Release Notes Minor 1.5.24

Minor Release 15.3

Released: 14 October 2026

What's new

There has been a refresh to how we resolve device signatures.

• Profiling & detection
  • Device signature contributions reweighted. Refreshed weighting of contributions deriving device signature. You should see fewer unrelated devices linked under the same signature, and fewer instances of the same device being split across multiple signatures. On iOS in particular, profiling.ios.os_version was weighted highly, which tended to increase probability of delinking signature when users upgraded their OS.

Minor Release 15.2

Released: 08 October 2026

What's new

Edge & deployments

• You can now restrict Linode firewalls from the portal. Each Linode deployment has two Linode Cloud Firewalls, one on the NodeBalancer that receives traffic and one on the worker nodes that run Darwinium. The Akamai deployment configuration now has a Firewall section with separate Inbound and Outbound settings.

  • Switch either from Accept All to Restrict To IP/Port Ranges and add named rules for the ranges you allow.
  • Inbound rules control what can reach the NodeBalancer on port 443, for example only your CDN's IP ranges.
  • Outbound rules control where the worker nodes can connect. When outbound is restricted, the worker nodes can still reach the Darwinium API over HTTPS and your region's DNS resolvers, so a tight outbound policy won't cut the cluster off from Darwinium.
  • Note: every cluster sync now applies the portal's rules to both firewalls, including firewalls created before this release. If you've added rules directly in Linode Cloud Manager, add them in the portal as well or the next sync replaces them.

• Overload control for Linode deployments. A new Overload Control setting in Akamai deployment configuration.

  • If a worker node's CPU passes the "Start shedding at" threshold, a growing share of requests go straight to your origin without Darwinium inspection, and above "Shed everything at" they all do. The trade-off is that shed requests aren't profiled or scored.
  • Shed requests skip journey matching entirely, so they cost an overloaded node very little.
  • The cluster health check reports the cluster unhealthy when more than half of the nodes that respond are past "Shed everything at".
  • Overload control is off by default. Set both thresholds or neither.
  • Left blank, they default to 80% and 90% CPU on dedicated CPU nodes, and 75% and 85% on shared CPU nodes.

• Portal warns if Darwinium can't manage Linode clusters. The Akamai deployment configuration now checks the saved Linode personal access token and shows whether it has the scopes Darwinium needs (Kubernetes, Linodes, Firewalls and NodeBalancers), or flags it as invalid.

  • The cluster alerts also warn when a cluster's Kubernetes control plane access list leaves out Darwinium's addresses. Darwinium manages each cluster through its control plane, so either problem stops cluster syncs and upgrades, and you now see it before a sync fails.

Fixes

• Edge & deployments
  • If the portal couldn't fetch a target's clusters from Linode, a sync treated that as a target with no clusters and could sync it to an empty state. The sync now stops with a "Could not fetch clusters from Linode" error instead.
  • Plus, a cluster marked for deletion can be undeleted before you sync, and cluster controls are disabled (with a warning) while a new Linode token is typed but not saved, since cluster operations always use the saved token.

Minor Release 15.1

Released: 01 October 2026

Fixes

• Edge & deployments
  • Support reverting to previous inline wildcards * on CloudFront step triggers, where a regression no longer was able to resolve a potential path conflict and so refuse to deploy build. Add the line: disable_infix_wildcard: true under targets in journeys.yaml to preserve previous behaviour.

Minor Release 15

What's new

• Edge & deployments
  • Snippets installed from the marketplace are ready to use in your journey. After you install a snippet from the Snippets marketplace, we now offer to add it to the journey you have open, so you no longer add its file path by hand. Marketplace cards also show which snippets are installed and when an update is available.
• Rules & configuration
  • The rules editor describes features and rules in plain English. Next to the machine name (for example high_risk_logins_1h) you now see a description such as "Count of events of type LOGIN in the last 1 hour where …", so you can tell what a feature counts without opening its definition.

Fixes

• Portal
  • Improved search responsiveness in Investigations
• Edge & deployments
  • Choosing a snippet from the journey editor's Add Step menu stopped doing anything in Minor Release 14. It adds the snippet's step in one click again.
  • The reCAPTCHA snippet failed to install from the Snippets marketplace.
  • (15.1, 1st October) Inline wildcard on Cloudfront now have a toggle
• Rules & configuration
  • Opening a rules file containing a Remove label remediation, or adding that remediation to a rule, made the rules editor report a Rules File Format Error. Those rules open and edit normally again.

