  • Cats Effect to 3.7.1
  • Jackson JSON library to 2.22.3
  • Logback logging library to 1.6.5
  • Apache Avro to 1.12.2
  • Google Protocol Buffers to 4.36.2
  • Square Wire to 6.4.7
  • OkHttp to 5.3.2
  • HdrHistogram to 2.2.2
  • OpenTelemetry API to 1.66.0
  • Dropwizard Metrics to 4.2.40
  • SLF4J commons-logging bridge to 2.0.20
  • TLS configuration library (Ayza) to 10.1.0
  • jnr-posix native bindings to 3.2.4
  • Apache Commons Codec to 1.22.1
  • LZ4 compression library to 1.11.1
  • Command-line parser (scopt) to 4.2.0
  • Scala parser combinators to 2.5.0
  • Cron expression library (cron-utils) 9.2.1, newly bundled
  • Cypher editor (Monaco) to 0.56.0
  • zod validation library to 4.5.4
  • API documentation viewer (Stoplight Elements) to 9.0.25
  • Scala Java Time (web UI date handling) to 2.7.0
  • Scala.js runtime to 1.22.0

Release 1.1.0

Enhancements:

  • The Interactive API docs now remember your place; expanded sections, scroll position, and in-progress requests are preserved when you navigate away and back, instead of resetting every time
  • The v2 API now rejects requests containing unrecognized or misspelled JSON fields with a clear error naming the field, instead of silently ignoring them and falling back to defaults.
  • Startup configuration errors for unrecognized config keys now clearly name the offending key and its location instead of showing an unhelpful generic error
  • The web UI now automatically loads the latest version after a new release is deployed, without requiring a hard refresh to clear stale cached files
  • The License Usage page title is now consistent with the rest of the product, for a more predictable navigation experience
  • Administrators can enable verbose actor-system and cluster diagnostic logging via a JVM system property, without turning on debug logging for all third-party libraries
  • Retry count, backoff timing, and retry window are now configurable per ingest via the API, so you can tune resilience to fit each data source

Security:

  • Replaced the "Admin" role with a new "SRE" role that grants full operational control (system status, shutdown, pausing/resuming ingest) without access to view or modify model data. Identity providers that issue an "Admin" role claim will need to be updated to issue "SRE" instead.
  • Updated the system configuration API endpoint to return only an explicit, pre-approved set of operational fields (persistor type, listener settings, memory limits, and similar) instead of the entire raw configuration masked by a hardcoded list of sensitive fields, so credentials and other secrets embedded in the configuration can never be exposed through it
  • Authorization failures are now split between 401 Unauthorized (missing or invalid credentials) and 403 Forbidden (authenticated but lacking permission), aligning with standard REST API conventions. Existing integrations that check specifically for a 401 status to detect "permission denied" will need to check for 403 instead.
  • Updated the dependencies for AWS SDK, Amazon Kinesis client, Hadoop, and Jackson to address several reported vulnerabilities

Bugfixes:

  • CSV ingestion using the v2 ingest pipeline now ingests every row in a file instead of stopping after the first
  • Ingest throughput metrics now stay live and accurate through a stream restart
  • Recreating an ingest with the same name now starts with a clean slate, so status counts no longer carry over from the deleted one.

Updates:

  • Cassandra database driver to 4.19.3
  • Pekko actor and streaming libraries to 1.6.0
  • Logback logging library to 1.5.38
  • Minimatch to 5.1.9

Release 1.0.2

Security:

  • Metrics endpoint now filters results based on caller permissions, preventing disclosure of ingest and standing query names to unauthorized users
  • Users are now automatically redirected to the login page when their OIDC session expires
  • Updated Docker base image to address CVE-2026-5419 and CVE-2026-42014
  • Updated uuid to 14.0.0 (CVE-2026-41907)
  • Updated minimatch to 5.1.8 (CVE-2026-27903, CVE-2026-27904)
  • Updated js-cookie to 3.0.8 (CVE-2026-46625)

Updates:

  • uuid to 14.0.0
  • minimatch to 5.1.8
  • js-cookie to 3.0.8

Release 1.0.1

Enhancements:

  • Improved page navigation with new URL routes and reordered sidebar
  • License usage page now updates in real-time with time-since-verified indicator and graceful handling of connectivity interruptions
  • Added OAuth2 resource parameter support for OIDC identity providers
  • Improved interactive API documentation with reordered sidebar sections

Security:

  • Updated Netty to 4.1.133.Final (CVE-2026-41417)
  • Updated ayza to 10.0.5, resolving bundled Bouncy Castle vulnerability (CVE-2026-5598)
  • Removed sensitive implementation details from entitlements-related log output

Bugfixes:

  • Fixed authentication for OIDC providers that use distinct access token issuers (e.g., ADFS)
  • Fixed authentication failure when the identity provider returns a single role instead of a role array (e.g., ADFS)
  • Fixed stream acknowledgment ordering to prevent potential data reprocessing on restart
  • Fixed license usage page displaying incorrect last-contacted time
  • Fixed API documentation not displaying discriminated union types correctly
  • Fixed sidebar collapse button not accessible after expanding on narrow viewports

