Changelog
What's New
New features, bug fixes, and improvements across every release.
v1.0.110
Added1
- Billing now shows monthly AI usage, the configured spend limit, remaining allowance, reset date, current credit balance, and auto-reload status in one responsive overview.
Fixed2
- Auto-reload can now be turned off reliably, ignores refund deductions, prevents concurrent duplicate charges, and recovers interrupted charges through Stripe webhooks and scheduled reconciliation.
- Existing auto-reload settings are paused once during the durable-payment upgrade; owners must review and re-enable them from Billing after deployment.
v1.0.109
v1.0.108
Fixed1
- The Purchase Credits dialog now shows which saved card will be charged, and the bonus percentage on the selected amount is legible again (it was green-on-green when highlighted).
v1.0.107
Added1
- Buying credits now earns a volume bonus: a $100 top-up lands $150 in credit, and larger top-ups earn more (up to 70%). A "Buy Credits" shortcut now sits on the dashboard, and the amount you'll receive — bonus included — is shown before you pay.
v1.0.106
Security2
- Banned accounts can no longer sign back in: session creation is now blocked at the auth layer for banned users (attempts are audit-logged), and the chat API additionally rejects any session issued before a ban. Previously a ban only blocked web pages, so a banned user could re-authenticate and keep calling API endpoints.
- Chat endpoints now stay on topic and on budget: a lightweight classifier turns away requests unrelated to software work (kill switch: `CHAT_SCOPE_GUARD=off`), and organizations that have never purchased credits get a daily chat spending cap (`CHAT_FREE_DAILY_CAP_USD`, default $2). Together these shut down use of the chat API as a free general-purpose LLM proxy.
v1.0.105
Security1
- Self-hosted AWS deployments now run Redis (ElastiCache) with authentication and least-privilege ACLs, rolled out through a staged, health-gated cutover. The app connects compatibly with restricted (auth-only) Redis users and cleans up stale presence entries more reliably.
v1.0.104
Security1
- AWS self-hosted deployments now support a staged managed origin-TLS boundary using an Application Load Balancer, an operator-provisioned ACM certificate, and explicit operator-maintained trusted-edge IPv4 ranges. The documented `preflight` to `enforced` cutover is health-gated and keeps rollback ordering explicit. This repository change does not alter the current WDC/datacenter deployment or cut over production traffic; Full (strict), database/migration compatibility, and the intended application image must be verified separately before an operator changes traffic.
v1.0.103
Security1
- AWS Terraform deployments no longer keep application or database secret values in Terraform state or EC2 user data. Operators pre-provision one Secrets Manager application secret, RDS manages its own master password, and the instance fetches values at runtime with exact Secrets Manager and KMS permissions, writing them atomically to a root-only environment file. A five-minute refresh is transactional and health-gated: it preserves the existing `OCTOPUS_DATA_KEY`, keeps current database credentials working after RDS rotation, and retries safely after partial failures. Existing stacks upgrade through a documented preflight stage before the enforced cutover; Docker Compose 2.30.0 or newer is required.
v1.0.102
Security1
- AWS Terraform deployments now require an encrypted S3 backend with native state locking. A new bootstrap root provisions the versioned, private, KMS-encrypted bucket and generates account-pinned configuration plus least-privilege operator IAM; existing local state has a workspace-safe migration runbook. Common saved-plan filenames are ignored because plans can retain secrets. The HTTPS guide now correctly requires origin TLS before Cloudflare Full or Full (strict).
v1.0.101
Fixed1
- Reviews interrupted by a server restart or timeout used to hang in "reviewing" with no error. They're now caught automatically: recent ones retry on their own, and older ones are marked failed with a note so you can re-trigger with a push or an @octopus mention.
v1.0.100
v1.0.99
Fixed1
- Mentioning the reviewer now points to `@octopus-review`, which links to the Octopus bot on GitHub — a bare `@octopus` linked to an unrelated account. Existing `@octopus` mentions still trigger a review.
