v1.84.14 SBOM
Released 2026-09-19. All sixteen items on the independent auditor's fix-before-first-production-use list from the 2026-09-18 pre-production audit, plus six follow-ups. Nothing but the setup wizard answers before setup is complete, and the appliance runs in production mode unless told otherwise. Evidence integrity covers normalised events, the custody log and each raw record's source and time; exports carry no signing key and an imported case is shown as attested rather than verified; investigations sealed before this release read as unverified. Collection and search failures are reported instead of shown as zero results, and every page shows a failed load as a failure. Model and evidence text cannot act in the browser or reach files or the network; every response carries security headers and the API docs are off in production. Abort and Delete stop running work; Delete is complete, auditable and refused under legal hold. Product keys are re-verified at every start and bound to the machine, so every key must be entered again once. Connectors honour the proxy, time out, renew tokens mid-run, resume from checkpoints, cap rate-limit waits, and no longer call the retired CrowdStrike Incidents API. AI Defender never adds a citation and withholds false action claims and false all-clears.
Download the raw CycloneDX JSON: backend (174 deps) • frontend (197 deps)
Format: CycloneDX 1.6. Each row below corresponds to a single entry in the JSON; the JSON is canonical, this table is a convenience view.
Backend (Python)
174 components.
| Package | Version | Licence |
|---|---|---|
| aiofiles | 25.1.0 | Not declared |
| aiohappyeyeballs | 2.6.2 | Not declared |
| aiohttp | 3.14.3 | Not declared |
| aioresponses | 0.7.8 | Not declared |
| aiosignal | 1.4.0 | Not declared |
| aiosqlite | 0.22.1 | Not declared |
| annotated-doc | 0.0.4 | Not declared |
| annotated-types | 0.7.0 | Not declared |
| anthropic | 0.107.0 | Not declared |
| anyio | 4.13.0 | Not declared |
| arabic-reshaper | 3.0.1 | Not declared |
| asn1crypto | 1.5.1 | Not declared |
| attrs | 26.1.0 | Not declared |
| authlib | 1.7.2 | Not declared |
| bcrypt | 5.0.0 | Not declared |
| bidict | 0.23.1 | Not declared |
| blinker | 1.9.0 | Not declared |
| blis | 1.3.3 | Not declared |
| brotli | 1.2.0 | Not declared |
| catalogue | 2.0.10 | Not declared |
| certifi | 2026.5.20 | Not declared |
| cffi | 2.0.0 | Not declared |
| charset-normalizer | 3.4.7 | Not declared |
| click | 8.4.1 | Not declared |
| cloudpathlib | 0.24.0 | Not declared |
| confection | 1.3.3 | Not declared |
| configargparse | 1.7.5 | Not declared |
| contourpy | 1.3.3 | Not declared |
| coverage | 7.14.1 | Not declared |
| cryptography | 50.0.1 | Not declared |
| cssselect2 | 0.9.0 | Not declared |
| cycler | 0.12.1 | Not declared |
| cymem | 2.0.13 | Not declared |
| defusedxml | 0.7.1 | Not declared |
| distro | 1.9.0 | Not declared |
| docstring-parser | 0.18.0 | Not declared |
