Connector

​

2.14.3

​

Changed

• Increase ListResourceTags context timeout for large numbers of resource tags

​

2.14.2

​

Fixed

• Fix Connector requests to the control plane hanging during API deployments.

​

2.14.1

​

New

• Add support for logging files transferred during an SFTP session.

​

Fixed

• Fixed an issue with re-signing chunked puts to S3 through the AWS proxy.

​

2.14.0

​

New

• Support type-safe masking on MongoDB.

​

Changed

• Improve the accuracy and coverage of MongoDB audit logs.

​

2.13.2

​

Changed

• Log AWS native-user credential resolution failures, including the assumed role ARN and the STS error.

​

2.13.1

​

New

• Support host-based smart routing and X-Formal header authentication for Kubernetes resources.

​

2.13.0

​

New

• Support rewriting HTTP paths in policies
• Surface input.session.id and input.request.id where applicable as policy evaluation inputs.
• Surface session ID and request IDs in the default formal block message across technologies

​

Fixed

• Respect disabled inline discovery for nested JSON fields and other discovery paths.

​

2.12.1

​

Fixed

• Fix AWS SDK uploads that use Content-Encoding: aws-chunked, which the HTTP proxy previously rejected.

​

2.12.0

​

New

• Select a native user on the HTTP proxy with the @<native_user> syntax, the same way the other protocols already allow.

​

Fixed

• Fix a listener scoping issue where a user connected to one listener could reach a resource served by another listener on the same Connector.
• Fix an issue where masking a NUMERIC column on Postgres returned a text placeholder instead of a number.
• Fix an issue where a mask that falls back to NULL on MySQL returned an empty value instead of NULL.

​

2.11.6

​

Fixed

• Fix an issue where masking a non-text column over MySQL failed instead of applying the mask.

​

2.11.5

​

Fixed

• Fix an issue where S3 listing prefixes were not included in Rego policy input or audit logs.

​

2.11.4

​

Changed

• Log whether the Connector is connected to a policy data loader and how much data it received, instead of printing whole datasets in debug logs.
• Record web resource login redirects and callbacks in the session logs.

​

Fixed

• Fix an issue where a rejected Postgres login was also recorded as a successful session.

​

2.11.3

​

Fixed

• Fix an issue where syncing a large policy data loader dataset to the Connector could fail, and compress the transfer.

​

2.11.2

​

Changed

• Speed up policy evaluation when policies match against large policy data loader datasets.

​

2.11.1

​

Fixed

• Fix native-auth fallback behavior in the AWS proxy.

​

2.11.0

​

New

• Add support for AWS API native user authentication on the Formal Connector.

​

2.10.0

​

New

• Add Redis smart routing based on TLS server name (<resource-name>.<connector-host>).

​

2.9.3

​

New

• Add support for federated token authentication with end-user identity propagation.

​

Fixed

• Redirect browsers to re-authenticate when a web resource session cookie is expired or rejected, instead of returning 401 Unauthorized.

​

2.8.0

​

Changed

• Make the Connectors schema inline discovery configurable from Formal Control Plane.

​

2.7.0

​

New

• Add support for encrypting and decrypting HTTP tokens with a cloud KMS key on the Connector.

​

2.6.0

​

New

• Initial release of the FIPS-compliant build of the Connector (formalco-prod-connector-fips).

​

2.5.2

​

Changed

• Speed up queries that return masked data. Large result sets are now several times faster, especially with many concurrent sessions.

​

2.5.1

​

Fixed

• Improved gRPC support.

​

2.5.0

​

New

• Support end-user identity propagation for Kubernetes, so requests made through a shared or machine identity are attributed to the real user in policies and audit logs.
• Support rewriting HTTP request and response bodies from policies, including raw, JSON, and form-encoded payloads.
• Add a block action for unknown MCP servers that suggests approved alternatives.

​

Changed

• Run health checks for web and other HTTP-based resources that were previously skipped.

​

2.4.0

​

New

• Add support for Amazon Redshift.
• Support Azure IAM authentication for native database users.
• Support rewriting HTTP response headers from policies, mirroring existing request header rewrite support.

​

Fixed

• Tighten transparent proxy listener rule matching. Connectors must be explicitly configured to proxy for a technology/resource via a listener rule.

