Patch notes

1.21.12 — 2026-10-19

Fixed

• Fixed the MCP tools detail pane so long parameter lists scrolled instead of being clipped.
• Fixed upgrades from packages before 0.182.0 so existing API and client web.config files were preserved and the installer no longer rolled back with Windows Installer error 1603.

1.21.10 — 2026-10-19

Added

• Added per-page directory selection so each Directory Browser tab, Recycle Bin view, security page, service-account page and rules page explicitly worked in its own Active Directory connection.
• Added Directory Browser connection tabs that kept separate tree, selection, search, schema and action state for each open directory.
• Added connection health indicators to selectable directory lists so pages showed the last known connection status before opening a directory.
• Added Active Directory and Platform target tabs to MCP Tools, Notification Rules and the Operations log so platform settings were separated from directory-specific settings.
• Added per-connection count chips for MCP tool definitions, Directory Policies, Attribute Policies and Notification Rules so administrators could see which directories had their own settings.
• Added targetKind filtering for the Operations log, export and facets APIs so integrations could request Everything, Active Directory or Platform rows explicitly.

Changed

• Removed the global workspace directory picker from the shell because directory scope is now chosen on the page or tab where the action is performed.
• Changed the Operations log to open on Everything, remember each user's last filters in the browser, show a Where column when rows span targets or directories, and clear target-specific filters when switching targets.
• Changed MCP tool definitions so only Active Directory tools can have per-connection descriptions, while Platform tools use one global definition.
• Changed Notification Rules so Active Directory rules use per-directory chips and Platform API key or agent rules manage per-directory recipients inside the rule editor.
• Changed the user guide and screenshots to describe the new page-level directory selection model and updated shell layout.

Fixed

• Fixed directory links so an object was not revealed in another directory when a link omitted or named an unusable connection.
• Fixed late responses from directory writes so they showed the outcome without overwriting a page that had moved to another connection or role.
• Fixed tab, chip and rule controls so they were locked while writes were in flight and resumed safely after role changes or connection-list reloads.
• Fixed Directory Browser delete confirmation state so a pending delete request did not carry over to the next selected object.
• Fixed Operations log object filtering, remembered filters, connection-list failures and long query handling so filtered views behaved consistently across targets.
• Fixed release publishing so a release was not made public until the MSI, checksum, SBOM and notices were all uploaded and verified.

Security

• Updated System.Security.Cryptography.Xml and System.Security.Cryptography.Pkcs to 10.0.13 to address high-severity advisories GHSA-846f-f764-76mx, GHSA-7hqp-7c5m-4vq6 and GHSA-c399-9853-6jmj.

1.19.1 — 2026-10-14

Added

• Added support for running one installation across several application servers behind a load balancer, with shared cache invalidation, shared sign-in state, single-runner background jobs, shared rate limits, live operation updates across servers, rolling server-by-server updates and setup-wizard join packages.
• Added licence enforcement for managed Active Directory user-account limits, including the Licence screen count, refusal of user creation or enablement at the limit, refusal of user group-membership changes over the limit, operations-log records for refusals and notification rules for approaching or reaching the limit.
• Added Software Licence Terms acceptance on licence activation and on the Licence screen, with the accepted version, user and time recorded locally and the accepted version and time reported to Synergy.
• Added an optional usage-statistics consent question during activation and on the Licence screen, so feature-usage counts were collected only after an administrator agreed.
• Added database-backed SSO flow state and SAML replay protection so OpenID Connect and SAML sign-ins worked correctly across load-balanced servers.
• Added Keycloak SAML setup guidance to the user guide.
• Added a User guide link to the console help menu and moved the Release notes link to the published patch-notes page.
• Added third-party notices and a CycloneDX software bill of materials to release artifacts and the installed setup documentation.
• Added automatic retention for local feedback and bug-report submission records, with a default deletion period of 365 days.

Changed

• Changed title-level branding to SYNERGY Management Gateway for Active Directory and updated installer, console, OpenAPI, MCP, email and setup presentation points to use the full product name.
• Changed the MSI manufacturer, assembly metadata, About dialog and SBOM supplier/manufacturer to name SYNERGY Consulting, UAB.
• Changed managed-account licence counting to include only enabled person user accounts, so disabled accounts no longer consumed licence capacity.
• Changed the Licence screen to show managed-account usage, licence-term acceptance status and a clearer licence health model for stale checks and offline operation.
• Changed offline licence handling to verify stored licence tokens with pinned Synergy Hub signing keys and to allow operation for no more than 30 days without a successful licence confirmation.
• Changed the n8n community node package presentation to use the full product name and updated its transport, linting and error handling for n8n verification.
• Changed My Waiting Operations to show a clearer waiting list, inline cancellation, likely-to-fail warnings, outcome filters, grouped repeated decisions and expanded request details.
• Changed attribute-policy management so installation-wide rules could be edited or deleted from a directory view, with warnings that the change applied to every directory.
• Changed the console to serve the Plus Jakarta Sans brand font locally instead of loading it from Google Fonts.
• Changed the console logo, favicon and setup wizard icon to use approved SYNERGY brand assets.
• Changed live logs and log-file browsing to identify which server produced the entries in multi-server installations.
• Changed PostgreSQL database backups in multi-server installations to require a shared network folder that all gateway servers could reach.
• Changed Swagger UI so it was available only in Debug builds, while OpenAPI JSON documents remained available in Development.

