Releases

All Aira components share a single version number. When we release, the API, dashboard, Python SDK, TypeScript SDK, and Docker images all get the same tag.

Install / upgrade:

pip install aira-sdk==3.8.1        # Python
npm install aira-sdk@3.8.1         # TypeScript
./upgrade.sh                       # Self-hosted (latest)

v3.8.1 — August 20, 2026

• Python SDK: Fix Python version requirement in README (3.9 → 3.10 to match pyproject.toml). Remove 779 accidentally tracked node_modules files from repository.
• TypeScript SDK: Version sync.

v3.8.0 — August 20, 2026

Highlights

• Built-in code review agent — zero-config PR governance. Scans security, data protection, error handling, performance, and code quality on every push. No policies needed to start.
• Auto-merge — clean PRs merge automatically. PRs with violations go through an AI-evaluated auto-merge policy that decides merge vs block. Follow-up guidance generated for the PR author.
• Slack and Microsoft Teams — approval notifications with action details and dashboard links. Slack via OAuth, Teams via Workflows webhook.
• Dashboard-only approvals — email and Slack/Teams are notification-only. All approve/deny actions happen in the dashboard with full context.
• 25 new frontier models — GPT-5.6 family, Claude Opus 5, Claude Sonnet 5, Gemini 3.7 Flash, Grok 4.6, DeepSeek V4 Flash, Kimi K3, Qwen 3.8, GLM 5.3, Mistral Medium 3.5, Command A+. Total: 61 built-in models across 13 providers.
• Cohere — new provider with Command A+ model.
• Anthropic prompt caching — all LLM prompts upgraded for Claude's prompt caching, reducing latency and cost on policy evaluations.
• 6 new API reference pages — analytics, DID, feature flags, mutual signing, verifiable credentials, file sanitization.

Models

• 25 new models added: gpt-5.6, gpt-5.6-terra, gpt-5.6-luna, o4-mini, claude-opus-5, claude-sonnet-5, gemini-3.7-flash, gemini-3.6-flash, grok-4.6, grok-4.5, deepseek-v4-flash, mistral-medium-3.5, mistral-small-3.2, kimi-k3, qwen3.8-max, glm-5.3, command-a-plus
• Cloud variants: bedrock:claude-opus-5, bedrock:claude-sonnet-5, azure:gpt-5.6, vertex:claude-opus-5, vertex:claude-sonnet-5, vertex:gemini-3.7-flash, vertex:gemini-3.6-flash
• Self-hosted: deepseek-v4-flash, kimi-k3 added to supported self-hosted models
• Total built-in models: 61 (was 37 in v3.7.0)
• Cohere added as 13th provider (API base: api.cohere.com/compatibility/v1)
• Credential source tracking: GET /api/v1/models now returns credential_source (byok, platform, or null) per model
• PDF receipt display names updated for all 61 models

Code Governance

• Built-in code review agent: zero-config PR scanning covers security (hardcoded secrets, SQL injection, XSS, SSRF), data protection (PII in logs, sensitive data in errors), error handling, performance (N+1 queries, resource leaks), and code quality
• Auto-merge: PRs with 0 violations auto-approve and squash-merge. PRs with violations evaluated by configurable auto-merge policy (AI or consensus mode)
• Merge decision comments: AI posts reasoning before merge. When violations are allowed, generates follow-up guidance with file:line references
• Review lifecycle: resolves conversation threads, dismisses prior CHANGES_REQUESTED reviews, re-scans full diff on each push (prevents bypass via clean follow-up commits)
• Violation tracking: persistent violation records with warning/critical severity split
• Scan caching and rate limiting: prevents redundant scans and API abuse
• Code Review preferences tab: choose the default model for built-in reviews in Dashboard → Models

Integrations

• Slack integration: OAuth-based connection, channel selection, test notifications, /invite @Aira workflow. Gated behind slack_integration feature flag
• Microsoft Teams integration: Workflows-based webhook (Power Automate), Adaptive Card notifications. Gated behind teams_integration feature flag
• Notification channels: unified channel dispatcher supporting email, Slack, and Teams. Dashboard page at Settings → Notification Channels
• Feature flags dashboard: self-hosted admins can toggle feature flags from the UI (Settings → Feature Flags)

Dashboard

• Code Review tab on Models preferences page — select default model for built-in reviews
• GitHub integration page — auto-merge policy editor, feature flag toggles
• Teams integration page — webhook URL configuration, test notifications
• Slack integration page — connect, test, disconnect
• Feature flags settings page — toggle beta features
• Credential source badges across all model preference tabs (BYOK, Platform, No key)
• Action detail page shows parsed details_preview as clean key-value grid
• Sidebar reorganization — cleaner grouping, integration pages behind feature flags
• Inline editing on policy detail page