​

2.3.2

​

Fixed

• Fix a bug where recently created or updated OTel connection settings were not applied at startup.

​

2.3.0

​

New

• Add support for writing to and reading from a cache from hooks.

​

Changed

• Encrypt clustering gossip communications between connectors. Note: when upgrading to this version via a rolling restart, a second rolling restart is required to ensure the cluster is not partitioned. Without a second restart, rate limit enforcement may be inconsistent.
• Add support for allowlisting CIDR ranges for hook outbound traffic.

​

Fixed

• Fix an issue where a MySQL connection could drop after a query failed partway through its results, forcing users to reconnect.
• Fix an issue where an empty text value in a MySQL result could be returned as NULL.

​

2.2.0

​

Changed

• Require allowlisting environment variables and upstream network destinations for hooks.

​

2.1.0

​

New

• Initial release of Formal Hooks

​

2.0.1

​

Fixed

• Fix a bug affecting end-user identity propagation for newly created human users

​

2.0.0

​

New

• General availability of our overhauled system for syncing data between the Connector and the control plane.

​

1.55.2

​

Fixed

• Fix an issue where users could not log in over RDP with NLA using SPNEGO

​

1.55.1

​

Fixed

• Keep hashed UUID values as valid UUIDs so they can be written back to UUID columns

​

1.55.0

​

New

• Add IAM authentication for Redis on Amazon ElastiCache (Valkey 7.2+, Redis OSS 7+)

​

1.54.5

​

Fixed

• Fix an issue with NLA over SPNEGO in the RDP proxy

​

1.54.4

​

Fixed

• Allow RDP clients that authenticate over SPNEGO to connect

​

1.54.3

​

Fixed

• Fix an issue where large Snowflake query results could fail to load through the Connector

​

1.54.2

​

Changed

• Add more detail to RDP connection logs to help diagnose handshake and negotiation failures

​

1.54.1

​

Changed

• Improve logging for RDP connections that fail during the handshake, making these issues easier to diagnose

​

1.54.0

​

New

• Allow connection to upstream resources using mTLS
• Mask JSON fields that are wrapped in casts or functions
• Add support for the Redis Cluster protocol

​

Fixed

• Mask JSON fields whose keys contain special characters
• Preserve JSON field types when masking

​

1.53.0

​

New

• Mask JSON fields however a query navigates to them, including path expressions and array-index access
• Mask values stored directly in JSON arrays, including columns whose entire value is an array

​

Fixed

• Mask JSON fields combined with other columns inside a single output expression
• Preserve valid JSON encoding when masking a field selected directly from a JSON column
• Fix Postgres connections for stateless JWT machine users when clients send options=-c ... startup parameters

​

1.52.0

​

New

• Add Postgres support for field masking in JSON/JSONB columns

​

Fixed

• Fix an issue where fields nested inside JSON arrays were not always masked

​

1.51.0

​

New

• Encrypt sensitive log fields in the standard JWE format, so they can be decrypted with any standard JWE library
• Add support for GCP Cloud KMS encryption keys

​

1.50.3

​

Fixed

• Ensure SSM sessions are cleaned up after resource connection tests

​

1.50.2

​

Changed

• Improve performance of large Snowflake queries by streaming results directly when no masking policy applies

​

1.50.1

​

Changed

• Improve logging and policy evaluation on LLM requests by parsing OpenAI and Anthropic events
• The gcp_cloudsql dial method now targets the Cloud SQL instance’s private IP. The Connector must run in the instance’s VPC, or in a peered or PSC-connected VPC.
• Cloud SQL Admin API calls now identify the client as formal-connector/<version>

​

1.50.0

​

New

• Add support for resource dial configurations, enabling connection to Google Cloud SQL Postgres and MySQL instances natively

​

Fixed

• Preserve quoting in commands run through the SSH proxy
• Keep standard output and standard error separate over the SSH proxy

​

1.49.12

​

Fixed

• Propagate stdin EOF through the SSH proxy

​

1.49.11

​

Fixed

• Sanitize assume role session names for SSM connections

​

1.49.10

​

Fixed

• Restore forwarding of X-Formal-End-User-Identity to HTTP resources

​

1.49.9

​

New

• Allow the policy engine to read environment variables prefixed by FORMAL_POLICY_ENV_