Updates:

  • AWS SDK to 2.42.41
  • Tapir to 1.13.19
  • Amazon Kinesis Client to 3.4.3
  • commons-codec to 1.22.0
  • caffeine to 3.2.4
  • msgpack-core to 0.9.12
  • jcl-over-slf4j to 2.0.18

Release 1.0.0

Enhancements:

  • NEW: Redesigned web interface with modernized layout, sidebar navigation, and consistent theming across all pages

  • NEW: Official release of API V2 which is now the default in the UI; API V1 is still available for backwards compatibility but will be deprecated in the future

    • Follows the Google API style guides with established patterns and strategies for modern REST APIs
    • Comprehensive developer documentation with examples is built in and enhanced

  • NEW: Role-Based Access Control (RBAC) with OIDC authentication

    • Added OIDC Authorization Code Flow with login and callback endpoints
    • Added direct session support for browser consumers with session invalidation on logout
    • Integrated RBAC into UI with login/logout functionality and permission-based component rendering
    • API V2 is required when RBAC is enabled

  • Cassandra database is now supported

  • "Contexts" are now referred to as "models" and function as namespaces throughout APIs, UI, and configuration; model namespaces must now be explicitly created before use

  • Added model namespace creation dialog to the upload page

  • Enhanced audit logging with SP 800-53 compatibility and configurable rolling logs

  • Docker base image to eclipse-temurin 21.0.10_7-jre-noble

Security Fixes:

  • AWS credentials are automatically redacted in API responses and logs
  • Kafka configuration sensitive values (SSL passwords, SASL credentials) are redacted in API responses and logs
  • Disallow unsafe-eval from Content Security Policy
  • Updated Bouncy Castle to 1.84 (CVE-2026-5598)
  • Switched lz4 compression library to maintained fork (CVE-2025-66566)
  • Updated Netty to patched version (CVE-2025-67735)
  • Updated msgpack (CVE-2026-21452)
  • Fixed multiple JavaScript dependency vulnerabilities

Bugfixes:

  • Fixed upload progress reporting showing incorrect cumulative counts
  • Fixed reverse proxy path prefix support for UI routing and V2 OpenAPI endpoints
  • Fixed GraalJS 25+ compatibility with Multi-Release JAR manifest

Updates:

  • Apache Pekko to 1.5.0
  • Pekko HTTP to 1.3.0
  • Pekko Connectors (CSV, Kinesis, S3, SNS, SQS) to 1.3.0
  • RocksDB JNI to 10.10.1.1
  • Tapir to 1.13.15
  • Scala to 2.13.18
  • Cats Effect to 3.7.0
  • Circe JSON libraries to 0.14.15
  • GraalVM JS engine to 25.0.2
  • protobuf-java to 4.34.1
  • Kafka clients to 3.9.2
  • Amazon Kinesis Client to 3.4.2
  • Netty to 4.1.130.Final
  • AWS SDK to 2.42.24
  • jwt-scala to 11.0.4
  • sttp client4 to 4.0.22
  • logback-classic to 1.5.32
  • Dropwizard Metrics to 4.2.38
  • PureConfig to 0.17.10
  • commons-codec to 1.21.0
  • commons-text to 1.15.0
  • sttp-oauth2 to 0.21.0
  • OIDC authentication library to 0.13.5
  • Pekko Management to 1.2.1
  • boopickle to 1.5.0
  • jnr-posix to 3.1.22
  • schema-registry-serde to 1.1.27
  • Docker base image to eclipse-temurin 21.0.10_7-jre-noble

Release 0.15.0

Enhancements:

  • License key and internet access required to run Novelty
  • Added license usage UI with visual reporting of entitlements and consumption
  • Improved graph query performance by limiting edges returned during traversals
  • Increased default max SSE line and event sizes to 5MB to prevent infinite retry loops on large messages

Security Fixes

  • File ingest operations now require an allowedDirectories configuration; files loaded by from ./file_ingests are allowed by default
  • Reduced in-memory lifecycle of passwords by using character arrays that are blanked after use
  • Enhanced UUID generation to use FIPS 140-2 compliant cryptographically secure random values
  • Enforced strict-transport-security HTTP header across all endpoints
  • Added additional HTTP security headers including tightened CSP
  • Added authentication serialization improvements
  • Improved secret redaction in configuration printing
  • ClickHouse persistence now requires credentials to be set via environment variables instead of configuration files

Bugfixes

  • Removed application base url configuration in favor of runtime inference
  • Improved error response formatting by using correlation codes that link user-facing errors to detailed server logs for easier troubleshooting
  • Replaced documented IP addresses with RFC 5737 TEST-NET addresses
  • Removed CloudTrail ingestion functionality including RabbitMQ and Redis dependencies