| dpkt | 1.9.8 | Not declared |
| evtx | 0.11.1 | Not declared |
| fastapi | 0.136.3 | Not declared |
| filelock | 3.29.1 | Not declared |
| flask | 3.1.3 | Not declared |
| flask-cors | 6.0.3 | Not declared |
| flask-login | 0.6.3 | Not declared |
| fonttools | 4.63.0 | Not declared |
| freetype-py | 2.5.1 | Not declared |
| frozenlist | 1.8.0 | Not declared |
| geographiclib | 2.1 | Not declared |
| geopy | 2.4.1 | Not declared |
| gevent | 25.9.1 | Not declared |
| geventhttpclient | 2.3.9 | Not declared |
| google-auth | 2.53.0 | Not declared |
| google-genai | 2.8.0 | Not declared |
| greenlet | 3.5.1 | Not declared |
| h11 | 0.16.0 | Not declared |
| html5lib | 1.1 | Not declared |
| httpcore | 1.0.9 | Not declared |
| httptools | 0.8.0 | Not declared |
| httpx | 0.28.1 | Not declared |
| idna | 3.18 | Not declared |
| iniconfig | 2.3.0 | Not declared |
| isodate | 0.7.2 | Not declared |
| itsdangerous | 2.2.0 | Not declared |
| jinja2 | 3.1.6 | Not declared |
| jiter | 0.15.0 | Not declared |
| joserfc | 1.7.0 | Not declared |
| kiwisolver | 1.5.0 | Not declared |
| ldap3 | 2.9.1 | Not declared |
| locust | 2.44.1 | Not declared |
| lxml | 6.1.1 | Not declared |
| markdown-it-py | 4.2.0 | Not declared |
| markupsafe | 3.0.3 | Not declared |
| matplotlib | 3.10.9 | Not declared |
| mdurl | 0.1.2 | Not declared |
| msgpack | 1.1.2 | Not declared |
| multidict | 6.7.1 | Not declared |
| murmurhash | 1.0.15 | Not declared |
| networkx | 3.6.1 | Not declared |
| numpy | 2.4.6 | Not declared |
| ollama | 0.6.2 | Not declared |
| openai | 2.41.0 | Not declared |
| oscrypto | 1.3.0 | Not declared |
| packaging | 26.2 | Not declared |
| phonenumbers | 9.0.32 | Not declared |
| pillow | 12.3.0 | Not declared |
| pluggy | 1.6.0 | Not declared |
| preshed | 3.0.13 | Not declared |
| presidio-analyzer | 2.2.362 | Not declared |
| propcache | 0.5.2 | Not declared |
| psutil | 7.2.2 | Not declared |
| pyasn1 | 0.6.4 | Not declared |
| pyasn1-modules | 0.4.2 | Not declared |
| pycairo | 1.29.0 | Not declared |
| pycparser | 3.0 | Not declared |
| pydantic | 2.13.4 | Not declared |
| pydantic-core | 2.46.4 | Not declared |
| pydantic-settings | 2.15.0 | Not declared |
| pydyf | 0.12.1 | Not declared |
| pygments | 2.20.0 | Not declared |
| pyhanko | 0.35.1 | Not declared |
| pyhanko-certvalidator | 0.31.1 | Not declared |
| pyjwt | 2.13.0 | Not declared |
| pyotp | 2.9.0 | Not declared |
| pyparsing | 3.3.2 | Not declared |
| pypdf | 6.16.2 | Not declared |
| pyphen | 0.17.2 | Not declared |
| pyspnego | 0.12.1 | Not declared |
| pytest | 9.0.3 | Not declared |
| pytest-asyncio | 1.4.0 | Not declared |
| pytest-cov | 7.1.0 | Not declared |
| pytest-timeout | 2.4.0 | Not declared |
| python-bidi | 0.6.10 | Not declared |
| python-dateutil | 2.9.0.post0 | Not declared |
| python-docx | 1.2.0 | Not declared |
| python-dotenv | 1.2.2 | Not declared |
| python-engineio | 4.13.2 | Not declared |
| python-multipart | 0.0.32 | Not declared |
