Certificates Rotate Without a Restart
Renewing a certificate no longer means restarting a node. Send the process a SIGHUP and the engine re-reads the certificate and key from disk, then presents the new credentials on the very next handshake.
That makes renewal a two-step job any scheduler can run: write the renewed files, signal the node. The node keeps serving throughout.
Installers That Set the Table
The DEB, RPM and MSI installers now provision the key and log directories themselves, with strict permissions from the first start. If you have set your own ownership, the installers respect it, and it survives binary upgrades on every operating system.
Every Artifact Verifiable
Each release artifact can be checked cryptographically. All eight artifacts of a release, the binaries, the packages and the SBOMs, are cosign-signed, and the SBOMs ship alongside in both SPDX and CycloneDX form, matching the build exactly. The dependency tree is also current, with every pending patch applied.
The verification steps on the downloads page take a freshly downloaded file from checksum to signature in a few commands.
Search Results That Fit an Agent
Threat-intelligence records can be enormous, and a single hit with thousands of array entries is enough to fill an agent's context window. Arrays in search results now have strict boundaries, so an agent receives a readable hit and keeps its context for the question.
IP-typed fields understand CIDR natively. A query for 10.0.0.0/8 or 2001:db8::/32 matches exactly the addresses in that block, and sorting on an IP field runs in address order, so a result list reads the way a network engineer expects.
Upgrading
API key digests are now computed directly on the key body. Run the included key-rehash.sh once and it migrates your existing configuration files in place.
Get It
CameoDB 0.3.8 is the current release: one binary, nothing else to install, signed and checksummed for macOS, Linux and Windows. The v0.3.7 post covers the paging, recovery and Windows service work it builds on.