Release digest: August 3 - 10, 2026 (Week 32)

Added

Chronicle (Release v16.20.0): Add result-aware seeding and a fresh buffer for retrying corrected definitions without changing existing IEventSeeding implementations. (#3612)
Chronicle (Release v16.20.0): Add [ReleaseUnder] support for composing a read model from PII owned by different subjects.
Chronicle (Release v16.20.0): Add CHR0043 and CHR0044 diagnostics for key redirection and joins that can store PII under an unprovable subject.
Chronicle (Release v16.20.0): Add event-store-aware reactor side-effect classification while retaining the previous handler contract.
AuthProxy (Release v2.13.0): Add a two-stage invitation protocol that signs the authenticated provider identity and invitation transaction with short-lived RS256 attestations.
AuthProxy (Release v2.13.0): Add active and previous attestation keys, strict 10–60 second lifetimes, Aspire configuration, and verified GitHub email lookup.
AuthProxy (Release v2.13.0): Add immutable Microsoft Entra invitation binding using the validated tenant-specific issuer and oid when mailbox verification is unavailable.
Chronicle (Release v16.19.3): ChronicleConnectionString.Redacted and ChronicleConnectionStringBuilder.BuildRedacted() render a connection string with every credential masked (chronicle://clientId:***@host:35000), keeping scheme, host, port and the non-sensitive options. Use these anywhere a connection string is logged or reported; ToString() still renders it in full.
AuthProxy (Release v2.12.0): Cratis:AuthProxy:Authorization:RequiredClaims — require an authenticated caller to carry a claim, optionally with a set of accepted values, before any request is forwarded. Every requirement must be satisfied (an and); within one requirement any listed value will do (an or). Values are compared case-insensitively.
AuthProxy (Release v2.12.0): The same section on a service (Cratis:AuthProxy:Services:<key>:Authorization) applies in addition to the proxy-wide requirements, so a service can narrow who reaches it but never widen it. The targeted service is resolved the way the route table resolves it — the single configured service, otherwise the Service-ID header or the service query parameter.
AuthProxy (Release v2.12.0): GitHub organization and team membership as claims. A GitHub OAuth provider that requests the read:org scope has its organizations and teams read once while sign-in completes and added to the session as urn:github:organization and urn:github:team (as organization/team-slug). The claims also travel to the application on the forwarded principal. GitHub Enterprise works without extra configuration — the endpoints are derived from the configured UserInformationEndpoint.
AuthProxy (Release v2.12.0): not-authorized.html, a new well-known page served at 403 to a signed-in caller who does not satisfy a requirement. It carries a sign-out link, since coming back as a different account is the only way forward, and can be overridden like every other page through PagesPath.
AuthProxy (Release v2.12.0): Aspire builders WithRequiredClaim(claim, anyOf…) and WithRequiredClaimForService(service, claim, anyOf…). Repeated calls append.
AuthProxy (Release v2.12.0): Documentation: a new Authorization page with a worked GitHub organization and team example, and an OAuth 2.0 provider section in Authentication, which was previously undocumented.
Screenplay (Release v2.1.0): scoped to <scope> on a query, stating what its results are narrowed to (#36)
Screenplay (Release v2.0.0): reads <ReadModel> [by <property>] on a command, declaring the state it consults before it decides (#35)
Screenplay (Release v2.0.0): require <condition> inside validate, for rules about the command as a whole rather than one of its properties (#32)
Screenplay (Release v2.0.0): readmodel <Name> as a declaration in its own right, and reducer <Name> => <ReadModel> with on <EventType> rules for views a projection cannot express (#39)
Screenplay (Release v2.0.0): for <expression> inside a produces body, saying which event source the event lands on (#33)
Screenplay (Release v2.0.0): produces and invokes on a reactor trigger, so an automation states the events it appends and the commands it hands on (#34)
Screenplay (Release v2.0.0): Qualified references and a stated scoping rule for what a screen binds to — a bare name resolves slice, then feature, then module, then document (#28)
Screenplay (Release v2.0.0): A language registry, so the languages an inline block may carry can be extended without changing the compiler (#74)
Screenplay (Release v2.0.0): provider <Name> name <Alias>, so two providers of the same kind are distinguishable (#80)
Screenplay (Release v2.0.0): != in the validation grammar (#66)
Screenplay (Release v2.0.0): A slice may declare more than one projection (#30)
Screenplay (Release v2.0.0): query <Name> => observable <ReturnType> for live queries (#37)
Screenplay (Release v2.0.0): A diagnostic code on every diagnostic, so consumers group and suppress without matching message text (#63)
Screenplay (Release v2.0.0): ScreenplaySyntaxWalker, a base class that walks every node kind (#77)
Screenplay (Release v2.0.0): Documented contexts for inline rule and policy code (#61)
Chronicle.Kotlin (Release v2.9.0): Artifacts are discovered and registered with the kernel automatically when the client connects, in the order the kernel needs them, and again on every reconnect. Manual registration is unchanged and still fully supported.
Chronicle.Kotlin (Release v2.9.0): IEventStore.registerAll() registers every artifact in one call, and awaitRegistration() waits for the automatic pass so the first append is deterministic.
Chronicle.Kotlin (Release v2.9.0): ChronicleOptions.withoutAutoRegistration() turns discovery off, and withArtifactsFrom(vararg packages) narrows it to the packages you own. KnownClientArtifacts takes an explicit list where classpath scanning is unwanted.
Chronicle.Kotlin (Release v2.9.0): IArtifactActivator lets a dependency injection container create artifacts, so a reactor or reducer can take its dependencies through its constructor.
