{
  "summary": "Container-aware egress attribution now works on Windows and macOS (both via Docker Desktop), not just Linux - firewall rules can scope by container/pod label and DLP events show container name/image/labels on all three platforms, though Windows/macOS support ships marked experimental: correlation can miss when a container's traffic is routed through the agent's own system-proxy path instead of being transparently intercepted, so pair it with a process- or destination-based rule as a backstop there. Getting this working surfaced and fixed several real Windows bugs found only by running the mechanism against a live container in a golden-image test VM: a PID-namespace mismatch in Docker's own API response, wsl.exe silently stripping shell variables from generated scripts, a missing auth header on WinDivert asset downloads, a WinDivert handle-priority collision, an unsupported processId filter field, and a filter-negation syntax WinDivert rejects - the net effect is that Windows HTTP/HTTPS transparent inspection now actually opens for the first time. New: browser-extension request detection flags traffic originating from a Chrome/Edge/Brave/Opera or Firefox extension's own background script (via the Origin header, since TLS is already terminated) - useful against a malicious or compromised extension exfiltrating page content from other open tabs, since that traffic otherwise looks identical to ordinary browsing. Supply-chain protection's installer-session tracking is now liveness-based instead of a fixed 5-minute timer, closing a bypass where a malicious postinstall script could sleep past the old window and read credentials undetected; it also now detects a tracked process detaching to persist independently (daemonizing), with existing process-allow-rules already covering legitimate watch-mode tools that do this on purpose. Also: the device-identity sign-in page now returns you to the site you were trying to reach after verifying, instead of a dead-end 'you can close this window' page; several dashboard card layout fixes."
}