v1.0.98
Added1
- Self-hosted deployments can now enable Sentry error, performance, and session-replay monitoring by setting `SENTRY_DSN` (and optionally `NEXT_PUBLIC_SENTRY_DSN` for browser capture). Session replay masks all text, inputs, and media, and sensitive fields are scrubbed before anything leaves the app; Sentry stays fully disabled when no DSN is configured.
v1.0.97
Security1
- AWS Terraform deployments now identify the application with a dedicated data-access security group, so RDS and optional Redis no longer trust every workload in the VPC. Existing stacks have a documented two-stage cutover that attaches the identity before removing legacy CIDR ingress. SSH stays unreachable unless an operator both configures a key pair and explicitly supplies trusted CIDRs; internet-wide SSH CIDRs are rejected.
Fixed3
- Reviews skipped because an organization is out of credits now say exactly that and point to adding credits, instead of the confusing "monthly usage limit" message — the out-of-credits and monthly-cap cases are now clearly distinct.
- Organizations that bring their own API key for the provider their reviews actually use are no longer incorrectly blocked as "out of credits"; a single relevant provider key is enough (previously keys for all providers were required at once).
- Credit top-ups that fail for a reason other than the card — a temporary processing or configuration issue — no longer show a misleading "card was declined" message. Genuine card declines are still reported as declines.
v1.0.96
Security1
- Webhook tenant isolation is now enforced (previously shadow-mode observation only). GitHub repository events route solely through the signed installation ID and the organization-scoped repository lookup, and events whose repository does not belong to that installation's organization are dropped. GitLab webhooks authenticate the per-organization hook token before the request body is read and fail closed on unknown, ambiguous, inactive, or dismissed project mappings. GitHub delivery IDs and retry telemetry remain observation-only and never influence routing. No schema behavior change beyond a new index on the GitLab webhook token lookup.
v1.0.95
Security1
- Every GitHub App installation entry point — the dashboard "Grant Access" button, the indexing-log recovery link, and the hosted CLI's repo wizard — now starts from the server-signed `/api/github/install` route instead of linking straight to GitHub, so all installs carry the browser- and user-bound signed state. Starting an install while signed out resumes the install after login, and starting one before a GitHub App is configured redirects to the integrations settings page with an explanation instead of a raw API error. A repository-wide test now enforces that raw `github.com/apps/…` install URLs appear only in the two server-owned redirect routes.
v1.0.94
Security2
- Local agent API endpoints now treat the organization API token as the security boundary: a registered agent name held by an active token can no longer be taken over or acted on by a different token in the same organization, and task claims, results, and LLM-task completions are bound to the token that registered the agent. Deleting a token frees its agent names for reuse. Agents that intentionally share one token keep sharing authority — use separate tokens for separate boundaries.
- Agent task results larger than the 1 MiB transport limit are now rejected with HTTP 413 and the task is marked failed instead of staying stuck in a claimed state. Stored results remain capped at 50 KiB, now truncated to a bounded prefix that preserves the result's JSON type, and text is sanitized so PostgreSQL-incompatible characters can no longer poison result storage. Agent endpoints reject inputs containing PostgreSQL-invalid characters (NUL, lone surrogates) with HTTP 400 before any database access — registration and heartbeat names, repository lists, and machine info, plus `agentId` lookup keys and task id path parameters across all agent routes. Posting a result to a search task, or a completion to an LLM task, that is not in claimed state now returns HTTP 409 instead of an ownership error. Malformed JSON bodies on agent endpoints are rejected with an explicit HTTP 400 `Invalid request body` (413 stays reserved for oversized bodies), and agent registration stores omitted or explicit-null machine info as SQL `NULL` rather than a JSON null value.
