--- title: "Santa Release Notes" description: "Santa release notes. Security fixes, new rule types, telemetry, and enforcement changes in each release of the open source macOS agent." doc_version: "1" last_updated: "2026-10-16" canonical: "https://northpole.security/releases/santa" --- ![](https://northpole.security/images/workshop/figma/hero-bg.png) [Release notes](https://northpole.security/releases) # Santa release notes What was added, changed, and fixed in the ten most recent releases of the Santa agent. ## 2026.8 September 16, 2026 [View on GitHub](https://github.com/northpolesec/santa/releases/tag/2026.8) ### Security The Santa codebase has been undergoing dedicated security review by folks with access to frontier AI security models. The issues fixed below were identified through that work, and we recommend updating. This is an ongoing investment to ensure Santa remains your most trusted endpoint security solution. - 🔒 Fixed issues where a local user could race Santa’s inspection of an executable so that policy was evaluated against different content than the kernel was about to run - 🔒 Fixed issues where a cached execution decision could be reused after the underlying content changed - 🔒 Fixed an issue where a universal binary declaring an unusually large number of architectures was treated as a non-Mach-O file and allowed to run Full details for each issue are available in the [published advisories](https://github.com/northpolesec/santa/security). ### Announcements - 🎉 **Get the most out of Santa with Workshop!** [Workshop](https://northpole.security) is North Pole Security’s official sync service, built to integrate deeply with Santa. It is fully featured, scalable, and enterprise ready. Learn more at [northpole.security](https://northpole.security). - 📣 Ready for Golden Gate: this release has been validated on macOS Golden Gate (27.0). ### Fixed - ❗ Interrupted HTTP responses no longer result in a successful sync. A clean sync with an interrupted response would apply a partial rule set on the host. - ❗ Transitive rules now evaluate at the lowest precedence level so that they cannot interfere with other established rules on the host - ❗ Fixed a rare UI beachball when displaying block dialogs - ❗ Changes to transitive rule settings now take effect immediately instead of leaving stale cached decisions ### Changed - ↔️ Santa no longer presents a block dialog when it is determined that the OS will not allow the execution to continue anyway - ↔️ Santa package receipts now include the full version (i.e. `Year.Release.Build`) - ↔️ Sync settings and state applied from a given `SyncBaseURL` are now cleared when the `SyncBaseURL` changes (note: this can take about 10 minutes to take effect) - ↔️ Improved tamper protections - ↔️ Several performance improvements, including exec path evaluation and UI rendering - ↔️ `EnablePageZeroProtection` now only applies to 32-bit (i386) images, matching the kernel, which enforces `__PAGEZERO` itself for every other image type - ↔️ [Workshop customers](https://northpole.security): Execution telemetry now reports whether a decision was made while in Temporary Monitor Mode ### Added - ➕ `zsh` autocompletions for `santactl` - ➕ [Workshop customers](https://northpole.security): Santa now supports timed rules. CEL policies can use `policy_for_range()` to define time windows for when a binary is allowed to run, and `kill_on_expiry()` to forcefully quit the process when the window expires. Users are shown a notification ahead of the quit with the process and rule details. - ➕ [Workshop customers](https://northpole.security): Per-process options for file access rules, allowing fine-tuned policy for processes that should be silently denied, audited only, given custom messages/URLs, and more ## 2026.7 August 4, 2026 [View on GitHub](https://github.com/northpolesec/santa/releases/tag/2026.7) ### Security The Santa codebase has been undergoing dedicated security review by folks with access to frontier AI security models. The issues fixed below were identified through that work, and we recommend updating. This is an ongoing investment to ensure Santa remains your most trusted endpoint security solution. - 🔒 Fixed two issues related to Mach-O parsing that could prevent policy from being effectively enforced on specially crafted x86 binaries - 🔒 Fixed a heap buffer overflow that could be triggered with certain `EventLogType` configurations when an execution contained an extremely large number of arguments - 🔒 Improved tamper resistance handling to protect against local rule modification - 🔒 Fixed a narrow issue with File Access rules where an exception applying to platform binaries only could be erroneously granted to unsigned x86 binaries - 🔒 Fixed a narrow issue affecting CEL policies that conditionally returned ALLOWLIST\_COMPILER after accessing a non-cacheable field Full details for each issue are available in the [published advisories](https://github.com/northpolesec/santa/security). ### Announcements - 🎉 **Get the most out of Santa with Workshop!