Minor Release 14

Released: 18 September 2026

What's new

• Rules & configuration
  • Decision strategies can use dependencies imported from other steps. Models could already import data captured at another journey step, for example the PROFILING dependency from a proxy step, but decision strategies couldn't. They now can, on both API and proxy steps. The final decision on an API call can take the device profile captured earlier in the journey into account without routing it through a separate model first.

Fixes

• Portal
  • Some attributes were missing from the Investigations column list.
  • Stability improvements on reading storage configurations
• Edge & deployments
  • The origin response warning added to the journey editor in Minor Release 10 named dependencies by their internal ID. It now shows their names and points to the first response header or response body rule that triggers it.
• Rules & configuration
  • The "Create incident?" switch in the rules editor's remediation form wouldn't turn on, so you couldn't send a rule's matches to an incident queue from the editor.
  • A rules file containing errors failed to open in the rules editor. The editor now checks the file first and, if it can't display it, offers a button to open it as plain text so you can fix it.
  • Dependencies imported from another step (for example that step's RESPONSE) didn't appear as options in the Workflows model dependency list, even when they were already in the journey YAML. They now show and can be selected.
  • The step selection dropdown in the Workflows sidebar opened partly hidden behind other panels.

Minor Release 13

Released: 17 September 2026

Fixes

• Portal
  • The Download to Excel button on the Signals dashboard did nothing, and CSV exports from the dashboard used internal column names that didn't match what you see on screen. Exports work again and carry the displayed column names.
  • Opening an event's sidebar, or choosing Show full event data, failed if your Investigations template didn't include identifier or event_type as a column. You'd see a 400 error or "No S3 event data found". Both attributes are now loaded behind the scenes whichever columns you pick.
  • Device Map dashboard card resolved watermark.
  • The Users and Roles admin page would cap listing every user in organisations, and removing several users in quick succession produced an error.

Minor Release 12

Released: 14 September 2026

What's new

• Edge & deployments
  • Handling oversized responses on CloudFront CloudFront limits how large a response an edge function can return (about 1 MB). When content we inject into a page would push it over that limit, we now keep the header injection and drop only the body injection. If your origin's response is over the limit on its own, we pass it through untouched. Either way your visitor gets the page, and the case is recorded as a journey error.
  • CloudFront steps skip response processing when there's nothing to do. Some journeys use a rule to remove event_type from requests they don't want recorded as events. If a request has no event_type once request processing finishes, and nothing on the step works on the response (no response injection or response proxy action, and no custom worker on the response), our edge function now hands the request back to CloudFront to fetch from your origin directly. Those requests skip a round trip through the edge function and aren't subject to its response size limit.

Minor Release 11

Released: 8 September 2026

Fixes

• Portal
  • The Investigations column list only offers attributes your node has populated, but it looked back over recent data only. An attribute that hadn't appeared for a week or more was left off the list even though your data contained it. The lookup now covers your full 13 months of retained data.

Minor Release 10

Released: 7 September 2026

What's new

• Edge & deployments
  • CloudFront step: Journey editor now warns when a step has to process the origin response. Some step settings mean our edge function has to fetch your origin's response itself so it can work on it. The triggers are a response header rule that captures PII, a response model that captures PII, a response body that isn't skipped, or a response proxy action. The editor now flags these steps and names the rule responsible.

Fixes

• Rules & configuration
  • The journey editor was reportedly slow on journeys with a large number of validation errors. We restructured how errors are reported so large journeys stay responsive.

Minor Release 9

Released: 4 September 2026

Fixes

• Portal
  • Shared Investigations links stopped working. Opening one no longer filled in the query or date range, and the query didn't run. Links using the older date-range format lost their date range as well. Links in either format now fill in both and run the query, so links you've already shared with colleagues work again.
  • Grouping the Investigations grid by a column was lost when you refreshed the page.