v1.0.93
Security1
- GitHub webhook deliveries are now recorded in a signature-verified delivery ledger that cross-checks tenant routing in shadow mode — observation only, with no change to how reviews are dispatched. Only bounded metadata is stored (never payload content), retained 30 days by default; self-hosted deployments can tune this via `WEBHOOK_DELIVERY_RETENTION_DAYS`.
v1.0.91
Security1
- OAuth connect flows for Linear, Jira, and Bitbucket now bind the sign-in state to the browser and user that started it, closing a CSRF gap when connecting those integrations.
v1.0.90
Security1
- Security-hardening pass across integration and local trust boundaries: fixed an open redirect on the post-auth return path (including a control-character bypass), tightened cookie cleanup, and locked down CI token permissions.
v1.0.89
Changed1
- Generated files — dependency lockfiles, ORM migration snapshots, test snapshots, minified/bundled output, and anything your repo marks `linguist-generated` in `.gitattributes` — are excluded from review, so a large generated file can no longer crowd your hand-written changes out of the review. Excluded files are listed in the review summary.
v1.0.88
Changed1
- Increased how much of a diff a review covers (~10×) and stopped silently truncating large diffs, so files further down a big PR are no longer skipped. When a diff is genuinely too large it now says so, instead of scoring a partial view. Tunable per deployment.
v1.0.87
Added1
- Self-hosted instances can create the required GitHub App automatically from Settings → Integrations. One button runs GitHub's App Manifest flow, stores the credentials, and takes you straight to installing it on your repositories — no more copying App ID, private key, and webhook secret into `.env` by hand. Create it under your account or a GitHub organization.
v1.0.85
Added1
- New OSS bot-account review mode: a zero-permission GitHub Action notifies Octopus, which reviews the pull request server-side and posts as a shared bot account. Because that bot is a non-collaborator, GitHub's own permissions make it comment-only — the guarantee security-conscious maintainers ask for, with no write token running in CI. Opt in per repository with a consent file.
v1.0.80
Added1
- Auto-review now skips draft pull requests and runs automatically when a PR is marked ready for review, so work-in-progress is no longer reviewed prematurely. A manual `@octopus` mention still reviews a draft on request.
Changed1
- The community daily-limit message now links to pricing, so hitting the limit points to a clear next step instead of a dead end.
v1.0.79
Added1
- Reasoning effort for extended-thinking models (Fable, Opus 5) is now configurable platform-wide and per organization, so you can trade review depth against speed and cost.
Changed1
- The default review model is now Claude Opus 4.8.
v1.0.62
Added2
- Claude Opus 5 is available as an opt-in premium review model. Your default reviewer is unchanged; point a repository at Opus 5 in settings when you want a deeper read on a tricky change (gnarly concurrency, a security-sensitive change, a big refactor). Works with your own Anthropic key too.
- Claude Fable 5, Anthropic's frontier model, is available as the top opt-in tier for the most demanding reviews.
Changed1
- The Opus review tier now costs $5 / $25 per million tokens, down from $15 / $75, matching Anthropic's current Opus pricing. Opus 4.6 is replaced by Opus 4.8 in the model list.