Fixed

• Fixed licence screens that showed an absent managed-account limit as an undefined limit.
• Fixed operations-log detail dialogs that failed to load before/after change states when the API omitted null state fields.
• Fixed password reset and password change audit rows so they named the affected object.
• Fixed navigation rail label clipping and descender clipping in group labels.
• Fixed stale permission, API key, operation-policy, attribute-policy, MCP, notification, connection and licence caches so security and policy changes were honoured across instances.
• Fixed race conditions in API key, permission and operation-policy caches where a concurrent read could re-cache a pre-change value after an eviction.
• Fixed rolling update handling across several servers so approvals remained valid until all live servers reached the approved version and installer failures stopped the rollout cleanly.
• Fixed setup readiness checks to use the local IIS binding first, with the public URL reported as a warning when only external reachability failed.
• Fixed the setup wizard so its executable, taskbar entry, Start-menu shortcut and Apps & features entry showed the SYNERGY icon.

Security

• Fixed shipped npm audit advisories by updating Angular packages, removing an unused dependency and overriding vulnerable transitive n8n workflow dependencies.
• Fixed SAML replay protection so a captured SAML response could not be consumed once per application server.
• Encrypted stored OpenID Connect PKCE verifiers and nonces used during SSO sign-in flows.
• Added rate limiting to OpenID Connect sign-in starts and shared account-protecting rate limits across servers.
• Ensured stored licence tokens were verified offline before use and expired from offline use after the configured 30-day grace period.

Breaking changes

• Recreate n8n workflows and credentials that used package 1.x node type activeDirectory or credential type activeDirectoryApiKey, because package 2.0 renamed them to synergyManagementGateway and synergyManagementGatewayApi for n8n verification.
• Ensure every installation can reach Synergy Hub at least once every 30 days, because stored licence confirmations were no longer honoured indefinitely while offline.
• Accept the current Software Licence Terms on the Licence screen after upgrading if the Licence terms card reports that the current version has not been accepted.
• Install the IIS WebSocket Protocol feature and use SQL Server or PostgreSQL before adding additional application servers, because SQLite remained single-server only and multi-server live updates depended on WebSockets unless the load balancer used affinity.

1.0.0 — 2026-10-12

Added

• Added attribute policies for making directory attributes read-only or blocked globally or per directory, including installed read-only rules for Exchange-managed attributes and policy-aware directory browsing, schema responses, audit redaction and restore reapply handling.
• Added Sentry as a Log Stream destination, with support for sending application logs to Sentry Logs or as Sentry Issues using an encrypted DSN key.
• Added row-level delete actions and live testing to the Attribute Policies screen so administrators can manage and verify effective attribute access rules more easily.
• Added updated customer documentation, screenshots and a bundled user-guide document covering attribute policies and Sentry log destinations.

Changed

• Changed the product release stage from Beta to Release and updated version metadata, release wording and installer documentation for the 1.0.0 release.
• Redesigned the first-run setup page with clearer on-server setup guidance, password validation feedback, auto-checking for completion elsewhere and a confirmation step before sign-in.
• Changed setup readiness checks to verify the IIS site locally first and report public URL, DNS, certificate and binding issues as actionable warnings instead of failing with a generic connection error.
• Changed Log Stream terminology and screens to treat webhooks and Sentry as destination types under the same delivery, retry and status model.

Fixed

• Fixed the Agent Slowed Down notification rule type so it shows its translated name and description instead of a raw identifier.
• Fixed notification recipient suggestions by paging /users within the API limit, so recipients are suggested again on the notification rules screen.
• Fixed setup diagnostics to validate inherited web.config files and detect the IIS URL Rewrite prerequisite before startup, making IIS 500.19 causes visible during setup.
• Fixed attribute policy enforcement to use the real object class, preserve protected-target checks when attributes are blocked, and redact previously stored audit state according to current blocked-attribute rules.
• Fixed Attribute Policies layout issues in directory scope and kept the page within the standard centered content width.
• Fixed a release-build test race by waiting for the operation stream broadcast instead of using a fixed delay.

Security

• Protected blocked attributes from being read, searched through LDAP filters, displayed in schema responses, stored in new audit snapshots or exposed through existing operation-log state.
• Stored Sentry DSN keys encrypted and refused Sentry DSNs that still include the key in the URL, preventing keys from being written to logs, backups or API responses.

Breaking changes

• Install IIS URL Rewrite 2.1 on the target server before setup, because the installer now treats the module as a required prerequisite for the client web.config rewrite rules.
• Review integrations that write Exchange-managed attributes such as msExchMailboxGuid, homeMDB, mailNickname or targetAddress, because these attributes are now read-only by default through installed attribute policies.