A single patch after the busy 4.0.2/4.0.3 pair — but it carries a real behaviour change for dynamic frameworks, honest loading states on list views, and a container-hardening step that operators need to read before upgrading.
The first two patches after 4.0 are anything but quiet: quick forms turn ad-hoc requests into a real intake channel, every PDF export moves onto one engine, the audit table-mode is rebuilt, workflows gain AI steps, and a focused performance push targets the pages that were slowest to load.
CISO Assistant reaches 4.0. The headline is a large findings and third-party risk epic — binders, commitments, campaigns, external ratings — landing alongside JIT SSO provisioning, a reworked tasks and evidence module, and a pagination contract that API consumers will want to read before upgrading.
The workflow engine learns to write: an update action with a hard-coded integrity line, date-aware scheduling, and bulk edits that finally emit events. Plus the UNESCO AI Maturity Framework, a feature-flag cache, and a long run of fixes across exports, search, permissions and the framework builder.
A SCIM account-takeover chain closed, the IAM permission engine rewritten on querysets to lift a hard scaling ceiling, a new aggregated MCP architecture with HTTP transport, and a streamlined approval management interface. Plus manual score overrides, per-template email toggles, and the ISO 27701:2025 outline.
A big week: threat modeling with TTP catalogs and MITRE ATLAS, a full workflow engine with a visual builder, customizable asset classes rendered as a tree, and service accounts for machine-to-machine API access. Plus a breaking change on implementation groups, evidence previews for a dozen file types, and four new libraries.