As part of this release we had 3 commits which resulted in 3 issues being closed.

Bugs

• #6090 Removed Corax search engine settings are restored on existing databases at every start-up
• #6091 Index definition change rebuilds an unlocked Lucene index on Corax when the database default is Corax
• #6092 Locked index with a changed definition starts silently with the old definition or fails with an unclear RavenDB error

All three bugs concern the RavenDB search engine for error and audit instances. ServiceControl 6.20 and later recommend migrating indexes from Corax to Lucene. These bugs can undo a migration or hide that a migrated index no longer receives updates.

From 6.22.2, ServiceControl:

• no longer writes a search engine setting to existing databases
• uses Lucene for new indexes and indexes rebuilt if the index definition also changed
• reports at startup which search engine each index uses, which indexes RavenDB rebuilds, and which locked indexes block an update.

Monitoring instances do not use RavenDB and are not affected.

How to know if you are affected

• You are affected by #6094 if you use ServiceControl 6.20.0 to 6.22.1 and removed the Indexing.Static.SearchEngineType and Indexing.Auto.SearchEngineType settings from an error or audit database. This happens when you follow the Migrating the whole database procedure on a RavenDB server whose default is Lucene, because RavenDB Studio removes a setting that equals the server default.
• You are affected by #6095 if you use ServiceControl 6.21.1 to 6.22.1 with a database whose default search engine is Corax, and an index uses Lucene without a search engine setting on the index itself. This is the case after a whole database migration when #6094 restored the Corax setting on the database.
• You are affected by #6096 if you locked an index in RavenDB Studio. The migration procedure required the lock before 6.21.1.

Symptoms

• For #6094 and #6095, indexes that were migrated to Lucene use Corax again after a restart of ServiceControl. The change back happens when an index is reset, a new index is created, or an upgrade changes an index definition. Until then, Database Settings in RavenDB Studio show both search engine settings with value Corax again.
• For #6095, after an upgrade that changes an index definition, the List of Indexes in RavenDB Studio shows a ReplacementOf/<index> index that uses Corax. The instance log warns The following RavenDB index(es) use the Corax search engine at start-up, the Error Database Search Engine or Audit Database Search Engine custom check fails in ServicePulse, and ingestion is degraded while the index is rebuilt.
• For #6096, after an upgrade that changes the definition of a locked index, an index with lock mode Locked (ignore) keeps the old definition and the log does not mention it. An index with lock mode Locked (error) stops the instance from starting with a RavenDB exception that does not name the index.

When to upgrade

You should upgrade immediately if you are affected. Otherwise, you should upgrade during your next maintenance window.

Before starting the upgraded instance, unlock indexes in RavenDB Studio so that they can receive index-definition changes. In 6.22.2, a changed index definition locked with either Locked (ignore) or Locked (error) prevents the instance from starting. The startup error names the indexes that must be unlocked.

After the upgrade, an existing Corax index keeps Corax until its definition changes. To migrate it now, follow the migration procedure. A lock is no longer necessary.

Where to get it

You can download the new version of ServiceControl from our website or Docker Hub.

Please read our support policy for more details.

Version: ClamAV 1.5.4
Scan Date: Fri, 06 Nov 2026 09:04:40 GMT

----------- SCAN SUMMARY -----------
Known viruses: 3628253
Engine version: 1.5.4
Scanned directories: 1
Scanned files: 4
Infected files: 0
Data scanned: 33.96 MiB
Data read: 515.69 MiB (ratio 0.07:1)
Time: 44.697 sec (0 m 44 s)
Start Date: 2026:11:06 09:03:54
End Date:   2026:11:06 09:04:39

As part of this release we had 2 commits which resulted in 2 issues being closed.

Improvements

• #6051 .NET October 2026 out-of-band security updates (release-6.21)
• #6079 Update dependency Particular.ServicePulse.Core to 2.13.1

Where to get it

You can download this release from our website.