​

1.49.8

​

New

​

Changed

• Send policy action details in logs along triggered policies, such as which columns a masking policy would affect
• Improve policy evaluation performance

​

Fixed

• Fail loudly when the Connector can’t handle a Snowflake request or response

​

1.49.7

​

Fixed

• Fix connector startup failure after issuance of a new TLS certificate

​

1.49.6

​

Changed

• Improve response policy evaluation performance

​

1.49.5

​

Fixed

• Fix connector policy inclusion bug for Kubernetes sessions

​

1.49.4

​

Changed

• Improve connection pooling behavior for S3 connections

​

1.49.3

​

Changed

• Improve policy evaluation performance

​

1.49.2

​

Changed

• Propagate upstream exit codes from SSH sessions

​

Fixed

• Fix failures when connecting to an EKS cluster in a different region than the Connector

​

1.49.1

​

Changed

• Improve S3 connection performance

​

1.49.0

​

New

• Add support for device trust on MySQL connections
• Allow policies that match on the HTTP request hostname
• Add or rewrite HTTP request headers from a policy
• See which client application opened each MySQL connection in logs and policies
• Add support for asymmetric AWS KMS keys

​

Changed

• Improve S3 connection performance
• Improve MySQL health check performance
• Cap on-disk log buffering to 90% of available disk space to avoid filling up the host
• Improve on-disk log buffering reliability and performance

​

Fixed

• Show Formal block messages inside Codex when an action is blocked

​

1.48.2

​

Fixed

• Improve masking accuracy on CTE queries

​

1.48.1

​

Changed

• Faster Connector startup when running multiple MySQL listeners

​

1.48.0

​

New

• Add support for GCP IAM authentication in the new MySQL proxy implementation

​

Fixed

• Respect the disable TLS configuration on backend connections in the new MySQL proxy

​

1.47.2

​

Fixed

• hash.with_salt masking now produces properly salted, non-reproducible outputs
• Improve data label accuracy on SELECT query outputs

​

1.47.1

​

Fixed

• Ensure compatibility with strict Snowflake clients in DataFrame writeback flows

​

1.47.0

​

New

• Add device trust support for MongoDB

​

Changed

• MongoDB session policies are now enforced on every connection, not just SCRAM clients

​

Fixed

• Include Anthropic cache tokens in input token counting
• Strip X-Formal-* headers before forwarding HTTP requests to upstream

​

1.46.0

​

New

• Add support for IAM (Assume Role) native users for S3

​

Fixed

• Fix Snowflake DataFrame writeback flows

​

1.45.2

​

New

• Add support for SSH certificate native users

​

1.45.1

​

New

• Add response policy support in the new MySQL proxy implementation
• Support Postgres response-policy masking on advanced SQL queries (UNION, CTE, subqueries, JOIN).
• Surface column lineage through more SQL expression shapes in policy inputs.

​

1.44.1

​

Fixed

• Fix keypair and password authentication for Snowflake resources

​

1.44.0

​

New

• Add support for request-level policies in the new MySQL proxy implementation

​

Fixed

• Fixed a Rego policy handling that could prevent data masking.
• Fixed Snowflake data masking for non-string columns.

​

1.43.5

​

New

• Add ‘input.native_user_assignment’ as an available policy input.

​

Fixed

• Fix ‘email_mask_while_preserving’ so that outputs match Formal documentation.

​

1.43.4

​

Improvements

• Throttle SSM concurrency
• Support custom block messages for Claude Code tool calls

​

1.43.3

​

Improvements

• Improve parsing of Postgres options parameters

​

1.43.2

​

Improvements

• Improve performance of AWS IAM (assume role) authentication for RDS and SSM health checks

​

1.43.1

​

Improvements

• Allow S3 browser objects to be addressed using unescaped path segments. This creates a breaking change from previous versions where objects must be downloaded by appending ?download=1 to the URL rather than /dl.
• Parse Hex tool metadata SQL comments in Snowflake

​

1.42.7

​

Fixed

• Fix TLS handling for Redis connections

​

1.42.6

​

Fixed

• Fix overly verbose debug-level logging for control plane updates

​

1.42.5

​

Fixed

• Parse Snowflake queries using GROUPING SETS with non-parenthesized items
• Redact passwords in Snowflake ALTER USER ... SET PASSWORD = ... statements

