Changelog
What's new in NYXR
Every release, newest first - what was added, improved, fixed and hardened. Each line maps to a real change in the platform.
Effective CTI attribution, global configuration portability & clearer defaults
- FixedThreat Intelligence feed contribution now reports requests actually blocked by CTI during the operator-selected timeframe, attributes each event through its exact IP or CIDR provenance, and no longer presents catalog indicator counts as enforcement.
- FixedThe shared Z.AI credit ledger now records dashboard-assistant usage from every user, including successful model rounds before a later tool failure, alongside behavioral verdicts and learner/fingerprint labels.
- AddedSettings can export and restore a strict versioned global JSON configuration archive, including platform, learner and AI-credit policies, with transactional writes, RBAC, audit history, change notification and the existing nftables drop confirmation.
- ImprovedLearned Intelligence rules and fingerprints now reuse the shared DataTable with global search, per-column value filters, selection, CSV export, record details and pagination.
- ImprovedBehavioral scoring sections start collapsed for a clearer overview, while the reusable default-value badge marks every scoring and general-settings control as canonical or user-customized.
- ImprovedThe language, theme, search and Under Attack controls align to the compact top-bar height; the assistant New, Back and Close actions use the same reduced vertical footprint.
- SecurityWorkspace dependencies are updated to their latest mutually compatible releases, the deprecated Base UI package is migrated to @base-ui/react, pnpm is upgraded to 11.13.0, and the production dependency audit reports no known vulnerabilities.
Truthful enforcement, complete localization & operational readiness
- FixedLogs Explorer now constrains long IP and organization identities inside phone cards, removes the obsolete end-of-history footer, and keeps its single paginator as the authoritative navigation control.
- FixedFrench mode now uses 24-hour chart times, localized country and WAF-posture labels, translated theme and audit actions, plus bilingual evidence-grounded explanations for newly generated AI verdicts.
- SecurityBehavioral scoring materializes the engine’s effective default weights before editing or saving, preventing an empty override map from appearing as zero-valued protection.
- ImprovedAccess-list selection opens the corresponding inspector and creator identities are resolved to account names and emails without exposing internal usr identifiers.
- FixedA request or AI recommendation is no longer presented as an applied ban without a persisted ban identifier, eliminating ghost-ban claims for sources such as 94.154.43.185.
- SecurityAudit attribution now trusts the dynamically allocated private Docker bridge instead of one stale subnet, preserving the real forwarded operator IP after network recreation.
- AddedSecurity posture now evaluates complete validated backups, recorded restore drills, active configuration versions and running observability components; degraded and missing controls count as action required.
- FixedGateway-first scenario bans now carry their exact counter evidence into a durable ban row, receive an immediate bilingual AI verdict, and are retried by reconciliation after provider outages instead of remaining opaque Redis-only records.
Operator-first console navigation, responsive investigations & clearer audit trails
- ImprovedReorganized the console into five task-oriented workspaces with capability-aware destinations, a Ctrl/Cmd+K command palette, instant client navigation and one consistent top breadcrumb instead of repeated page trails.
- ImprovedReworked the authenticated shell and high-traffic pages for phones, tablets and desktops: 44px touch targets, compact tablet rail, reduced-motion support, resilient wrapping and no page-level horizontal overflow.
- ImprovedLogs Explorer now uses investigation cards below desktop widths and a priority-based fixed table above them, with URL-backed service, fingerprint, JA4, coherence and reputation filters that remain shareable without overlap or horizontal scrolling.
- AddedSaved Logs Explorer investigations now persist in PostgreSQL as private or team views, can be reopened in one click and can be deleted by their owner or an authorized administrator.
- ImprovedDashboard service scope and Threat Intelligence time/country scope now persist in the URL and consistently drive their related statistics, timelines, events and drill-downs.
- AddedOperations now includes a read-only security-posture summary built from effective control-plane settings, environment readiness, MFA coverage, feed health and active sessions.
- FixedAudit Log actors now show the current account name and email rather than internal usr identifiers, with explicit deleted-account handling, server-side search, localized action details and redacted before/after diffs.
- SecurityHigh-impact kernel drop settings require the exact WAN-interface confirmation, while navigation and management actions follow effective capabilities instead of relying on visual hiding alone.
- FixedWAF autotune promotion now opens a real event-backed scoped-exception preview and creation flow instead of copying an unusable search snippet.
- AddedLogs Explorer advanced filters now cover every operational event field: service, decision, severity, method, status, URI, client IP, country, CRS rule, block reason, ASN, user agent, CRS/behavioral scores, time range, fingerprint, JA4, coherence and reputation.
- ImprovedRequest details now explain the complete decision chain with every CRS rule ID/name/match, anomaly and behavioral scores, weighted signals, and the exact CTI feed provenance when available.
