What’s New
MCP Server A new connector type that lets you query your eramba instance using natural language through your LLM of choice. Authorization respects eramba’s existing groups and visualisations - users can only query data they have permission to see.
Details here: Feature - LLM / Agentic
Awareness program The awareness portal has been migrated to the new UI. A new Policy Attestation content type lets users acknowledge selected eramba policies directly in the portal. Content can now be reordered via drag & drop, and questionnaires support a new question pool (a random subset of questions drawn per attempt). Programs run as Once or Cycles. Reminders are fully configurable - invitation, after-start, before-end, plus a non-completion reminder for users who haven’t finished.
Details here: Feature - Awareness portal
SCIM Provisioning Your identity provider can now create, update, deactivate and delete eramba users automatically.
Details here: Feature - SCIM Connector
ACL for Users settings and User Templates Settings → Users and User Templates have been migrated to the new UI as the foundation for the upcoming OA portal phase two. Full plan and follow-up phases here: Feature - Online Assessment Facelift
Details here: Feature - Access Management Updates
In-app notifications A lightweight internal messaging channel that lets us deliver release notes, new feature announcements and occasional tips directly inside eramba - no extra network setup required for on-prem installs, everything routes through support-v3. Only shown to admin users.
Details here: Feature - In app notifications
API v2 Reworked v2 API with Swagger documentation built into the eramba UI - try requests and inspect responses without leaving it. Nothing you send from there is saved. The v1 API stays available.
Details here: Feature - API v2
Tags Management A new “Manage tags” option is available in the form that supports tags. You can rename, edit, delete (single or bulk) and create tags directly from a bottom drawer. When deleting a tag in use, you get a prompt to remove it from all items first.
Details here: Feature - Tag management
Security Incidents & Projects - Section Migration The Security Incidents and Projects sections have been migrated to the new UI + new functionality Incident Management Playbook
Details here: Feature - Incident Management Playbook
Note on Field Order: As part of this migration, any custom field ordering you may have applied to the Security Incidents or Projects section will be reset to the default. Please review and reapply your preferred field order after updating.
Delete Action - Internal Migration No functional changes for users.
Macros Update - Internal Migration No functional changes for users.
Bugs
| Issue | Summary | Ref. |
|---|---|---|
| ERA-1801 | Bug - internal controls issues filter | https://eramba.zendesk.com/agent/tickets/36692 |
| ERA-1781 | Bug - Editing a IC will recalculate the audits | |
| ERA-1720 | Filters multiple conditions on same field FE part | |
| ERA-1705 | Adjust due date filters to have second condition to not include expired items | |
| ERA-1704 | Allow multiple conditions in filter on one field | |
| ERA-1702 | Quick add in any form on user field opens old cakephp form | |
| ERA-1698 | Feature - Make audits editable after close | |
| ERA-1687 | After login warnings | |
| ERA-1686 | Block Add action when license is expired does not work | |
| ERA-1682 | Internal Control item with periodical audit selected can’t be saved | |
| ERA-1669 | IC status issues | https://eramba.zendesk.com/agent/tickets/36356 |
| ERA-1667 | Bug - OA Portal Title doesn’t work | |
| ERA-1642 | Bug - Creating ad-hoc IC Audit does not save the roles | https://eramba.zendesk.com/agent/tickets/36355 |
| ERA-1636 | Compliance Package Notification recipient is missing | |
| ERA-1631 | OA clone does not work if what you are cloning has custom fields | |
| ERA-1628 | Bug - emails.log will show auth credentials if auth fails | |