Chronicle.Kotlin (Release v2.9.0): Reactor, reducer and read model reactor handlers may be suspend, so a handler that awaits an HTTP call or the event log no longer blocks the thread the observation runs on. (#16)
Chronicle.Kotlin (Release v2.9.0): IReactorMiddleware wraps every reactor handler invocation, keeping tracing, logging and metrics out of reactor code. Java implements BlockingReactorMiddleware instead. (#11)
Chronicle.Kotlin (Release v2.9.0): A reactor handler may take parameters beyond the event — a read model resolved for the event’s event source out of the box, or anything an IReactorMethodArgumentResolver supplies. (#27)
Chronicle.Kotlin (Release v2.9.0): ICanBeNotifiedAboutReplay tells a reactor when a replay begins and ends, per partition. (#13)
Chronicle.Kotlin (Release v2.9.0): store.failedPartitions surfaces the partitions an observer is stuck on, with the history of attempts, and retries one once the cause is fixed. (#13)
Chronicle.Kotlin (Release v2.9.0): ConceptAs<T> gives a domain value a type of its own, so the compiler can tell a book’s identifier from a member’s. Concepts serialize as the value they wrap, so adopting one for a property already in production changes neither the JSON nor the schema. (#15)
Chronicle.Kotlin (Release v2.9.0): AppendOptions.causation and EventForEventSourceId.causation attribute an append to a chain other than the ambient one — an imported event, or a side effect that belongs to a chain of its own. (#43)
Chronicle.Kotlin (Release v2.9.0): Chronicle work is reported as OpenTelemetry spans: appends, batches, reactor observations and reducer folds. Nothing to turn on. (#18)
Chronicle.Kotlin (Release v2.9.0): IProjectionsService.query(declaration) runs a Projection Declaration Language declaration and returns what it projected, without registering anything. (#19)
Chronicle.Kotlin (Release v2.9.0): Captures — sources outside Chronicle, pulled in and appended as events. Declare an ICapture and discovery saves and starts it on connect, or drive store.captures directly. (#10)
Chronicle.Kotlin (Release v2.9.0): io.cratis:chronicle-testing — EventScenario and ReadModelScenario specify what a slice appends and what a reducer folds, in-process, with no kernel, container or database. (#25)
Chronicle.Kotlin (Release v2.9.0): Guides for artifact registration, strongly-typed
Chronicle.Elixir (Release v2.2.0): Added Chronicle.ExternalServices.register/2,3 for registering external service definitions (HTTP or MsSql/PostgreSql endpoints) with Chronicle, via a pipe-friendly Chronicle.ExternalServices.DefinitionBuilder supporting basic/bearer/OAuth authorization and custom headers/options
Chronicle.Elixir (Release v2.2.0): Added Chronicle.Identities.rename/3 for renaming an identity’s display name by its stable subject
Chronicle.Elixir (Release v2.2.0): Added Chronicle.Compliance.delete_encryption_key/2 for deleting the PII encryption key for a subject
Chronicle.Elixir (Release v2.2.0): Added Chronicle.EventSequences.EventLog.redact/3 and redact_for_event_source/4 to permanently erase an event’s (or an event source’s) content for GDPR/compliance purposes — destructive and irreversible, unlike compliance encryption
Chronicle.Elixir (Release v2.2.0): Added get_from_sequence_number/2, get_next_sequence_number/1,2, get_tail_sequence_number_for_observer/2, and complete_stream/2,3 to Chronicle.EventSequences.EventLog (also mirrored on Chronicle.EventSequences.EventSequence for non-default sequences)
Chronicle.Elixir (Release v2.2.0): get_for_event_source/2 and get_tail_sequence_number/2 now accept :event_source_type, :event_stream_type, and :event_stream_id filters instead of silently ignoring them
Chronicle.Elixir (Release v2.2.0): Added append_and_wait_for_completion/3 to append an event and wait for every affected observer (reactor, reducer, …) to reach it or fail
Chronicle.Elixir (Release v2.2.0): A reactor’s handle/2 can now return {:ok, event_or_events} to append follow-up event(s) as a side effect, in addition to :ok/{:error, reason}
Chronicle.Elixir (Release v2.2.0): Chronicle.Reactors.Reactor and Chronicle.Reducers.Reducer gain optional replay-lifecycle callbacks (on_replay_begin/0, on_replay_end/0, on_partition_replay_begin/1, on_partition_replay_end/1)
Chronicle.Elixir (Release v2.2.0): Added Chronicle.ReadModels.watch/2 and unwatch/1 for subscribing to live read-model changesets, and dehydrate_session/4 for explicitly releasing a materialized read-model session
Chronicle.Elixir (Release v2.2.0): Added Chronicle.EventStoreSubscriptions.get_all/1 for listing currently-registered event store subscriptions
Chronicle.Elixir (Release v2.2.0): Added the Chronicle.FailedPartitions module (get_all/1, get_for/2) for inspecting observers with failed partitions
Chronicle.Elixir (Release v2.2.0): unique/2 gains a :scope option (:per_event_source_type / :per_event_stream_type / :per_event_stream_id) to narrow a uniqueness check instead of always checking globally
Chronicle.Elixir (Release v2.2.0): use Chronicle.Reducers.Reducer gains an :active option for passive reducers, whose read model is computed on demand instead of kept warm in the background
Chronicle.Elixir (Release v2.2.0): Added documentation for all of the above (new sections on the event sequences, reactors, read models, event store subscriptions, constraints, and reducers pages, plus a new Failed Partitions page) and console sample demonstrations of redaction, reactor side effects, wait-for-completion, and constraint scoping
Chronicle.TypeScript (Release v3.1.0): eventStore.externalServices.register(name, configure) to register external HTTP and database (MS SQL / PostgreSQL) services with the Chronicle Kernel, with a fluent builder for authentication (basic, bearer token, OAuth), headers, and provider-specific options.
Chronicle.TypeScript (Release v3.1.0): eventStore.identities.rename(subject, name) to rename an identity by its stable subject, matching the .NET client’s IIdentityManager.
Chronicle.TypeScript (Release v3.1.0): eventStore.pii.deleteEncryptionKey(identifier) to delete a PII encryption key (GDPR right-to-erasure), matching the .NET client’s IEventStore.PII.DeleteEncryptionKeyFor.
Chronicle.TypeScript (Release v3.1.0): eventLog.redact(sequenceNumber, reason) and eventLog.redactForEventSource(eventSourceId, reason, eventTypes?) for permanent, destructive redaction of event content — for GDPR/compliance erasure.
Chronicle.TypeScript (Release v3.1.0): eventLog.getForEventSourceIdAndEventTypes(...) and eventLog.getFromSequenceNumber(...) to read events back filtered by event source and/or event type.
Chronicle.TypeScript (Release v3.1.0): eventLog.getNextSequenceNumber(), plus extended filters on getTailSequenceNumber(...) and a new getTailSequenceNumberForObserver(...).
Chronicle.TypeScript (Release v3.1.0): eventLog.completeStream(eventStreamType, eventStreamId) to permanently close a non-default stream so further appends to it are rejected.
Chronicle.TypeScript (Release v3.1.0): eventLog.appendOperations, a hot stream of every event appended through an event log instance together with its result.
Chronicle.TypeScript (Release v3.1.0): AppendResult.waitForCompletion(timeoutMs?) to wait for every observer affected by an append to catch up (or fail) before reading a read model back.
Chronicle.TypeScript (Release v3.1.0): Reactor handler methods can now return event(s) as side effects — a single event, an array, an EventForEventSourceId (to target a different event source), or a mix — appended atomically once the handler completes.