​

1.42.4

​

Fixed

• Fix health checks for Redis resources

​

1.42.3

​

New

• More gracefully handle SSM rate limiting errors

​

1.42.2

​

New

• Add yolo_mode to agent info for connector sessions

​

1.42.1

​

New

• Improve health checks for MCP resources

​

1.42.0

​

New

• Add TCP reachability health check for RDP resources

​

1.41.10

​

Changed

• Inventory loading performance improvements

​

1.41.7

​

Changed

• Remove welcome messages from the SSH proxy
• Suppress noisy logging during device info signature verification

​

1.41.5

​

Changed

• Improve robustness of SSM resource reachability checks

​

1.41.4

​

Changed

• Improve speed of connector resource reachability checks

​

1.41.3

​

Changed

• Improve performance of resource data loading at connector startup
• Improve health check startup time

​

1.41.2

​

Changed

• Increase snowflake connection concurrency limits

​

1.41.1

​

Changed

• Improve resource hostname loading performance at connector startup

​

Fixed

• Fix MySQL USE statements with smart routing

​

1.41.0

​

New

• Add support for Postgres query cancellation

​

1.40.12

​

New

• Add support for logging macOS process signatures in device info

​

1.40.9

​

New

• Add raw HTTP request and response bodies to policy inputs

​

1.40.8

​

New

• Add support for device info parsing for HTTP connections

​

1.40.7

​

Fixed

• Fix error logs when retrieving search paths in Postgres with GCP IAM Authentication

​

1.40.6

​

New

• Log bytes sent and received for SSH sessions
• Log bind parameters for extended Postgres queries

​

1.40.5

​

Changed

• Reliability and performance improvements

​

1.40.4

​

Fixed

• Improve MySQL access token syncing reliability

​

1.40.3

​

Fixed

• Fix a bug where Kubernetes API servers on port 443 were detected as duplicate contexts in kubeconfig files

​

1.40.2

​

New

• Support Omni end user identity propagation for Snowflake

​

1.40.1

​

New

• Add support for hosted AI providers (OpenAI, Anthropic, Gemini, Google Vertex AI, AWS Bedrock, Azure AI) for session analysis

​

1.40.0

​

New

• Introduce RDP protocol support with session-level logs and policies

​

Changed

• Migrate auth redirects from app.joinformal.com to app.formal.ai

​

1.39.1

​

New

• Surface transaction_history and transaction_progress in query policy inputs for postgres

​

1.39.0

​

New

• Add support for request-stage policy evaluation and end-user identity propagation for Redis

​

Changed

• Reduce log error noise for Postgres connections

​

1.38.2

​

Fixed

• Support input conditions for time-based policy suspensions

​

1.38.1

​

Fixed

• Fixed an issue where changes to the PostgreSQL search_path were not properly tracked in the session state, causing unqualified table names (e.g., pg_class) to be resolved against outdated schema listings

​

1.38.0

​

Changed

• Restrict the Snowflake stage download proxy to known cloud storage endpoints (S3, Azure Blob, GCS) and cap decompressed response bodies at 256 MB
• Enforce ReadHeaderTimeout on all HTTP-based proxy servers to mitigate slow-client resource exhaustion
• Defer listener readiness until the initial control plane event stream catch-up completes, ensuring consistent configuration before accepting traffic

​

Fixed

• Support WebSocket-based kubectl port-forward introduced in kubectl v1.30+
• Preserve parsed table context when best-effort inventory lookups fail, so policy evaluation still has access to table names and schemas
• Resolve a concurrency issue in listener port lookups that could surface under high connection churn

​

1.37.1

​

Fixed

• Fix PostgreSQL extended query protocol support for PortalSuspended messages when Execute is called with a row limit
• Fix incorrect query attribution in PostgreSQL logs when standard queries (e.g. BEGIN) are sent between Parse and Bind in the extended query protocol

​

1.37.0

​

New

• General availability of stream session analysis for SSH, SSM, and Kubernetes exec sessions

​

1.36.5

​

New

• Add support for agent forwarding for SSH connections

​

1.36.4

​

New

• Add support for assuming roles from command line arguments for SSM (EC2 and ECS) connections

