Changelog

What changed in Updawg that you can see or use: the portal, the agent, the server and what it does with your fleet. Newest first, dated by when it went live. A change to the API itself is also in the API changelog, in more detail. What is planned is on the roadmap.

2026-10-18

• The Slack app answers slash commands: /updawg status, /updawg host, /updawg cve and /updawg pending.
• The app’s Home tab in Slack shows what is waiting for you, with links to it in the portal.
• A portal link pasted into Slack unfurls into a summary of the proposal, host or advisory it points at.
• A Slack thread under a proposal’s message and the proposal’s comments in the portal are one conversation: a reply in either shows up in the other.
• Removing the app from a workspace, or revoking its token, disconnects it cleanly.
• The portal says when the app could not join a channel it posts to, and which channels it will join by itself.

2026-10-17

• The Slack app. Add it to a workspace from Settings → Notifications, link your Slack account to your Updawg account, and approve, reject or snooze proposals from the message. Each proposal keeps one message, updated as it moves. Approving from Slack is off until an admin switches it on.
• A channel picker lists the workspace’s channels. The Slack app is on the Team plan and up; incoming webhooks to Slack still work on every plan. See the Slack app guide.

2026-10-16

• Compliance exports are made in the background: ask for a hosts CSV, a resolutions CSV or the PDF report, and download it when it is ready, for seven days.
• Email to an address that bounces or marks it as spam is stopped.
• The portal holds up under long hostnames, empty values and large numbers.

2026-10-11

• Live policy preview. The policy editor shows what saving would do as you type, using the same policy engine the server runs.
• Policies managed by the Terraform or OpenTofu provider are marked as such in the portal.
• The proposals inbox can be grouped by policy or by host group.
• An organization holding its own signing key can rotate it with updawgctl endorse, and limit what unattended signing will sign with updawgctl sign --policy.
• The portal shows which signing keys each host has pinned. Rotating a key retires the old one first, and asks hosts to renew when the organization’s keys have moved.
• Advisories are matched per architecture, and Oracle Linux’s module streams are read, so multi-arch and modular hosts get the right fixes.
• Agent: renews its certificate on a regular cadence and when the gateway asks. On the stable channel as 0.2.0-20261011151812.

2026-10-10

• Jobs that wait for your organization’s own signature notify you, through any notification rule on jobs.awaiting_signature, and remind you before they expire.
• Owners of a Free organization get an email when it goes over the five-host allowance, and one reminder to add a first host if there is none yet.
• US organizations can be on paid plans, with billing, single sign-on and SCIM managed from the same account.
• The organization switcher shows every organization you belong to, in every region, and finds one by name.

2026-10-09

• A US region. Create an organization in the US (Iowa) or the EU (Frankfurt). One account signs in to both, and the portal talks to each organization’s own region. See data residency.
• updawgctl enroll can point a host at another region’s gateway.
• Settings shows where an organization’s data lives.

2026-10-08

• Customer-held signing keys (Enterprise): your organization can hold the key that signs its jobs, so Updawg cannot sign a change for your hosts on its own. See customer-held signing keys.
• You can own more than one organization once all but one of them are paid, and create another from the switcher.
• A Free organization a week over its allowance pauses changes, with a warning in the portal before it does.

2026-10-07 — public beta

Updawg opened for sign-up at app.updawg.net. What was there on the first day:

• The agent for Debian, Ubuntu, RHEL, Rocky Linux, AlmaLinux, Oracle Linux and Amazon Linux 2023, on x86_64 and aarch64, as signed .deb and .rpm packages or a one-line install. It updates itself through the same signed proposals as everything else, on the stable channel unless you choose beta.
• Advisories from each vendor’s own feed: Ubuntu, Debian, Red Hat (including RHEL 10), AlmaLinux, Rocky Linux and Oracle Linux, rated by the vendor or from CVSS, with CISA’s Known Exploited Vulnerabilities marked. The portal shows what the fleet is exposed to and where, including what nothing fixes yet.
• Policies, proposals and approvals: policies in YAML with a schema and history, proposals with each change’s changelog, minimum approvers, snooze, comments with mentions, maintenance windows and auto-merge.
• Rollouts: staged by label, percentage or count, with soak times, health checks that halt a rollout, resume and cancel, and job logs that follow the job as it runs.
• Safety nets: a preflight on every host before approval, snapshots before installs on snapper, ZFS and LVM thin, and rollback from them.
• Release upgrades for Debian, Ubuntu and the RHEL family, planned and preflighted against the target release, including third-party repositories.
• Notifications to email, Slack and Teams webhooks, ntfy, PagerDuty and signed webhooks, with daily and weekly digests and end-of-life alerts.
• For teams: invitations and roles, sign in with GitHub, Google or Apple, single sign-on with OpenID Connect and SCIM provisioning (Enterprise), the audit log with export, compliance reports, API tokens, and the Terraform and OpenTofu provider.
• Billing through Stripe: Free for up to five hosts, Team, Business and Enterprise billed per active host per day.
• Your data: download a copy of it, or delete your account or your organization.