This page lists the upgrade notes for each Sandfly version: changes that affect existing installations, and any extra steps that a version requires. Read the notes for the version that you are upgrading to, and for any versions that you skip, before you follow the upgrade procedure. The notes are the same as the upgrade notes on the Sandfly setup releases page on GitHub. The most recent version is first. Versions that are not listed have no upgrade notes.

v6.0.0

Released: 2026-11-09

• 🚨 Upgrading to Sandfly 6.0 will delete all existing results from the Sandfly database. All other data will be preserved, but fresh host scans will need to run to re-populate scan artifacts. (Sandfly now stores artifacts instead of individual Sandfly results in the database.)
• Postgres 14 has reached end-of-life. Sandfly installations from prior to Sandfly 5.7.0 were installed with Postgres 14. If your installation is using Postgres 14 (after upgrading to Sandfly 6.0, you can view the Postgres version in the Settings -> About Sandfly page), Sandfly 6.0 includes a script to upgrade to Postgres 18. Shut down Sandfly with the shutdown_sandfly.sh script, then run the sandfly-setup/setup/util_scripts/upgrade_postgres.sh script to upgrade the Sandfly postgres volume to 18. The start_postgres.sh script (called by start_sandfly.sh script) automatically uses the correct Postgres version to match the data on disk.
• Docker Compose and Kubernetes users (e.g. installations not using the traditional sandfly-startup scripts): In addition to updating the image versions, increase the Postgres max connections parameter to 90 in the docker-compose.yaml file or the Kubernetes deployment descriptor for Postgres.

v5.8.0

Released: 2026-06-26

• Response actions are only available to users with the new "Responder" role. On upgrade, only the built-in "admin" user is granted the Responder role. You will need to grant existing users, including Admins, the Responder role if you wish to enable response actions.
• Sandfly now requires target hosts to be running Linux kernel 3.2 or later to scan them. For more information, see: https://sandflysecurity.com/blog/deprecation-of-linux-kernels-prior-to-32-in-sandfly-58

v5.7.0

Released: 2026-03-23

• Note: The release bundle, sandfly-setup-5.7.0.tgz, includes the offline Docker images. When installing on a server that doesn't have outside internet access, no additional steps are required. The setup and start scripts will now use the Docker images included in this setup archive instead of requiring connectivity to Docker Hub and quay.io.

Earlier Versions

For the upgrade notes of earlier versions, see the Sandfly setup releases page on GitHub.