​

1.36.3

​

Fixed

• Fixed a bug with PostgreSQL health checks using GCP Cloud SQL IAM authentication

​

1.36.2

​

Fixed

• Fix PostgreSQL table_paths not including unqualified table names when session schemas are unavailable

​

1.36.1

​

New

• Add API Request verb for Kubernetes policy evaluations

​

1.36.0

​

New

• Add support for Kubernetes WebSockets, v5 stream protocol, and follow requests

​

Fixed

• Block PostgreSQL COPY TO (\copy) operations when response policies are configured

​

1.35.0

​

New

• Initial release of the Formal Connector on Google Cloud Artifact Registry

​

Changed

• Enhanced metadata extraction from PostgreSQL queries, enabling better policy evaluation against DML operations

​

1.34.10

​

Fixed

• Fix a bug with IAM (Assume Role) authentication for EKS clusters

​

1.34.9

​

New

• Customers can now specify the frequency of the resources health check

​

1.34.8

​

Changed

• Improve performance of policy evaluation

​

Fixed

• Fixed a bug where dry-run rewrite policies were being applied to requests

​

1.34.6

​

Changed

• Improve performance of sending logs

​

1.34.5

​

Changed

• Improve performance of responses with many rows

​

1.34.4

​

Fixed

• Improve reliability of large snowflake arrow responses

​

1.34.3

​

New

• Emit the total number of bytes transferred during SFTP sessions in SSH session logs

​

1.34.2

​

New

• Support CEL expressions in policy suspension input conditions
• Added rate-limiting support for postgres and mysql and refactored s3 rate-limiting

​

Changed

• Logs are now persisted to disk and retried automatically during Control Plane outages, preventing log loss
• Support multiple policy suspensions for the same policy and identity id

​

Fixed

• Fixed a bug with the nullify redaction option
• Fixed a bug where query-rewrite policies didn’t allow adding LIMIT 0

​

1.34.1

​

New

• Support a custom OTEL metric collector hostname and port

​

Changed

• Improve the behavior of the Connector when Formal Control Plane can’t be reached

​

1.34.0

​

New

• Smart routing is now available for MySQL resources when using the new proxy implementation

​

Changed

• Parallelized Rego policy evaluation to improve performance on large numbers of policies

​

Fixed

• Reduce log noise for timestamp formatting
• Enforce stricter connection timeouts during SSH health checks

​

1.33.2

​

Fixed

• Reduce log noise for certain policy evaluations

​

1.33.1

​

New

• Add a parameter for request/response scope for HTTP AI body analysis

​

1.33.0

​

New

• Add support for MySQL end-user identity propagation in the new proxy implementation

​

Changed

• Include parsed query information in the new MySQL implementation logs

​

1.32.7

​

Fixed

• Fix connector startup failure when using spaces

​

1.32.6

​

Changed

• Add support for DynamoDB resource health checks

​

Fixed

• Address binary protocol issues affecting PlanetScale/Vitess connections when using prepared statements with the new MySQL proxy implementation
• Fix DynamoDB authentication when using the desktop app

​

1.32.5

​

Fixed

• Fix end-user not appearing in logs for SSH connections

​

1.32.4

​

Changed

• Add support for gRPC resource health checks

​

1.32.3

​

Changed

• Add support for custom message and timeout parameters in MFA policy actions

​

1.32.2

​

New

• Add support in the policy engine for tags on resources

​

1.32.1

​

Fixed

• Always use the incoming request port if it’s different from the listener port for Snowflake S3 support

​

1.32.0

​

New

• Add a new MySQL proxy implementation. This is a fundamentally different and more robust implementation, starting with a minimal feature set that we plan to expand quickly. This feature is behind a feature flag, contact us to enable it for your organization.
• Add MFA policy enforcement across all technologies via the Desktop App

​

1.31.31

​

Changed

• Downgrade health check failure logs to debug level to reduce log noise

​

1.31.30

​

Fixed

• Fix AWS RDS IAM authentication for resources in a different AWS region than the connector

​

1.31.29

​

New

• Log policy version in triggered policy logs

​

1.31.28

​

Fixed

• Fix a race condition on concurrent cache queries in BigQuery

​

1.31.26

​

Changed

• Emit formal.connector.resource_health_check metric for earlier health check failure stages

​

Fixed

• Fix window resize handling for SSH connections

​

1.31.22

​

New

• Add formal.connector.resource_health_check metric

​

1.31.21

​

New

• Support seamless authentication via the Formal console for the S3 browser. Users do not need to manually enter their Formal username and access token to access the S3 browser.

