What's new

Product version

1.5

Release date

April 2, 2026

Brief description

This release focuses on improving system stability and quality.

Summary

• Run CLI tools through k8s;
• Receive notifications from TRON.ASOC using Webhooks;
• Add three new comparison modes for incremental scans;
• Use multiple versions of security tools in parallel;
• Increase role model granularity—add more granular access for security tools and scan sources;
• Find and deduplicate similar security issues for triage;
• Expand security issue attributes—add CVSS and Exploitability attributes;
• Track security issues found again;
• Integrate with AppSec.Track.

What's new

Feature	Description
Run CLI tools through k8s	Run CLI tools such as Semgrep, PVS-Studio, and Trivy as dynamic pods in Kubernetes. What changed for users: Users can configure CLI tools with YAML templates in the system interface and use special placeholders for configuration. This launch method is available only when you deploy the system in Kubernetes.
Receive notifications from TRON.ASOC using Webhooks	Automatically send security events to external systems, such as SIEM systems, messengers, and ticketing systems. What changed for users: A new Webhook notification tool is available. You can configure the URL, request rate limit (requests per second), and token authentication (header and value).
Add three new comparison modes for incremental scans	Compare incremental scans within a project layer. What changed for users: You can compare scan results in three ways: - Each scan with the previous scan; - All scans with the selected scan; - Two selected scans.
Use multiple versions of security tools in parallel	Create multiple integrations for the same tool with different versions. What changed for users: You can run multiple versions of a security tool in parallel.
Increase role model granularity—add more granular access for security tools and scan sources	Separate security tools and scan sources into global resources, available in all projects, and project resources, available only in selected projects. What changed for users: When you connect a security tool or scan source, you can select one of two access types: - Global; - Project.
Find and deduplicate similar security issues for triage	An alternative deduplication method is now available. What changed for users: The Find and deduplicate similar issues action is available in the system interface. You can merge duplicates manually or automatically.
Expand security issue attributes—add CVSS and Exploitability attributes	Users can track security issue scores according to the Common Vulnerability Scoring System (CVSS) standard. They can also track exploit types present in issues. What changed for users: The security issues page now includes these table fields: - CVSS (v.2); - CVSS (v.3); - CVSS (v.4); - CVSS (v.?); - Exploitability.
Track security issues found again	Security issues found again during a scan receive the Reopen status. What changed for users: You can track security issues that were found again.

New integrations

Tool	Description
AppSec.Track (https://appsec.global/appsectrack)	Integration with AppSec.Track, a tool for monitoring and tracking application security tasks (Application Security Tracking).

REST API changes

New endpoints

• PUT /check/{check_id}/comparison
• DELETE /deduplicate-rules
• GET /errors-log
• GET /errors-log/csv
• GET /errors-log/filters
• GET /event-template
• DELETE /issues
• GET /issues/cvss-severities
• DELETE /issues/statuses/transitions
• POST /layer/{layer_id}/sbom
• DELETE /layers
• GET /ldap/allowed
• GET /license
• PUT /license
• GET /license/environment
• GET /license/status
• POST /notifier-type/{id}/test
• DELETE /notifiers
• GET /permissions/check
• DELETE /policies
• PUT /projects/archive
• PUT /projects/unarchive
• DELETE /reports
• PUT /restore-users
• DELETE /roles
• GET /scan-result/{result_id}/stats/issues
• GET /scan-results/stats/compare
• GET /scan-results/stats/{check_id}
• DELETE /security-rules
• DELETE /sources
• GET /sso/allowed
• DELETE /tokens
• POST /tool/{id}/cleanup
• DELETE /tools
• DELETE /trackers
• DELETE /groups

Changed endpoints

Changed endpoint	Summary of changes
POST /auth/login	The password parameter type changed from string to object.
GET /deduplicate-rules	- Removed filter[method] and search parameters. - Added search[name].
GET /dependencies	- Removed filter[check_id] and search. - Added filter[layer_id], search[name], search[project_name], search[type], and search[version].
GET /dependencies/filter	- Removed filter[check_id]. - Added filter[layer_ids].
GET /events, GET /events/csv	- Removed filter. - Added search[message] and search[message_ru].
GET /groups	- Removed search. - Added search[name] and search[project_tags].
GET /issue/{id}/history	Added responsible_group_values and responsible_user_values.
GET /issues	- Removed smart_search. - Added advanced filtering (filter[...]) and search (search[...]) by attributes such as assignee, category, cve, cwe, lib_name, and dates.
GET /issues/basic-filter	Added filter[need_detected_at].
GET /issues/count	- Removed filter[exclude_duplicates_for_issue_id] and smart_search. - Added advanced filtering and search.
GET /issues/filter	Added filter[comment_message], filter[detected_at...], filter[tool_name], and filter_inversion.
GET /issues/statuses	Added filter_inversion.
GET /ldap/settings	Removed the data body parameter.
POST /notifier/{id}/test	Removed the data body parameter.
GET /policies	- Removed search. - Added search[author], search[name], and search[project_name].
GET /projects	- Removed search. - Added filter[deleted_only], filter[with_deleted], search[code], search[name], and search[tag].
GET /projects/filter	Removed search.
GET /quality-gates	- Removed search. - Added search[author], search[name], and search[project_name].
GET /report/{id}	Removed the format query parameter.
PUT /report/{id}	Added the required data body parameter.
GET /resources	Added filter[project_access].
GET /roles	Added search[id] and search[name].
GET /sboms	Added filter[project_code] and search.
GET /scan-results, GET /scan-results/filter	- Added date filters for created_at and updated_at. - Added filter[checks] to /filter.
GET /security-rules, GET /security-rules/filter	- Removed multiple query parameters. - Added a unified filtering structure, filter[...], and search structure, search[...].
GET /sources	- Removed search. - Added search[name] and search[source].
GET /tools	- Removed search. - Added filter[version], search[name], search[type], search[url], and search[version].
GET /users	- Removed filter. - Added the deleted_only, need_password_change, role, and with_deleted filters and search by user fields.

Removed endpoints

• POST /check/{check_id}/sbom
• GET /check/{check_id}/secure
• GET /copilot/status
• DELETE /deduplicate-rule/{id}
• DELETE /group/{id}
• DELETE /issues/statuses/transitions/{id}
• DELETE /layer/{id}
• DELETE /notifier/{id}
• DELETE /policy/{id}
• DELETE /report/{id}
• DELETE /role/{code}
• DELETE /security-rule/{id}
• DELETE /source/{id}
• GET /source/{id}/secure
• GET /sso/settings/secure
• DELETE /token/{id}
• GET /tool/{id}/secure
• DELETE /tracker/{id}

Upgrade instructions

• Online documentation
• Install with Docker Compose
• Install with Helm Chart

Feedback and support

• support@tronasoc.ru
• Partner technical support policy for TRON.ASOC software users

Conclusion

We’re improving the user experience and responding to issues promptly.
Thank you to the users whose issue reports helped us prepare this update.