What's New in CISO Assistant — Week 38, 2026 (v4.0.4)

One release this week: v4.0.4 on September 15. After the two dense patches that opened the 4.x line it reads like a cleanup pass, and mostly it is — but three items are worth more than their line in the changelog: assignments now track dynamic framework scope, list views stop pretending to be empty while they load, and the backend container images move to a hardened base with a health check change you should apply before upgrading.

Assignments Follow the Requirements They Unlock

On a dynamic framework, the answers decide which requirements the audit actually covers. Assignments, however, froze that scope at creation — so a respondent never saw the requirements their own answers had unlocked, and someone had to dispatch them by hand after the fact (PR #4825).

An assignment now follows its implementation groups. What a newly selected group reveals joins the assignment holding the question that revealed it; what a deselected group hides leaves the assignment. A requirement that disappears and comes back may land in a different assignment than before, since routing follows the triggering question rather than the original dispatch. Requirements that were already visible under the default groups stay unassigned unless someone dispatches them explicitly — the change only moves what the answers move. submitted and closed assignments are frozen either way. The assignment documentation was updated to describe the expansion, routing and removal rules. Thanks to @Mohamed-Hacene.

List Views Stop Looking Empty

Two loading states were missing, and both made a working app look like an app with no data (PR #4743).

Pulling a CVE catalog gave no feedback at all. The KEV/EUVD pull runs synchronously inside the backend request — an external fetch plus a bulk upsert — so it can take a while, but nothing on screen changed and the buttons stayed enabled. Clicking again started a second concurrent import, each one popping its own success toast. Both buttons are now disabled for the duration of a pull, with a spinner on the running one, a guard in the handler, and an activity bar above the table.

A slow first table load was indistinguishable from an empty table. On a mediocre connection you could land on a list view, read an empty table and conclude there was nothing there while the rows were still in flight. ModelTable now renders placeholder rows whenever it has nothing to show and data is on the way — during a pull, on its own first fetch, or through a new opt-in loading prop. They are real <tr>/<td> elements, so they line up with the columns the incoming rows will fill. The prop defaults to false, so the fifty-odd other views that render ModelTable are untouched. Both behaviours ship with regression tests. Thanks to @Claquetteuuuh.

Hardened Container Images — Read Before Upgrading

The backend images move to Docker Hardened Images, with uv and other runtime dependencies patched alongside (PR #4813). The Enterprise services gain read-only filesystems, reduced privileges and non-root execution; image mirroring now runs daily instead of weekly; builds and startup tests use the Python 3.14 development image. Container vulnerability assessment notes were added to the documentation, including guidance on documented false positives and when a finding needs review.

The part to act on: the container health check switches from a curl-based probe to a Python one, and support for the curl check will be dropped. Update the health check in your Docker Compose file before that happens. The release flags this as a breaking change.

In the same vein, Docker Scout now scans containers and dependencies for fixable HIGH and CRITICAL vulnerabilities (PR #4820). Fixable CRITICAL findings block the build; HIGH findings are reported but do not. Results are summarised automatically, with an issue opened on critical findings and closed once a scan comes back clean. Both thanks to @ab-smith.

Bug Fixes

• Respondents could not reach their own requests — Users with the Respondent role had no My Requests tab, because the auditee permission set that shipped with quick forms was missing view_quickformresponse. They could submit a response and then lose sight of it. The permission is now granted (PR #4827). Thanks to @Axxiar.
• Service account and webhook settings read a feature flag without awaiting it — A missing await left the Service Accounts section and the Webhook settings deciding visibility on an unresolved promise, so availability was evaluated unreliably; unavailable webhook functionality now redirects to the settings page as intended. This completes the asynchronous feature-flag loading introduced in week 37’s #4807 (PR #4823). Thanks to @tchoumi313.
• A template comment leaked into the audit ZIP export — A comment in the HTML template spanned several lines and was not treated as multiline, so it rendered into the exported page. The HTML in a .zip export is clean again (PR #4814). Thanks to @Axxiar.
• Releases no longer fire on manual dispatch — The release workflow now runs on protected tags only, closing a path where a dispatch could publish outside the tagging process (PR #4824). Thanks to @ab-smith.

Internationalization

French and Arabic messages were brought back in line with the current English set, and the dead weight went out with them (PR #4815). Obsolete keys for legacy export options, quantitative-risk actions, service-account validation, privacy settings and framework-builder workflows were removed across every language, while the builder’s validation, preview, draft-saving and unsaved-changes messages stayed. French gained coverage for document management, assessment imports and the workflow builder, and a broken pluralization placeholder was corrected. Some vocabulary was also aligned with NCA and NIST terminology. Thanks to @ab-smith.

For full details, check out the v4.0.4 release notes on GitHub.