​

1.31.20

​

New

• Add support for scp (SFTP) to the SSH proxy for SSH resources

​

Fixed

• Fix session log entry values for failed SSH logins.

​

1.31.19

​

New

• Support optionally sending policy evaluation inputs to the Formal Control Plane based on log configuration settings.
• Support “request” and “response” as evaluation stage names in policies instead of “pre_request” and “post_request”.
• Enable row-level filtering for Snowflake responses.

​

Changed

• Preserve end-user across BigQuery job lifecycle requests to avoid authentication failures when impersonation is used.

​

Fixed

• Fix session log entry values for SSM (EC2/ECS) resources.
• Don’t attempt to start the Connector state server if it can’t write on disk.

​

1.31.12

​

New

• Support cross-account AWS role assumption for EC2/ECS SSM
• Support custom error messages for Postgres and MySQL request evaluation

​

Fixed

• Fix downloads for S3 objects with special characters in object keys
• Fix S3 technology failures when using the AWS JavaScript SDK

​

1.29.12

​

New

• Add AWS account ID and name to resource health check events for easier multi-account tracking

​

1.29.11

​

Fixed

• Fix S3 request logs to include formal user name, improving auditability

​

1.29.10

​

New

• Add per-bucket S3 health checks with autodiscovery, showing bucket names for faster diagnostics

​

1.29.9

​

New

• Add policy input logging for session and request stages with request/session IDs for better traceability
• Add sync of autodiscovered S3 buckets to the connector, with pagination and live updates

​

Changed

• Standardize request/session ID propagation across connectors, including Snowflake IDs, for consistent logs
• Enforce stricter policy engine capabilities for safer, more predictable evaluations

​

1.29.8

​

New

• Add S3 bucket access metrics to policies for rate limiting and blocking
• Add connector, resource, and space IDs to policy input logs for filtering

​

Changed

• Improve S3 access counting accuracy, include current request and drop daily counts
• Add bucket, path, action, and last modified to S3 policy inputs for finer control
• Provide richer user and query context in post-request policy checks across databases

​

Fixed

• Fix S3 auth failures to return 403 Forbidden with AWS-style XML
• Fix MySQL auth to forward native error packets to clients

​

1.29.7

​

New

• Add structured S3 logs with action, bucket, path, and last-modified, consistent across access styles

​

Fixed

• Fix S3 PutObject authentication by honoring payload hashes and signing required headers to prevent auth errors
• Fix query aggregation failures for long SQL statements in analytics to improve reliability

​

1.29.6

​

New

• Add normalized SQL queries to datastore request logs for easier analysis
• Add response-stage policy input logging in PostgreSQL, improving policy analysis

​

Changed

• Treat S3 hostnames as global endpoints, enabling ListBuckets and vhost/path access

​

1.29.5

​

Fixed

• Fix column matching to ignore case and spaces, preventing mismatches from formatting differences

​

1.29.4

​

New

• Add support for MCP resources, enabling MCP traffic parsing and accurate technology logs for auditing

​

1.29.3

​

New

• Add AI satellite integration, enforcing one link only with data classifier to prevent conflicts
• Add request log evaluation in policy backtests for fuller coverage
• Add MySQL and MariaDB support for hashed tokens, avoiding password length limits

​

Fixed

• Fix HTTP response handling for non-JSON payloads to prevent misclassification

​

1.29.2

​

Fixed

• Fix TLS defaults when no config is present, restoring secure connections and preventing connection errors

​

1.29.1

​

New

• Add configurable retention for policy evaluation input logs

​

1.29.0

​

New

• Add AI satellite integration for HTTP with automatic fallback for compatibility
• Add audit logs for frontend API create, update, delete actions for traceability

​

Changed

• Enforce required environment variables across environments to prevent misconfigurations
• Include uses row data flag in policies for consistent behavior across services

​

1.28.10

​

New

• Add support for duplicate columns in SQL queries, ensuring results match source databases.