v1.0.58
Added4
- Reviews now learn from your team's past reviews of similar code, staying consistent with earlier decisions and no longer re-raising issues you have already settled
- Reviews now read each pull request's title and description and check the change against it — flagging changes that do not do what they claim, miss a stated requirement, or expand scope unexpectedly
- Built-in, language-aware rulepacks for TypeScript/JavaScript, Python, Go, Rust, Java, and Ruby, plus an always-on security pack covering the OWASP Top 10 and common CWE weaknesses, so reviews catch idiomatic and security issues rather than only generic ones
- Security findings now include the relevant CWE identifier where one applies
Changed4
- More accurate findings with fewer false positives: an adversarial validation step now challenges each finding and keeps only those backed by concrete evidence, and every finding — inline and in the summary — is held to the same standard
- Smarter context retrieval surfaces the most relevant code from across the entire pull request, not just the first part of large diffs
- Large pull requests now run through the full review-quality pipeline instead of a lighter path
- Routine changes (lockfiles, generated files, docs, tiny edits) use a lighter, faster model, and review prompts are cached for quicker repeat reviews on active repositories
v1.0.26
Changed2
- Login page now shows a product-highlights panel in place of the 3D scene, cutting time-to-first-paint on the login screen
- Documentation accuracy overhaul: self-hosting build/upgrade/migration steps, CLI command names, and the pricing table now match the shipped platform
Fixed1
- OAuth provider gate is evaluated per-request, so correctly configured providers no longer show "(not configured)"
v1.0.25
Fixed1
- OAuth provider gate was rendered at build time, which disabled all providers in production
v1.0.24
Added2
- Release pipeline builds a hosted-deploy image variant alongside the self-host image
- OCI `revision`/`version` image labels
v1.0.23
Fixed2
- Stripe billing hardening: pinned API version, self-healing customer records, and a webhook retry contract with idempotent per-refund accounting
- Release build fixes: build context, lockfile workspace, and registry auth
v1.0.19
Added3
Fixed9
- Finding descriptions in the review summary table are no longer truncated #515
- Embedding vector dimension is now validated against the Qdrant collection #521
- Raised max_tokens floor and enabled streaming for always-thinking models #523
- Detailed findings are now stripped correctly across more comment shapes #512
- Self-hosted web container now receives the user .env via env_file #520
- All Anthropic text blocks are collected; empty responses now fail loudly #522
- Health and readiness probes are allowed through the auth middleware #518
- Prompt variable substitution now handles special characters safely #517
- Review dedup no longer crashes on null items and preserves non-Latin keywords #516
Security1
- Moved createOrgForUser out of a "use server" module so it is not exposed as a server action #519
v1.0.18
Added3
Fixed3
Changed1
- Homepage title and meta reworked for AI code review positioning
Security1
- Public Ask Octopus widget hardened against abuse and model disclosure #405
v1.0.17
Added9
- Rate-limit team invitations to prevent email spam abuse #400
- GitLab/CLI: show OAuth redirect URI and scopes, and review unsynced PRs on demand #399
- OpenAI Codex (gpt-5.3-codex) support via the Responses API #397
- Adaptive low-credit warning threshold based on burn rate #396
- Gate chat completion on the org spend limit #385
- Microsoft social login, with Graph-based email resolution and account linking #383
- Remove and restore repositories with sync-safe dismissal #379
- Seed GPT-5 Codex and GPT-5 Codex Mini models #374
- Docs: right-side table of contents, floating Ask AI, and restructured navigation
Fixed8
- Verify "missing X" findings against the full file to kill truncated-diff false positives #392
- Encrypt per-org AI provider keys at rest and decouple the data key #395
- Bitbucket: cache repo file tree by branch HEAD SHA to stop rate limits #398
- Bitbucket: resolve integration by webhook UUID to fix multi-tenant 401 errors #382
- Qdrant: skip upsert for points with empty embedding vectors #384
- Repo graph labels and focus state now readable in light mode #386
- Email: claim credit-low cooldown atomically to prevent duplicate sends #381
- GitHub: redirect to login when the install callback has no state #380