| python-socketio | 5.16.2 | Not declared |
| python3-saml | 1.16.0 | Not declared |
| pywinrm | 0.5.0 | Not declared |
| pyyaml | 6.0.3 | Not declared |
| pyzmq | 27.1.0 | Not declared |
| regex | 2026.5.9 | Not declared |
| reportlab | 4.5.1 | Not declared |
| requests | 2.34.2 | Not declared |
| requests-file | 3.0.1 | Not declared |
| requests-ntlm | 1.3.0 | Not declared |
| rich | 15.0.0 | Not declared |
| rlpycairo | 0.4.0 | Not declared |
| ruff | 0.15.16 | Not declared |
| setuptools | 84.0.0 | Not declared |
| shellingham | 1.5.4 | Not declared |
| simple-websocket | 1.1.0 | Not declared |
| six | 1.17.0 | Not declared |
| smart-open | 7.6.1 | Not declared |
| smbprotocol | 1.16.1 | Not declared |
| sniffio | 1.3.1 | Not declared |
| spacy | 3.8.14 | Not declared |
| spacy-legacy | 3.0.12 | Not declared |
| spacy-loggers | 1.0.5 | Not declared |
| srsly | 2.5.3 | Not declared |
| starlette | 1.6.0 | Not declared |
| svglib | 1.6.0 | Not declared |
| tenacity | 9.1.4 | Not declared |
| thinc | 8.3.13 | Not declared |
| tiktoken | 0.13.0 | Not declared |
| tinycss2 | 1.5.1 | Not declared |
| tinyhtml5 | 2.1.0 | Not declared |
| tldextract | 5.3.1 | Not declared |
| tqdm | 4.68.1 | Not declared |
| typer | 0.26.7 | Not declared |
| typing-extensions | 4.15.0 | Not declared |
| typing-inspection | 0.4.2 | Not declared |
| tzlocal | 5.3.1 | Not declared |
| uritools | 6.1.2 | Not declared |
| urllib3 | 2.7.0 | Not declared |
| uvicorn | 0.49.0 | Not declared |
| uvloop | 0.22.1 | Not declared |
| wasabi | 1.1.3 | Not declared |
| watchfiles | 1.2.0 | Not declared |
| weasel | 1.0.0 | Not declared |
| weasyprint | 69.0 | Not declared |
| webencodings | 0.5.1 | Not declared |
| websocket-client | 1.9.0 | Not declared |
| websockets | 16.0 | Not declared |
| werkzeug | 3.1.8 | Not declared |
| wrapt | 2.2.1 | Not declared |
| wsproto | 1.3.2 | Not declared |
| xhtml2pdf | 0.2.17 | Not declared |
| xmlsec | 1.3.17 | Not declared |
| xmltodict | 1.0.4 | Not declared |
| yarl | 1.24.2 | Not declared |
| zope-event | 6.2 | Not declared |
| zope-interface | 8.5 | Not declared |
| zopfli | 0.4.2 | Not declared |
Frontend (Node)
197 components.
| Package | Version | Licence |
|---|---|---|
| agent-base | 6.0.2 | MIT |
| asynckit | 0.4.0 | MIT |
| axios | 1.19.0 | MIT |
| bail | 2.0.2 | MIT |
| call-bind-apply-helpers | 1.0.2 | MIT |
| ccount | 2.0.1 | MIT |
| character-entities | 2.0.2 | MIT |
| character-entities-html4 | 2.1.0 | MIT |
| character-entities-legacy | 3.0.0 | MIT |
| character-reference-invalid | 2.0.1 | MIT |
| classcat | 5.0.5 | MIT |
| combined-stream | 1.0.8 | MIT |
| comma-separated-tokens | 2.0.3 | MIT |
| commander | 7.2.0 | MIT |
| cookie-es | 3.1.1 | MIT |
| csstype | 3.2.3 | MIT |
| d3 | 7.9.0 | ISC |
| d3-array | 3.2.4 | ISC |
| d3-axis | 3.0.0 | ISC |
| d3-brush | 3.0.0 | ISC |
| d3-chord | 3.0.1 | ISC |
| d3-color | 3.1.0 | ISC |
| d3-color | 3.1.3 | MIT |
| d3-contour | 4.0.2 | ISC |
| d3-delaunay | 6.0.4 | ISC |
