Release #: 2026.10.3

Release Date: October 29th, 2026

What's New

This release adds a Search page for technologies, models and agents, vendor contacts and CSV import, refresh schedules on AI Card requests and scheduled scans for VCS integrations. It also adds a Standard User role, an AI System filter on the Bill of Materials list, C# model detection and access checks for Azure CloudSensor, and includes several bug fixes. Four changes may need action from you: the new Search export format, permissions for API client management, project keys in Bitbucket Cloud filters and the Quarterly default on new AI Card requests.

Search Replaces Technology Search

Search is now its own page at the bottom of the side menu, and it finds technologies, models and agents found in code, plus cloud AI models for users with Cloud Assets read access. It replaces the Technology Search tab on the Bill of Materials page and is shown to users with Bill of Materials read access. The export is now named Asset Search Export and has new columns, so update any spreadsheet or script that reads the old Packages Export by file name or column name. See Asset Search Overview for details.

Permissions for API Client Management

API clients are the credentials that let scripts connect to Cranium without a person signing in. A script now needs the API Client permissions to create, list, update or delete API clients and gets a 401 error without them, so grant those permissions to the role the script uses. Assigning a user role, a disabled role or the Admin role to an API client now returns a 400 error, so assign an API role instead. The API Manager screens are not affected. See Authentication & Generating Credentials for details.

Project Keys for Bitbucket Cloud Filters

Detect AI discovery failed for every Bitbucket Cloud integration and now works. A project filter on a Bitbucket Cloud integration must now use project keys rather than project names, and a filter that holds names now fails. Update the filter to use project keys and run discovery again. Bitbucket Data Center integrations are not affected. See Integrating Bitbucket with Cranium and Accessing a Private VCS for details.

Refresh Schedules on AI Card Requests

AI Card requests can now repeat on a schedule, so a vendor is asked for an updated AI Card every 30 days, every 90 days or on a custom cycle of 7 to 90 days. New requests in the Request AI Card form default to Quarterly, so choose None for a one-time request. Requests sent before this release and requests made through the API have no schedule, and you can add or change the schedule of a sent request from the outgoing requests list. Vendors see the schedule and due date on the request. AI Card publish reminders are opt-in, and organizations that have them turned on receive reminders for each cycle. Changing a schedule to None stops reminders for the current cycle at once. See Managing Outgoing AI Card Requests and Responding to an AI Card Request for details.

Vendor Contacts, CSV Import and a Redesigned Vendor Page

Vendors can now hold contacts, with one primary contact each, and the vendor page has a new layout that lists the AI Card requests sent to that vendor. You can import vendors from a CSV file of up to 1,000 rows with Import Vendors on My Vendors, and adding a vendor now warns you when similar vendors already exist. Request AI Card can now address a request to an existing vendor and contact. Editing contacts needs the Vendor Update permission and importing needs Vendor Import, which the tenant Admin and Standard User roles hold by default on tenants with the license that includes vendor management. If an import partly fails, the rows that were created stay in place, so check the results before you import again. The Public API can also find a vendor by the value of a unique custom field. See My Vendors Overview and Endpoint Reference: Vendors for details.

Scheduled Scans for VCS Integrations

You can now schedule a VCS integration to be scanned every week or every month from the Scan Schedule section of the integration flyout. Each run discovers repositories, runs Detect AI, creates a Bill of Materials for each AI repository that doesn't have one and rescans existing BOMs whose repository has changed. BOMs created this way are not linked to an AI System, so link them yourself if you track BOMs by AI System, and expect many new BOMs from the first run on a large integration. Scheduling needs the new VCS Scan Schedules Update permission, which every role with VCS Integrations Update receives, along with the Detect AI scan and Bill of Materials Create permissions. For every BOM, a scan that is still pending can no longer be queued again, and a BOM whose last scan was aborted or timed out can now be rescanned even when its repository hasn't changed. See Integrations Overview and Detect AI Overview for details.

Standard User Role

Every tenant now has a built-in Standard User role with access to every product feature but not to tenant settings such as users, roles, API access, SCIM, MFA and SSO. Users with this role can still view the user list, and no existing user is moved to it. Disabled roles are no longer offered when you assign a role to a user. For SCIM provisioning, a role that can manage users, roles, API access or SCIM can no longer be chosen as the default role, and existing SCIM setups keep working until the default role is changed or SCIM is turned on again. See User Manager Overview for details.

Filter Bills of Materials by AI System

The Bill of Materials Filters dialog has a new AI System section, and you can select up to 10 AI Systems to see the BOMs attached to any of them. The section is shown to users who can read BOMs and also have User Read. No action is required. See Bill of Materials Overview for details.

C# Model Detection in CodeSensor

CodeSensor now detects foundation models used from C# code through SDKs such as Azure.AI.OpenAI, the OpenAI .NET SDK, Semantic Kernel and AWSSDK.BedrockRuntime. No action is required.

Access Checks for Azure CloudSensor

For tenants licensed for CloudSensor, Test Integration is replaced by Verify Access, which reads from Azure and reports what Cranium can read. Each discovery run now keeps Health Status up to date. When an Azure grant is narrowed, the integration shows a permission-change alert instead of marking the assets in those scopes as decommissioned, and you can accept the current access to clear it. No action is required.

Bug Fixes

• Fixed an issue where a BOM created from Detect AI results wasn't linked to its AI System when its scan couldn't start. The BOM is now linked and you see a message to rescan it. BOMs affected before this release need to be linked and rescanned by hand.
• Fixed an issue where scan results were lost during a brief service interruption. Processing now retries, and scans that failed this way before this release need to be run again.
• Fixed an issue where the Public API Bill of Materials infrastructure feed returned a 500 error when an item had two attributes with the same name.
• Fixed an issue where actions on the Bill of Materials and Vulnerabilities pages failed with a permissions error. Actions now follow role permissions, so custom roles with Vulnerability Assessment Update can resolve, ignore and restore vulnerabilities.
• Fixed an issue where AI Card reminder and outdated AI Card email subjects showed ' instead of an apostrophe. Emails already sent are unchanged.
• Fixed an issue where typing characters such as ( or [ in the Status, Destination or Owner filter search crashed AI System Manager.
• Fixed an issue where the Bill of Materials editor rejected the same technology at two different versions. A scan now takes over a technology that was added by hand instead of adding a second copy.