v1.0.16
Added11
- GitLab integration: OAuth, webhook, and merge request review support #360
- Encrypt all integration OAuth tokens at rest #363
- Chat now uses the org-selected model and surfaces defaults in settings #364
- Show the resolved AI model in repository AI Models dropdowns #367
- Async community review pipeline and configurable announcement bar #358
- Admin endpoint to retry stuck PR reviews #356
- Copy button on assistant chat messages
- Open-source landing page with nav, footer, and hero links
- Announce free reviews for open source projects #345
- GitHub Action documentation page #357
- Bug bounty policy, hall of fame, and security.txt
Fixed8
- GitLab clone failing with "could not read Username" because git smart-http rejects Bearer #366
- Ask Octopus chat: cap response length and abort stream on connection close #355
- Skip credit check for community orgs to prevent cost errors #343
- GitHub Action now rejects an invalid API token instead of silently falling back to community #344
- Qdrant: retry transient network errors on upsert
- Qdrant: return empty results when the query vector is empty #342
- Escape semicolons in Mermaid sequence diagram messages
- Reset repository analysis status when a run is cancelled
v1.0.15
Added7
- Knowledge Center: pin documents to always include in every review, regardless of diff similarity #317
- Review output language: organization-level setting for the prose language of summaries, finding titles, and descriptions. Code, identifiers, and `suggestion` fields stay in the source language. #318
- Repository-level config files (`.octopus.md` / `AGENTS.md` / `CLAUDE.md`, customizable). Opt-in per repo. Each enabled repo runs the file through a sandboxed Haiku extraction pass that strips meta-instructions and emits a clean rule list, cached by content hash. Extracted rules are injected as untrusted data inside the user message, never the system prompt. #319
- Central review category list with per-category severity thresholds and a pill-style picker #330
- Landing page refresh: provider chips, new hero, and a feature switcher #334
- Explainer banner for pinned documents in the Knowledge Center #336
- Route reviews of 300+ file PRs to a dedicated internal-cli worker #309
Fixed7
- Snap findings whose line range partially misses the diff onto the nearest changed line within ±10 lines, with a small note. Previously high-severity findings could drop to the summary table even when the change was within reach. #321
- Show "✅ No new issues detected since the last review" on re-reviews with zero findings, instead of leaving the comment looking empty. #321
- Sanitize mermaid blocks in review body before posting to GitHub #310
- Gate internal-cli routing behind `ENABLE_INTERNAL_CLI` flag
- Match `.octopus-ignore` artifact directories by path segment instead of substring #328
- Tighten Ask Octopus scope guards and stop message overflow #332
- Compute resolved-finding count from outdated prior comments rather than the live set #338
Changed1
- Tighten the LLM prompt to require finding line numbers reference added (`+`) lines in the diff, not context lines. #321
v1.0.14
Added5
- Jira integration: connect a workspace, map repositories to projects, and create issues from review findings #265
- Repository graph view with structural and semantic edges #287
- "The Story" section on landing page and X (Twitter) link in footer #302
- Boot-time reconciliation of stale repository states for improved reliability #296
- Cross-process review cancellation via Redis pub/sub #294
Fixed4
Changed2
- Usage page redesigned around user-facing activities #306
- Version-update toast redesigned with a changelog link
v1.0.13
Added7
- Comparison landing pages: /compare hub, /vs-coderabbit, /vs-greptile #275
- HMAC-signed GitHub App install flow with clearer error dialogs #273
- Rotating "Ask anything" entry point in the app sidebar #279
- Help & Docs menu in the app sidebar #248
- Organization avatar upload (Cloudflare R2) #249
- Email validation and Gmail alias normalization on sign-up #264
- Refreshed landing footer social links #247
Fixed6
- Embeddings batching now respects OpenAI's 300k-token per-request limit #283
- Prevent duplicate review runs across replicas #266
- Transaction history pagination shows the correct total #263
- Balanced Mermaid activate/deactivate across alt/else branches
- Rename Mermaid sequence participants that collide with reserved keywords #250
- Chat responds in the language of the user's latest message only #254
Changed1
