From c7db2583966246f0266e78527ab68315d9c73274 Mon Sep 17 00:00:00 2001 From: "mintlify[bot]" <109931778+mintlify[bot]@users.noreply.github.com> Date: Mon, 31 Aug 2026 09:12:27 +0000 Subject: [PATCH 1/5] chore: add changelog entries for CLI v2.39.0/v2.39.1 and Platform updates --- changelog/index.mdx | 77 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 77 insertions(+) diff --git a/changelog/index.mdx b/changelog/index.mdx index b5d5f7e..e335a91 100644 --- a/changelog/index.mdx +++ b/changelog/index.mdx @@ -4,6 +4,83 @@ description: "Release notes for Kosli products." rss: true --- + + +## Updates + +- **SCIM orgs: user management moves to your IdP** — in an organization whose user lifecycle is managed by SCIM, members owned by the IdP can no longer be invited, re-invited, role-changed, or removed through Kosli. Such edits used to appear to succeed, only to be silently overwritten by the next sync, leaving audit-log entries attributing the change to the wrong actor. An admin can opt back in to managing the remaining (non-IdP) users via a toggle on the user management page; with the opt-in off, the UI permits no invitations or role changes. Service accounts are unaffected and stay editable throughout. + +## Bug fixes + +- **Magic links survive email scanners** — a `HEAD` request (from a browser or a link scanner) no longer consumes a sign-in magic link, so the link still works when the user actually clicks it. Previously a pre-scanned link failed with "already used". +- **Attestations filter no longer breaks infinite scroll** — applying a filter on the org attestations list while a page request was still in flight could stop pagination for the rest of the session: the first page of filtered results rendered and nothing more, with no error. Filter and page requests are now serialised. + + + + + +## Updates + +- **Clearer help text** — reworded the help for [`kosli attest jira`](/client_reference/kosli_attest_jira), [`kosli attest sonar`](/client_reference/kosli_attest_sonar), and [`kosli snapshot azure`](/client_reference/kosli_snapshot_azure), and fixed formatting glitches in the generated CLI reference. + +[View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.39.1) + + + + + +## New features + +- **`--sonar-branch` on `kosli attest sonar`** — attest a SonarQube scan that ran on a branch other than the project's main branch by naming the branch. The flag cannot be combined with `--pull-request`. When a scan revision is not found, the error now says that only the main branch was searched and suggests passing `--sonar-branch`. See the [`kosli attest sonar` reference](/client_reference/kosli_attest_sonar). + +## Updates + +- **`kosli attest jira` reports rejected credentials as such** — when Jira does not accept the credentials (for example an expired API token), the CLI prints a warning naming the username and reports the affected issues as "not confirmed" instead of silently as missing. The `--assert` failure message distinguishes missing, unconfirmed, and mixed cases. See the [`kosli attest jira` reference](/client_reference/kosli_attest_jira). +- **`--jira-project-key` tolerates whitespace** — comma-separated lists like `"ABC, DEF"` are now accepted; each key is trimmed before validation, and invalid keys are quoted in the error message. +- **`.kosli_ignore` documented in command help** — the help for `kosli allow artifact`, `kosli assert artifact`, and every `kosli attest` command now describes `.kosli_ignore` support when fingerprinting directories. + +[View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.39.0) + + + + + +## New features + +- **Spaces enabled for every org** — Spaces, the hierarchical tree for organizing flows and environments, is now available to every organization by default. The Manage Spaces page and the Space filter on the Flows and Environments lists no longer require a feature flag or an org-level opt-in setting, both of which are gone. + + + + + +## Bug fixes + +- **Policy expressions treat a missing value as never matching** — `matches()` and the ordering comparisons (`<`, `>`, `<=`, `>=`) now evaluate to `false` when either side is missing, consistent with how `==`, `!=`, `in`, and `exists()` already behaved. Missing values are common: `flow` is empty for any artifact without provenance, and `flow.tags.` is empty for a tag a flow doesn't have. Previously an expression like `not matches(flow.name, "^snyk-.