From 26265b8fe1ec14d48e1ac5a1dad969ec9ad6d65c Mon Sep 17 00:00:00 2001
From: "mintlify[bot]" <109931778+mintlify[bot]@users.noreply.github.com>
Date: Mon, 17 Aug 2026 09:09:42 +0000
Subject: [PATCH 1/2] chore: add August 11-14 CLI and Platform changelog
 entries

---
 changelog/index.mdx | 46 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)

diff --git a/changelog/index.mdx b/changelog/index.mdx
index 77e3628..d6b8a44 100644
--- a/changelog/index.mdx
+++ b/changelog/index.mdx
@@ -4,6 +4,52 @@ description: "Release notes for Kosli products."
 rss: true
 ---
 
+<Update label="August 14, 2026" description="v2.36.6" tags={["CLI"]}>
+
+## Bug fixes
+
+- **Empty multi-value flag elements rejected** — `--attachments` or `--template` values that expand to an empty element (for example from an unset shell variable) now fail with a clear error naming the flag instead of being silently dropped.
+- **Empty boolean flag values rejected** — passing an empty value to a boolean flag (for example `--compliant ""` or `--new-compliance-status ""`) now fails with a clear error instead of recording the opposite compliance verdict.
+- **`KOSLI_*` env vars set to empty treated as unset** — `KOSLI_CONFIG_FILE=""` no longer suppresses config file loading, and `KOSLI_API_TOKEN=""` no longer skips decryption of a config-file token. Both fall back to the default.
+- **Bad config values surface errors** — config file or environment values that cannot be applied to a flag now produce an error naming the flag and its source, instead of silently failing.
+
+[View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.36.6)
+
+</Update>
+
+<Update label="August 14, 2026" description="" tags={["Platform"]}>
+
+## New features
+
+- **Custom attestation summaries** — [custom attestation types](/getting_started/attestations) can now define a `summary` list of JQ expressions that extract key values (for example `Critical`, `Tool`) from the payload. The attestation drawer renders these as labelled rows instead of only raw JSON, matching the built-in Sonar, Snyk, and JUnit types. Summaries are versioned with the type, so schema changes create a new version. Array payloads render one summary group per element.
+
+## Updates
+
+- **SCIM changes attributed to "External IdP"** — audit-log rows whose source is `scim` (create, set, or revoke membership) now show **External IdP** in the **Changed by** column instead of the org's first admin. The change is also reflected in the v2 audit-log API, which returns no setter for these rows.
+
+</Update>
+
+<Update label="August 13, 2026" description="" tags={["Platform"]}>
+
+## Updates
+
+- **Flows list rebuilt as a React page** — `/<org>/flows/` now runs as a React island. Search, space filter, sort (by name or latest activity), and paging update in place instead of triggering a full page reload. The `GET /api/v2/flows/{org}` endpoint gained `latest_activity_at` and `latest_state` fields and a `sort` (`name` | `latest_activity`) parameter with `sort_direction` to power the new UI.
+
+</Update>
+
+<Update label="August 11, 2026" description="" tags={["Platform"]}>
+
+## Updates
+
+- **SCIM webhook status handling** — a Descope SCIM payload whose status is neither `enabled` nor `disabled` (for example `invited`) is now rejected with an explicit error instead of silently doing nothing. Tenant membership is read from the loaded Descope user, so it always follows authoritative IdP state.
+
+## Bug fixes
+
+- **Faster webhook saves** — the SSRF guard on webhook URLs no longer performs a blocking DNS lookup while saving an action. A slow resolver can no longer stall the save (or time out the request).
+- **Notification emails and trail events hardened against injected HTML** — user-controlled names and descriptions in notification emails and trail event descriptions are now HTML-escaped when rendered, closing a defence-in-depth gap on top of existing input validation.
+
+</Update>
+
 <Update label="August 7, 2026" description="" tags={["Platform"]}>
 
 ## Bug fixes

From e6ff3a046d2ee300af38579fd062a4eb62dac474 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Dan=20Gr=C3=B8ndahl?= <dan@kosli.com>
Date: Tue, 18 Aug 2026 12:49:42 +0200
Subject: [PATCH 2/2] docs: address review comments on August changelog entries

---
 changelog/index.mdx | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/changelog/index.mdx b/changelog/index.mdx
index d6b8a44..28b3665 100644
--- a/changelog/index.mdx
+++ b/changelog/index.mdx
@@ -21,11 +21,7 @@ rss: true
 
 ## New features
 
-- **Custom attestation summaries** — [custom attestation types](/getting_started/attestations) can now define a `summary` list of JQ expressions that extract key values (for example `Critical`, `Tool`) from the payload. The attestation drawer renders these as labelled rows instead of only raw JSON, matching the built-in Sonar, Snyk, and JUnit types. Summaries are versioned with the type, so schema changes create a new version. Array payloads render one summary group per element.
-
-## Updates
-
-- **SCIM changes attributed to "External IdP"** — audit-log rows whose source is `scim` (create, set, or revoke membership) now show **External IdP** in the **Changed by** column instead of the org's first admin. The change is also reflected in the v2 audit-log API, which returns no setter for these rows.
+- **Custom attestation summaries** — [custom attestation types](/getting_started/attestations) can now define a `summary` list of JQ expressions that extract key values (for example `Critical`, `Tool`) from the payload. The attestation drawer renders these as labeled rows instead of only raw JSON, matching the built-in Sonar, Snyk, and JUnit types. Summaries are versioned with the type, so schema changes create a new version. Array payloads render one summary group per element.
 
 </Update>
 
@@ -39,14 +35,10 @@ rss: true
 
 <Update label="August 11, 2026" description="" tags={["Platform"]}>
 
-## Updates
-
-- **SCIM webhook status handling** — a Descope SCIM payload whose status is neither `enabled` nor `disabled` (for example `invited`) is now rejected with an explicit error instead of silently doing nothing. Tenant membership is read from the loaded Descope user, so it always follows authoritative IdP state.
-
 ## Bug fixes
 
 - **Faster webhook saves** — the SSRF guard on webhook URLs no longer performs a blocking DNS lookup while saving an action. A slow resolver can no longer stall the save (or time out the request).
-- **Notification emails and trail events hardened against injected HTML** — user-controlled names and descriptions in notification emails and trail event descriptions are now HTML-escaped when rendered, closing a defence-in-depth gap on top of existing input validation.
+- **Notification emails and trail events hardened against injected HTML** — user-controlled names and descriptions in notification emails and trail event descriptions are now HTML-escaped when rendered, closing a defense-in-depth gap on top of existing input validation.
 
 </Update>