v2.21.0
Date of release: 24/08/2026
Engine version: 16.11.0
Conform version: 1.1.1
Foresight version: 1.6.0
Genesis version: 0.2.0
New Features
NITF and NSIF file protection
Halo now protects NITF (National Imagery Transmission Format) and NSIF (NATO Secondary Imagery Format) files. Glasswall Genesis processes the imagery and the content embedded in it, and Halo returns the protected file with its analysis report.
- Submit these files to the existing synchronous and asynchronous CDR endpoints. No request changes are needed.
- Analysis reports are available in JSON only. A request for an XML report is rejected with a
400 Bad Requestand error code 4033, so setformat=JSONwhen you submit these files. - The analysis report for a NITF or NSIF file has its own structure. An integration that parses reports must check the file type first.
- NITF and NSIF members inside archives are protected as well. A member that cannot be protected is replaced by a
.txtplaceholder, its report ships alongside it, and the archive is returned with a206response. - A new optional
extendedFormatSettingspolicy section controls the protection. It sets a baseline that every format inherits, and per-format overrides fornitf,jpeg,jpeg2000,emf,wmf,h264,h265andsidd. In this release you manage these settings through the API only. - The Portal reports the risk of a NITF or NSIF file as unknown.
This capability requires a license that includes the Genesis entitlement. See the License notice below.
For more information, see Supported file types, Archive support and Define content management policies.
ReversingLabs file reputation configured at runtime
You now configure ReversingLabs file reputation from the Portal or the Halo API, instead of through a Helm value.
- A new File reputation tab on the Portal Protection settings page holds the endpoint, username, password and timeout.
- Test connection checks the endpoint and credentials before you save. Enabling ReversingLabs requires a passing test.
- The Halo API offers the same operations: read the settings, save them, and test a connection. The password is never returned.
- A change applies across the appliance and takes effect without a restart.
This is the supported path on the OVA and other self-hosted appliances, where the appliance owns its own secrets. On AKS, EKS, GKE and OKE, external-secrets owns the credential secret, so you set the credentials in your cloud secret manager and the remaining fields on the engine-reversinglabs ConfigMap.
For more information, see Enable ReversingLabs.
We appreciate your continued support and value your feedback. If you encounter any issues or have any questions, please don't hesitate to contact our support team.
Fixes and improvements
- Large uploads no longer run the synchronous and asynchronous APIs out of memory.
- Archive members that fail to unpack are now reported, and the asynchronous result matches the synchronous one.
- The Processed Files search in the Portal no longer shows results from an earlier search.
- Halo no longer builds an analysis report on retrieval when the caller declined one.
- Archive handling now uses Glasswall's security-hardened forks of SharpCompress and SharpZipLib.
- Foresight is updated to 1.6.0, which carries updated XLSX threat prediction models.
- Service container images are pinned to hardened Chainguard base image digests.
- The file share mount is hardened with the
noexec,nosuidandnodevoptions. - The RabbitMQ cluster operator is pinned to 2.17.0, and the third-party Helm chart versions are updated.
- The documented
return-executable-filedefault and the software deny-list file type values are corrected. - Security updates to third-party dependencies.
License notice
The Genesis entitlement gate is active from this release. A license issued before this release does not carry that entitlement, and every NITF or NSIF submission fails while it is missing. Contact Glasswall support for a reissued license before you process these formats.
ReversingLabs configuration notice
The configuration.ENABLE_REVERSING_LABS Helm value is ignored from this release. The Engine reads its ReversingLabs settings from the engine-reversinglabs ConfigMap and the halo-reversinglabs-username and halo-reversinglabs-password secret keys instead.
A deployment that enabled ReversingLabs through the old flag must set the settings again through the new flow. Until you do, ReversingLabs stays off. See Enable ReversingLabs.
Rabbitmq Upgrade Notice
Starting Halo v2.9.0, the Rabbitmq version is upgraded from 3.13 to 4.x. When upgrading from an older version of Halo to any version above 2.9.0 all stable rabbitmq feature flags should be enabled before performing the usual upgrade process using below command -
rabbitmqctl enable_feature_flag all
Deprecation notice
Please note cdrplatform-metrics-collation service is deprecated and removed from release 2.6.2. When upgrading to 2.6.2 and any version above, please uninstall the cdrplatform-metrics-collation helm chart using below command.