Chronicle.TypeScript (Release v3.1.0): eventStore.failedPartitions.getAllFailedPartitions() / getFailedPartitionsFor(observerId) to inspect partitions an observer (reactor/reducer) has given up on.
Chronicle.TypeScript (Release v3.1.0): Optional ICanBeNotifiedWhenReplay / ICanBeNotifiedWhenPartitionReplayed hooks so a reactor or reducer can be notified when a replay begins and ends.
Chronicle.TypeScript (Release v3.1.0): eventStore.eventStoreSubscriptions.getAll() to list subscriptions registered for an event store.
Chronicle.TypeScript (Release v3.1.0): @reducer accepts an isActive parameter to register a passive reducer that doesn’t automatically observe events.
Chronicle.TypeScript (Release v3.1.0): unitOfWork.getConstraintViolations(), getConcurrencyViolations(), and getAppendErrors() as separate accessors alongside getAppendResults().
Chronicle.TypeScript (Release v3.1.0): The model-bound arithmetic decorators (@addFrom, @subtractFrom, @increment, @decrement, @count) and their fluent equivalents (.add()/.subtract()/.count() on the declarative builders) now work.
Chronicle.TypeScript (Release v3.1.0): The model-bound @childrenFrom, @nested, and class-/property-level @clearWith decorators, and the fluent .children()/.nested()/.addChild()/.setThisValue() builders now work.
Chronicle.TypeScript (Release v3.1.0): .usingCompositeKey() / .usingParentCompositeKey() for read model keys composed from more than one event property.
Chronicle.TypeScript (Release v3.1.0): A new “ExternalServices” documentation page, a “Failed Partiti
Chronicle.Kotlin (Release v2.8.0): appendMany accepting events that each carry their own event source id, stream, tags and subject, committed as one atomic operation with an optional concurrency scope per event source. (#14)
Chronicle.Kotlin (Release v2.8.0): Compose a batch across call sites with eventSequence.forEventSourceId(id) { ... }, inspect it, and commit it with perform(). (#14)
Chronicle (Release v16.19.0): IEventSequence.Revise on the .NET client, exposing the kernel’s existing revise-event capability.
Chronicle.Kotlin (Release v2.7.0): Point, LineString and Polygon types that serialize as GeoJSON, so Chronicle recognizes them as geospatial and the sink can index and query them. (#28)
Chronicle.Kotlin (Release v2.7.0): Generated schemas mark geospatial properties with the point, linestring and polygon formats, matching the .NET client. (#28)
Chronicle.Kotlin (Release v2.7.0): ChronicleGson.chronicleGson exposes the client’s own serializer, for callers producing event content themselves.
Chronicle.Kotlin (Release v2.6.0): IReadModelReactor — react to read model instances being added, modified or removed by writing added, modified or removed methods, with no watch loop to maintain. (#12)
Chronicle.Kotlin (Release v2.6.0): Read model reactor handlers can return events to be appended as side effects, using the changed instance’s key as the event source id. (#12)
Prompter (Release v0.2.0): /issue turns a Discord conversation into a GitHub issue on the owning repository — bugs, missing APIs, feature requests, ideas, documentation gaps — drafted by Prompter and filed only after you confirm an ephemeral preview (P-45).
Prompter (Release v0.2.0): Newly-opened issues get a grounded answer with citations on repositories that opt in, and silence when the documentation cannot answer them (P-44).
Prompter (Release v0.2.0): New issues are announced in a maintainer channel with whether the documentation already answers them (P-46).
Chronicle (Release v16.18.0): RemovedWith<TEventType>() on the constraint builder, so a per-event-source unique constraint can express “at most one per cycle” rather than only “at most one ever”
Chronicle (Release v16.18.0): [RemoveConstraint] now releases a unique event type constraint
Chronicle.Kotlin (Release v2.5.0): @Tag labels a reactor or reducer for tooling, without affecting what it observes. (#24)
Chronicle.Kotlin (Release v2.5.0): @FilterEventsByTag, @EventSourceType and @EventStreamType narrow the events the kernel delivers to an observer, so filtered-out events are never sent. (#24)
Prompter (Release v0.1.0): Pulumi stack running Prompter on the existing UpCloud Kubernetes cluster: namespaced workload, in-cluster Postgres with pgvector, and an ingress publishing only POST /reindex (P-21).
Prompter (Release v0.1.0): Deploy - Production workflow that pins the released image tag, applies the stack, and redeploys or rolls back any version on demand (P-21).
Chronicle.Kotlin (Release v2.4.0): AppendOptions takes eventSourceType, eventStreamType, eventStreamId, subject, tags and occurred, so an append can target a non-default stream, carry tags, be backdated, or name the compliance subject. (#23)
Chronicle.Kotlin (Release v2.4.0): AppendOptionsBuilder for constructing options from Java, where Kotlin’s default arguments are unavailable. (#23)
Chronicle.Kotlin (Release v2.3.0): @Reactor and @Reducer take an eventSequence, for observing a sequence other than the event log.
Chronicle.Kotlin (Release v2.3.0): @Reducer takes isActive, for a reducer the kernel does not actively run.
Chronicle.Kotlin (Release v2.3.0): @OnceOnly excludes a reactor from replay on the class, or a single handler on a method.
Chronicle.Kotlin (Release v2.3.0): @Replay marks the handler that takes over while an observer is being replayed.
Chronicle.Kotlin (Release v2.3.0): Reducer handlers can take an EventContext after the state.
Chronicle.Kotlin (Release v2.3.0): EventContext carries the observation state, event source type, event stream type and id, event store, namespace, causation, tags, and hash.
Chronicle.Kotlin (Release v2.2.0): ExternalServices — register named HTTP or database (MS SQL / PostgreSQL) endpoints with basic/bearer/OAuth authentication, addressable by name from other Chronicle integrations.
Chronicle.Kotlin (Release v2.2.0): Webhooks — register webhooks either via a discoverable @Webhook + IWebhookDefiner class or imperatively, with authentication, header, event-type filtering, and replay/activation options; list and remove webhooks.
Chronicle.Kotlin (Release v2.2.0): Jobs — list jobs and their steps, get a single job, and stop/resume/delete a job.
Chronicle.Kotlin (Release v2.2.0): EventStoreSubscriptions — subscribe an event store to another event store’s outbox with optional event-type filtering, list, and unsubscribe. Now defaults to every event type this client has registered when a subscription isn’t narrowed explicitly, instead of subscribing to nothing.