Minor Release 8

Released: 2 September 2026, 03:10 UTC

What's new

Workflows

• Visual query is now in the rules editor. Potential values are offered in a list with their descriptions alongside, so you pick what you want rather than type it, and you no longer have to leave the rule to understand the data behind it. Your selection is remembered between sessions.
• Visual query improvements. Features now show as individual leaf attributes with their descriptions inline as comments, for your own features and Darwinium's.

• Data Driven Rule Editing. The value selector is continuous and plots your chosen value against the real distribution, so you can see whether a threshold captures the top 1% of traffic or the top 20% before committing to it.

• Rules now carry inline analytics. A rule's behaviour is graphed in the screen alongside the rule itself, and can be compared against any column so you can assess how well the rule correlates with the outcome you actually care about before promoting it.

• Feature editor redesign. The feature editor has a cleaner design, with inline documentation alongside the definition so you can understand what a feature does, and what each part of it contributes, without leaving the screen.

Rules & configuration

• Reference the current event inside a feature condition. Feature conditions with for_events now expose current_event, giving you the whole attribute tree for the event being scored alongside the historical events being counted. You can write conditions that compare the two, for example abs(transaction.amount - current_event.transaction.amount) < 10 to count how many past transactions were within $10 of this one.
• custom_identifier[*].name now accepted as Input means the naming of custom identifiers can be driven by your integration rather than fixed in journey configuration.
• Two new labels: Legacy Connection and Legacy Device: Both sit under the Risk label group and are available anywhere Risk labels are, including queries and policies. Use them to mark connections or devices running outdated software, then treat them differently in rules without inventing a custom label of your own.

Portal

• Add Label from sidebar rebuilt around one card per label. Each label now gets its own card with its own category, contexts, notes and attributes, chosen from a searchable drawer grouped by attribute group. You can copy an attribute set from one card and paste or merge it into another, and composite attributes are added and removed as a whole rather than one component at a time.

• Attributes never populated stay hidden. Columns with no values in them at all are now hidden from attribute selection, so the lists you pick from show only what your integration actually sends. That applies in the Investigations grid column selector, the editor's auto-recommendations, visual query on Investigations and dashboards, and dashboard configuration - leaving a much shorter list to scan instead of the full catalogue of everything Darwinium can capture.

Edge & deployments

• Share one deployment configuration across several nodes. A group of nodes can now point at a single shared deployment config instead of each carrying its own copy. If you run many similar nodes, that removes the work of keeping their settings in step and cuts the memory each node holds. Nodes on a shared deployment no longer show their own Deploy button, because deployment happens once for the group.
• CloudFront deployments handle a default root object. If your distribution sets a default root object (usually index.html), CloudFront rewrites a request for / before it matches cache behaviours, so the behaviour we registered against / never fired and the profiling script was never injected. We now read the distribution's default root object and target the behaviour at the path CloudFront actually matches. If you saw a Lambda with zero invocations on your home page, this was the cause.
• Wildcards in the middle of a path. Routes like /*/loader.html are now valid edge paths, so you can cover a repeated page across many first-level directories with one step instead of enumerating them. Where a new route overlaps an existing one ambiguously, the deploy still reports an error rather than guessing which should win.
• Cloudflare deployments check the domain against the zone. If a host alias points at a domain outside the configured Cloudflare zone, the deploy now fails with a message naming the mismatch instead of completing and leaving traffic unprofiled.
• Linode settings are easier to work with. Targets appear in a fixed order, node IPs are shown, cluster sizes start at the correct values, and you get a warning when an IP looks unstable. Deployment is now explicit rather than triggered as a side effect of editing, with a button to continue after a failed Helm deploy, and target deletion is locked while clusters still exist. Health checks also return as soon as more than half the cluster responds instead of waiting out the full three-second timeout.

Profiling & detection

• More than twice as many behavioural biometrics contexts. Field-level biometrics bind keystroke behaviour to the specific field being typed into, so a context has to exist for every field you want to profile. The list grows from 25 to 58, with consolidation across javascript, ios, android.