API

• POST /api/v1/feature-flags/{flag}/toggle — toggle feature flags (admin, self-hosted only)
• GET /api/v1/feature-flags — list all flags with status
• GET /api/v1/models — now returns credential_source per model
• PUT /api/v1/config/review-default-model — set default model for code reviews
• GET /api/v1/config/review-default-model — get current review model
• POST /api/v1/slack/connect — initiate Slack OAuth
• POST /api/v1/slack/test — send test notification
• DELETE /api/v1/slack/disconnect — remove Slack connection
• POST /api/v1/teams/configure — set Teams webhook URL
• POST /api/v1/teams/test — send test notification
• DELETE /api/v1/teams/disconnect — remove Teams connection
• GET /api/v1/notifications/channels — list available notification channels with connection status
• action.auto_merged webhook event type registered

Approval Flow

• Dashboard-only approval — approve/deny actions exclusively in the dashboard with full context. Email and Slack/Teams messages are notification-only with a dashboard link
• Approval token flow removed entirely — simpler, more secure
• details_preview stored on actions and piped through to email, Slack, and Teams notifications
• Modern email templates with shared branding wrapper
• Consistent approval expiry copy across all channels

SDKs

• Python (pip install aira-sdk==3.8.0): version bump, dependency upgrades, stale model reference fixes
• TypeScript (npm install aira-sdk@3.8.0): TypeScript 7.0.2 compatibility, version bump

Infrastructure

• All Python dependencies upgraded to latest
• All npm dependencies upgraded to latest (frontend, docs)
• TypeScript 7.0.2 across frontend and TypeScript SDK
• google-genai migration (new Google AI SDK)
• GitHub Actions upgraded to latest (checkout v7, setup-python v7)
• CI: tests run on PRs, build+deploy only on push to main
• GHCR auth added to deploy step for image pulls
• Backend: pytest (2,231 tests) gates deployment
• Frontend: tsc --noEmit + vitest (527 tests) gates deployment

Bug Fixes

• Expired API key timezone comparison fixed
• Slack OAuth callback uses HTML redirect to avoid cross-origin cookie loss
• Email formats JSON details as clean table rows, not raw JSON string
• Policy operator values use backend names (eq/neq) not display labels
• PR comments avoid #N clickable links (policy references use "policy 2" format)
• Full PR diff on synchronize when auto-merge is enabled (prevents bypass)

Docs

• 6 new API reference pages: analytics, DID, feature flags, mutual signing, verifiable credentials, file sanitization
• GitHub integration guide with full auto-merge documentation
• Slack integration guide (cloud + self-hosted setup)
• Teams integration guide (Workflows setup)
• Feature flags guide updated with all current flags
• Supported models page updated with all 25 new models
• 17 stale model references fixed across docs
• Code governance guide updated for built-in agent

v3.7.0 — June 10, 2026

Highlights

• Dark mode — toggle in sidebar footer, persists to localStorage, respects system preference
• Analytics dashboard — time-series charts for actions, approval rates, model agreement, policy denials, top agents (recharts)
• Onboarding wizard — 3-step getting-started flow for new orgs (register agent → authorize action → see receipt)
• Global search (Cmd+K) — command palette to search actions, agents, cases, policies, and navigate
• Richer notifications — drift alerts, webhook failures, settlement completions, compliance reports ready
• Bulk operations — multi-select with checkboxes on actions, agents, API keys tables
• TypeScript SDK fully typed — 19 new interfaces, zero Record<string, any> returns
• 5 blog posts — EU AI Act, cryptographic receipts, zero-downtime deploys, multi-model consensus, open-source models
• 4 documentation guides — troubleshooting, self-hosted developer setup, batch processing, version migration
• CI runs tests — all repos now run tests before build/deploy. No broken code ships.