*")` crashed snapshot compliance evaluation, and could return a 500 from the assert-artifact endpoint. See [policy expressions](/policy-reference/environment_policy#policy-expressions). + + + + + +## Updates + +- **Environments tag filter drills into values** — the tag filter on the Environments list now offers both key-existence and key:value filtering, matching the Flows, Repos, and Controls pages. Previously it only listed keys, which made it useless when environments share keys but differ on values. + +## Bug fixes + +- **Environment policies see override attestations** — `attestation` rules in [environment policies](/policy-reference/environment_policy) (and the assert-artifact API) now evaluate the newest attestation including overrides. Previously an override never matched the rule's attestation type, so overriding a non-compliant attestation could not bring an environment back to compliant, and overriding a compliant one down to non-compliant left the environment falsely reporting compliant. +- **Archived resources disappear from the Spaces tree** — archiving two or more environments or flows could leave some of them still showing on the Spaces page. All archived resources are now filtered out. +- **Attestation reads tolerate retargeted artifact names** — reading attestations no longer fails with a 500 when the same fingerprint was later reported under a different artifact name in the same trail. The artifact-name consistency check now runs when an attestation is written, not on every read. + + + + + +## Updates + +- **Cleaner timestamps on the flows list** — the flows list now shows a plain date and time, matching the environments list, instead of a stacked icon, caption, and timestamp. The frequency-chart tooltip on the repo page also switches from DD/MM/YYYY to the app-standard YYYY-MM-DD. + + + ## Bug fixes From e367b01c74148fa793aa69c0249b29dcf5f5c6f3 Mon Sep 17 00:00:00 2001 From: Marko Bevc Date: Mon, 31 Aug 2026 22:57:24 +0100 Subject: [PATCH 2/5] chore: apply suggestion from @mbevc1 --- changelog/index.mdx | 1 - 1 file changed, 1 deletion(-) diff --git a/changelog/index.mdx b/changelog/index.mdx index e335a91..dd457d4 100644 --- a/changelog/index.mdx +++ b/changelog/index.mdx @@ -12,7 +12,6 @@ rss: true ## Bug fixes -- **Magic links survive email scanners** — a `HEAD` request (from a browser or a link scanner) no longer consumes a sign-in magic link, so the link still works when the user actually clicks it. Previously a pre-scanned link failed with "already used". - **Attestations filter no longer breaks infinite scroll** — applying a filter on the org attestations list while a page request was still in flight could stop pagination for the rest of the session: the first page of filtered results rendered and nothing more, with no error. Filter and page requests are now serialised. From 3f41d39d8c07d0d8bd6291fdb8b6ae1cffd0c0b2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Dan=20Gr=C3=B8ndahl?= Date: Mon, 7 Sep 2026 08:36:45 +0200 Subject: [PATCH 3/5] docs: address review comments on August 31 changelog entry - Move the SCIM user-management bullet under "Breaking changes": it removes a capability from the UI for affected admins. - Split the opt-in toggle detail into its own "Updates" bullet, shortening the longest bullet in the file. - Capitalize "Audit Log" as the page name instead of generic "audit log". - Fix British "serialised" -> "serialized". --- changelog/index.mdx | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/changelog/index.mdx b/changelog/index.mdx index dd457d4..3c669d3 100644 --- a/changelog/index.mdx +++ b/changelog/index.mdx @@ -6,13 +6,17 @@ rss: true +## Breaking changes + +- **SCIM orgs: user management moves to your IdP** — in an organization whose user lifecycle is managed by SCIM, members owned by the IdP can no longer be invited, re-invited, role-changed, or removed through Kosli. Such edits used to appear to succeed, only to be silently overwritten by the next sync, leaving Audit Log entries attributing the change to the wrong actor. Service accounts are unaffected and stay editable throughout. + ## Updates -- **SCIM orgs: user management moves to your IdP** — in an organization whose user lifecycle is managed by SCIM, members owned by the IdP can no longer be invited, re-invited, role-changed, or removed through Kosli. Such edits used to appear to succeed, only to be silently overwritten by the next sync, leaving audit-log entries attributing the change to the wrong actor. An admin can opt back in to managing the remaining (non-IdP) users via a toggle on the user management page; with the opt-in off, the UI permits no invitations or role changes. Service accounts are unaffected and stay editable throughout. +- **Opt back in to managing non-SCIM users** — an admin in a SCIM-managed organization can manage the remaining (non-IdP) users via a toggle on the user management page. With the opt-in off, the UI permits no invitations or role changes. ## Bug fixes -- **Attestations filter no longer breaks infinite scroll** — applying a filter on the org attestations list while a page request was still in flight could stop pagination for the rest of the session: the first page of filtered results rendered and nothing more, with no error. Filter and page requests are now serialised. +- **Attestations filter no longer breaks infinite scroll** — applying a filter on the org attestations list while a page request was still in flight could stop pagination for the rest of the session: the first page of filtered results rendered and nothing more, with no error. Filter and page requests are now serialized. From 953bf088af28575e3cbcbd9f1b2b00d00a4731ef Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Dan=20Gr=C3=B8ndahl?