| d3-dispatch | 3.0.1 | ISC |
| d3-drag | 3.0.0 | ISC |
| d3-drag | 3.0.7 | MIT |
| d3-dsv | 3.0.1 | ISC |
| d3-ease | 3.0.1 | BSD-3-Clause |
| d3-fetch | 3.0.1 | ISC |
| d3-force | 3.0.0 | ISC |
| d3-format | 3.1.2 | ISC |
| d3-geo | 3.1.1 | ISC |
| d3-hierarchy | 3.1.2 | ISC |
| d3-interpolate | 3.0.1 | ISC |
| d3-interpolate | 3.0.4 | MIT |
| d3-path | 3.1.0 | ISC |
| d3-polygon | 3.0.1 | ISC |
| d3-quadtree | 3.0.1 | ISC |
| d3-random | 3.0.1 | ISC |
| d3-scale | 4.0.2 | ISC |
| d3-scale-chromatic | 3.1.0 | ISC |
| d3-selection | 3.0.0 | ISC |
| d3-selection | 3.0.11 | MIT |
| d3-shape | 3.2.0 | ISC |
| d3-time | 3.1.0 | ISC |
| d3-time-format | 4.1.0 | ISC |
| d3-timer | 3.0.1 | ISC |
| d3-transition | 3.0.1 | ISC |
| d3-transition | 3.0.9 | MIT |
| d3-zoom | 3.0.0 | ISC |
| d3-zoom | 3.0.8 | MIT |
| dagre | 0.8.5 | MIT |
| debug | 4.4.3 | MIT |
| debug | 4.1.13 | MIT |
| decode-named-character-reference | 1.3.0 | MIT |
| delaunator | 5.1.0 | ISC |
| delayed-stream | 1.0.0 | MIT |
| dequal | 2.0.3 | MIT |
| devlop | 1.1.0 | MIT |
| dunder-proto | 1.0.1 | MIT |
| es-define-property | 1.0.1 | MIT |
| es-errors | 1.3.0 | MIT |
| es-object-atoms | 1.1.2 | MIT |
| es-set-tostringtag | 2.1.0 | MIT |
| estree | 1.0.8 | MIT |
| estree-jsx | 1.0.5 | MIT |
| estree-util-is-identifier-name | 3.0.0 | MIT |
| extend | 3.0.2 | MIT |
| fault | 1.0.4 | MIT |
| follow-redirects | 1.16.0 | MIT |
| form-data | 4.0.6 | MIT |
| format | 0.2.2 | MIT |
| function-bind | 1.1.2 | MIT |
| get-intrinsic | 1.3.0 | MIT |
| get-proto | 1.0.1 | MIT |
| gopd | 1.2.0 | MIT |
| graphlib | 2.1.8 | MIT |
| has-symbols | 1.1.0 | MIT |
| has-tostringtag | 1.0.2 | MIT |
| hasown | 2.0.4 | MIT |
| hast | 3.0.4 | MIT |
| hast-util-parse-selector | 2.2.5 | MIT |
| hast-util-to-jsx-runtime | 2.3.6 | MIT |
| hast-util-whitespace | 3.0.0 | MIT |
| hastscript | 6.0.0 | MIT |
| highlight.js | 10.7.3 | BSD-3-Clause |
| highlightjs-vue | 1.0.0 | CC0-1.0 |
| html-url-attributes | 3.0.1 | MIT |
| https-proxy-agent | 5.0.1 | MIT |
| iconv-lite | 0.6.3 | MIT |
| inline-style-parser | 0.2.7 | MIT |
| internmap | 2.0.3 | ISC |
| is-alphabetical | 2.0.1 | MIT |
| is-alphanumerical | 2.0.1 | MIT |
| is-decimal | 2.0.1 | MIT |
| is-hexadecimal | 2.0.1 | MIT |
| is-plain-obj | 4.1.0 | MIT |
| lodash | 4.18.1 | MIT |
| longest-streak | 3.1.0 | MIT |
| lowlight | 1.20.0 | MIT |
| lucide-react | 1.28.0 | ISC |
| markdown-table | 3.0.4 | MIT |
| math-intrinsics | 1.1.0 | MIT |
| mdast | 4.0.4 | MIT |
| mdast-util-find-and-replace | 3.0.2 | MIT |
| mdast-util-from-markdown | 2.0.3 | MIT |
| mdast-util-gfm | 3.1.0 | MIT |
| mdast-util-gfm-autolink-literal | 2.0.1 | MIT |
| mdast-util-gfm-footnote | 2.1.0 | MIT |
| mdast-util-gfm-strikethrough | 2.0.0 | MIT |
| mdast-util-gfm-table | 2.0.0 | MIT |
| mdast-util-gfm-task-list-item | 2.0.0 | MIT |
| mdast-util-mdx-expression | 2.0.1 | MIT |
| mdast-util-mdx-jsx | 3.2.0 | MIT |
| mdast-util-mdxjs-esm | 2.0.1 | MIT |