** [Workshop](https://northpole.security) is North Pole Security’s official sync service, built to integrate deeply with Santa. It is fully featured, scalable, and enterprise ready. Learn more at [northpole.security](https://northpole.security). ### Fixed - ❗ Dock icons no longer stick around when quickly closing stacked UI windows - ❗ Fixed issue with file types being unexpectedly handled by Santa - ❗ [Workshop customers](https://northpole.security): CEL process ancestor data reliability greatly improved under load ### Changed - ↔️ Improved tamper resistance features protecting critical Santa components - ↔️ Several small performance and memory improvements - ↔️ [Workshop customers](https://northpole.security): Users now receive a notification banner when temporary admin mode session ends (EPM) ### Added - ➕ The block dialog “open” button label can now be configured per-rule - ➕ [Workshop customers](https://northpole.security): Santa now supports queued commands that are delivered on the next sync, so commands issued while a host is offline still run - ➕ [Workshop customers](https://northpole.security): Signal matches on telemetry now include process tree and responsible process info in uploaded events - ➕ [Workshop customers](https://northpole.security): Signals can now be correlated across a time period, requiring a threshold before firing - ➕ [Workshop customers](https://northpole.security): Added new package inventory command to support scanning hosts for data about Homebrew, PyPI, Go, NPM, browser extensions, IDE extensions, and much more ## 2026.6 July 10, 2026 [View on GitHub](https://github.com/northpolesec/santa/releases/tag/2026.6) ### Announcements - 🎉 **Get the most out of Santa with Workshop!** [Workshop](https://northpole.security) is North Pole Security’s official sync service, built to integrate deeply with Santa. It is fully featured, scalable, and enterprise ready. Learn more at [northpole.security](https://northpole.security). ### Fixed - ❗ Fixed regression with compiler rules that could prevent Santa from generating transitive rules ### Changed - ↔️ When using protobuf, protobuf variants, and JSON `EventLogType` values, when a spool is filled, the oldest files are now evicted instead of dropping the newest events. - ↔️ [Workshop customers](https://northpole.security): Network activity telemetry now includes hostname, and rule match information ### Added - ➕ Support for new rule policies `SILENT_GUI_BLOCKLIST` and `SILENT_TTY_BLOCKLIST` to allow more fine-grained silencing options over the existing `SILENT_BLOCKLIST` - ➕ `santactl doctor` now checks certificate validity - ➕ protobuf telemetry now contains an opaque unique identifier `event_id` per-message - ➕ [Workshop customers](https://northpole.security): On device telemetry scanning, EDR signals - ➕ [Workshop customers](https://northpole.security): Network rule support to enable blocking/allowing network activity - ➕ [Workshop customers](https://northpole.security): Endpoint Privilege Management (EPM) support to further lock down endpoints by limiting access to admin and sudo privileges - ➕ [Workshop customers](https://northpole.security): CEL policies now have access to `today()` and `days(X)` functions to support relative time checks - ➕ [Workshop customers](https://northpole.security): New sandbox policy placeholder variable support: `BINARY_PATH` ## 2026.5 June 8, 2026 [View on GitHub](https://github.com/northpolesec/santa/releases/tag/2026.5) ### Announcements - 🎉 **Get the most out of Santa with Workshop!