Chronicle.Kotlin (Release v2.2.0): Event type migrations — IEventTypeMigration/EventTypeMigration base class plus an EventTypeMigrationBuilder DSL (renamedFrom, defaultValue, split, combine) for upcasting/downcasting between event type generations, discovered alongside @EventType classes at register().
Chronicle.Kotlin (Release v2.2.0): 15 new model-bound projection attributes: @Join, @ChildrenFrom, @Nested, @ClearWith, @Count, @Increment, @Decrement, @AddFrom, @SubtractFrom, @FromAll, @FromEvery, @NotRewindable, @RemovedWith, @RemovedWithJoin, @NoAutoMap.
Chronicle.Kotlin (Release v2.2.0): Declarative projection builder methods: .join(), .fromEvery()/.fromAll(), .removedWith()/.removedWithJoin(), .children(), .nested(), .notRewindable(), plus composite/constant keys.
Chronicle.Kotlin (Release v2.2.0): Reactor handlers can now return a follow-up event, a List<Any>, or the new EventForEventSourceId wrapper, and it’s auto-appended as a side effect — same-stream or cross-stream.
Chronicle.Kotlin (Release v2.2.0): ComplianceService.deleteEncryptionKey for permanently erasing a subject’s PII (“right to be forgotten”).
Chronicle.Kotlin (Release v2.2.0): redact / redactForEventSource — permanently rewrites one event’s content, or every event’s content for an event source (optionally narrowed to specific event types). Destructive and irreversible
Chronicle (Release v16.17.0): CHR0042 analyzer warning when a read model property is written by both a local mapping and a join, covering the model-bound attributes and the fluent builder
Stage (Release v1.2.0): Add a Cratis.Stage.Rendering.Cratis renderer that generates a Cratis Arc + Chronicle vertical-slice application directly from a compiled Screenplay application, including first-time project scaffolding via the Cratis.Templates NuGet package (#11)
Arc (Release v21.0.0): TypeToTsType build item, declaring how a .NET type crosses the wire — consulted ahead of the built-in map, so it corrects an existing type as readily as it declares a new one
Arc (Release v21.0.0): ValidationResultReason on ValidationResult, so a rejection can be told apart from another without matching message text, which is presentation and changes without notice
Arc (Release v21.0.0): ShouldHaveValidationErrorBecauseOf, for asserting why a command was rejected — asserting only that it failed passes just as readily when it failed for the wrong reason
Arc (Release v21.0.0): ICommandResultAssertionPolicy, a seam for applying a repository’s own policy on top of the built-in CommandResult assertions, so a shared convention lives in one place instead of every spec
Arc (Release v21.0.0): ARC0015, warning when a query parameter is declared raw and converted to a concept in the method body, which skips the concept’s validator so an invalid value reaches the handler as though it had been validated
Arc (Release v21.0.0): markAsCommandFormField and markAsCommandFormColumn, so a command form field survives a build transform that rewrites displayName — Storybook’s reactDocgen: 'react-docgen-typescript' does that by default, which unbound every field with nothing in the output to say why
Arc (Release v21.0.0): beginSilentValidation on the command form context, for a custom field to claim a token before it validates so a result a later run has overtaken is discarded rather than applied
Arc (Release v21.0.0): Documentation for how .NET types map to TypeScript, and for declaring your own
Chronicle (Release v16.16.0): IEventStore.Registration reports what became of each declared artifact when registration ran, and what stopped the run if it failed, with WaitForRegistration() to await it
Chronicle (Release v16.16.0): IProjections.GetStateForModel<TReadModel>() and GetFailedPartitionsForModel<TReadModel>() reach a projection by the read model it maintains, which for a model-bound projection is the only handle there is
Chronicle (Release v16.16.0): ReadModelScenario exposes the client artifacts registry, so a spec can ask which artifacts were registered
Chronicle (Release v16.16.0): [ReservedProtoFields] keeps retired proto field numbers reserved across regeneration
Chronicle (Release v16.16.0): CHR0039 now covers every awaitable and the integration testing surface
Chronicle (Release v16.15.0): Filtering on the Workbench event-sequence table: a whole-sequence server-side filter by event source id, plus page-scoped column and global filters with an event-type dropdown (#1925)
Chronicle (Release v16.14.0): The Workbench failed-partitions view now shows a per-partition error glimpse on hover and a details pane on click, listing each attempt’s timestamp, sequence number, error messages and stack trace (#1436)
AuthProxy (Release v2.11.4): Security spec suite covering broken access control, injection, open redirect, request smuggling and security misconfiguration. Specs run a real AuthProxy in front of a real origin that records every forwarded request, so assertions can be made about what reached the backend rather than only what the client saw (#42)
AuthProxy (Release v2.11.4): A Security workflow that runs the security specs and a known-vulnerable dependency check on every pull request, with no path filter (#42)
AuthProxy (Release v2.11.4): Startup warnings naming every declared anonymous path that was refused, and why
AuthProxy (Release v2.11.1): Documented the WithAnonymousPaths Aspire extension method.
AuthProxy (Release v2.11.1): Added the missing sidebar entry for the Well-Known Pages documentation.
Screenplay (Release v1.8.0): rule <Name> as a validation rule kind, for a rule whose logic is an arbitrary predicate: orgNumber rule BeAValidOrganizationNumber message "Must be a valid organization number". It carries message like any other rule, and works on both command and concept validation. (#47)
Screenplay (Release v1.8.0): A named rule can now carry its own implementation as an indented body under the rule line, the same way handler and reactor triggers do: a file <Path> reference, or an inline csharp block. Both are optional — a bare rule <Name> is still valid for logic that stays outside the document entirely.
