Vulcan v2.4.2

Released August 29, 2026

A patch release: SRG components reach export/import parity with STIGs, the project page gains a component lock indicator, and the session-timeout regression that logged out active users is resolved.

Added

• SRG component export/import parity. SRG components now support the full working-copy round-trip — export to CSV or Excel, edit the spreadsheet, and re-import it — exactly like STIG components. Previously SRG components were excluded from the tabular working-copy export, and the spreadsheet re-upload refused them entirely.
• Component lock indicator on the project page. Each component card now shows whether its requirements are locked: a solid lock when every requirement is locked, and an "N of M locked" indicator when only some are. The project API response (GET /projects/:id) gains a lock_summary object ({ locked, total, all_locked }) on each component.

Fixed

• Session timeout no longer logs out active users prematurely. The default inactivity timeout was restored to 1 hour after a prior change had dropped it to 10 minutes. Vulcan's session timer resets on server requests, and 10 minutes was short enough that ordinary work — reading or reviewing a page without navigating or saving — could exceed it and log you out mid-task. A true reset-on-user-activity timeout (which would allow a safely shorter window) is a tracked follow-up.
• VULCAN_SESSION_TIMEOUT / VULCAN_REMEMBER_ME_DURATION suffix parsing. Values with a unit suffix were cast to an integer before the duration parser saw them, so 5m resolved to 5 hours and 30s to 30 minutes. Suffixes now parse correctly — 5m is 5 minutes.
• Development / CI: fixed a docker-compose boot race, added migration retry for the based_on NOT NULL constraint, and stabilized the SRG export specs.

Changed

• Release image build: the Docker build-job timeout was raised from 20 to 45 minutes so the multi-arch image (jemalloc + YJIT compiled from source) finishes on a cold cache without a manual re-run.
• Dependency bumps (dev): @redocly/cli 2.46.0 → 2.47.0, @eslint/js 9.39.5 → 10.0.1.

Upgrade notes

No breaking changes. One behavior change to be aware of: if you deploy with a suffix-form VULCAN_SESSION_TIMEOUT (for example 5m or 30s), the effective timeout changes with this release because the suffix is now honored. Plain-seconds values (e.g. 900) and 1h / 15m-style values are unaffected. Review your value if you set one with a unit.