​

Fixed

• Fix returning MySQL responses when analysis fails, ensuring accurate error reporting.

​

1.28.9

​

New

• Add qualified wildcards (table., alias.) and column alias detection for accurate multi-table queries

​

Fixed

• Fix metric setup with automatic startup retries, ensuring monitoring works when agents start late

​

1.28.8

​

Fixed

• Fix device trust errors in Postgres when using custom native usernames, preventing login failures.

​

1.28.7

​

Fixed

• Fix production connector image to include required files, preventing startup failures

​

1.28.5

​

Changed

• Limit inventory to labeled objects, tracking label add/removal updates

​

1.28.4

​

New

• Add native DB user context to PostgreSQL policy checks

​

1.28.3

​

Changed

• Change S3 health checks to use network connectivity

​

1.28.2

​

Changed

• Improve MySQL query performance when policies are enabled

​

1.28.1

​

New

• Add multi stage resource health checks for HTTP, SSH, and SSM
• Make the connector health check port configurable to prevent port conflicts in shared environments.

​

1.28.0

​

New

• Add resource health checks for Kubernetes, ClickHouse, and Snowflake with connection and authentication validation

​

Changed

• Remove policy evaluation details from logs

​

1.27.2

​

Fixed

• Fix incorrect query parameters in Postgres
• Fix JIT SSO

​

Changed

• Update Datadog profiling: support agent URL via env vars, check reachability with retries to reduce startup errors

​

1.27.1

​

New

• Add auto-creation of MySQL discovery connections, preventing failures when no prior connection exists

​

1.27.0

​

New

• Add per-stage connection health logs covering network, security, login, and data

​

1.26.11

​

Changed

• Apply log level changes from the UI instantly during CDC syncs, no restart needed

​

1.26.10

​

Changed

• Standardize log timestamps for consistent parsing across tools

​

1.26.9

​

New

• Add support for MariaDB databases, expanding compatibility

​

Fixed

• Fix MySQL connection failures when clients omit auth plugin, improving compatibility with older clients

​

Changed

• Enable on-demand test connection checks from the Formal console for faster troubleshooting

​

1.26.8

​

New

• Add password redaction for SQL queries in PostgreSQL and Snowflake, with CLI support
• Add formal user type to SSH stream logs for clearer auditing

​

Changed

• Remove Redshift technology support
• Remove query fingerprints from logs

​

1.26.7

​

Changed

• Stop publishing the Redshift connector, making it unavailable in new releases

​

1.26.6

​

New

• Add MCP technology support using HTTP flow, simplifying MCP integrations
• Add native auth types: SSH key, Snowflake key, HTTP basic, bearer, API key
• Enhance logging with unique request IDs, event types

​

Fixed

• Fix inconsistent stage labels in logs for clearer filtering

​

1.26.5

​

Changed

• Allow startup without TLS when no certificate is provided, simplifying initial deployment; enable TLS later

​

1.26.4

​

New

• Add API to generate and upload CloudFormation templates, simplifying connector deployment automation

​

Changed

• Update TLS handling to run without a certificate, preventing errors in non-TLS environments

​

1.26.3

​

Fixed

• Fix remote access checks for ECS clusters with cross-region configs, enabling successful connections
• Fix empty service name display when connecting to ECS containers using a service ARN, improving clarity

​

1.26.2

​

New

• Add GCP autodiscovery for Compute Engine, GKE, and Cloud SQL to speed setup

​

Fixed

• Fix errors during data classification when JSON contains empty or null fields
• Fix SSH session logs missing resource details on startup

​

Changed

• Remove field-level encryption, simplifying setup and avoiding unused complexity

​

1.26.1

​

New

• Add AI-driven scenario monitoring for Kubernetes exec with risk scores, policy enforcement, and session-end audit logs
• Terminate Kubernetes exec sessions automatically when users become blocked

​

Fixed

• Fix typos in Kubernetes exec error messages for clearer troubleshooting

​

1.26.0

​

New

• Add secure satellite and policy data loader connections with certificate loading, on-demand issuance, and auto renewal