- SecuritySecurity-event ingestion now trusts NGINX’s post-realip client address instead of reparsing spoofable raw forwarding headers; legacy public-client rows incorrectly attributed to loopback/private IPs are repaired in place.
- FixedThreat Intelligence map dependencies are bundled into the standalone console SSR image so the production route loads without external node_modules resolution failures.
- AddedAccess-list entries can now be edited in place from a pencil action; every change is audited and immediately recompiles the gateway allow, deny and geo snapshots.
- FixedTable selection checkboxes no longer open row details, including the accessible role-based checkbox implementation used on desktop investigative tables; access-list deletion also sends the CSRF-safe JSON request headers consistently.
- SecurityAsk AI bulk analysis now renders a localized selection card while processing and stores only a safe summary in conversation history, never exposing the prepared prompt or raw forwarded block in the UI; conversation deletion also uses the CSRF-safe request contract.
- SecurityThe default behavioral auto-ban for repeated scanning patterns is extended from 24 hours to 7 days.
- AddedManaged notification destinations now support Discord, Slack, Microsoft Teams and Telegram Bot with encrypted credentials, per-destination event/severity/service routing, title prefixes, mentions, technical-context controls, console links and provider-native test messages.
- ImprovedTargeted WAF exceptions now expose the complete request, CRS catalog metadata, exact ModSecurity variable/value/operator evidence, other transaction matches and 30-day historical impact before showing the resulting scoped directive.
- ImprovedBehavioral scoring is reorganized around a clear signal-to-action decision flow and three guided configuration groups, while preserving every threshold, decay, fingerprint, AI, weight and pattern control.
- FixedGateway-created automatic bans are rehydrated with their latest behavioral evidence in the console, and AI recommendations, blocked requests and bans actually enforced are now shown as distinct states instead of an ambiguous “ban” verdict.
- FixedProtection navigation now stays in normal page flow instead of floating in the middle of the viewport; enforcement details also avoid duplicating an AI verdict as a generic reason.
WAF UX round 2: bulk actions, keyboard shortcuts, CRS doc links & buildReplayQuery
- AddedWAF rules table now ships bulk enable / disable: select rows with the per-row checkboxes and the shared DataTable renders a "N selected" action bar with one-click apply. The reducer runs sequentially and stops on the first failure so a transient backend blip never leaves the table in a half-applied state. 4 unit tests cover the pure reducer (success / first-failure / empty / reentrant).
- AddedWAF rules table keyboard shortcuts: press `/` anywhere on the page to focus the search input (with auto-select), and `Esc` to clear it when focused. The placeholder advertises the affordance; both bindings ignore the event when another input is focused.
- AddedEvery CRS rule id in the catalog now links to its canonical `.conf` source on the OWASP CRS GitHub repository (deep-link `v4.0/rules/@<id>.conf`), and every category links to the directory listing. New `crsRuleDocUrl` / `crsCategoryDocUrl` helpers are pure + unit-tested (6 tests).
- ImprovedShadow replay panel refactored to share its `buildReplayQuery` mapping with the lib layer: the React component is now a thin state-machine around the pure helper, which is itself unit-tested (8 tests) for every default / sentinel / whitespace edge case.
- ImprovedLogs Explorer cell state stays in lockstep with the row-action menu: `setExceptionEvent` and `setSearch` now flow through a typed `ColumnActions` object so the column cells and the menu stay in sync without prop drilling.
- SecurityExternal doc links use `rel="noreferrer noopener"` and `target="_blank"` per OWASP recommendation, never leaking `Referer` to github.com or exposing the opener window to tab-nabbing.
WAF UX overhaul: posture gauge, autotune actions, scoped filters & click-to-exception
- AddedNew "WAF posture" gauge on the WAF page: a single 0-100 score combining service coverage, disabled-rule ratio, recent enforcement and data-plane reachability, with a radial gauge + per-axis breakdown (icon + label + value, never colour-only - CDC §5.2.2). 20 unit tests cover the pure scoring helpers.
- AddedShadow replay panel now ships with scoped filters (1h / 6h / 24h / 7d / 30d window, per-service picker, debounced ruleId input) plus a "Reset filters" button and active-filter chips so the operator always knows which slice of traffic they are looking at.
- AddedEvery autotune candidate now ships with three inline actions: "Promote to scoped exception" (copies a ready-to-paste search snippet since the current /waf/exceptions/preview endpoint requires an event id), "Pin rule" (bookmarks the CRS id locally for follow-up), and "Dismiss for 7 days" (persists dismissal in localStorage with automatic expiry cleanup). 8 unit tests cover the localStorage helpers.
- ImprovedLogs Explorer: the CRS rule badge and the URI in the request column are now real <button> elements that open the create-exception dialog pre-filled with the clicked value (Tab/Enter/Space navigable, ARIA-labelled). The action menu adds "View similar events" which pushes `ruleId:<id>` into the unified search.
