Changelog¶

Release notes for EnforceGate vX.

2026.52.0 (GD) — "Verdigris Beetle" August 6, 2026¶

Maintenance release. No operator-visible changes; the operator surface is identical to 2026.51.0 (GD). Recommended for deployments already on 2026.51.0 as a routine update.

2026.51.0 (GD) — "Amber Locust" August 4, 2026¶

• EnforceGate vX reaches General Deployment. This is the first release published at the GD tier — the maturity level we recommend for production. Earlier releases were tiered Early Access (EA), meaning preview builds for testing and evaluation. Nothing about your deployment changes on upgrade; the tier reflects our confidence in the release, and it is now the tier we support for production use. See release tiers.
• The Business edition is now supported by the engine. Business sits between Pro and Enterprise, carrying Pro's full feature set with a higher capacity ceiling — 40 bundled connector sessions instead of 25, extensible to 45 with the same 5-session add-on. This release is the engine and build-pipeline groundwork; Business licences are not yet on sale. See Editions.
• show ip interface brief — the Cisco IOS classic, now in the engine CLI: one row per host interface with its IPv4, admin state and line state. The quickest way to confirm which address the host actually holds before wiring a connector, a firewall CIDR, or the captive-portal hostname. IPv4 only for now. See show ip interface brief.
• show policy reads better. The rules and shared directory paths now print below the file table rather than above it, so the file listing is the first thing you see. Display only — no change to what is reported.

2026.50.0 (EA) — "Obsidian Mantis" July 21, 2026¶

• Bring your own threat feeds. Policy rules can now match exact URLs — no regex required. Point match-url-list: at a file of literal URLs (URLhaus and OpenPhish publish in exactly this format, so feeds drop in as-is), or list a handful inline with match-urls:. URLs are normalised before matching, so feed entries reliably match real traffic. Every edition. See match attributes.
• Heads-up: match-url-list changed meaning. Lines used to be treated as regexes; they're now literal. If you relied on the old behaviour, rename the attribute to match-uri-regex-list: — same behaviour, clearer name. The engine warns at load time if it spots a regex in a literal list.
• Block a whole path, not just one URL. match-url-prefix-list: covers everything under a path — evil.com/malware catches the whole subtree without also catching the unrelated /malware-tools next door.
• Toolbox gains a threat-list toolkit. wget, rsync, more decompressors, dos2unix (a stray line-ending no longer breaks matching), idn2 for international domains, and miller for the CSV-format feeds. Enough to script the common threat-list sources end to end. See Toolbox.

2026.49.1 (EA) — "Cinnabar Hornet" July 20, 2026¶

• Exosys Curated Domain Lists now enforce. Write match-category: gambling in a policy rule and the engine enforces it against our maintained category feed — 60+ categories, delivered as a single signed file loaded at boot. No cloud lookup on the request path, and the deployment stays air-gapped after the initial download. See Managed categories.
• Feed status and hot reload. show feed reports the loaded generation, category counts, and entitlement; request feed reload picks up a newly-downloaded generation without restarting the engine. A failed reload never drops the running feed.
• Release artifacts are now named per edition. A Pro build is distinguishable from an Enterprise one at a glance — image names, VM images, and the version stamp all carry the edition. No operator action needed.
• Management console visibility and an installer fix. eghost status now shows the console's source-CIDR restriction and SSH lockdown posture, which were previously invisible. The appliance installer no longer trips over a firewall lock race during startup.

2026.47.5 (EA) — "Cobalt Osprey" July 10, 2026¶

• Appliance firewall hardening. The product ports (3128 / 80 / 443) used to bypass the host firewall entirely — meaning they answered on every interface, WAN included. The new eghost firewall commands gate them to your LAN interface or to specific source networks. New installs harden automatically; existing appliances upgrade with eghost firewall apply. See Appliance firewall.
• The appliance firewall now fails closed. If firewalld fails to start or its rules get flushed, the appliance stays closed rather than falling open — while remaining reachable on SSH and the management console so you can get back in.
• Pin destinations by TLS SNI. match-sni: lets a pin rule name the SNI directly, alongside the existing domain matching. See Pinned destinations.
• Steer the appliance's OS updates. eghost os upgrade exposes the update cadence, maintenance window, reboot policy, and a pause switch for change freezes. Appliance only — on Docker hosts, the OS stays yours to patch. See Appliance OS upgrade.
• Polish. A troubleshooting switch to temporarily open the firewall; eghost policy list no longer errors on a fresh install; the console shell prompt allows three password attempts instead of one; ping added to the toolbox. Usage errors across eghost now exit with code 2 consistently (runtime failures stay at 1) — worth checking if you script against exit codes.