** [Workshop](https://northpole.security) is North Pole Security’s official sync service, built to integrate deeply with Santa. It is fully featured, scalable, and enterprise ready. Learn more at [northpole.security](https://northpole.security). - 📣 If you’re using telemetry with Workshop, please upgrade to Workshop v2026.5 before rolling out Santa v2026.5 to ensure no gaps in collected data. ### Fixed - ❗ Fixed a rare issue with sync service rate limiting - ❗ Fixed reachability handling so Santa reliably resumes syncing after the network comes back - ❗ [Workshop customers](https://northpole.security): The network extension’s DNS proxy now rides out transient network changes (e.g. VPN reconnects) instead of dropping queries - ❗ [Workshop customers](https://northpole.security): Improved push notification connection reliability ### Changed - ↔️ Uploaded events for platform binaries will now be classified with the decision `ALLOW_PLATFORM` instead of `ALLOW_CERTIFICATE` - ↔️ The `santactl eventupload` command has been renamed to `santactl inventory` (`eventupload` still works as an alias) ### Added - ➕ [Workshop customers](https://northpole.security): New rule policy that confines a binary to a specified sandbox profile (BETA) - ➕ [Workshop customers](https://northpole.security): Trigger an on-demand binary upload from an endpoint with a real-time push notification (BETA) - ➕ [Workshop customers](https://northpole.security): CEL fallback rules can now be used with platform binaries - ➕ [Workshop customers](https://northpole.security): CEL policies can now return `AUDIT` to generate an event without blocking the operation - ➕ New July 20 easter egg in the Santa UI for anyone with the [`FunFontsOnSpecificDays`](https://northpole.dev/configuration/keys/#FunFontsOnSpecificDays) config key set ## 2026.4 May 20, 2026 [View on GitHub](https://github.com/northpolesec/santa/releases/tag/2026.4) ### Announcements - 🎉 **Get the most out of Santa with Workshop!** [Workshop](https://northpole.security) is North Pole Security’s official sync service, built to integrate deeply with Santa. It is fully featured, scalable, and enterprise ready. Learn more at [northpole.security](https://northpole.security). ### Fixed - ❗ EventDetailURL template parameters are now properly percent-encoded - ❗ Improved File Access event logging when source data had been lost due to cache evictions ### Changed - ↔️ Clean syncs now also replace all settings managed by the sync server in addition to rules. Sync server operators must send all desired settings during the Preflight phase of a clean sync. - ↔️ SyncBaseURL is now required to be HTTPS unless configured to use localhost - ↔️ The sync service no longer retries requests on non-transient errors (e.g. most HTTP 4xx errors) - ↔️ Keyboard shortcuts now conform to idiomatic system shortcuts. `Cmd+W` closes windows, `Esc` closes panes such as the “More Info” pane. ### Added - ➕ Blocked device mount notifications can now be silenced - ➕ Strengthened anti-tamper protections across additional filesystem operations, signal handling, Endpoint Security data validation, and Santa’s own upgrade path. --- The lite package has moved so automation consuming the previous URL will need updating. ## 2026.3 April 10, 2026 [View on GitHub](https://github.com/northpolesec/santa/releases/tag/2026.3) ### Announcements - 🎉 **Get the most out of Santa with Workshop!** [Workshop](https://northpole.security) is North Pole Security’s official sync service, designed to deeply integrate with Santa. It is fully featured, scalable, and enterprise ready. Learn more at [northpole.security](https://northpole.security). - 📣 There is now a “Santa Lite” package included in the release. It is generally ***not recommended*** to use this but we recognize there are users that want reduced packaging. Read the [Lite Package docs](https://northpole.dev/deployment/lite-package/) for more information. - 🔒 Security Advisory: For security reasons, we strongly recommend all users update to Santa 2025.12 or newer. On prior versions, an attacker with admin privileges could bypass Santa. A detailed blog post will be published soon with more information. ### Fixed - ❗ Fixed issue where sync interval settings were not always being correctly applied - ❗ [Workshop customers](https://northpole.security): Improved handling of network mount name formats ### Changed - ↔️ Sync interval settings sent by the sync server are now persisted and will be used as the default on restarts - ↔️ [Workshop customers](https://northpole.security): Telemetry filter expressions from the MDM config now take precedence over filter expressions configured in Workshop ### Added - ➕ Santa can now enforce encryption settings when blocking/remounting removable media (currently APFS only) - ➕ Several performance and memory improvements to keep Santa snappy - ➕ Santa can be configured with a set of signing IDs to extend pid\_suspend