- ImprovedLogs Explorer client-ip cell now ships a one-click "Filter by IP" icon button beside the resolved IP, eliminating the kebab-menu detour for the most common investigative pivot.
- ImprovedLogs Explorer now allows scoped exception creation on observed (non-blocked) events too - a noisy CRS hit logged today is exactly when an operator wants to preempt a future block.
- ImprovedServices table WAF column now leads with a coloured Badge (Off / Detect / Block with matching Lucide icon - never colour-only) so the posture is scannable at a glance, while keeping the inline mode picker one click away via a chevron dropdown.
- AddedNew `apps/console/src/lib/managed-services-lite.ts` shares a typed `[id, domain, wafMode]` slice of the managed-services list between the WAF page (shadow-replay service picker) and the posture gauge (coverage axis) through a single TanStack Query key.
- AddedConsole now ships its own vitest setup (`apps/console/vitest.config.ts`) so WAF and other console-side helpers can be unit-tested without touching the backend - 28 tests green at HEAD.
- SecurityNo new attack surface: every new UI surface only consumes the existing authenticated `/api/v1/waf/*` and `/api/v1/services` endpoints. localStorage entries are namespaced under `waf-autotune-*` so a future "reset preferences" can wipe them in one shot.
Fingerprint engine, investigation views & production-aligned landing
- SecurityClient Fingerprint Engine now scores browser coherence from JA4, header order and count, expected browser headers, UA versus HTTP/ALPN/sec-ch, Accept headers and HTTP/2 visibility, while staying observe-only by default.
- AddedLogs Explorer now exposes fingerprint details, score factors, JA4 coverage health and quick filters for fpHash, JA4, bad coherence and reputation thresholds.
- AddedBot Intelligence fingerprints are now investigable: timeline samples, top IPs, top paths, top User-Agents, frequency, reputation and operator allow/block overrides.
- ImprovedDetection & Response adds an explicit fingerprint mode in Behavioral scoring: Observe by default, Block only when an operator enables fingerprint enforcement.
- ImprovedThe public landing nine-layer protection schema now follows the production gateway order instead of a simplified marketing sequence.
- SecurityThe gateway now consumes the compiled fingerprint reputation snapshot, with per-service observe/challenge/block rollout, local request-smuggling/desync guards, verified-bot fast-path and canary honeypot traps with fake-but-plausible decoy data.
- AddedWAF shadow replay and auto-tuning surfaces show how many historical requests a rule would block and which noisy CRS hits deserve scoped exceptions instead of global disables.
- AddedRequest explanations now include a full decision timeline from real IP through access gate, CTI, ban, antibot, fingerprint, learned rules, rate limits, CRS and origin.
- AddedBot Intelligence adds a campaign workbench for distributed JA4/fingerprint/ASN/path/rule clusters with group-action review controls.
Console unification, accessibility & auto-deploy hardening
- ImprovedBans & Verdicts unified into a single "Behavioural Enforcement" page: active bans, AI verdict reasoning and auto-ban rules in one scrollable view — no tab switching needed.
- ImprovedBot Intelligence merged into "Detection & Response" (formerly Protection Rules) as a 4th workspace tab: service policies, behavioral scoring, automated rules and AI-learned intelligence in one place.
- ImprovedThreat Intelligence now shows the feed registry below the analytics; Reports redirects to Logs Explorer, consolidating 8 pages into 5.
- ImprovedBreadcrumb navigation in the header bar shows the nav group and page title, keeping orientation clear on every page.
- FixedThe theme toggler no longer crashes the console server during first render (SSR document guard).
- FixedAuto-deploy now rebuilds Docker images when source code changes — previously only restarted containers, leaving new code unshipped.
- FixedTypeScript typecheck reduced from 6 errors to 0 across the console; unused theme logic consolidated between the toggler and the user menu.
Dependency refresh, real deprecation fixes & the CTI score explorer
- ImprovedRefreshed the whole monorepo to current majors: TypeScript 6, Zod 4, React 19, Astro 7, Recharts 3, three.js r185, Hono 4.12, drizzle 0.45, otplib 13 and vitest 4.
- FixedCleared every TypeScript 6 / React 19 / Zod 4 deprecation hint for real instead of silencing them: React.FormEvent → React.SubmitEvent, React.ElementRef → React.ComponentRef, three.Clock → three.Timer, the deprecated Recharts <Cell> → a Bar shape renderer, z.string().uuid() → z.uuid(), parsed.error.flatten() → z.flattenError(), and JSON import assertions → import attributes. The `ignoreDeprecations` escape hatch is gone.