| ERA-1621 | Bug - Error handling on database restore | |
| ERA-1586 | Bug - Doing an asset review marks new review and previous review as current | |
| ERA-1584 | Bug - Can’t create ad-hoc reviews on assets | |
| ERA-1581 | Email configuration message is shown when there is no authentication on SMTP | https://eramba.zendesk.com/agent/tickets/36186 |
| ERA-1580 | IC Issues csv import displays date as “-0001-11-30” when uploaded empty | https://eramba.zendesk.com/agent/tickets/36157 |
| ERA-1577 | Bug - User Settings are open twice | https://eramba.zendesk.com/agent/tickets/36102 |
| ERA-1569 | Can’t clone Report | https://eramba.zendesk.com/agent/tickets/36007 |
| ERA-1558 | OA import bug | |
| ERA-1549 | Bug - Add sorting by project name on project tasks | |
| ERA-1546 | Feature - MCP allowed to see dynamic status names | |
| ERA-1514 | Bug - Email sent to disabled users when using custom roles | |
| ERA-1450 | Bug - OA Number of questions does not take into account hidden questions | |
| ERA-1407 | Feature - Views changes | |
| ERA-1386 | Feature - Handle loading states on the buttons | |
| ERA-1376 | Bug - Can’t delete a connector, it’s always being used, even when authentication method is local | |
| ERA-1365 | Bug - Error handling of pdf generation when logo is unaccessible | https://eramba.zendesk.com/agent/tickets/35696 |
| ERA-1335 | Bug - Empty Liability magnifier causes internal errors | |
| ERA-1321 | Bug - Date empty filter crashes Internal Control Audits with quick search | |
| ERA-1314 | Feature - Delete emails on queue | https://eramba.zendesk.com/agent/tickets/35570 |
| ERA-1308 | Bug - Fields module relationship, need to be empty by default | |
| ERA-1307 | Classification labels bug in dynamic status config | |
| ERA-1301 | Bug - Can’t add attachment as Unauthenticated OA | https://eramba.zendesk.com/agent/tickets/35486 |
| ERA-1299 | Feature - Allow upload of .xlsm with password | https://eramba.zendesk.com/agent/tickets/35497 |
| ERA-1228 | Bug - Stages filter not working correctly | https://eramba.zendesk.com/agent/tickets/35104 |
| ERA-1231 | Bug - Note field a bit hidden on policy portal | https://discussions.eramba.org/t/feature-policy-portal-make-the-field-for-the-last-change-log-higher-or-allow-adjusting-its-size-manually/8441 |
| ERA-1189 | Bug - Wrong label on BU chart | https://eramba.zendesk.com/agent/tickets/34936 |
| ERA-1187 | ESC key should close only the active element in create / edit forms | |
| ERA-1182 | Feature - Issues when STRICT_TRANS_TABLES is enabled | https://eramba.zendesk.com/agent/tickets/34884 |
| ERA-1181 | Bug - Fields on Third Party API | |
| ERA-1134 | Bug - Timing out when uploading mapping / changing GRC contact on compliance | https://eramba.zendesk.com/agent/tickets/34577 |
| ERA-1114 | Inline edit testing | |
| ERA-1090 | Bug - API error adding a comment when notification is enabled | https://eramba.zendesk.com/agent/tickets/34533 |
| ERA-1086 | Feature - Allow more than 255 characters on the webhook url | https://eramba.zendesk.com/agent/tickets/34487 |
| ERA-1077 | Bug - Can’t delete incident stages in any way | |
| ERA-1051 | Feature - Improve first login loading time | https://eramba.zendesk.com/agent/tickets/34403 |
| ERA-990 | Feature - Add license expiration date on about page (saas) | https://eramba.zendesk.com/agent/tickets/34193 |
| ERA-958 | Bug - Can’t clone Compliance packages | https://eramba.zendesk.com/agent/tickets/34116 |
| ERA-933 | Bug - Accessing Risk appetite without setup calculation results in gray screen | |
| ERA-927 | Bug - Disabled dynamic statuses are still shown on reports | https://eramba.zendesk.com/agent/tickets/33672 |
| ERA-918 | Bug - Wrong label on notification custom role | |
| ERA-777 | Bug - OA Max Score is not achievable | |
| ERA-773 | Vulnerability/Bug - User can use api when disabled | |
| ERA-736 | Feature - Display time on user audit logs | |
| ERA-589 | Bug - Notification recipient doesn’t show custom roles - Goals | |
| ERA-529 | Activity logs only display foreign key |