POSTAL_CODE
ADDRESS_CITY
ADDRESS_STATE
PREVIOUS_ADDRESS_STREET1
PREVIOUS_ADDRESS_STREET2
PREVIOUS_ADDRESS_STREET3
PREVIOUS_POSTAL_CODE
MIDDLE_NAME
LAST_NAME_AT_BIRTH
ALIAS_FIRST_NAME
ALIAS_LAST_NAME
RELATED_PERSON_FIRST_NAME
RELATED_PERSON_LAST_NAME
PLACE_OF_BIRTH
NATIONALITY
DOCUMENT_ISSUE_DATE
DOCUMENT_EXPIRY_DATE
TAXATION_ID
ACCOUNT_HOLDER_NAME
ORGANIZATION, SECONDARY_EMAIL
SECONDARY_TELEPHONE
SOCIAL_HANDLE
DATE_RANGE_FROM
DATE_RANGE_TO
GENERAL_PURPOSE_THREE
GENERAL_PURPOSE_FOUR
... through to
GENERAL_PURPOSE_TEN

• iOS SDK device signature uses additional attributes. iOS device signature has been extended to consider additional attributes, giving it more forensics to work with when resolving devices.

• Updated proxy detection model. Our proxy detection model has been retrained, improving how reliably proxied connections are picked out.

• Updated VPN detection model. Our VPN detection model has been tweaked, improving accuracy of vpn_probability

• Stronger Android root detection. We improved the on-device root checks and added server-side verification of Android key attestation, so the result is confirmed by us rather than taken on trust from a device that may already be compromised. Rooted devices that defeat client-side checks alone are harder to hide.

• profiling.ios.system.location.is_mock is now a subject. It behaves the same way as profiling.android.location.is_mock, so you can build features on it.

• profiling.handle is now an identifier allowing velocity and distinct-count features referencing it

Fixes

Portal

• Column names in Investigations were compressed, or overlapped the data underneath them, on the grid and in org templates.
• Query history on the Investigations page only updated after a full page refresh, which broke the flow of an investigation. It now updates with each new query.
• The Features section of the event sidebar rendered nothing at all if the lookup for a single feature's distribution failed. Features that resolved now display
• The sidebar stopped remembering the width you set it to, and the Location Insights map no longer re-rendered when resized. Both now work again.
• In visual query, Darwinium's own features were listed among your general features, model scores weren't graphed correctly, and signal categories didn't appear as a selection. Searching for an IP address didn't work, signals carrying every possible value converted incorrectly, SEGMENT_SPLIT* signals were missing, and an invalid query put the graph cards into an error state instead of reporting the query problem.
• Some older labels, and updated cookie-copy labels generated by the engine, could not be deleted and kept reappearing after removal.
• The feature condition input was misaligned and had no visible text field. It also validated the same input twice.
• incidentManagement.yaml reliability in editor improved
• Reset password silent fails when triggered in the Users admin section
• Looking a user up by email address matched on a substring rather than the exact address, so the wrong account could be returned.

Edge & deployments

• Deployments could sometimes fail when a distribution had multiple targets configured, including the case where a target used a subdomain host alias that wasn't recognised and was treated as a literal host.
• A CloudFront deploy could fail after a node's short name changed, because workers deployed under the old name were left behind and no longer matched.
• Redeploys now clean up the cache behaviours they replace. Changing a path pattern used to add the new behaviour and leave the old one in place. The deploy now reconciles the behaviours it owns, creating, updating and deleting as needed.
• "No steps match" is now diagnosable. Lambda@Edge logged the same line whether a request was an asset we correctly have no step for (a .js or .css file) or a page whose step configuration genuinely wasn't matching. It now logs the path it evaluated and separates the two cases, so an edge log tells you whether your journey config is working as intended.
• Steps with an S3 or API Gateway origin could be given the wrong origin request policy, which deployed cleanly the first time and then failed on the next deploy of the same journey.
• Setting an encrypted cookie didn't work on Front deployments.
• The cookie_last_seen timestamp came through as zero on CloudFront
• A race between the proxy event and a from-identifier API event could fail the dependency write for a journey, so data captured at the proxy step didn't reach the API event that depended on it. The two are now ordered correctly.
• The Linode cluster deployment page showed a blank region, and the settings page had two separate buttons that both had to be pressed to keep a change.
• Events have increased resilience during a messaging outage. When the API server can't hand an event to our internal message broker it now has additional requeue and retries.

