Release period: v1.2.135.6 → v1.2.135.7
This release brings license status into the product, with expiry warnings, a grace period and a clean end of access, and makes web application scans finish their testing within budget while recording every distinct finding. Note the breaking change to the license fields in the Workspace and Organization APIs before upgrading any integration that reads them.
Release period: v1.2.135.5 → v1.2.135.6
This release deepens web application scanning: frameworks are now detected from the running page, stored XSS from file uploads is verified rather than inferred, and software composition analysis can optionally check findings against OSV.dev. Authenticated crawls of single-page applications are substantially more reliable, several classes of false positive are gone, and the API catalog now tells HTTP Basic authentication apart from Bearer.
Release period: v1.2.135.4 → v1.2.135.5
A small release. The Vulnerabilities PDF can now be produced in an audit format suitable for handing to an auditor or a customer's security team, and viewing a satellite, CLI or test-runner auth key no longer sends you back through your identity provider.
Release period: v1.2.135.3 → v1.2.135.4
This release is about trusting what you see. Duplicate API endpoints can now be merged in bulk, TLS findings from the Satellite are reported again after being silently absent, and scan results no longer render a vulnerable or unrecognised scan as clean. Custom AI-authored tests gain a full authoring lifecycle — create, validate, approve — with every run bound to the exact code a human reviewed. Note the breaking change to the API Surface export below before upgrading any integration that reads it.
Release period: v1.2.135.2 → v1.2.135.3
This release centres on reporting and inventory hygiene: the API Surface report gains the columns and filters teams have been asking for, duplicate API endpoints can now be merged into one, and inactive APIs can be left out of reports entirely. Security testing gets materially more complete — a default levo test run now covers every test category instead of half of them — and web app scans can ask a person for a one-time code mid-scan. DAST evidence is more honest, and MCP connections and identity-provider lookups are fixed for organizations on Keycloak.
Release period: v1.2.135.1 → v1.2.135.2
This release connects Levo to WSO2 API Gateway with a one-click push of endpoints, gives the Service Graph its own full-screen page, and adds AI-assisted triage from the vulnerability view. Security testing results are markedly more trustworthy: tests that could not run are reported as skipped rather than failed, several classes of false positives are gone, and injection tests once again reach the endpoints they target. DAST scans gain second-factor support, PDF reports get a redesign, and sign-in, SSO and administration are more reliable across identity providers.
Release period: v1.2.135.0 → v1.2.135.1
This release lets security teams tune API security testing per application, puts test-run cleanup under role-based control with bulk delete, and introduces a Beta Service Graph in the API catalog. It also broadens test coverage to form-encoded APIs and unauthenticated-access probes, produces cleaner OpenAPI specs for strict gateway imports, and makes on-prem component health alerts far less noisy.
Release period: September 1, 2026 – September 8, 2026 (partial month)
A short but active stretch: a new API discovery source, two new integrations, and an overhauled component health monitoring experience, alongside a batch of accuracy and reliability fixes across security testing and web application scanning.
Release period: August 1 – August 31, 2026
August was a big month for coverage and visibility: a major expansion of web application scan checks, sharper AI Firewall detection, and a redesigned view into every on-prem component's health.
Release period: July 1 – July 31, 2026
This month's release focuses on making your API inventory easier to trust and act on — clearer endpoint activity data, safer parameter editing, broader DAST framework coverage, and a more reliable test-run experience.