helm delete cdrplatform-metrics-collation -n cdrplatform
Service Versions (Image tags)
| Service | Container Repository | Version |
|---|---|---|
| cdrplatform-engine | glasswallhub.azurecr.io/cdrplatform-engine | 2.21.0-201948 |
| cdrplatform-sync-api | glasswallhub.azurecr.io/cdrplatform-sync-api | 2.21.0-201948 |
| cdrplatform-report-extractor | glasswallhub.azurecr.io/cdrplatform-report-extractor | 2.21.0-201948 |
| cdrplatform-portal | glasswallhub.azurecr.io/cdrplatform-portal | 2.21.0-201948 |
| cdrplatform-policy-api | glasswallhub.azurecr.io/cdrplatform-policy-api | 2.21.0-201948 |
| cdrplatform-api-access | glasswallhub.azurecr.io/cdrplatform-api-access | 2.21.0-201948 |
| cdrplatform-portal-access | glasswallhub.azurecr.io/cdrplatform-portal-access | 2.21.0-201948 |
| cdrplatform-license-management | glasswallhub.azurecr.io/cdrplatform-license-management | 2.21.0-201948 |
| cdrplatform-cleanup | glasswallhub.azurecr.io/cdrplatform-cleanup | 2.21.0-201948 |
| cdrplatform-async-api | glasswallhub.azurecr.io/cdrplatform-async-api | 2.21.0-201948 |
| cdrplatform-metrics-projection | glasswallhub.azurecr.io/cdrplatform-metrics-projection | 2.21.0-201948 |
| cdrplatform-tally-accumulator | glasswallhub.azurecr.io/cdrplatform-tally-accumulator | 2.21.0-201948 |
| icap-server | glasswallhub.azurecr.io/icap-server | 2.21.0-201948 |
| cdrplatform-rabbitmq | glasswallhub.azurecr.io/cdrplatform-rabbitmq | 2.21.0-201948 |
| cdrplatform-storage-monitor | glasswallhub.azurecr.io/cdrplatform-storage-monitor | 2.21.0-201948 |
Helm Chart Versions
| Chart | Chart Repository | Version |
|---|---|---|
| cdrplatform-rabbitmq | glasswallhub.azurecr.io/helm/cdrplatform-rabbitmq | 0.9.4 |
| cdrplatform-external-secrets | glasswallhub.azurecr.io/helm/cdrplatform-external-secrets | 0.6.0 |
| cdrplatform-storage | glasswallhub.azurecr.io/helm/cdrplatform-storage | 0.8.1 |
| cdrplatform-engine | glasswallhub.azurecr.io/helm/cdrplatform-engine | 0.6.3 |
| cdrplatform-sync-api | glasswallhub.azurecr.io/helm/cdrplatform-sync-api | 0.4.2 |
| prometheus-scaling | glasswallhub.azurecr.io/helm/prometheus-scaling | 0.3.1 |
| cdrplatform-portal | glasswallhub.azurecr.io/helm/cdrplatform-portal | 0.4.2 |
| cdrplatform-policy-api | glasswallhub.azurecr.io/helm/cdrplatform-policy-api | 0.3.2 |
| cdrplatform-api-access | glasswallhub.azurecr.io/helm/cdrplatform-api-access | 1.2.3 |
| cdrplatform-portal-access | glasswallhub.azurecr.io/helm/cdrplatform-portal-access | 0.2.2 |
| cdrplatform-license-management | glasswallhub.azurecr.io/helm/cdrplatform-license-management | 0.4.0 |
| cdrplatform-cleanup | glasswallhub.azurecr.io/helm/cdrplatform-cleanup | 0.3.4 |
| cdrplatform-async-api | glasswallhub.azurecr.io/helm/cdrplatform-async-api | 0.2.3 |
| cdrplatform-metrics-projection | glasswallhub.azurecr.io/helm/cdrplatform-metrics-projection | 0.2.2 |
| cdrplatform-report-extractor | glasswallhub.azurecr.io/helm/cdrplatform-report-extractor | 0.2.2 |
| cdrplatform-tally-accumulator | glasswallhub.azurecr.io/helm/cdrplatform-tally-accumulator | 0.2.4 |
| cdrplatform-mongodb | glasswallhub.azurecr.io/helm/cdrplatform-mongodb | 0.3.0 |
| icap-server | glasswallhub.azurecr.io/helm/icap-server | 1.5.4 |
| cdrplatform-storage-monitor | glasswallhub.azurecr.io/helm/cdrplatform-storage-monitor | 0.2.5 |
Documentation
Swagger Documentation Glasswall Documentation Clean a file Archive Support License Management