Fundamentals (Release v7.17.0): DateOnly holds a date with no time and no time zone, with parse, toString, toDate, from, fromDate and equals. A calendar date put through a JavaScript Date becomes UTC midnight, which every browser-local getter west of UTC reads back as the day before — an answer that looks right and is wrong only for users in some time zones, which is how it survives development in others
Fundamentals (Release v7.17.0): TimeOnly holds a time of day with no date and no time zone, with parse, toString, from and equals. A Date needs a date and a time of day has none, so new Date('14:30:45') is Invalid Date — the value is destroyed outright rather than merely shifted
Fundamentals (Release v7.17.0): DateOnlyJsonConverter and TimeOnlyJsonConverter, registered so both deserialize from the ISO-8601 form the server sends and serialize back to it
Fundamentals (Release v7.17.0): JsonSerializer.registerConverter registers a JSON converter for a type, taking the place of any converter already registered for it, so an application can correct how a type crosses the wire without forking the serializer
Fundamentals (Release v7.17.0): typeKeyOf, declaredTypeKey, conceptAsTypeKey and valueMapTypeKey identify a convertible type by the key it declares rather than by its class object. Comparing class objects is what breaks when two copies of this package end up in one realm, and a consuming package recognizing a concept that way has no way to be correct — typeKeyOf(type) === conceptAsTypeKey survives the boundary where type === ConceptAs cannot
Fundamentals (Release v7.17.0): ITypes.DiscoveryMode reports whether the type universe was built from generated providers, the reflection fallback, or providers supplied by the caller, so a silent fall back to reflection is visible rather than something to infer from behavior
Fundamentals (Release v7.17.0): TypeDiscoveryDiagnostics.FindMissingContributors lists project-referenced libraries that contributed nothing to the type universe, which is what a missing or misconfigured generator looks like from the outside
Fundamentals (Release v7.17.0): A Cratis.Fundamentals.TypeDiscovery event source reports the assemblies behind a type universe, and warns when it reached nothing beyond Cratis.Fundamentals — a universe that small is almost always a discovery failure rather than an application with no types
Fundamentals (Release v7.17.0): @cratis/fundamentals warns on load when it has been loaded more than once into the same JavaScript realm. Two copies each bring their own converter registry and their own class objects, so a converter regist
AuthProxy (Release v2.11.0): AnonymousPaths on a service declares path prefixes served to unauthenticated callers, which is what makes a health endpoint or a public page reachable now that the provider-selection page is no longer served to everyone. Prefixes match on whole segments, and an entry that cannot be expressed as plain literal segments is discarded rather than matched, so a declaration can never mean one thing to the middleware and another to the router
AuthProxy (Release v2.11.0): WithAnonymousPaths Aspire builder for declaring those paths from the app host, so the declaration lives with the service definition instead of in separate configuration
AuthProxy (Release v2.11.0): Documentation for anonymous paths, and a page describing how AuthProxy answers unauthenticated callers
Screenplay (Release v1.7.0): type <Name> declares a composite value type — the child-record shapes events routinely carry (lines InvoiceLine[]). Referencable from event, command and type properties (#29)
Screenplay (Release v1.7.0): pii reason "…" / sensitive reason "…" in a concept body records why a value is personal data — purpose, lawful basis, whose subject it lives under — instead of losing it to a bare marker (#38)
Screenplay (Release v1.7.0): identifier marks the command property a runtime resolves the event source id from. At most one per command; without it a new Uuid is assumed (#52)
Screenplay (Release v1.7.0): then error with no reason states a rejection the specification does not name, replacing then error "" as the only expressible form (#46)
Screenplay (Release v1.7.0): description on a reactor and on each on trigger, and reactor trigger bodies are now optional — a reactor is describable before any code exists (#40)
Screenplay (Release v1.7.0): Queries gain a description, parameters sourced from the context with from $context.…, and a performer block — the query’s counterpart to a command handler, as a file reference or an inline csharp/sql block (#53)
Screenplay (Release v1.7.0): CommandContext and QueryContext in Cratis.Screenplay.Contexts establish what a command handler and a query performer are given — the command or arguments, TenantId, CausedBy, Causation and when it occurred (#54, #55)
Screenplay (Release v1.7.0): sql as an inline code block language
Screenplay (Release v1.7.0): Documentation pages for composite types and for the command and query context, plus a declarative-first section in the grammar stating that a document must be expressible — and meaningful — with zero file references

Changed

Arc (Release v21.1.0): Expand ARCCHR0003 to report reactors that append to the default event log through an injected IEventStore, including indirect member-access paths.
Arc (Release v21.1.0): Preserve configured container factories and Development scope validation across the AddCratisArc host entry points while disabling only eager validation that Arc cannot support.
Arc (Release v21.1.0): Update Chronicle dependencies to 16.20.0.
Chronicle (Release v16.20.0): Validate TLS certificates by default; the Development connection string remains the explicit self-signed-certificate opt-out. (#3606)
Chronicle (Release v16.20.0): Apply AutoMap and [NoAutoMap] consistently in root, child, and nested projection builders and diagnostics.
Chronicle (Release v16.20.0): Scope client event serialization and side-effect classification to the executing event store.
AuthProxy (Release v2.13.0): Use one configured canonical (provider key, issuer, subject) identity across forwarded principals, invitation exchange, credential linking, tenant revalidation, and sign-in notifications. (#76)
AuthProxy (Release v2.13.0): Keep existing constructors and unsigned invitation exchange compatible; signed invitation mode is additive and opt-in.
AuthProxy (Release v2.12.0): A claim requirement that names no claim type now fails startup, naming the exact configuration key. It could never be satisfied, so starting would refuse every caller and ignoring it would leave the gate silently open.
AuthProxy (Release v2.12.0): Paths a service declares in AnonymousPaths are not gated. They exist for callers with no session, who carry no claims, so gating them would refuse every one of them — a webhook receiver would get a 403 it could do nothing about.
AuthProxy (Release v2.12.0): The authentication endpoints and callers with no session are not gated either; the existing sign-in machinery handles them.
AuthProxy (Release v2.12.0): GitHub membership is read at sign-in and lives in the session, so revoked membership takes effec
Screenplay (Release v2.1.0): A query with no scoped to is scoped to the tenant it runs for; scoped to global is how a query opts out and reaches past it (#36)
Screenplay (Release v2.0.0): One condition grammar for the whole language: and binds tighter than or, both are left associative, and parentheses group (#83)
Screenplay (Release v2.0.0): authorize carries a requirement tree rather than a flat list, so A or B C states which grouping it means. AuthorizeSyntax.Policies is replaced by Requirement; call References() for the policies alone (#68)
Screenplay (Release v2.0.0): A claim target is an expression, so a literal value stays distinguishable from a path (#67)
Screenplay (Release v2.0.0): SliceSyntax.Projection is now Projections (#30)
Screenplay (Release v2.0.0): An authentication provider carries no configuration — reaching a provider is what running an application needs to know, not what the application is (#80)
Components (Release v2.6.0): The component library now works with Arc 21 as well as Arc 20, so applications are no longer held on the Arc 20 line. This is what Cratis Chronicle 16.18.0 and newer require.
Prompter (Release v0.1.0): Publish now deploys the version it just pushed, and skips cleanly while the cluster side is unconfigured (P-21).
Prompter (Release v0.1.0): Deployment runbook documents how a release is actually cut: a merged pull request labeled major, minor or patch, or a manual dispatch with an explicit version (P-26).