Version: ClamAV 1.5.4
Scan Date: Fri, 30 Oct 2026 23:04:15 GMT

----------- SCAN SUMMARY -----------
Known viruses: 3628245
Engine version: 1.5.4
Scanned directories: 1
Scanned files: 4
Infected files: 0
Data scanned: 33.90 MiB
Data read: 515.68 MiB (ratio 0.07:1)
Time: 29.622 sec (0 m 29 s)
Start Date: 2026:10:30 23:03:44
End Date:   2026:10:30 23:04:13

As part of this release we had 131 commits which resulted in 5 issues being closed.

Features

• #5905 Include endpoint-provided usage information in the usage report
• #5998 Licence metadata management
• #6040 Usage report endpoint data

Improvements

• #5989 Update dependency Particular.ServicePulse.Core to 2.13.0
• #5999 Remove PlannedToDecommission user indicator

Where to get it

You can download this release from our website.

Version: ClamAV 1.5.4
Scan Date: Wed, 28 Oct 2026 05:38:38 GMT

----------- SCAN SUMMARY -----------
Known viruses: 3628193
Engine version: 1.5.4
Scanned directories: 1
Scanned files: 4
Infected files: 0
Data scanned: 33.90 MiB
Data read: 515.68 MiB (ratio 0.07:1)
Time: 48.040 sec (0 m 48 s)
Start Date: 2026:10:28 05:37:41
End Date:   2026:10:28 05:38:29

As part of this release we had 3 commits which resulted in 6 issues being closed.

Dependency CVEs

• #6000 GitHub Security Advisory ID (GHSA-2fmv-rv2c-59x7) reported on branch release-6.21
• #6001 GitHub Security Advisory ID (GHSA-846f-f764-76mx) reported on branch release-6.21

Improvements

• #6017 .NET October 2026 Updates
• #6018 Windows installer packages unused Kafka client libraries that include a vulnerable libcurl
• #6019 Exclude unused Kafka libraries and update .NET to 10.0.13
• #6033 Update Particular.ServicePulse.Core to 2.12.1

Where to get it

You can download this release from our website.

Version: ClamAV 1.5.4
Scan Date: Fri, 23 Oct 2026 16:52:01 GMT

----------- SCAN SUMMARY -----------
Known viruses: 3628191
Engine version: 1.5.4
Scanned directories: 1
Scanned files: 4
Infected files: 0
Data scanned: 29.30 MiB
Data read: 496.98 MiB (ratio 0.06:1)
Time: 24.927 sec (0 m 24 s)
Start Date: 2026:10:23 16:51:35
End Date:   2026:10:23 16:52:00

As part of this release we had 2 commits which resulted in 2 issues being closed.

This release fixes two security vulnerabilities. See the security advisory for who is affected and what to do.

Bugs

• #5986 API accepts requests without a valid token when authentication is enabled and role-based authorization is disabled
• #5987 Email notification settings API returns the stored SMTP password

Where to get it

You can download this release from our website.

Version: ClamAV 1.5.4
Scan Date: Fri, 09 Oct 2026 16:15:17 GMT

----------- SCAN SUMMARY -----------
Known viruses: 3628144
Engine version: 1.5.4
Scanned directories: 1
Scanned files: 4
Infected files: 0
Data scanned: 29.27 MiB
Data read: 499.29 MiB (ratio 0.06:1)
Time: 45.521 sec (0 m 45 s)
Start Date: 2026:10:09 16:14:26
End Date:   2026:10:09 16:15:12

As part of this release we had 3 commits which resulted in 2 issues being closed.

Bugs

• #5950 Migrated Lucene indexes are reset to Corax at start-up when the index is not locked (fixes #5948)
• #5959 Retry processor runs a dynamic query that creates the auto index Auto/RetryBatches/ByStatus (fixes #5960)

Where to get it

You can download this release from our website.

Version: ClamAV 1.5.4
Scan Date: Wed, 07 Oct 2026 11:28:45 GMT

----------- SCAN SUMMARY -----------
Known viruses: 3628133
Engine version: 1.5.4
Scanned directories: 1
Scanned files: 4
Infected files: 0
Data scanned: 29.16 MiB
Data read: 499.27 MiB (ratio 0.06:1)
Time: 42.470 sec (0 m 42 s)
Start Date: 2026:10:07 11:27:57
End Date:   2026:10:07 11:28:40

As part of this release we had 35 commits which resulted in 1 issue being closed.