| mdast-util-phrasing | 4.1.0 | MIT |
| mdast-util-to-hast | 13.2.1 | MIT |
| mdast-util-to-markdown | 2.1.2 | MIT |
| mdast-util-to-string | 4.0.0 | MIT |
| micromark | 4.0.2 | MIT |
| micromark-core-commonmark | 2.0.3 | MIT |
| micromark-extension-gfm | 3.0.0 | MIT |
| micromark-extension-gfm-autolink-literal | 2.1.0 | MIT |
| micromark-extension-gfm-footnote | 2.1.0 | MIT |
| micromark-extension-gfm-strikethrough | 2.1.0 | MIT |
| micromark-extension-gfm-table | 2.1.1 | MIT |
| micromark-extension-gfm-tagfilter | 2.0.0 | MIT |
| micromark-extension-gfm-task-list-item | 2.1.0 | MIT |
| micromark-factory-destination | 2.0.1 | MIT |
| micromark-factory-label | 2.0.1 | MIT |
| micromark-factory-space | 2.0.1 | MIT |
| micromark-factory-title | 2.0.1 | MIT |
| micromark-factory-whitespace | 2.0.1 | MIT |
| micromark-util-character | 2.1.1 | MIT |
| micromark-util-chunked | 2.0.1 | MIT |
| micromark-util-classify-character | 2.0.1 | MIT |
| micromark-util-combine-extensions | 2.0.1 | MIT |
| micromark-util-decode-numeric-character-reference | 2.0.2 | MIT |
| micromark-util-decode-string | 2.0.1 | MIT |
| micromark-util-encode | 2.0.1 | MIT |
| micromark-util-html-tag-name | 2.0.1 | MIT |
| micromark-util-normalize-identifier | 2.0.1 | MIT |
| micromark-util-resolve-all | 2.0.1 | MIT |
| micromark-util-sanitize-uri | 2.0.1 | MIT |
| micromark-util-subtokenize | 2.1.0 | MIT |
| micromark-util-symbol | 2.0.1 | MIT |
| micromark-util-types | 2.0.2 | MIT |
| mime-db | 1.52.0 | MIT |
| mime-types | 2.1.35 | MIT |
| ms | 2.1.3 | MIT |
| ms | 2.1.0 | MIT |
| parse-entities | 4.0.2 | MIT |
| prismjs | 1.30.0 | MIT |
| property-information | 7.1.0 | MIT |
| proxy-from-env | 2.1.0 | MIT |
| qrcode.react | 4.2.0 | ISC |
| react | 12.11.2 | MIT |
| react | 19.2.8 | MIT |
| react | 19.2.18 | MIT |
| react-dom | 19.2.8 | MIT |
| react-dom | 19.2.4 | MIT |
| react-markdown | 10.1.0 | MIT |
| react-router | 8.3.0 | MIT |
| react-syntax-highlighter | 15.6.6 | MIT |
| refractor | 3.6.0 | MIT |
| remark-gfm | 4.0.1 | MIT |
| remark-parse | 11.0.0 | MIT |
| remark-rehype | 11.1.2 | MIT |
| remark-stringify | 11.0.0 | MIT |
| robust-predicates | 3.0.3 | Unlicense |
| runtime | 7.29.2 | MIT |
| rw | 1.3.3 | BSD-3-Clause |
| safer-buffer | 2.1.2 | MIT |
| scheduler | 0.27.0 | MIT |
| space-separated-tokens | 2.0.2 | MIT |
| stringify-entities | 4.0.4 | MIT |
| structured-clone | 1.3.1 | ISC |
| style-to-js | 1.1.21 | MIT |
| style-to-object | 1.0.14 | MIT |
| system | 0.0.79 | MIT |
| trim-lines | 3.0.1 | MIT |
| trough | 2.2.0 | MIT |
| unified | 11.0.5 | MIT |
| unist | 3.0.3 | MIT |
| unist-util-is | 6.0.1 | MIT |
| unist-util-position | 5.0.0 | MIT |
| unist-util-stringify-position | 4.0.0 | MIT |
| unist-util-visit | 5.1.0 | MIT |
| unist-util-visit-parents | 6.0.2 | MIT |
| use-sync-external-store | 1.6.0 | MIT |
| vfile | 6.0.3 | MIT |
| vfile-message | 4.0.3 | MIT |
| xtend | 4.0.2 | MIT |
| zustand | 4.5.7 | MIT |
| zwitch | 2.0.4 | MIT |