- SEO pass across docs and blog: canonical URLs, richer meta descriptions, BlogPosting JSON-LD, explicit AI-bot rules in robots.txt #277
Removed1
- In-app admin panel #260
v1.0.12
Added5
Fixed9
- Scope repository unique constraint to organizationId and rework Bitbucket workspace OAuth #231
- Pass orgId through GitHub OAuth state for reliable org association #207
- Org membership validation on Pubby auth and trigger endpoints #220
- Input validation on user and organization name fields #219
- Harden /api/auth/device against abuse #203
- Spend limit banner shows detailed status #215
- Event bus observer initialization race condition #209
- Issue creation dialog content overflow on long descriptions #234
- Blog slug uniqueness respects soft-deletes #233
Security1
- Remove deprecated collab integration and fix IDOR in generateIssueContent #217
v1.0.11
Added4
Fixed6
- Emit repo-analyzed event from all analysis trigger paths #200
- Improved re-review scoring and resolved findings tracking #197
- Sanitize semicolons in Mermaid and skip diagrams for docs PRs #196
- Reduce false positives in review engine prompt and validation #188
- Correct domain and page URLs in Ask Octopus system prompt
- Fallback to /files endpoint when GitHub returns 406 on large diffs
v1.0.10
Added3
v1.0.9
Added6
Fixed5
- Duplicate review guard now includes pending status #162
- Sanitize Mermaid state diagram notes and descriptions #148
- ObfuscatedEmail polymorphic tag to avoid nested anchor elements #145
- Top loader stuck on hash navigation and fast query param changes #144
- Handle PR synchronize events and post neutral check runs for blocked authors #142
v1.0.8
Added7
- CLI quick install section with bash/PowerShell installer scripts #115
- Claude Code integration docs page and footer branding
- Review processing moved to pg-boss queue with admin-configurable settings #123
- Auto-detect OS to pre-select CLI install platform tab
- AI provider logos to hero section
- Server ID to version endpoint #129
- Nginx reverse proxy config for web/review-engine routing #127
Fixed4
- CLI installer scripts now download .tar.gz archives instead of raw binaries
- Install scripts with tmpdir fix, tty prompt, and no-sudo default
- Cohere logo height alignment with other provider logos #128
- Docs path references and Windows CLI install command
v1.0.7
Added7
- Landing page overhaul with bento grid features, FAQ accordion, and Review Engine animation #108
- Email template system with database-driven templates, Resend integration, and pg-boss job queue #109
- Admin UI for email template management with AI-powered generation and bulk sending #109
- Session management page with active session list, device tracking, and revoke actions #110
- Knowledge base templates for one-click content creation with 8 pre-built templates #111
- Marketing email opt-out toggle in notification settings #109
- Rotating hero text animation on landing page #99
Fixed1
- Middleware redirect poisoning via X-Forwarded-Host header replaced with explicit URL config #113
v1.0.6
Added3
v1.0.5
Added8
- Status page system with public and admin interfaces, real-time updates via Pubby #81
- Audit logging system with admin UI and event observers #82
- Organization types (Standard/Community/Friendly) and community program management #83
- Review pipeline: cancel stuck reviews, local review API, GitHub Action endpoint, review simulator #84
- Chat repo context, multi-language translation, sidebar rename to "Ask Octopus" #85
- Billing: credit-low alerts, GitHub Marketplace webhook, usage page credit banner #86
- Linear auth error handling with reconnect UX
- CLI auto-org creation for new users
Fixed2
Changed1
- README branding image updated #74
v1.0.4
v1.0.3
v1.0.1
v1.0.0
Added7
- Onboarding tips on dashboard
- SEO metadata, OG tags, sitemap, robots.txt, and llms.txt
- Block specific PR authors from triggering reviews #27
- Dim unicorn 3D scene on text selection #16
- Social links and Product Hunt badge to landing footer #15
- Discord and LinkedIn links to landing footer #31
- Comprehensive unit test suite for core libraries #37
Fixed7
- Findings summary regex matches full table including separator rows
- Preserve review summary/score on re-review, only replace findings table
- Re-review filter updates main comment and findings count
- Per-finding feedback parsing, emoji recognition, and inline comment dedup #33
- Reset indexing status when abort controller is missing #30
- Suppress dismissed findings in Additional findings summary #25
- CI lint failures across all packages #36