Releases
Changelog
A running history of Flowcerta platform changes, parser coverage updates, rule additions, and customer-visible release notes.
- Custom rule authoring — author org-scoped UiPath risk rules from a dashboard editor: activity and property conditions, or a composable match.where tree (boolean allOf/anyOf/not, structural notInsideAncestor / siblingBefore / siblingAfter, child-element matching), with a live dry-run against an uploaded .xaml. Rules fire for every member and every CI run.
- Community rule packs — import and export rule packs as YAML with a preview-then-apply additive merge, import offline from the CLI with rpagov rules import, and browse a curated in-app catalog that drops a pack straight into the import preview.
- Orchestrator scan-on-publish and regression alerts — connect UiPath Orchestrator to scan each newly-published package version automatically and post a workflow.score_regressed webhook to Slack or Teams when a version drops a score band or adds a Critical/High finding. Opt-in per connection (Migration 046).
- Orchestrator governance status — each connection lists its synced processes with a health band and a regression flag drawn from the workflow inventory.
- SBOM export — GET /api/v1/inventory/sbom returns an automation SBOM in JSON or SPDX 2.3, covering invocations, queues, credential references, observed endpoints, and package versions.
- Compliance intent pages — new /for/sox-compliance-automation, /for/hipaa-rpa-governance, /for/gdpr-rpa-governance, and /for/pci-dss-automation-governance landing pages.
- Public compliance mapping — /compliance maps each governance rule to SOC 2, HIPAA, GDPR, NIST 800-53, ISO 27001, and PCI DSS controls, and the OpenAPI spec is published at /api-docs/openapi.json.
- Audit evidence packs — export a signed (HMAC-SHA256) audit pack per org or per validation as JSON or PDF, with portfolio stats, findings, applied policy, and framework coverage; download buttons on the portfolio and validation views.
- Outbound webhooks — org-level HMAC-signed webhooks fan out validation.completed, validation.below_threshold, and exception.expiring_soon to generic, Slack, or Teams endpoints, managed from a Webhooks tab.
- Cross-workflow severity — upload a whole project (.nupkg/.zip) for a dependency graph and blast-radius ranking; a finding in a workflow invoked by many others is elevated by caller count.
- Power Automate expansion — six new detectors (PA-005..PA-010): hardcoded endpoints, empty scopes, tight recurrence triggers, unfiltered event triggers, variable initialization inside loops, and high-concurrency loops.
- In-house nurture engine — event-triggered email sequences (post-scan, signup, org-created, re-engagement) with HMAC unsubscribe links, sent over the existing notification transport (Migration 040).
- CoE starter policy packs and comparison surfaces — three published starter policy packs, three /vs/ comparison pages, and a /security-and-procurement page with a pilot form.
- Growth plan unlimited users — the 10-user cap on the Growth tier was removed.
- Workflow Review unified routing — every operator entry point (upload handoff, validation banners, findings, overview hotspots, portfolio drilldowns, compliance per-control workflows) now routes into the same Workflow Review queue.
- Power Automate analyzer expansion — three new detectors landed: PA-002 (hardcoded credentials in action inputs), PA-003 (HTTP actions with retries disabled), PA-004 (unbounded Do Until loops).
- Free scanner email gate — anonymous /scan results now show top findings free and gate the rest behind an email submit. Every scan produces a shareable read-only report URL.
- CI smoke test — Playwright app-shell smoke now runs on every pull request, with chromium auto-installed in CI.
- Inventory operations — per-row validation history drawer, regression count stat card, and a tunable stale-threshold and needs-review score per org.
- Validation feed signals — non-regression diffs, blocking-finding markers, applied policy summary (overridden and exempted rule IDs), and inline rule playbook links.
- Ingest diagnostics — recent failed ingest jobs surface on the validations page; GET /api/v1/jobs/{id} returns the failure reason.
- UiPath crosswalk reconciliation — every UiPath 2024.10 rule classified against the catalog; reconciliation report surfaces name drift between the catalog and upstream.
- Two new UiPath detectors — FC-UIP-PMG-001 (duplicate activity IDs) and FC-UIP-ARG-003 (undefined output property).
- Empty states clarified — every dashboard page explains what the empty state means in context rather than rendering a bare placeholder.
- Live UiPath rule refresh tool — refreshes the published rule docs from upstream on a seven-day cache.
- Pipeline context preservation — validation records now keep repository, branch, commit, run, and Power Platform deployment context end to end (Migration 036).
- Weekly digest composer and scheduler — opt-in weekly summary emails for governance activity.
- Orchestrator connections scaffolding — opt-in connector slot for UiPath Orchestrator and AA Control Room (Migration 034 foundation for proactive scan-on-publish).
- Detector explainability — every RiskFlag carries SourceXPath and SourceLineNumber so "why did this fire?" lands at the source.
- CLI explain subcommand — debug rule decisions with full provenance and detector narratives.
- GitHub Actions annotations — CLI emits inline GitHub Actions annotations for findings in CI logs.
- Validation source provenance — the dashboard shows where each validation was submitted from (CI, manual upload, API key).
- Bundled rule catalog — the dashboard reads rule metadata from a generated catalog so toggles, playbooks, and policy packs stay in sync.
- Validation ownership — assign a named owner to any validation result from the detail view.
- Finding dispositions — mark findings as Will Fix, Acknowledge, or Request Exception without leaving the results view.
- Risk exception approval workflow — managers can approve or reject exceptions with a written rejection reason captured in the record.
- Regression detection — change impact diff now surfaces severity changes and waiver changes across repeat validations of the same workflow.
- Policy pack environment profiles — configure per-environment rule overrides (dev/test/prod) without hand-editing JSON.
- Validation evidence export — copy a handoff-ready evidence summary from any validation detail for audit and review use.
- CI/CD source filtering — filter the Validations feed by source to see only pipeline-submitted runs.
- Validation finding actions — link directly from a finding to the published rule playbook and re-validation shortcut.
- Compliance mapping pipeline — each finding now maps to applicable controls in ISO 27001, SOC 2 Type II, GDPR, and NIST CSF.
- Rule playbook links — findings for seeded rules link directly to published remediation guidance.
- Team collaboration — assign reviewers, track approval state, and view org-scoped review history on Pro and Enterprise plans.
- Policy pack rule management — custom rulesets with per-rule severity, enforcement mode, and exemption controls.
- Validation API — POST /api/v1/validate accepts multipart workflow files and returns a structured score, findings, and blocking status.
- GitHub Actions integration — drop-in CI step with enforcement_mode=blocking support.
- Azure DevOps support — CmdLine@2 task example with Build.DefinitionName and Build.BuildNumber pipeline labels.
- API key management — create and revoke keys with scoped permissions from the Team panel.