Improvement

• #5882 Update dependency Particular.ServicePulse.Core to 2.12.0

Where to get it

You can download this release from our website.

Version: ClamAV 1.5.3
Scan Date: Fri, 11 Sep 2026 14:20:24 GMT

----------- SCAN SUMMARY -----------
Known viruses: 3628060
Engine version: 1.5.3
Scanned directories: 1
Scanned files: 4
Infected files: 0
Data scanned: 29.10 MiB
Data read: 499.25 MiB (ratio 0.06:1)
Time: 42.331 sec (0 m 42 s)
Start Date: 2026:09:11 14:19:38
End Date:   2026:09:11 14:20:21

As part of this release we had 274 commits which resulted in 23 issues being closed.

Bug

• #5784 Properly await throughput recording in MonitoringService

Improvements

• #5662 Fix conditional GET across the API
• #5824 Switch to standard OpenTelemetry environment variables for OTLP configuration
• #5825 Remove references to TotalThroughput in usage report
• #5828 Report deployment and storage environment data in the usage report
• #5832 Disable RavenDB storage prefetching by default
• #5833 Use Lucene search engine for new RavenDB databases and flag indexes still on Corax
• #5836 Add OpenTelemetry metrics for retry and archive operations
• #5837 Simplify and clarify Platform Install experience on ServiceControl Management
• #5840 Enrich internal custom checks with flag showing them as such
• #5848 Terminate message queries that exceed a configurable time limit
• #5858 Show the "add instance" screen if no instances are installed when using ServiceControl Management
• #5859 Update dependency Particular.ServicePulse.Core to 2.11.0

Where to get it

You can download this release from our website.

Version: ClamAV 1.5.3
Scan Date: Fri, 11 Sep 2026 05:41:26 GMT

----------- SCAN SUMMARY -----------
Known viruses: 3628058
Engine version: 1.5.3
Scanned directories: 1
Scanned files: 4
Infected files: 0
Data scanned: 28.54 MiB
Data read: 499.45 MiB (ratio 0.06:1)
Time: 48.056 sec (0 m 48 s)
Start Date: 2026:09:11 05:40:33
End Date:   2026:09:11 05:41:21

As part of this release we had 3 commits which resulted in 2 issues being closed.

Bugs

• #5820 Include Microsoft.Data.SqlClient.Extensions.Azure for Entra support
• #5821 ASBS "Dead Letter Queue" custom check can never pass with Entra ID / managed identity authentication

Where to get it

You can download this release from our website.

Version: ClamAV 1.5.3
Scan Date: Tue, 25 Aug 2026 03:58:36 GMT

----------- SCAN SUMMARY -----------
Known viruses: 3628027
Engine version: 1.5.3
Scanned directories: 1
Scanned files: 4
Infected files: 0
Data scanned: 26.72 MiB
Data read: 497.11 MiB (ratio 0.05:1)
Time: 41.505 sec (0 m 41 s)
Start Date: 2026:08:25 03:57:50
End Date:   2026:08:25 03:58:32

As part of this release we had 3 commits which resulted in 1 issue being closed.

Improvement

• #5749 .NET August 2026 Updates

Where to get it

You can download this release from our website.

Version: ClamAV 1.5.3/28097/Wed Aug 19 06:24:38 2026
Scan Date: Wed, 19 Aug 2026 23:25:45 GMT

----------- SCAN SUMMARY -----------
Known viruses: 3628010
Engine version: 1.5.3
Scanned directories: 1
Scanned files: 4
Infected files: 0
Data scanned: 26.26 MiB
Data read: 492.53 MiB (ratio 0.05:1)
Time: 33.354 sec (0 m 33 s)
Start Date: 2026:08:19 23:25:10
End Date:   2026:08:19 23:25:44