Skip to content

Scanner changelog#

All notable changes to the Scanner add-on (ML phishing detection, semantic search, PII detection, categorization), starting from 1.2.0. The Scanner is versioned and released independently of the main application, see the Piler Enterprise changelog.

1.3.4 - 2026-11-11#

Upgrade step: the scanner needs Manticore 25.0.0 or newer, like piler 2.3.2, see Manticore 25.0.0 or newer.

Security#

  • The participants of an email were escaped by hand in the query that saves its semantic search data: a crafted address could change the query. The values are passed separately from the query now.

Changed#

  • The scanner logs an error at startup when Manticore is older than 25.0.0.

1.3.3 - 2026-11-07#

Security#

  • Some deeply nested emails made the scanner use excessive memory and CPU. Multipart containers nested deeper than 32 levels are skipped now.

1.3.2 - 2026-11-04#

Fixed#

  • An email whose sender or recipient address has a quote (e.g. o'brien@example.com, a valid address) was not categorized by the custom categories: the percolate query failed. A backslash in the subject could also make the query fail, or change the text it matched (\t became a tab).
  • With S3 storage, an email whose attachments were not uploaded yet by s3uploader was scanned without them, or failed. The scanner now treats it like an email that is not uploaded yet, and scans it again later.

Changed#

  • The scanner and piler-ui use the same code to read and write the Smart Insights settings and results, instead of two copies of it.

1.3.1 - 2026-10-23#

Fixed#

  • The scanner ignored PILER_STORE_DIR and PILER_ASTORE_DIR when it read the emails from the store directly: it always used /var/piler/store/<server id>, and looked for the attachments in the wrong directory. It uses the configured directories now.
  • PILER_STORE_DIR without a trailing slash (e.g. /srv/piler/store) gave a wrong store path, and no email could be read.
  • SEMANTIC_SEARCH_MAX_TOKENS limited the email body in bytes, not characters, so a Hebrew or Cyrillic email got about half the text of an English one, and the cut could split a character. Emails embedded earlier keep their embeddings until they are embedded again, e.g. by running the scanner with -backfill.

Changed#

  • The scanner logs a warning when it reads the emails through retrieverd (RETRIEVER_METHOD=socket), which is not recommended and will be phased out.

1.3.0 - 2026-09-27#

Changed#

  • The ML phishing detector no longer depends on a native runtime library or CGO - it's now a fully static, dependency-free Go binary. This makes the scanner image smaller, faster to build, and easier to deploy across architectures.
  • Retrained the phishing-detection model on a substantially larger and more diverse set of examples. Internal testing shows a meaningful reduction in false positives (legitimate email incorrectly flagged) versus the previous model, with no loss in detection rate.
  • Simplified the scanner's Docker image build to a prebuilt-binary copy, matching the main application image's build process.

1.2.0 - 2026-08-16#

Changed#

  • Semantic search embeddings are computed by an external, OpenAI-compatible endpoint (SEMANTIC_SEARCH_ENDPOINT_URL, e.g. Ollama) instead of in-process ONNX models. The model is your choice; see Semantic search.