Release Notes: v2026.11.0

Upgrade note: Migrations run automatically on startup. Review the breaking changes and migration sections below before upgrading.

Highlights

• Guided onboarding for new workspaces — New users now see a step-by-step onboarding wizard with a checklist and progress drawer, making it easier to set up sources, invite teammates, and start seeing data quickly.
• External MCP server support for AI agents — You can now connect third-party MCP servers to your AI agents, authenticate them with OAuth, and grant specific tools, expanding what your agents can do beyond built-in capabilities.
• ClickHouse Cloud as a first-class destination — ClickHouse Cloud services can be provisioned, linked, and used as a dedicated destination, with full UI support for managing services grouped by data warehouse.
• Source deletion with grace period and cancellation — Deleting a source now enters a grace period during which workspace users or admins can cancel the deletion, preventing accidental data loss.

Features

• First-run onboarding experience — A new onboarding wizard, checklist, and progress drawer guide users through workspace setup including connecting sources, inviting members, and provisioning AI.
• Guidance cards — A reusable guidance card framework nudges users during workspace setup.
• External MCP server management — Connect, authenticate (via OAuth), and manage external MCP servers, then grant their tools to AI agents for expanded investigation capabilities.
• ClickHouse Cloud destination — A new ClickHouse Cloud destination type with full provisioning, UI, and migration sweep support for moving workspaces to dedicated Cloud services.
• ClickHouse Cloud organization provisioning — RunReveal orgs and workspaces can now be provisioned directly from ClickHouse Cloud organizations, with service linking and onboarding flows.
• Source deletion with grace period — Sources enter a grace period on delete; workspace users and admins can cancel pending deletions, and admins receive notifications for orphaned sources.
• Serval custom endpoints — The Serval connector now supports custom endpoint configuration.
• AI model updates — Support for current GPT and Claude models, including Bedrock Claude prompt caching and server-side compaction.
• MITRE ATT&CK v20 — The ATT&CK catalog has been updated to v20 with warnings on retired technique IDs.
• Admin portal improvements — Platform admins can now be managed from the Admin Portal, and a cross-workspace destinations table with error health is available.
• Consolidated settings pages — Workspace, User, and AI settings are unified into a streamlined settings experience.
• Polling window engine — A new window-based polling architecture for Google Workspace and other polling sources, with Postgres scrape gauges for monitoring.
• Changelog RSS feed — The documentation site now publishes a changelog RSS feed.
• ClickHouse design-system palette — A ClickHouse-branded color palette is available alongside the RunReveal palette.
• Batch writer streaming — Batch objects are now streamed directly into ClickHouse inserts instead of being buffered.
• Async custom view sync — Custom views for BYODB destinations now sync ClickHouse DDL asynchronously.
• Default pending signups — New account signups default to a "pending" state for approval.
• Workspace switching from pending approval — Users awaiting approval can now switch between workspaces.
• Bucket ownership enforcement — A bucket can now belong to only one workspace, preventing cross-workspace conflicts.
• Scheduled orphan reaper — A scheduled job cleans up orphaned batch notification queue rows.
• Bedrock spend roll-ups — AI budget tracking now rolls up Bedrock spend incrementally instead of re-aggregating per turn.
• Readonly IAM user provisioning — A readonly database IAM user is now provisioned automatically.