Dashboard

• Dark mode with Sun/Moon toggle in sidebar — uses CSS custom properties, works on every page
• Analytics page at /dashboard/analytics — 5 charts with 7d/30d/90d period selector (admin-only)
• Onboarding banner on overview page for new orgs (0 actions), links to /dashboard/getting-started
• Command palette (Cmd+K / Ctrl+K) — fuzzy search across recent actions, agents, cases + nav shortcuts
• Notification bell now shows drift alerts, webhook delivery failures, sealed settlements, ready compliance reports
• Bulk operations: checkbox column + floating toolbar on actions (legal hold, export), agents (suspend), API keys (revoke)

API

• GET /api/v1/analytics/actions-over-time — daily/weekly action counts
• GET /api/v1/analytics/approval-rates — approved/denied/review breakdown
• GET /api/v1/analytics/model-agreement — consensus case agreement scores
• GET /api/v1/analytics/policy-denials — denial rates by action type
• GET /api/v1/analytics/top-agents — top agents by action volume
• POST /api/v1/actions/bulk-legal-hold — set/release legal hold on multiple actions
• POST /api/v1/actions/bulk-export — export receipts for multiple actions
• POST /api/v1/agents/bulk-suspend — suspend multiple agents
• POST /api/v1/api-keys/bulk-revoke — revoke multiple API keys
• Notifications endpoint now returns 4 additional types: drift_alert, webhook_failure, settlement_sealed, report_ready

SDKs

• TypeScript (npm install aira-sdk@3.7.0): 19 new response interfaces — Policy, SanitizeResult, WebhookInfo, UsageSummary, DriftAlert, and more. All client methods fully typed.
• Python (pip install aira-sdk@3.7.0): Version bump.

Infrastructure

• CI pipelines now run tests before build/deploy on all 6 repos
• Backend: pytest (2033 tests) gates deployment
• Frontend: tsc --noEmit + vitest (527 tests) gates deployment
• Docs/handbook: next build validates all MDX pages before deploy
• SDKs: Python 3.12→3.13, Node 20→22 in CI

Bug fixes

• Fixed missing settings import in action_notary_service.py — endpoint whitelist strict mode was crashing
• Fixed missing settings import in article6_explanation.py — PDF generation was crashing
• Fixed 70 frontend test failures (api-client URL prefix, stale CSS class assertions, stale model names)
• Fixed 24 backend test failures (admin 403→404 assertions, free-tier model restrictions, plan config values, metrics auth)

Docs

• 4 new guides: troubleshooting, self-hosted developer setup, batch processing, version migration
• 5 new blog posts on EU AI Act compliance, cryptographic receipts, zero-downtime deploys, multi-model consensus, open-source models

v3.6.0 — June 10, 2026

Highlights

• Claude Fable 5 — Anthropic's most capable model, available as built-in model for Pro plans and above. Also available via Bedrock and Vertex AI.
• Dynamic version reporting — /health endpoint now returns the actual running version (was hardcoded). Self-hosted customers can check their version programmatically.

Models

• Added claude-fable-5 — state-of-the-art on nearly all benchmarks, exceptional autonomous agents
• Available via Bedrock (bedrock:claude-fable-5) and Vertex AI (vertex:claude-fable-5)
• Pro plan and above (added to free-tier block list)
• Total built-in models: 36

API

• /health and / endpoints now return the version from pyproject.toml dynamically (was hardcoded as 1.1.0)
• Self-hosted customers can check their running version: curl https://your-domain/health | jq .version

SDKs

• Python (pip install aira-sdk==3.6.0): Version bump. PyPI
• TypeScript (npm install aira-sdk@3.6.0): Version bump. npm

Docs

• Supported models page updated with Claude Fable 5
• Performance benchmarks page published

v3.5.2 — June 7, 2026

Highlights

• Caddy replaced with Traefik v3.6 — Docker-native health-aware routing. True zero-downtime deploys without drain file hacks.
• Legal pages updated — comprehensive Terms of Service, DPA with BYOK clarity, sub-processor lists corrected.
• API key dialog fix — dialog no longer closes instantly after key creation.

Infrastructure

• Traefik v3.6 replaces Caddy on both cloud and self-hosted deployments
• Traefik watches Docker container health natively — routes only to healthy containers
• docker-rollout + Traefik = zero requests dropped during deploys (verified with health loop test)
• All Caddy references removed from codebase, docs, and handbook

Dashboard

• API key creation dialog stays open after key is generated — user can copy the key before it closes

Legal

• Terms of Service — added: force majeure, termination (for cause/convenience), confidentiality (mutual NDA), warranty disclaimer (AS IS), liability carve-outs for German BGB (gross negligence), mutual indemnification, dispute resolution, severability
• DPA — added: SCC 2021 version + supplementary measures, sub-processor objection rights with termination option, breach notification follow-up (7-day reports), data subject rights SLA, audit rights detail, data export before deletion, binding effect clause
• Sub-processors corrected — only Aira-managed keys (OpenAI, Anthropic, Google) are our sub-processors. BYOK providers (xAI, DeepSeek, Mistral, etc.) are the customer's responsibility.
• Security page — new page at docs.airaproof.com/docs/guides/security