protections to other software - ➕ `santactl fileinfo` now has an “expected decision” field that shows if Santa is expected to allow or deny the execution (note: runtime characteristics may still result in a different decision being applied) - ➕ CEL policies now have access to `path` and `is_platform_binary` properties - ➕ `santactl doctor` now validates FAA configurations - ➕ Block reason has been added to the UI/TTY - ➕ Added `pid_suspend`/`pid_resume` to telemetry - ➕ [Workshop customers](https://northpole.security): CEL fallback policies - You can now add CEL expressions that can apply a global policy in the event no specific rule matched - ➕ [Workshop customers](https://northpole.security): CEL policies can now access ancestor execution arguments - ➕ [Workshop customers](https://northpole.security): CEL policies can now basic access file descriptor information, enabling policies to express how to handle conditions like `stdin` attached to a pipe or socket - ➕ [Workshop customers](https://northpole.security): Added real-time command to trigger hosts to upload installed binaries/bundles - ➕ [Workshop customers](https://northpole.security): MDM policies can now define the set of allowed real-time commands - ➕ [Workshop customers](https://northpole.security): Santa will now upload metrics directly to Workshop by default, allowing performance monitoring ## 2026.2 March 3, 2026 [View on GitHub](https://github.com/northpolesec/santa/releases/tag/2026.2) ### Announcements - 🎉 **Santa has a new Workshop!** North Pole Security is excited to announce the release of [Workshop](https://northpole.security), an official sync service specifically designed to deeply integrate with Santa. It is fully featured, scalable, and enterprise ready. Come learn more at [northpole.security](https://northpole.security). - 📣 The Santa package now includes two new binaries: a network extension daemon (`com.northpolesec.santa.netd`) and a helper utility for telemetry export (`sleigh`). Both are intended for use by Workshop customers only. ### Fixed - ❗ Fixed issue where the Santa UI could appear to open smaller than needed and then “snap” to the correct size - ❗ Fixed a rare UI state race condition that could inadvertently cause the About dialog to be displayed when it shouldn’t - ❗ Terminal prompts are no longer hidden when an application executed from a terminal is blocked and Santa writes information to the TTY - ❗ Fixed regression where custom URLs or `EventDetailURL` values of “null” were not appropriately removing the button from the UI ### Changed - ↔️ Santa now properly registers for notifications on startup. Unless the system has a [Notifications profile](https://northpole.dev/deployment/profile-notifications/) installed, users may see a system banner notifying them that Santa would like to send notifications. No new or additional notifications exist. - ↔️ Compiler rules now also track file clone events for tracking executable output in order to create more comprehensive transitive rules. This is commonly seen with newer rust/cargo toolchains. - ↔️ `santactl doctor` feedback around sync availability is now significantly more accurate, with fewer false positives - ↔️ Terminology around “USB blocking” has been standardized to “removable media blocking” to better reflect the full range of devices Santa handles, such as SD cards, Thunderbolt drives, and NVMe devices ### Added - ➕ CEL policies now have access to the executing binary’s signing ID during evaluation, enabling capabilities such as wildcard matching - ➕ Added support for the `FileAccessEventDetailURL` and `FileAccessEventDetailText` configuration keys, used as fallbacks when there is an FAA block and no per-rule URL or text is provided - ➕ Execution events sent to the sync server now indicate whether or not the applied rule was a static rule - ➕ A [CEL playground](https://northpole.dev/cookbook/cel-playground/) is now available for testing and validating CEL rules - ➕ Added French (France), French (Canada), and Spanish translations - ➕ [Workshop customers](https://northpole.security): Removable media block events are now uploaded during sync and viewable in Workshop - ➕ [Workshop customers](https://northpole.security): Telemetry filtering expressions allow you to redact/filter telemetry before being exported - ➕ [Workshop customers](https://northpole.security): CEL rules can now act upon the process tree when making a decision - ➕ [Workshop customers](https://northpole.security): (BETA) Santa can now report network telemetry ## 2026.1 January 29, 2026 [View on GitHub](https://github.com/northpolesec/santa/releases/tag/2026.1) ### Announcements - 🎉 **Santa has a new Workshop!