Updates and Security Advisories
DocAI Fabric ships continuously. Three public channels tell you what changed, and one page tells you how far you can rely on each feature.
| Channel | What it carries | How often | Follow it |
|---|---|---|---|
| What's new | Features that became generally available and notable new previews, explained for the people who use them | Every two weeks, skipped when there is nothing new | Email (subscribe on the page), RSS or JSON feed |
| Release notes | Every release: everything in it you can notice (new, improved, fixed), security updates, API changes, and what a self-hosted update needs | With each release; the email is a weekly digest, sent on Mondays when there were releases | Email (subscribe on the page), RSS or JSON feed |
| Security advisories | Fixed Critical and High vulnerabilities: who was affected, which release fixes it, what to do | When a fix is released | Email (subscribe on the page), RSS or JSON feed |
| Feature stages | Whether a feature is in Preview, generally available, deprecated or retired, and what each stage promises | As features change stage | A Preview or deprecated feature says so at the top of its guide page |
Who should follow what
| Role | Follow | Why |
|---|---|---|
| Security contact (CISO, security team) | Security advisories | Each advisory says whether your deployment was affected and what, if anything, you need to do |
| Operator of a self-hosted deployment | Security advisories, and release notes | You install fixes and updates yourself: an advisory names the image version that fixes it, and a release's notes say what changes and what the update needs from you. We send no separate notice of a vulnerability; the advisory is the notice |
| Organization administrator, integrator, developer using the API | Release notes, What's new, and Feature stages | Every change you or your integration may notice, API changes included, and which features are still in Preview before you build on them |
| Everyone who uses DocAI Fabric | What's new | The new features worth knowing about, every two weeks |
On the cloud service we install every fix ourselves: an advisory tells you what happened and when it was fixed, and usually asks nothing of you.
Subscribing by email
What's new, the release notes digest and the security advisories are separate emails: subscribe to any of them.
- From the application: on the Support page, under Updates by email, tick what you want and click Subscribe. Or ask the assistant, for example "subscribe me to security advisories". Either uses the address you sign in with.
- From the website: enter your address on What's new, Release notes or Security advisories and tick what you want.
A new subscription is confirmed from the email we send: nothing is sent until you click it, so nobody can start a subscription for an address they do not control. Adding another email to an existing subscription from the website asks for the same confirmation; from the application it does not, since you are signed in with that address.
Every email has an unsubscribe link for that email only, and a Choose what you receive link to change them all or stop everything. The release notes digest covers the releases from 29 October 2026; earlier releases are on the website only.
A shared mailbox, such as your security team's, subscribes from the website: whoever reads it confirms it. On a self-hosted deployment, the Support page and the assistant send you to the website to subscribe.
Following security advisories
Subscribe to them by email (above), or follow the RSS feed, which most email clients, chat tools and feed readers can follow, or the JSON feed for your own tooling: point your team's channel or your vulnerability management tool at one of them. The advisories published before the email existed (October 2026) were not emailed.
Each advisory lists, per product (the cloud service, the self-hosted image), the affected versions, the fixed version and the action needed. On a self-hosted deployment, compare the fixed version with the one you run:
curl http://localhost:8080/api/version
Then update as described in Getting updates (a high-availability deployment updates each node the same way).
How we handle a vulnerability you report: Responsible Disclosure.