​

Changed

• Ensure columns are consistently ordered at runtime for predictable output

​

Fixed

• Fix missing resource technology in session listings

​

1.25.7

• Fixed a bug in the TLS certificate renewal process

​

1.25.6

• Streamlined TLS certificate handling at connector startup

​

1.25.5

• Fixed a bug that would prevent connector TLS certificates from being updated on renewal unless the connector is restarted

​

1.25.4

• Enabled satellite hostnames linked to a Connector to be configured from the Control Plane and read by the Connector
• Added ‘ConnectorName’ attribute for better tracking and logging during telemetry operations

​

1.25.3

• Removed a specific MongoDB configuration created for a legacy client, streamlining the process for connecting to DocDB with client-side options

​

1.25.1

• Introduced metrics to monitor opened, closed, and currently active connections, enhancing visibility into connection management for performance optimization and troubleshooting
• Implemented new metrics to monitor the number of received Control Plane pings, increasing observability of system interactions

• Fixed some errors with S3 authentication

​

1.25.0

• Regularly send connector instance heartbeat as a gauge metric via OpenTelemetry, bolstering real-time monitoring capabilities
• Default to starting up etcd without failing if the etcd cluster doesn’t come up

• Cleaned up configuration and feature flag storage

​

1.24.12

• Removed unnecessary quotes from table names when parsing SQL queries to make policies easier to write

​

1.24.11

• Moved classifier-related environment variables into the new formal_resource_classifier_configuration Control Plane objects

​

1.24.10

• Fixed column detection issues with parsing UNION statements with wildcards within Common Table Expressions (CTEs)

​

1.24.9

• Enhanced logging to include connector ID, improving traceability for debugging and monitoring purposes

​

1.24.8

• Resolved connection issues in the MySQL proxy that were caused by handshake problems with MariaDB

​

1.24.7

• Enabled automatic connection to the first task’s first container within a specified ECS service when no specific task or container is selected

• Simplified S3 connection establishment

​

1.24.6

• Resolved issue with Snowflake private key authentication for enhanced connection security

• Removed unused PII_SAMPLING_RATE ensuring cleaner code base and improved performance

• Included desktop app device trust keys in critical data load process for strengthened data security

​

1.24.5

• Improved robustness of desktop app device trust keys

​

1.24.4

• Improved logging around device trust signature verification errors

​

1.24.3

• Added stateless authentication support for Clickhouse

• Fixed the parsing of device info to ensure accurate timestamping in UTC

​

1.24.2

• Reduced wait time for PROXY protocol headers from 10 seconds to 200 milliseconds, enhancing performance and speeding up the handling of new connections

• Fixed MySQL column detection and data label matching for policies

​

1.24.1

• Implemented stateless authentication for Snowflake

​

1.24.0

• Introduced stateless JWT authentication for Kubernetes, PostgreSQL, HTTP, and SSH, enhancing security and streamlining user verification process

​

1.23.6

• Improved reliability for MySQL resources

​

1.23.2

• Enhanced MySQL error messages for better readability during the handshake process

​

1.23.1

• Added support for hashed token authentication for Postgres proxy, providing a new option for users facing length restrictions on database passwords

​

1.23.0

• Added support for SSH private key authentication to upstream, enhancing secure connection options

• Updated MySQL to utilize our unified SQL semantic analyzer, ensuring consistent behavior across databases
• Enabled port fields in resources to be updated for more flexible configurations

​

1.22.2

• Introduced a readiness endpoint for the connector (on health check port 8080 /ready), allowing it to signify when all listeners are initialized and ready to receive traffic

• Achieved consistency in logging and assertion libraries across the system, improving reliability of error logging

​

1.22.1

• Added support for handling Snowflake positional reference syntax in SQL queries
• Introduced capability to resolve Snowflake positional arguments based on actual column names from inventory
• Extended support for LATERAL queries, enabling more complex SQL queries that depend on preceding tables’ columns

• Resolved possible crash when retrieving outbound IP in telemetry, improving stability

• Streamlined MySQL TLS environment variables into a centralized TLS config
• Dropped ability of the connector to exit if a health check fails, boosting connector resilience

​

1.22.0

• Refactored log encryption configuration and improved encryption of exec streams (SSH, SSM, Kubernetes)

• Removed the ability to configure log encryption and encryption keys via environment variables; such configuration will need to be done via the Formal console or Terraform provider