Chronicle.Kotlin (Release v2.3.0): Handler shapes the client cannot invoke now fail at register() instead of on every event. (#17)
Chronicle (Release v16.17.0): The projection joins documentation (model-bound and declarative) now states join precedence: a joined property is applied over any value a local mapping wrote for the same property, independent of arrival order
Stage (Release v1.2.0): Upgrade Cratis.Screenplay and Meziantou.Analyzer to their latest stable versions
Arc (Release v21.0.0): DateOnly and TimeOnly now generate as the DateOnly and TimeOnly types from @cratis/fundamentals rather than as Date, which rendered a calendar date a day early west of UTC and a time of day as Invalid Date. Each has a converter of its own, so the value arrives as a type rather than as text every call site has to parse. Requires @cratis/fundamentals 7.17.0
Arc (Release v21.0.0): A validator message declared as a factory is no longer resolved at generation time and baked into the generated client validator, because a factory can depend on state that does not exist then, making the baked result one arbitrary evaluation; the rule still mirrors, the message is left to the server
Arc (Release v21.0.0): autoServerValidateThrottle now governs the per-keystroke validation request instead of a second, redundant one, so typing no longer issues an unthrottled request per keystroke
Arc (Release v21.0.0): setSilentValidationResult on the command form context takes the token from beginSilentValidation and returns whether the result was applied; called without one it behaves as it did
Arc (Release v21.0.0): ShouldHaveValidationErrors no longer passes when the only thing that rejected the command was a dependency the pipeline could not resolve, which let a spec report success against a pipeline that never ran
Arc (Release v21.0.0): @cratis/fundamentals is declared as an ordinary d
Chronicle (Release v16.16.1): The published packages reference Cratis.Fundamentals 7.17.1, up from 7.16.8. A concept held in a collection or a value map now serializes as its underlying value rather than as {"value": ...}, matching how a concept serializes everywhere else
Chronicle.TypeScript (Release v3.0.0): @cratis/chronicle declares @cratis/fundamentals as a peer dependency instead of pinning it to an exact version. Consumers whose package manager does not install peers automatically must now declare it themselves.
Components (Release v2.5.2): Continuous integration caching uses actions/cache@v4.
Chronicle (Release v16.16.0): A unique constraint violation message no longer includes the offending value; it moved to the violation details, where the application chooses whether to render it
Chronicle (Release v16.16.0): Client EventSequenceNumber.Max is now ulong.MaxValue - 1, matching the kernel; code that captured the old value sees it as an ordinary sequence number
Chronicle (Release v16.16.0): Subscribing the same handler to IConnectionLifecycle.OnConnected or OnDisconnected twice now subscribes it once; removing is unchanged
Chronicle (Release v16.16.0): IEventStore gains a member, so any implementation outside this repository must add it
AuthProxy (Release v2.11.4): Anonymous path entries are validated against an allow-list of letters, digits, -, ., _ and ~. Percent-encoding, backslashes, semicolons, authority syntax, control characters and non-ASCII are refused, as is any . or .. segment
AuthProxy (Release v2.11.4): Anonymous path entries may no longer target the prefixes AuthProxy answers itself (/.cratis, /_pages, /invite, /register, /signin-*). Declaring one never made an endpoint more public — it took the endpoint away from AuthProxy and handed it to a backend
AuthProxy (Release v2.11.4): CI now builds Debug as well as Release and runs the specs. Previously no tests ran in CI at all
AuthProxy (Release v2.11.0): HTTP liveness and readiness probes pointed at AuthProxy on / now receive 401 and must be repointed at a declared anonymous path or switched to a TCP socket probe. A Kubernetes httpGet probe on / previously got 200 because the provider-selection page was served to anyone; it now fails, and a failing liveness probe restarts the pod, so this needs changing as part of the upgrade rather than after it
AuthProxy (Release v2.11.0): Unauthenticated callers that are not browsers navigating to a page are refused with 401 instead of receiving the provider-selection page at 200, and tenant selection refuses them with 403 instead of serving the tenant chooser at 200. A page has to carry a success status to render, which meant every non-browser caller was told its request succeeded: a webhook sender recorded delivery and never retried, and a frontend’s fetch() passed the conventional response.ok check and failed later on parsing, far from the cause
AuthProxy (Release v2.11.0): A wildcard Accept: */* no longer counts as asking for HTML, so fetch(), curl and webhook senders receive a status they can act on. */* is what a client sends when it will take whatever it is given, and reading it as a request for a page is what turned a refusal into a recorded success; Sec-Fetch-Dest decides when present, since it is the only signal separating a document navigation from a scripted request issued by the same browser. A caller sending text/html;q=0 is likewise taken at its word
AuthProxy (Release v2.11.0): The refusal carries a WWW-Authenticate: Bearer challenge when a bearer token is accepted, so a caller is told which credential would work rather than having to infer it from a bare 401
AuthProxy (Release v2.11.0): Requests are still forwarded unchanged when no identity providers are configured, so a deployment that has not opted into authentication is unaffected by any of the above
Screenplay (Release v1.7.0): $context. paths are validated against the members of CommandContext/QueryContext — command, arguments, tenant, causedBy, causation, occurred, identity — and an unknown path is reported
Screenplay (Release v1.7.0): Property and query-parameter type references resolve against the primitives, declared concepts, declared types and imports; a reference to something the document never declares is reported. Query return types name read models and are not checked
Screenplay (Release v1.7.0): Concept and type names share one namespace, so declaring both is an error
Screenplay (Release v1.7.0): ConceptSyntax.Attributes is now IEnumerable<ConceptAttributeSyntax> (name plus optional reason); ConceptSyntax.AttributeNames gives the previous string sequence
Screenplay (Release v1.7.0): SpecificationErrorSyntax.Name is nullable — null is a rejection with no named reason
Screenplay (Release v1.7.0): The Monaco language service and the VS Code extension know every new construct: keywords, completions, hover, embedded SQL highlighting, and diagnostics matching the compiler

Fixed

Arc (Release v21.1.0): Allow Arc.Core applications to start in Development without discarding the host’s other service-provider settings.
Arc (Release v21.1.0): Keep Cratis.Arc.ProxyGenerator.Build as a package build dependency without flowing its executable assembly into downstream compile and runtime graphs.
Chronicle (Release v16.20.0): Keep removed immediate and passive read models absent across cached reads, previews, joins, no-op events, and testing; only a constructive later event can recreate them. (#3608)
Chronicle (Release v16.20.0): Preserve encrypted enum, nullable-enum, boolean, and numeric PII values through JSON and MongoDB storage and release. (#3603)
Chronicle (Release v16.20.0): Preserve failed seed batches for retry and retain repeated and tag-distinct events in author order. (#3612)
Chronicle (Release v16.20.0): Surface projection-processing failures instead of returning an empty model.