Profiling & detection

• TLS handshakes that arrived out of order lost the JA3 and JA4 fingerprints, every tls.* attribute and the TLS round-trip time for that connection. Those connections now fingerprint correctly.
• profiling.android.location.coordinate composite attribute was corrected
• profiling.vpn_signals was missing the LIKELY_VPN* signal even when the score and device.signals both reflected it, and could report signals derived from gateway measurements that weren't present on the event.

Rules & configuration

• More helpful build error logs upon feature conditions referencing an attribute that isn't an identifier or subject, or referencing custom general-purpose attributes
• Deleting a step in the journey editor crashed the view if that step was the one being edited.
• Quantile features could exceed an internal expression size limit when an attribute received values at extreme ends of the floating point range, and quantile data from separate ranges failed to merge.
• Events updated through the Update API couldn't be filtered properly in Investigations, so searches on update_applied_steps or on attributes sent in an update returned the wrong set.

Plus… various smaller fixes, Journey Recorder and its workspace analyser have been hardened following release, shared deployment metadata handling and a build failure have been fixed, Android SDK feature evaluation in the global policy has been tuned, Lambda@Edge functions deployed into customer AWS accounts now carry an AWS partner tag, and our CloudFront deployment documentation has gained a pre-flight checklist covering default root object, WAF allowlisting and where to find edge logs.

Minor Release 7.5

Released: 27 July 2026

What's new

• Profiling & detection
  • Android DRM ID attribute. profiling.android.drm.device is now treated as equivalent to profiling.android.drm_id. Devices that only report the DRM path are now recognised correctly on return visits.

Fixes

• Portal

  • Switching organisations could leave the sidebar unable to load for non-PII accounts on the next event you opened.
  • Raw event details failed to load for certain devices, showing an internal error instead.

• Labels

  • Labels inferred from global IP intelligence data (ipinfo) will show alongside other labels in sidebar
  • Improvements to label delete operation across platform, including: requests will now retry automatically, delete consistency when from identifier view node card, and when removing a wildcard context attribute under one context.

• Privacy (SPII / IBD)

  • PII failed to decrypt in the sidebar's label panel on in browser decryption (IBD)-enabled nodes, for SPII/PII users.
  • PII failed to decrypt for some attributes in the identifier view's label display, while others on the same event displayed correctly.
  • Non-SPII users couldn't add a label to a National ID field, even though a PII user could label the exact same event.

Minor Release 7.4

Released: 20 July 2026

What's New

Edge & deployments
Updated configuration setting on our backend to improve TCP slow start after idle connection . This mainly affects integrations that keep a connection open and send events sporadically; events after a quiet period should now execute faster.

Minor Release 7.3

Released: 15 July 2026

Fixes

• Portal
  • Nodes with a nickname created under older naming rules could no longer have any of their other settings saved until the name itself was fixed. You can now edit unrelated settings on these nodes without being blocked by name validation.
• Profiling & detection
  • Fixed a cross-origin iframe check that could be silently optimised away during the SDK build. Integrations that embed the tag in a cross-origin iframe are now checked correctly again.

Minor Release 7.2

Released: 13 July 2026

Fixes

• Profiling & detection
  • Adjusted duration of certain local cookies, to improve device.identifier stability and resolution over longer time periods.

Minor Release 7

Released: 3 July 2026

What's new

• Edge & deployments
  • Configurable health checks for Linode clusters. Two new options let you tune how Linode edge health checks behave: probe_origins includes your origin's health in the check (off by default), and health_check_paths lets you add extra URL paths to check alongside the default one. This means node failover can reflect the health of your origin, not just the edge, without you having to build a separate origin monitor.

Fixes

• Portal
  • Fixed a bug where adding a new target under Nodes > Settings showed a blank screen instead of the target form.

Minor Release 6

Released: 1 July 2026

What's new

• Profiling & detection

  • Timezone/location mismatch now checks against more signals. We extended timezone-mismatch detection to compare the country implied by a device's timezone against the country derived from other location signals, including IP address, device geolocation, bank, and phone number. A disagreement now raises a GEO_TIMEZONE_MISMATCH signal, giving you another data point for catching sessions where the claimed location doesn't add up.

