Astralis 3.1.X release notes

• 3.1.2: November 4, 2026
• 3.1.1: November 2, 2026
• 3.1.0: October 27, 2026

Astralis 3.1.2

Core

• Security: Updated third-party dependencies in the server image to address published security advisories:
  • Integrations and data stores: PyMongo 4.18.3 (CVE-2026-106435) for MongoDB connections; Snowflake Connector for Python 4.8.1 and filelock 4.2.6, which also fix the urllib3 copy bundled with the Snowflake connector; dnspython 2.9.1, which fixes excessive CPU use when parsing DNS responses; aiohttp 3.14.5 and yarl 1.25.1.
  • Document processing: pypdf 6.21.4, which fixes several PDF parsing and resource-exhaustion vulnerabilities.
  • Authentication and tokens: joserfc 1.7.7 and pyasn1 0.6.5.
  • Workflows, LLM and MCP: temporalio 1.35.0; litellm 1.100.4 (CVE-2026-114612) with boto3 and botocore 1.43.113; the MCP Python SDK 1.30.0, plus a 4 MiB limit on request bodies to the MCP gateway and its OAuth endpoints; msgpack 1.2.4, which fixes a memory leak during deserialization.

Notes

• Snowflake connections keep certificate revocation (OCSP) checks on. Snowflake Connector 4.8 disables them by default; Astralis turns them back on in fail-open mode, so behaviour is unchanged from 3.1.1.
• MongoDB connections still require MongoDB 4.4 or newer, as since 3.1.0.

Database schema & data changes

• This patch adds no database migrations.

Astralis 3.1.1

Core

• Structured Event Logging: Completes the event catalog started in 3.1.0. Astralis can now also log data exports (report downloads and access packages) and privacy request bulk imports, failed connection tests and unreachable integrations, OAuth client scope changes, MCP gateway sign-ins, token issuance and rejected bearer tokens, and confidential-data, data and error events. Organization-grant scope refusals and refused client secret rotations now log a direct authorization_denied event with the attempted scopes and target client.
  • Two new settings under [logging.log_event_defaults] (or the matching FIDES__LOGGING__LOG_EVENT_DEFAULTS__* environment variables): a timestamp format, as a strftime pattern or epoch_millis / epoch_seconds, and custom names for severity levels (for example WARNING to WARN).
  • Fixed the {event.record.request_id} template resolving to unknown on status-code fallback events and events from background tasks.
  • Event logging stays off by default. See the 3.0.6 notes for how to turn it on and shape the output.
• Security: Updated Pillow to 13.0.0 to address image processing vulnerabilities.

Database schema & data changes

• This patch adds no database migrations.

Astralis 3.1.0

Release notes for 3.1.0 are not written yet. See the 3.1.0 release on GitHub (opens in a new tab) for the full list of changes.