Updates

  • Updated amazon-kinesis-client to 3.1.3
  • Updated logback-classic to 1.5.20
  • Updated caffeine to 3.2.3
  • Updated pekko-actor, pekko-cluster, and related components to 1.2.1
  • Updated avro to 1.12.1
  • Updated commons-csv to 1.14.1
  • Updated commons-codec to 1.19.0
  • Updated commons-io to 2.20.0
  • Updated netty-handler to 4.1.127.Final (security update)
  • Updated ayza (formerly sslcontext-kickstart) to 10.0.1
  • Updated AWS SDK components (aws-core, aws-query-protocol, kinesis, kinesis-video, and others) to 2.31.78
  • Updated scalajs-dom to 2.8.1
  • Updated msgpack-core to 0.9.10
  • Updated java-driver-core and java-driver-query-builder to 4.19.1
  • Updated metrics-core, metrics-jmx, and metrics-json to 4.2.37
  • Updated amqp-client to 5.26.0
  • Updated scalacheck to 1.19.0
  • Updated scala-logging to 3.9.6
  • Updated pprint to 0.9.4
  • Updated kind-projector to 0.13.4
  • Updated org.eclipse.jgit to 7.3.0.202506031305-r
  • Updated sbt and related components to 1.11.7
  • Updated sbt-scalafmt to 2.5.6
  • Updated sbt-jmh to 0.4.8
  • Updated sbt-sbom to 0.5.0
  • Updated sbt-scalajs and scalajs-compiler to 1.20.1

Release 0.14.2

Bugfixes

  • Initialize browser history on UI page load, correcting behavior of browser navigation when navigating between tabs, and using the back/forward browser buttons

Release 0.14.1

This patch release includes foundational changes in preparation for an upcoming major release; current functionality remains unaffected.

Enhancements

  • Show Java runtime version in admin build-info endpoint
  • Handle yaml format errors in API endpoint requests

Updates

  • Remove now-redundant reactor-netty-* dependency overrides
  • Update aws-sdk, ... to 2.31.54
  • Update pekko-http-circe to 3.0.1
  • Update pureconfig to 0.17.9
  • Update embedded-cassandra to 5.0.2
  • Update cats-effect to 3.6.1
  • Update kafka-clients to 3.9.1
  • Update tapir-core, tapir-json-circe, ... to 1.11.33
  • Update pekko-management, ... to 1.1.1
  • Update protobuf-java to 3.25.8
  • Update amazon-kinesis-client to 3.0.3
  • Update pekko-http, pekko-http-spray-json, ... to 1.2.0
  • Update graalvm.js to 24.2.1
  • Update bootstrap to 5.3.6
  • Update @stoplight/elements to 9.0.1
  • Update plotly.js to 2.25.2

Release 0.14.0

Enhancements

  • Optionally support NGINX in Docker image for basic auth by setting USE_NGINX and USE_BASIC_AUTH env vars to “true”

Updates

  • Update circe-core, circe-generic, ... to 0.14.12
  • Update logback-classic to 1.5.18
  • Update marketplacemetering, s3, sso, ssooidc, ... to 2.30.38
  • Update shapeless to 2.3.13
  • Update flatbuffers-java to 25.2.10
  • Update tapir-core, tapir-json-circe, ... to 1.11.20
  • Update circe-yaml from 0.11.7 to 0.11.9

Release 0.13.8

Enhancements:

  • Enable thatDot products to stream data directly to each other using reactive streams

Bugfixes:

  • Fix Novelty Exploration UI to correctly show observation node relationship from plots
  • Fix Novelty Exploration UI quick queries
  • Update selected namespace when user selects new namespace from dropdown on Novelty plots page
  • Add netty-handler override for CVE-2025-24970

Updates:

  • Update Pekko dependencies to 1.1.3
  • Update pekko-connectors-*, ... to 1.1.0
  • Update Tapir dependencies to 1.11.16
  • Update sttp:tapir/sttp:apispec to 1.10.15 / 0.11.2
  • Update rocksdbjni 9.7.3
  • Update logback-classic to 1.5.17
  • Update jnr-posix to 3.1.20
  • Update kafka-clients to 3.9.0
  • Update project reactor netty version
  • Update cats-effect to 3.5.7
  • Update marketplacemetering, s3, sso, ssooidc, ... to 2.30.31
  • Update pureconfig to 0.17.8
  • Update amqp-client to 5.25.0
  • Update schema-registry-serde to 1.1.22
  • Update openapi-circe-yaml to 0.11.7
  • Update protobuf-java to 3.25.6
  • Update js to 24.1.2
  • Update scala-library to 2.13.16
  • Update cats-core to 2.13.0
  • Update caffeine to 3.2.0
  • Update msgpack-core to 0.9.9
  • Update software.amazon.glue:schema-registry-serde to 1.1.23
  • Update rsocket-core, rsocket-transport-netty to 1.1.5
  • Update jcl-over-slf4j to 2.0.17
  • Update rocksdbjni to 9.7.4
  • Update commons-text to 1.13.0
  • Update commons-codec to 1.18.0
  • Update commons-csv to 1.13.0