Changelog

Synapse-Vulncheck Changelog

NEXTVERS - 2026-XX-YY

Automatic Migrations

  • Migrated storage version tracking to use Storm package inits.

  • Migrated existing API key settings to the new configuration manager. Per-user API keys were migrated to user-scoped configurations named synapse-vulncheck:<useriden>. A legacy API key whose configuration cannot be added, for example because a global configuration already exists, is left in place and reported in the Cortex log; use vulncheck.config.add to add it.

Features and Enhancements

  • Updated Power-Up to use $lib.auth.users.get() instead of $lib.user.

  • Added support for proxy and SSL verification configurations on a per-vault basis.

  • Added new configuration manager commands:

    • vulncheck.config.add

    • vulncheck.config.del

    • vulncheck.config.list

    • vulncheck.config.show

    • vulncheck.config.update

    • vulncheck.config.migrate

  • Added a --config argument to vulncheck.enrich, vulncheck.search, and vulncheck.index to override the default configuration.

  • Added the power-ups.vulncheck.admin permission, which grants access to all Synapse-Vulncheck commands and the vulncheck.privsep module.

  • Replaced the Optic configuration workflow with one for synapse-vulncheck vaults.

  • Removed the vulncheck.setup.apikey command. Use vulncheck.config.add / vulncheck.config.update instead.

Bugfixes

  • Fixed the data migrations failing when a view is deleted while they run, or when a view’s write layer is read-only. Views with a read-only write layer are now skipped with a warning.

v2.0.0 - 2025-04-23

Automatic Migrations

  • Deleted the following deprecated properties on risk:vuln that were set by Synapse-Vulncheck: :cisa:kev:added, :cisa:kev:duedate, :nist:nvd:published.

Features and Enhancements

  • Updated vulncheck.index to populate the it:exec:query:synuser property.

  • Updated ingest logic to no longer set the following deprecated properties on risk:vuln: :cisa:kev:added, :cisa:kev:duedate, :nist:nvd:published. Please use the authoritative sources to set these properties on it:sec:cve.

v1.3.0 - 2025-01-17

Features and Enhancements

  • Updated deprecated $lib.list() usage to JSON style syntax.

v1.2.0 - 2024-06-28

Features and Enhancements

  • Replace deprecated risk:hasvuln usage with risk:vulnerable.

This release contains an automatic data migration that will run when the package is first upgraded. The migration creates risk:vulnerable nodes from the deprecated risk:hasvuln nodes.

v1.1.0 - 2024-06-05

Bugfixes

  • Safely skip invalid CPE strings.

v1.0.1 - 2024-02-20

Features and Enhancements

  • Update deprecated $lib.dict() usage to JSON style syntax.

v1.0.0 - 2023-12-22

NOTE: The Vulncheck V3 API uses a new authentication method which will require re-adding an API token with the vulncheck.setup.apikey command.

Features and Enhancements

  • Update to use the Vulncheck V3 API.

  • Add vulncheck.index command for ingesting a Vulncheck index.

v0.3.0 - 2023-06-16

Features and Enhancements

  • Updated to use new CVSS model and $lib.infosec.cvss.vectToScore()

v0.2.0 - 2023-03-22

Features and Enhancements

  • Update Power-Up to build with code signing.

v0.1.0 - 2023-01-05

NOTE: This release is considered Beta and may be subject to change.

Features and Enhancements

  • Set risk:threat:name if unset.

v0.0.2 - 2022-11-16

NOTE: This release is considered Beta and may be subject to change.

Bugfixes

  • Fix an issue with API token refreshing.

  • Avoid creating empty risk:threat nodes from empty API results.

v0.0.1 - 2022-11-04

NOTE: This release is considered Beta and may be subject to change.

Features and Enhancements

  • Initial release of the Synapse-Vulncheck Power-Up