= Date: Mon, 7 Sep 2026 08:45:10 +0200 Subject: [PATCH 4/5] docs: drop the removed Spaces opt-in step from the tutorial The August 28 changelog entry announces that the org-level opt-in setting for Spaces is gone, but the tutorial still listed enabling it as step 3 -- a dead prerequisite that would make a reader conclude Spaces is unavailable. - Remove the step and renumber. - Drop the "Currently" hedge on availability, which described the gated state. - Link the tutorial from the changelog bullet. --- changelog/index.mdx | 2 +- tutorials/organizing_with_spaces.mdx | 7 +++---- 2 files changed, 4 insertions(+), 5 deletions(-) diff --git a/changelog/index.mdx b/changelog/index.mdx index 3c669d3..8e7b886 100644 --- a/changelog/index.mdx +++ b/changelog/index.mdx @@ -50,7 +50,7 @@ rss: true ## New features -- **Spaces enabled for every org** — Spaces, the hierarchical tree for organizing flows and environments, is now available to every organization by default. The Manage Spaces page and the Space filter on the Flows and Environments lists no longer require a feature flag or an org-level opt-in setting, both of which are gone. +- **Spaces enabled for every org** — Spaces, the hierarchical tree for organizing flows and environments, is now available to every organization by default. The Manage Spaces page and the Space filter on the Flows and Environments lists no longer require a feature flag or an org-level opt-in setting, both of which are gone. See [organizing flows and environments with Spaces](/tutorials/organizing_with_spaces). diff --git a/tutorials/organizing_with_spaces.mdx b/tutorials/organizing_with_spaces.mdx index cd09d92..8125277 100644 --- a/tutorials/organizing_with_spaces.mdx +++ b/tutorials/organizing_with_spaces.mdx @@ -52,7 +52,7 @@ In this structure: ### Who Can Use Spaces? -Currently, the Spaces functionality is available to all users within an organization. All users can: +Spaces is available to every organization, and to all users within an organization. All users can: - Navigate through the Space hierarchy - View resources within a Space @@ -65,9 +65,8 @@ To begin using Spaces: 1. Review your current organizational structure 2. Identify logical groupings for your Flows and Environments and map them to spaces -3. Enable Spaces in your organization's settings, the Spaces tab will appear in the left navigation -4. Organize flows and Environments according to the design -5. New and existing Flows and Environments will be under the organization Root until they are moved to a space +3. Organize flows and Environments according to the design +4. New and existing Flows and Environments will be under the organization Root until they are moved to a space ## Using Spaces From 9962aa1316ca7f3c56cad7bb8a27ec4b9254358c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Dan=20Gr=C3=B8ndahl?= Date: Mon, 7 Sep 2026 10:06:19 +0200 Subject: [PATCH 5/5] docs: drop SCIM entries from the August 31 changelog SCIM has no dedicated documentation page, so per review these entries have nowhere to send a reader and should not ship until that page exists. The work is tracked separately. --- changelog/index.mdx | 8 -------- 1 file changed, 8 deletions(-) diff --git a/changelog/index.mdx b/changelog/index.mdx index 8e7b886..26c3e3a 100644 --- a/changelog/index.mdx +++ b/changelog/index.mdx @@ -6,14 +6,6 @@ rss: true -## Breaking changes - -- **SCIM orgs: user management moves to your IdP** — in an organization whose user lifecycle is managed by SCIM, members owned by the IdP can no longer be invited, re-invited, role-changed, or removed through Kosli. Such edits used to appear to succeed, only to be silently overwritten by the next sync, leaving Audit Log entries attributing the change to the wrong actor. Service accounts are unaffected and stay editable throughout. - -## Updates - -- **Opt back in to managing non-SCIM users** — an admin in a SCIM-managed organization can manage the remaining (non-IdP) users via a toggle on the user management page. With the opt-in off, the UI permits no invitations or role changes. - ## Bug fixes - **Attestations filter no longer breaks infinite scroll** — applying a filter on the org attestations list while a page request was still in flight could stop pagination for the rest of the session: the first page of filtered results rendered and nothing more, with no error. Filter and page requests are now serialized.