New Integrations

Bug Fixes

• ClickHouse multi-host DSN parsing — Fixed parsing of DSNs with multiple hosts so clusters with several nodes connect correctly.
• Service-scoped admin data access — ClickHouse service provisioning is now gated on admin data access to the specific service.
• Wiz threat field handling — The Wiz threats integration now correctly accepts array values for tdrSources, detectionIds, and notes.
• Custom source wizard view saving — The custom source wizard now sends the sourceType when saving its view.
• Custom role reserved names — Creating a custom role with a reserved name now fails with a clear error instead of silently succeeding.
• Backfill lease atomicity — Backfill configs are now leased atomically to prevent stranded processing rows.
• Google Workspace polling reliability — Fixed several issues: partial polls now preserve LastEvent correctly, dense polls continue paging until a full minute of events is read, and the newest alert is no longer re-ingested.
• Polling auth back-off — Permanent Google auth failures and other auth errors now trigger exponential back-off, and windows past the max lookback are dropped.
• Fair polling window claims — Polling window claims now use fair ordering and index-ordered queries for better throughput.
• Window split batch cap — Window split batches are now capped to prevent runaway splits.
• RBAC source restrictions on UEBA — Custom role source restrictions now apply correctly to the ueba_actor_hourly table.
• Managed detection settings — Investigation settings are no longer shown for unsubscribed managed detections.
• Threat feed reliability — Stale threat feeds are retired and replacements loaded automatically; Mullvad IPs are parsed directly from the Mullvad endpoint.
• Slack OAuth callbacks — OAuth callback failures are now returned to the app and the source stays active instead of going into a broken state.
• Self-hosted fonts — Builds no longer fetch Google Fonts externally; fonts are self-hosted.
• OAuth security fixes — Role-based privilege escalation is prevented, and GitHub login now requires a verified primary email.
• MCP prompt pagination — MCP prompts and skills now page correctly within the enforced page limit.
• Cloudflare audit fixed windows — Fixed windows now read behind a safety lag so late-arriving events are not dropped.
• Source volume promotion — Received-at source volumes are now safely promoted, and materialized view targets are repaired.
• Object decompression in verify-settings — Objects are now decompressed before sampling during source verify-settings.
• Event latency measurement — Event latency is now measured after transforms for accurate reporting.
• Bitwarden polling — Fixed Bitwarden polling from wedging on its date range.
• Detection alert IDs — Stream ExecutionID is now used as the alert ID for detections.
• Destination write back-off — Destinations that fail before any data is written now trigger back-off.
• Scheduler crash prevention — The scheduler no longer crashes when a threat feed refresh or health check fails; it records the result and continues.
• ClickHouse login domain gating — ClickHouse login is now gated on authorized login domains with a generic error message.
• RBAC V2 org role reads — Migrated orgs now read roles from RBAC V2 correctly on ClickHouse.
• Workspace provisioning invite preservation — Provisioning no longer clobbers a pending invite.
• AI budget model prices — AI model prices have been updated to reflect current costs.
• Null user preferences guard — A null value passed to UserPreferencesUpdate no longer causes a crash.
• Source card Last Event — The Last Event timestamp on source cards is restored.
• ClickHouse object verification — Provisioned ClickHouse objects are now verified after creation.
• Sidebar new-tab support — Settings links in the sidebar can now be opened in a new tab.
• AI settings secret toggles — Secret fields in AI settings now have visibility toggles.
• Auth redirect fix — Login redirects now happen from an effect instead of during render, fixing a React warning.
• ClickHouse org link preservation — The ClickHouse org link is preserved across admin org edits.
• Partitioner tuning — Reduced max_insert_threads and tweaked settings to produce fewer parts.
• GCP WIF role detection — Auto-detection of the AWS account for the default GCP Workload Identity Federation role is now correct.
• CVE-2026-111497 fix — Bumped the brotli dependency to v1.2.7 to address a decompression vulnerability.

Breaking Changes

• New account signups default to pending — New signups now enter a "pending" state instead of being immediately active. If you have automation that expects immediate account availability, update it to handle the pending-to-active approval flow.
• ClickHouse Cloud service provisioning — Existing ClickHouse Cloud services can now be provisioned and linked to RunReveal. Deployments that previously managed ClickHouse independently should review their service configuration before upgrading, as the platform will now create destination records and workspace roles tied to Cloud services.
• External MCP server schema — New database tables and configuration for external MCP servers are introduced. If you have custom tooling that queries the mcp or agent-related tables directly, review the new schema. No action is needed if you use the API exclusively.
• Docs sign-in gate removed — The bring-your-own-cloud and API reference documentation pages no longer require sign-in. If you relied on the sign-in gate for access control to documentation, be aware these pages are now publicly accessible.

Maintenance

• Bumped Go to 1.27.3 and Alpine to 3.24 for the eMudhra CA compromise.
• Bumped langchaingo fork to upstream sync merge for Go 1.27 compatibility.
• Stopped publishing packages to Gemfury.
• Linted UI colors outside the design system and applied design-system colors to sysadmin pages, status badges, and pills.
• Consolidated internal operations runbooks and added UI copy guidelines, permissions gating guide, platform FAQ, and common source error documentation.
• Removed RUNWAY conference banner from docs.
• Streamed RPC responses with json/v2 instead of buffering them.
• Stopped creating workspace roles in the global ClickHouse instance.

Database Migrations