2026.46.0 (EA) — "Onyx Peregrine" July 7, 2026¶

• Client-IP and method rules now actually enforce. match-client-ip and match-method were documented but silently ignored — meaning a rule intended for one subnet was applied network-wide. Now fixed and enforced. Audit any policy using these attributes after upgrading, since the effective behaviour changes. See the subnet recipe.
• Unknown policy attributes now warn instead of failing silently. A typo in an attribute name is reported at load time rather than quietly ignored. The phantom application: attribute is retired — it never did anything.
• Test a rule without a test client. show policy match <url> source-ip 10.20.30.5 method POST simulates the request, so you can verify a subnet- or method-scoped rule before shipping it.
• Console escape hatches. enter shell drops to a host root shell; enter toolbox shell drops into the sandboxed toolbox instead and returns you to the CLI on exit.
• Machine-readable SBOM with every release. A signed CycloneDX inventory ships alongside the human-readable notices — for customers whose scanners or compliance processes want it.

2026.45.0 (EA) — "Onyx Peregrine" July 3, 2026¶

• Paid editions no longer stop filtering when a license lapses. If a license expires or the Control Server is unreachable, the engine keeps enforcing your last policy for a 21-day grace window, then falls back to a reduced-capability floor — it never goes dark. See Never bricks on a license lapse.
• Pro and Enterprise are open for waitlist signup, with per-instance pricing planned. No ship date yet.
• One login, not two. The installer now sets a single operator username and password for both the management console and the engine's admin API.
• Support links updated to point at the customer portal for advisories and tickets.

2026.43.1 (EA) — "Iron Harrier" June 30, 2026¶

• SSH into the console now drops you straight into the engine CLI — no second password required. Can be disabled for hardened deployments.
• Default engine admin account renamed admin → enforcegate on fresh installs. Existing deployments are unaffected, but scripts keyed to the old username need a one-line update.
• Direct SSH (port 22) is locked down by default. Use the audited management console on port 2222 instead.
• Unattended installs are now supported for fleet and CI provisioning via a seed file.
• Several reliability fixes: the management console now starts correctly on SELinux-enforcing hosts, upgrades no longer abort on a transient container hiccup, and bad credentials fail fast at install instead of after a long timeout.

2026.42.0 (EA) — "Helm Heron" June 28, 2026¶

• New management console (eghost console) gives operators a dedicated, restricted SSH path straight into the engine CLI, with a start shell escape hatch for host-level maintenance. See Appliance management console.
• Per-service container shells — jump directly into the engine, portal, TLS, or toolbox container instead of one shared shell command.
• Smarter captive-portal acknowledgements. A domain-wide acknowledgement option means clicking through once on a warned site covers all its subdomains, and acknowledgement duration is now configurable. See the multi-domain recipe.
• Better policy troubleshooting — commands now show why a request matched the rule it did, filter long rule lists by name, and work across both operator and toolbox-managed policy files.
• Appliance ISO images now ship the same SSH hardening as the VM image: root login disabled, access restricted to the operator account.

Early Access foundation May 29 – June 25, 2026¶

(codenames "Sitting Duck" and "Lean Kestrel")

This period shipped the foundational EnforceGate vX capability set:

• The match engine, scaling to 150 million rules
• The captive portal — block / warn / multilingual Acceptable Use Policy / audit log
• SSL/TLS inspection in three modes: off, peek, and full decryption
• Plain-text, git-backed policy authoring with snapshots and rollback
• The eghost and egctl operator CLIs, styled after Cisco / Junos command modes
• An optional sandboxed toolbox for scripting your own threat-feed and domain-list sources
• Appliance VM/ISO and Docker distribution paths, with signed, integrity-checked images
• The Pro / Business / Enterprise edition structure

For a command-by-command history of this period, see the engineering changelog.