- AddedCTI IP score explorer: a read-only "Why does this IP have this score?" inspector that walks the feed-worker provenance map — contributing feeds, trust levels, categories, default actions, confidence and first/last seen — so disabling a feed or allow-listing an IP is an informed call.
- ImprovedThe new CTI score explorer and the targeted WAF-exception dialog are fully bilingual (English / French), wired into the app message tree alongside the rest of the console.
Reliability fixes & the adaptive bot-detection engine
- SecurityKernel-level bans are enforced again: the firewall helper was crashing against the host kernel and silently applying nothing. Banned sources are now dropped at the kernel before they reach the proxy.
- FixedThreat-intel no longer blocks internal infrastructure: a feed listing a private network range was poisoning the blocklist. Reserved and private ranges are now stripped on ingest, with a gateway guard so a poisoned feed can never block internal traffic.
- AddedGroundwork for the adaptive bot-detection engine: a fingerprint-aware, self-learning layer that profiles clients (TLS/JA4 + request fingerprints), learns per-service traffic baselines and proposes detections you approve. Shipping in stages; the data model and contracts land first.
Upload false-positive fix & recent additions
- FixedMedia services no longer block legitimate file and audio uploads: browser recordings sent as audio/webm;codecs=opus and large image uploads were tripping two CRS protocol rules. They are now relaxed per-URL for the upload endpoints only, so the rest of the service stays fully inspected.
- AddedFirst-run guided tour that walks new operators through the console, with a replay button in Settings.
- AddedHealth board that lists every stack and NetBird container with live status, read through a read-only Docker socket proxy.
- AddedAI-credit tracking for the assistant and behavioural verdicts, with a low-credit alert in Notifications.
- ImprovedThe whole console and the public site are now fully bilingual (English / French) with an instant, no-refresh language switch.
- ImprovedRicher Discord notifications: on-brand embeds with severity colour, context fields and deep links back into the console.
Faster assistant, seamless navigation & unified alerts
- FixedThe AI assistant stopped replying (and got much slower) after the prompt-injection hardening - it now answers in seconds again, with the same anti-injection safeguards intact.
- ImprovedMoving between the landing, dashboard and changelog is now instant: client-side navigation with no full page reload and no flash.
- ImprovedOne redesigned notification system across the whole console - on-brand alerts with a contextual action and a dismiss button, replacing the old toasts.
- ImprovedRebuilt the changelog as a clean release timeline.
Console consolidation & polish
- ImprovedMerged Performance into Health and Bans into AI Verdicts, and redesigned the bans view.
- ImprovedLight-theme contrast pass, plus the traffic-over-time legend icons now match each curve colour.
- FixedAccessibility and Lighthouse cleanups across the authenticated console and the login / changelog pages.
Tables, AI assistant & changelog
- AddedUniform table toolkit: global search, per-column value filters (multi-select checklists + contains), click-to-sort, row multi-select and CSV export across every table.
- Added"Ask AI" bulk action: forward a selection of requests or verdicts to the assistant for analysis, with the data treated as untrusted.
- AddedThis changelog, reachable from the console and the public site.
- SecurityHardened the AI assistant against prompt injection: user input and tool results are treated strictly as data, with anti-exfiltration and role-lock rules.
- FixedAssistant conversations now replay in chat order (oldest message first).
- FixedSection tabs sit flush left and the track hugs the tabs instead of stretching full width.
- ImprovedSubtle row striping and a cleaner selection / export toolbar for readability.
WAF mode enforcement fix
- FixedA protected service in detect/off mode no longer challenges or rate-limits requests - only block mode enforces. Detect/off is now truly observe-only.
NYXR landing & console home
- AddedPublic NYXR marketing site with an animated WebGL hero, the nine-layer engine schema and a faithful console preview.
- ImprovedThe landing now lives at /, the authenticated console moved to /dashboard, sign-in at /login.
Conditional Access
- AddedConditional Access policies: gate any service behind a country rule, TOTP, a shared password or a trusted-IP bypass - non-bypassable and fail-closed at the gateway.
- AddedPer-policy maximum failed attempts with a styled block page on lockout.
- ImprovedAccess Lists and Conditional Access merged into a single "Access & Policies" workspace.
- ImprovedStyled, on-brand block / challenge / gate pages.
Kernel-level bans & AI verdict
- AddedKernel-level enforcement: confirmed bans are dropped at the kernel with nftables (off / log / drop).
- ImprovedAn AI "allow" verdict is now authoritative down to the kernel ban layer, lifting over-eager behavioural bans.
- AddedRead-only AI assistant (the NYXR cat) with per-user conversation history.
Core gateway
- AddedModSecurity v3 + OWASP CRS WAF, IP / ASN / country / threat-intel filtering, adaptive antibot challenges, advanced rate limiting and behavioural bans.
- AddedReal-time Astro admin console with live logs, KPI dashboards and centralized observability.