Skip to main content

​
Chart 5.3.6 / Operator v5.3.5 — August 2026

Configurable collector resources, with safe defaults. The collector now runs with default resource settings — requests 25m CPU / 64Mi memory, limits 500m CPU / 512Mi memory — grounded in measured usage with headroom, and configurable per-field via agent.collector.resources (standard Kubernetes requests/limits shape). Previously the collector ran with no requests or limits and the Helm value was unwired. An unparseable value falls back to that field’s default, so a typo can never make the collector unschedulable. Existing installs pick up the defaults on their next operator upgrade.

​
v5.4.16 — August 2026

One verdict vocabulary: SHIP / HOLD / BLOCK — everywhere. The change-prediction subsystem historically used SHIP / CAUTION / HOLD while the pre-flight surface used SHIP / HOLD / BLOCK — two vocabularies with conflicting tier meanings. As of this release, every surface (pre-flight, change predictions, prediction insights, the approval gate, and the CI validate endpoint) speaks SHIP / HOLD / BLOCK: SHIP = safe to ship, HOLD = caution/review, BLOCK = expected to fail (and, at Approve/Auto autonomy, gated until a human approves).

​
Changes

  • Prediction verdicts unified — new predictions emit SHIP / HOLD / BLOCK; historical rows were migrated in place exactly once (legacy worst-tier HOLD → BLOCK, legacy CAUTION → HOLD), so insight metrics and history remain correct.
  • /api/validate gate decision fixed — a change gated by an unapproved failure prediction now returns decision: "BLOCK". Previously this path returned an undocumented HOLD, which the documented “fail the job on BLOCK” CI pattern did not catch. If your pipeline matched on HOLD for this case, update it to BLOCK.
  • CLI score bands — the mid-range score label is now REVIEW (matching the documented “Review Recommended” range); score bands are not verdicts.

​
v3.9.19 — June 2026

Cross-cluster GitOps, a signed supply chain, and a single-artifact enterprise install.

​
New Features

  • Cross-cluster GitOps discovery — the in-cluster agent reads ArgoCD Application resources and Flux Kustomization, HelmRelease, and Source resources directly over the Kubernetes API. No ArgoCD or Flux API token is required, so discovery works even on clusters the SaaS control plane can’t reach. GitOps state persists in Postgres and survives restarts and replicas.
  • Signed supply chain — the Helm chart, the operator and agent images, and a CycloneDX SBOM for each are signed with cosign (backed by AWS KMS). Verify any artifact with cosign verify --key https://charts.changeguard.ai/cosign.pub.
  • Single Helm chart install — the chart is now the one install artifact (the standalone agent is removed; the one-liner is a thin Helm bootstrap). It is published to both the chart repo and as an OCI artifact, with a global.imageRegistry override for air-gapped clusters and ready-made ArgoCD/Flux install examples.
  • Automatic SBOM collection — Syft SBOMs are harvested and posted automatically on every install, like the other scanners.

​
Fixes

  • Customer compliance scoring now excludes ChangeGuard AI’s own namespaces and cluster RBAC, so the score reflects only your workloads.
  • Cross-cluster ArgoCD fleet view and Flux GitOps state now render reliably across backend replicas.

​
v3.9.3 — May 21, 2026

Operator as default install method. The ChangeGuard AI operator now manages the full lifecycle — data collector, security scanners, runtime detection, and AI analysis — through a single ChangeGuardAgent CRD.

​
New Features

  • Security Scanning by default — KubeBench, Grype, Falco, Pluto, and Syft enabled on every install
  • Identity & Access view — RBAC analysis with 55+ finding types
  • Attack Path Analysis — privilege escalation graph
  • Compliance frameworks — SOC 2, PCI DSS, HIPAA, FedRAMP, EO 14028 mapping
  • Updated design system — dark navy UI with engineering-tool density

​
Fixes

  • Agent RBAC permissions now include rbac.authorization.k8s.io by default
  • Casbin middleware ordering fix
  • Sidebar navigation routing fix for all 31 views

​
v3.9.2 — May 2026

  • Score history persistence
  • Slack and Microsoft Teams webhooks
  • CSV and JSON export for compliance
  • Self-service signup with 14-day free trial

​
v3.8.0 — April 2026

  • NVIDIA NIM AI integration
  • Flux CD deep integration
  • Air-gapped install support
  • Helm chart for operator

​
v3.7.0 — March 2026

  • ArgoCD deep integration via CRD watching
  • GitOps drift detection and sync history
  • Cross-cluster image vulnerability correlation

​
v3.6.0 — February 2026

  • Initial release: CSC scoring, agent collection, ArgoCD fleet management, multi-tenant SaaS, REST API