Release period: v1.2.135.6 → v1.2.135.7
This release brings license status into the product, with expiry warnings, a grace period and a clean end of access, and makes web application scans finish their testing within budget while recording every distinct finding. Note the breaking change to the license fields in the Workspace and Organization APIs before upgrading any integration that reads them.
Release period: v1.2.135.3 → v1.2.135.4
This release is about trusting what you see. Duplicate API endpoints can now be merged in bulk, TLS findings from the Satellite are reported again after being silently absent, and scan results no longer render a vulnerable or unrecognised scan as clean. Custom AI-authored tests gain a full authoring lifecycle — create, validate, approve — with every run bound to the exact code a human reviewed. Note the breaking change to the API Surface export below before upgrading any integration that reads it.
Release period: v1.2.135.4 → v1.2.135.5
A small release. The Vulnerabilities PDF can now be produced in an audit format suitable for handing to an auditor or a customer's security team, and viewing a satellite, CLI or test-runner auth key no longer sends you back through your identity provider.
Release period: v1.2.135.2 → v1.2.135.3
This release centres on reporting and inventory hygiene: the API Surface report gains the columns and filters teams have been asking for, duplicate API endpoints can now be merged into one, and inactive APIs can be left out of reports entirely. Security testing gets materially more complete — a default levo test run now covers every test category instead of half of them — and web app scans can ask a person for a one-time code mid-scan. DAST evidence is more honest, and MCP connections and identity-provider lookups are fixed for organizations on Keycloak.
Release period: v1.2.135.1 → v1.2.135.2
This release connects Levo to WSO2 API Gateway with a one-click push of endpoints, gives the Service Graph its own full-screen page, and adds AI-assisted triage from the vulnerability view. Security testing results are markedly more trustworthy: tests that could not run are reported as skipped rather than failed, several classes of false positives are gone, and injection tests once again reach the endpoints they target. DAST scans gain second-factor support, PDF reports get a redesign, and sign-in, SSO and administration are more reliable across identity providers.
Release period: v1.2.135.0 → v1.2.135.1
This release lets security teams tune API security testing per application, puts test-run cleanup under role-based control with bulk delete, and introduces a Beta Service Graph in the API catalog. It also broadens test coverage to form-encoded APIs and unauthenticated-access probes, produces cleaner OpenAPI specs for strict gateway imports, and makes on-prem component health alerts far less noisy.