• Edge & deployments

  • Profiling now works on cacheable pages. Journey steps using cacheable profiling injection no longer send a Set-Cookie header, since CDNs such as Akamai disable caching by default whenever that header is present. This lets you profile pages served from cache without losing the caching benefit.
  • Custom header mapping for Linode deployments. You can now map the Host header and insert custom headers when Linode forwards requests to your origin, and these apply even on requests that don't match any journey step.

Fixes

• Portal
  • Unified node name validation across the Create and Edit Node modals (letters, numbers, spaces, and .-_()[]), with the Save button disabled until the name is valid, so you get feedback before submitting rather than a failed save.
  • Fixed Bulk Action → Close on unassigned incidents, which previously did nothing without showing an error.
  • Rule conditions in the Rule Editor no longer display truncated until you reload the page.
  • The Device Signature Compare panel on the incident sidebar no longer causes horizontal scrolling
  • Fixed panels in the Identity Graph view rendering over the navigation buttons.
  • The UTC/local timestamp toggle on time-series views now applies immediately, without needing a page refresh.
  • Fixed a race condition during new node and user setup where the journey Git repository wasn't always initialized correctly, which could block pushing journey changes with a permissions error.
  • Fixed a lookup issue where a from_identifier reference in the portal couldn't find its associated event.
• Edge & deployments
  • Linode edge deployment configuration and segmentation improvements

Minor Release 4.1

Released: 18 June 2026

Fixes

• Portal
  • Fixed a crash in signal-analytics queries that didn't include any filters.
  • Fixed an issue where queries against analytics cluster could lock, slowing down performance.

Minor Release 4

Released: 16 June 2026

What's new

Profiling & detection

• We optimised the protobuf structure of how event timing data is stored in JS profiling payload, leading to reduced overall size.

Minor Release 3

Released: 15 June 2026

What's new

Edge & deployments

• Option to disable event timing per snippet. You can now turn off event timing collection at the snippet level. This is useful where event timing isn't needed and you want to keep the profiling payload small.

Profiling & detections

• Lower edge profiling cap. Edge profiling polling is now capped at 100 per event (down from 1000), keeping the profile blob to a manageable size on CDN and edge deployments.

Minor Release 2

Released: 12 June 2026

What's new

Edge & deployments

• CloudFormation template for AWS integration roles. We added a CloudFormation template that provisions the IAM roles needed for CloudFront and bring-your-own S3 integrations in your AWS account. It covers the common combinations (CloudFront execution and deployment roles, chaining with an existing Lambda@Edge, BYO S3 read/write roles, and optionally creating the S3 bucket itself), so standing up an integration no longer means building each role by hand.
• Choice of HA or non-HA control plane for Kubernetes clusters. When creating a Linode Kubernetes cluster you can now choose whether it runs a high-availability control plane, and each cluster shows its HA status at a glance. This lets you match cost to environment, for example a non-HA control plane for test and HA for production. Darwinium typically still suggests using HA clusters.
• mTLS to origin for Linode. A new toggle lets Linode edge servers present a client certificate (mTLS) when connecting to your origin, for origins that require mutual authentication. It's off by default
• Leaner edge-to-API behaviour. Edge workers no longer forward an event to the API server just because a profiling cookie is present.

Profiling & detection

• Bounded event timing for tag deployments. Event timing windows on tag deployments are now capped at 100 in total, so the profiling blob has cap on size

Fixes

Portal

• Time-series graphs displayed in local time now bucket data into the correct columns. They were previously bucketed using UTC, which could shift data into the wrong time slot
• Aggregate statistics now display correctly on dashboards.

Profiling & detection

• Journey IDs now persist correctly for events that use encrypted cookies, so the events in a session stay linked to the same journey.

Minor Release 1

Deployed: 10 June 2026 AEST

What's new

Support added for response payload compression (gzip).

• Pass the header Accept-Encoding: gzip in your EventAPI
  call and the response may be returned gzip-compressed.
• When it is, the response includes Content-Encoding: gzip. Decompress only
  when that header is present — small or already-compressed responses may be
  returned uncompressed.
• Smaller bodies mean fewer TCP segments.
• Supported for both HTTP/1.1 and HTTP/2 clients.