Chronicle (Release v16.20.0): Honor [JsonPropertyName] when [ReleaseUnder] resolves a PII subject property.
Chronicle (Release v16.20.0): Prevent root-level MongoDB joins from matching every document or throwing when a key is null or cannot be converted.
Chronicle (Release v16.20.0): Make client testing artifact discovery deterministic and isolate fresh seeding buffers from previous failures.
AuthProxy (Release v2.13.0): Remove conflicting reserved canonical identity claims and reject missing, duplicate, or noncanonical provider identity values.
AuthProxy (Release v2.13.0): Require exactly one invitation recipient proof: a verified email address or a complete opaque provider identity binding.
AuthProxy (Release v2.13.0): Preserve GitHub organization and team enrichment while deriving the final canonical invitation evidence.
Components (Release v2.6.2): Dropdown, multiselect, and calendar overlay panels no longer render behind dialogs after a dialog has been opened more than once — useOverlayZIndex no longer lowers or overwrites the z-index PrimeReact assigned, only raises panels sitting below its floor
Components (Release v2.6.1): DropdownField, MultiSelectField and CalendarField open their panels correctly inside command dialogs — the panels now escape the dialog’s stacking and scroll context (appended to the body, forced above modal dialogs), the way the standalone Dropdown wrapper already did. (Cratis/StudioIssues#64)
Screenplay (Release v2.0.0): A policy condition dropped its parentheses when printed, so a printed document admitted different callers than the one it came from (#59)
Screenplay (Release v2.0.0): A produces when condition dropped its parentheses when printed, and its precedence disagreed with a policy condition (#83)
Screenplay (Release v2.0.0): A query with a nullable return type was never registered as a symbol in the language service (#85)
Screenplay (Release v2.0.0): policies.md documented a policy result and a context that do not exist (#62)
Screenplay (Release v2.0.0): The invoicing sample navigated to three screens it never declared (#82)
Screenplay (Release v2.0.0): Projection documentation described children … id …, events inside a join block, and an automap directive, none of which the language has
Arc (Release v21.0.4): Command and read-model scenarios work again against current Chronicle releases. Arc was built against an older Chronicle that predates IEventSequence.Revise, so the scenario event log did not implement it — every scenario-based specification failed at construction with a TypeLoadException once an application upgraded Chronicle.
Chronicle (Release v16.19.2): Applications that depend on both Chronicle and Arc can upgrade again. Arc releases up to 21.0.2 pulled in an unlisted build of SharpCompress that NuGet ordered above the listed version Chronicle pins, which failed the restore with a package downgrade error (NU1605).
Arc (Release v21.0.3): The MongoDB integration no longer depends on a SharpCompress version that is unlisted on NuGet. Because that version still sorted above the latest listed one, any project combining Arc with a package targeting the listed line failed to restore with a package downgrade error.
Components (Release v2.6.0): Specs that mock the same module no longer interfere with each other, which had made dialog-closing specs fail intermittently.
Chronicle.Elixir (Release v2.2.0): unique/2’s :message option is no longer silently discarded when normalizing constraint declarations
Chronicle.Elixir (Release v2.2.0): [x] mix compile --warnings-as-errors (client library and console sample) — zero warnings, zero error
Chronicle (Release v16.19.1): An event-store subscription (outbox → inbox) that is already active now picks up an event type added to its definition after the subscription was first established, instead of silently continuing to deliver only the original event types indefinitely. (#3591)
Chronicle (Release v16.19.0): Model-bound [ChildrenFrom] projections now stamp the _derivedTypeId discriminator for a children collection whose declared item type is a [DerivedType] base with exactly one implementation, so a newly created child of a polymorphic collection round-trips through the sink correctly instead of losing its discriminator. (#3571)
Arc (Release v21.0.1): A read model’s non-nullable collection property reads back as empty rather than null when queried through IMongoCollection<T>, whether the stored document omits the field or stores null
Chronicle (Release v16.18.0): A [Passive] read model carrying a [PII] property can be read; every keyed read previously threw
Chronicle (Release v16.18.0): A watched read model carrying a [PII] property streams its changesets; every one was previously dropped silently
Prompter (Release v0.1.1): Container image builds again: it named a .NET 10 runtime tag that does not exist, so the first release published no image at all (P-26).
Chronicle.Kotlin (Release v2.4.0): The compliance subject was fixed to the event source id with no way to override it, so PII for a subject other than the event source could not be modeled from Kotlin or Java. (#23)
Chronicle.Kotlin (Release v2.3.1): IdentityProvider.kt and identityProvider.kt differed only by case, so only one could exist in the working tree on a case-insensitive filesystem and the build failed with an unresolved reference. (#29)
Chronicle.Kotlin (Release v2.3.0): EventContext.correlationId was a random value and causedBy was always Identity.unknown; both are now read from the kernel.
Stage (Release v1.2.0): Fix a nullable-reference build break in SpecificationError.Name (Screenplay’s bare then error syntax has no name, but the record required one)
Templates (Release v1.2.1): Applications scaffolded from the cratis and cratis-aspire templates emit hashed build artifacts under wwwroot/assets/ instead of at the wwwroot root, so /assets/** can be expressed as a reverse-proxy, CDN or WAF path rule
Templates (Release v1.2.1): The template package no longer carries local build output from Templates/ChronicleWeb/obj when packed from a working tree that has been built
Chronicle (Release v16.16.0): The pre-16.12 constraint-store upgrade shipped but never ran, because its serializer was never registered
Chronicle (Release v16.16.0): One unregistered event type aborted projection discovery for every projection, taking the whole read side down
Chronicle (Release v16.16.0): A projection replay rewrote every stored child whole, defaulting every member the projection did not set
Chronicle (Release v16.16.0): Reading a read model turned an absent collection into null instead of an empty one
Chronicle (Release v16.16.0): The compliance release pass blanked a value that had never been encrypted
Chronicle (Release v16.16.0): A client concurrency scope meaning “no expected sequence number” arrived at the kernel as an ordinary number, so the kernel ran a check that could only pass
Chronicle (Release v16.16.0): A skipped concurrency check was attributed to the caller
Chronicle (Release v16.16.0): GetStateFor<TProjection>() looked in the read model dictionary with a projection type, so it could only ever throw
Chronicle (Release v16.16.0): A failed projection registration named every identifier in the batch instead of the definition that failed
Chronicle (Release v16.16.0): A registration that threw left its outcome looking unfinished, so a consumer waiting on it timed out instead of being told what failed
Chronicle (Release v16.16.0): Two projections maintaining the same read model resolved silently by declaration order
Chronicle (Release v16.16.0): Two dependency injection containers in one process sharing a namespace were handed the same event store
Chronicle (Release v16.16.0): Concurrent callers asking for the same event store each built their own and ran discovery twice
Chronicle (Release v16.16.0): An event store that could not be reached on its first resolution stayed unreachable for the lifetime of the process
Chronicle (Release v16.16.0): CHR0002 demanded [EventType] on generic arguments that are not events
Chronicle (Release v16.16.0): CHR0004 and CHR0005 analysed a reactor’s private helper methods as if they were handl
Chronicle (Release v16.15.0): The event-sequence table’s sequence-number and event-type columns no longer render blank — their field paths referenced a non-existent metadata member instead of context (#1925)
Architecture (Release v1.0.2): The Cratis.Architecture.CodeAnalysis package now ships the analyzer in analyzers/dotnet/cs (targeting netstandard2.0) instead of lib/, so the analyzers actually load and run in consuming projects and IDEs.