Self-Hosted

• Installer now creates upgrade.sh, backup.sh, uninstall.sh on the server (were missing before)
• Upgrade verified end-to-end: ./upgrade.sh with zero downtime

Docs

• Handbook: monthly release cadence (last Friday of every month)
• Performance benchmarks on landing page (6 stats, animated)

v3.5.1 — June 5, 2026

Highlights

• One-command self-hosted installer — curl -sSL https://get.airaproof.com/install.sh | bash. Auto-generates secrets, configures HTTPS via Traefik, creates admin account.
• Notifications — mark-as-read on notification click, full notifications page, mark all as read. Badge shows unread count.
• Interactive API docs — Swagger UI and ReDoc enabled at /docs and /redoc on all deployments.
• 9 new API reference pages — settlements, drift, models, SSO, reputation, notifications, credentials, API keys, approvers.

API

• POST /notifications/mark-read — mark specific notifications as read (JWT auth)
• POST /notifications/mark-all-read — mark all pending as read (JWT auth)
• GET /notifications/pending — now returns id, notification_key, read, unread_count
• OpenAI SDK upgraded to v2.x (backward-compatible — no API changes)
• Swagger UI (/docs) and ReDoc (/redoc) now available in production

Dashboard

• Notifications page at /dashboard/notifications — table view with mark read
• Notification bell shows unread count, click marks as read and navigates
• Chat model selector: fixed empty dropdown during model loading
• Models preferences: "No key" indicator, enable/disable all, max 3 for consensus
• Cases creation: max 3 models enforced in UI
• Login/register pages: social login buttons hidden in self-hosted mode

SDKs

• Python (pip install aira-sdk==3.5.1): Fix sanitize_file() crash (was using non-existent self._session). Pin framework integration upper bounds. PyPI
• TypeScript (npm install aira-sdk@3.5.1): Upgrade vitest 4.x, TypeScript 5.9, Node engine >=22. npm

Infrastructure

• Zero-downtime deploys — all services use docker-rollout. New containers start and pass health checks before old ones are removed. No request is dropped.
• PostgreSQL 16 → 17
• Python 3.12 → 3.13
• Node.js 20 → 22
• OpenAI SDK 1.x → 2.x
• All framework integration deps pinned with upper bounds
• /metrics requires admin key (was open when key not set)
• Admin endpoints return 404 instead of 403 on auth failure

Self-Hosted

• One-command installer with auto-TLS, admin account creation, and version pinning
• Zero-downtime upgrades — ./upgrade.sh uses docker-rollout for API and frontend
• Single-domain architecture — Traefik routes /api/v1/* to backend, /api/auth/* to frontend, /* to frontend
• Frontend uses relative URLs — no build-time API URL baking needed
• upgrade.sh accepts version arg: ./upgrade.sh v3.5.1
• backup.sh with 14-backup rotation
• Social login buttons hidden by default (enable via env vars)
• Server specs: 8 GB RAM / 4 vCPU minimum, 16 GB / 8 vCPU recommended

Docs

• 35 API reference pages (was 26) — every endpoint documented
• Self-hosted guide rewritten for one-command installer
• API reference index: complete endpoint overview table
• Interactive docs links: Swagger, ReDoc, OpenAPI spec

v3.5.0 — June 4, 2026

SDKs

• 15 new methods each on Python Aira / AsyncAira and TypeScript Aira: sanitize, webhooks, usage, models, policy lifecycle
• Gateway config helpers: gateway_openai_kwargs() / gatewayOpenAIConfig()
• Python SDK on PyPI · TypeScript SDK on npm

v3.1.0 — April 14, 2026

DORA Compliance

• Full EU Digital Operational Resilience Act support (Articles 17–19, 24–27, 28–44)
• 12 new SDK methods: incidents, third-party register, resilience tests
• Signed major-incident PDF reports
• Dashboard: incident management, third-party register, test log
• DORA guide · API reference

Earlier Releases

The platform shipped its foundational features before formal versioning:

• EU AI Act — Article 12 logging, Article 9 risk categories, Article 6 right-to-explanation, Annex IV technical documentation
• Cryptographic receipts — Ed25519 signatures, RFC 3161 timestamps, Merkle settlements
• Multi-model consensus — parallel execution, structured output, disagreement scoring, human review
• Agent governance — DID identity, drift detection, reputation, verifiable credentials, agent estate
• Content scanning — PII/PHI detection, DICOM de-identification, tokenization
• Evidence & compliance — sealed evidence packages, compliance bundles, time-travel queries
• Gateway — transparent LLM proxy with policy enforcement
• Escrow — liability ledger for high-stakes operations

See the changelog for detailed entries.