Skip to content

What's New in Nullafi Shield v3.10.0

v3.10.0Released: August 14, 2026  ·  Container image: public.ecr.aws/nullafi/shield:v3.10.0

Overview

  • 3

    New Features

  • 3

    Improvements

  • 1

    Bug Fix

  • 1

    Security Fixes

Version 3.10.0 headlines with per-service health and performance metrics on the Services page, plus a durable login history for admin accounts and a more flexible proxy authentication option — alongside usability improvements, a reliability fix, and dependency security updates.

New Features

Theme: Operational Visibility & Administration

  • Per-Service Health & Performance Metrics

    Every service on the Services page now has its own detail view showing real-time health and performance — connection load, response mix, and latency to dependencies — along with 1-hour, 6-hour, and 24-hour trend charts, so administrators can spot a service approaching its limits before it causes an outage.

    Deployment

  • Administrator Session History

    Shield now keeps a durable record of every administrator login, including when each session started and whether it is currently active or expired. Administrators can review who accessed the system and when, rather than seeing only who is logged in right now.

    Policy

  • Custom Group Header for Proxy Authentication

    Proxy authentication can now pass group membership through a custom header, the same way usernames are already supported, giving integrators more flexibility when wiring Shield into an existing proxy authentication setup.

    Deployment

Example · Per-Service Health & Performance Metrics in practice

Before The Services page showed whether a node was up or down, but not how close it was to its limits or any historical data. The page was useful for instantaneus status but not for additional context or history.

After Each service's detail page shows live load against capacity, plus trend charts going back 24 hours, so administrators can spot a node approaching saturation and act before it affects traffic.

Policy

Compliance requirements, data governance changes, and policy updates that take effect with this release.

Policy & Compliance

Administrator Session History — Retention Administrator login records are retained for 365 days by default and cannot be cleared from the dashboard, preserving a reliable audit trail of administrator access. The retention period can be adjusted via configuration.

Policy documentation

Deployment

Infrastructure requirements, environment changes, and steps needed to deploy this release safely.

Deployment & Infrastructure

ICAP Node Max Connections Default Changed The default value of the ICAP node's Max Connections environment variable has changed to 0 (unlimited). Deployments that rely on the previous default to cap concurrent ICAP connections should set this variable explicitly after upgrading.

Custom Group Header for Proxy Authentication A new header option lets proxy authentication carry group membership, mirroring how usernames are already handled today. Adopting it is opt-in — add the header to your proxy configuration when you're ready to take advantage of it.

Deployment guide

Improvements & Bug Fixes

Full list of resolved issues and quality improvements in this release.

Type Description ID
Improvement The ICAP node's Max Connections default changed from 25 to unlimited (0), so ordinary traffic spikes are no longer throttled by an artificially low connection cap. NS-704
Improvement Tables on Policy management pages — such as lists of applications and data types — can now be sorted by column and filtered, making longer lists much easier to manage. NS-605
Improvement Dropdown lists throughout the dashboard now support type-ahead search that matches anywhere in an item's name, with results sorted alphabetically, instead of only jumping to items that start with the typed letter. NS-670
Fix Resolved a timeout that could occur when Shield makes its initial connection to an LDAP directory, improving reliability of directory-backed group lookups. NS-698
Security Applied security updates to third-party dependencies used by the ICAP engine, addressing several known vulnerabilities. NS-684

Upgrade Instructions

Follow these steps before upgrading in production. Estimated time: 10 minutes.

  1. Back up your database and configuration files Take a full snapshot of your database and export your current configuration — including your .env and any custom policy files. Store backups off-instance before proceeding.

  2. Review the ICAP node's Max Connections setting If your deployment depends on the previous default of 25 concurrent connections, set NULLAFI_ICAP_MAX_CONNECTIONS (or your deployment's equivalent variable) explicitly before or immediately after upgrading, since the new default is unlimited (0).

  3. Pull and deploy the updated container image

    docker pull public.ecr.aws/nullafi/shield:v3.10.0

    Configure your container runtime scripts or commands to use the new image. (If using Nullafi's sample Docker Compose files, modify the .env file so that SHIELD_IMAGE points to the new image.) Restart the Shield service after pulling the updated image.

nullafi.com  ·  docs.nullafi.com  ·  support@nullafi.com  ·  Previous releases