Lens (Release v0.0.1): Lens now shows when it could not save your settings, instead of reporting “Saved” and losing them silently by the next time the popup is opened
Lens (Release v0.0.1): A failed users, tenants, or Arc context refresh is now reported instead of disappearing without a trace
AuthProxy (Release v2.11.2): Changes to Cratis:AuthProxy:Services now take effect when configuration reloads rather than at the next restart — routes and clusters are both rebuilt, so a service that moves address, or is added or removed, is routed accordingly without cycling the proxy
AuthProxy (Release v2.11.2): Withdrawing a path from AnonymousPaths now removes the route that relaxed authorization for it, instead of leaving that route serving the prefix until the process restarted
AuthProxy (Release v2.11.2): Declaring a new path in AnonymousPaths now opens it on reload, instead of the prefix counting as anonymous to the middlewares while still matching only the authenticated catch-all
AuthProxy (Release v2.11.1): Fixed AuthProxy documentation instructing readers to set Ingress:PagesPath (a key AuthProxy never reads) instead of Cratis:AuthProxy:PagesPath when overriding built-in error and invitation pages.
AuthProxy (Release v2.11.1): Fixed the frontend CI build, which failed to install dependencies due to a TypeScript 7 / typescript-eslint peer-dependency conflict.
Screenplay (Release v1.8.0): A rule whose logic could not be expressed was left out of the document entirely, so a property with two declarative rules and three predicates read as a property with two rules — with no way for a reader to tell “nothing further constrains this” from “the rest could not be written down”. (#47)
Screenplay (Release v1.8.0): The VS Code extension’s TextMate grammar was missing the rule keyword, so it highlighted as plain text there even though the Monaco tokenizer recognized it.
AuthProxy (Release v2.11.0): select-provider.html is now shipped. It was documented as a default page but absent from the
Arc (Release v20.69.3): Deserializing a read model with a polymorphic ([DerivedType]) interface- or abstract-typed member no longer overflows the stack and kills the process — the derived-type discriminator convention is registered for concrete class maps as they are created, and an unresolvable discriminator now throws the catchable CannotResolveConcreteDerivedType instead of recursing
Chronicle (Release v16.13.4): Dictionaries with additionalProperties schemas no longer get corrupted into an array of { Key, Value } documents when their containing object’s state is cloned for a subsequent event (#3568)
Chronicle (Release v16.13.4): SQL Server / PostgreSQL read models now correctly serialize schema-defined dictionary properties as JSON objects instead of arrays
Chronicle (Release v16.13.4): [x] Infrastructure.Specs — 2 new unit specs for Clone()/AsExpandoObject() covering dictionary values (confirmed failing before the fix, passing after)
Chronicle (Release v16.13.4): [x] Storage.MongoDB.Specs — new integration spec against a real MongoDB container proving a dictionary survives a first write and a subsequent sibling-property update
Chronicle (Release v16.13.4): [x] Storage.Sql.Specs — new SQLite-backed spec for the same scenario (confirmed failing before the fix, passing after)
Chronicle (Release v16.13.4): [x] Storage.InMemory.Specs and Core.Specs — full regression run, no failures
Chronicle (Release v16.13.4): [x] Debug and Release builds clean, zero warnings, for all touched/dependent projects

Removed

Screenplay (Release v2.0.0): $secrets, and the secrets files it read — credentials are a runtime concern, and a document holding them is a different do

Security

Chronicle (Release v16.20.0): Avoid logging compliance-subject identifiers during cross-store key propagation and unmatched projection joins.
Chronicle (Release v16.20.0): Diagnose cross-subject PII joins and key redirection before they make erasure incomplete.
Chronicle (Release v16.20.0): Ensure omitted client TLS settings cannot silently disable certificate validation. (#3606)
AuthProxy (Release v2.13.0): Bind signed invitation completion to the issuer, audience, tenant, invitation, transaction, challenge, exact capability hash, JWT ID, provider identity, assurance, and authentication time.
AuthProxy (Release v2.13.0): Reject malformed signing keys, stale configuration, mixed recipient modes, and mismatched protected callback state without falling back to unsigned exchange.
Chronicle (Release v16.19.3): The .NET client no longer writes the connection string’s credentials to the log. Connecting logged the full connection string at Information level — including the OAuth client secret, and on every watchdog reconnect — so the secret reached any log pipeline the client was configured with.
Arc (Release v21.0.2): Fix observable queries decrypting/releasing compliance and PII data under the wrong tenant’s Chronicle namespace, which caused [PII] properties to come back empty for every subscriber but whichever tenant’s subscription resolved the namespace first (#2463)
AuthProxy (Release v2.11.4): Fixed an open redirect on the login, link, tenant-selection and logout endpoints. Each carried its own version of a same-site check and they disagreed: two accepted //evil.test outright, and the two that rejected it still accepted /\evil.test, which every major browser treats identically. The login endpoint is the most exposed of the four — its returnUrl is accepted anonymously and becomes the post-authentication redirect, so a victim completes a genuine sign-in before landing on the attacker’s page
AuthProxy (Release v2.11.4): Fixed authorization being granted by the presence of the script-readable .cratis-identity cookie, whose value was never read. Sending any value for it alongside a valid session skipped every service’s /.cratis/me authorization call, so a user whose access had been revoked stayed authorized for as long as they kept sending it. The decision now lives in a separate HTTP-only cookie sealed with data protection and bound to the principal and tenant it was issued for
AuthProxy (Release v2.11.4): Fixed an unauthenticated HTTP 500 reachable by sending both a Service-ID header and a ?service= parameter. The two route variants shared a templa

Deprecated

No updates