** North Pole Security is excited to announce the release of [Workshop](https://northpole.security), an official sync service specifically designed to deeply integrate with Santa. It is fully featured, scalable, and enterprise ready. Come learn more at [northpole.security](https://northpole.security). - 📣 macOS 13 (Ventura) is no longer supported. ### Fixed - ❗ Instigating process information is no longer missing for File Access rule violations committed by processes that started before Santa was running - ❗ Fixed issue that prevented blocking mounts of certain external media types - ❗ Blocked USB mounts are now logged in the telemetry stream - ❗ Fixed overzealous caching of blocked execution events if the event was unable to be uploaded immediately due to network issues - ❗ Removed unintentional escape codes in `santactl fileinfo --json` output ### Added - ➕ Co-branding is now supported, allowing admins to configure their company name or logo to be displayed on Santa UI dialogs - ➕ Santa now has a menu item! This has functionality to trigger a sync and reset any silenced block notifications. For [Workshop customers](https://northpole.security), you can also control temporary monitor mode and see how much time is remaining. Users can turn this off or on from the “About” dialog. Admins can configure this to be off by default by setting the `EnableMenuItem` configuration key to `false`. - ➕ The `santactl fileinfo` command now supports a `--verify` flag to display code signature validation result for each slice of the binary as well as a security assessment via `spctl` - ➕ [Workshop customers](https://northpole.security): Network shares can now be blocked from mounting and exception lists can be configured (macOS 15+) - ➕ [Workshop customers](https://northpole.security): Push command support to terminate arbitrary processes - ➕ [Workshop customers](https://northpole.security): You can now use CEL rules to require that a user performs TouchID ## 2025.12 December 17, 2025 [View on GitHub](https://github.com/northpolesec/santa/releases/tag/2025.12) ### Announcements - 🎉 **Santa has a new Workshop!** North Pole Security is excited to announce the release of [Workshop](https://northpole.security), an official sync service specifically designed to deeply integrate with Santa. It is fully featured, scalable, and enterprise ready. Come learn more at [northpole.security](https://northpole.security). - 📣 Santa will be ending support for macOS 13 (Ventura) in January 2026. ### Fixed - ❗ Rules received from a sync server with CEL policies using features not supported by the current version of Santa will no longer cause syncing to fail. - ❗ Addressed a memory leak in the `santasyncservice` process. - ❗ Window icons are no longer blurry ### Changed - ↔️ The name for Santa as shown in the macOS settings Privacy & Security Full Disk Access pane is now more descriptive: “Santa Endpoint Security Extension”. - ↔️ Support for the `EnableForkAndExitLogging` configuration key has been removed and configurations should migrate to using the `Telemetry` key. - ↔️ The `target` field in `FileAccess` telemetry messages emitted by FAA rule violations was switched to be a `FileInfo` type. This is a wire-, forward-, and backward-compatible protobuf change that now allows consumers to see `stat(2)` info. ### Added - ➕ [\[Workshop Customers\]](https://northpole.security) On-Demand Monitor Mode! Admins can configure policies for hosts that allow users to temporarily enter Monitor Mode as needed for a defined period of time. Hosts will automatically revert to Lockdown Mode once the time expires. This enables a much smoother experience for users like developers that need to constantly build & run new binaries without having machines carry permissions for longer than necessary. - ➕ CEL policies have access to two new fields which allow for more dynamic and flexible rules: the effective user ID (`euid`) and current working directory (`cwd`). - ➕ `EventDetailURL` and `EventDetailText` can now be set by the sync server. - ➕ `santactl rule` can now be used to check if a given path is covered by a Data FAA rule. - ➕ `santactl status` now displays the current sync interval. - ➕ More comprehensive anti-tamper protections. ## 2025.11 November 6, 2025 [View on GitHub](https://github.com/northpolesec/santa/releases/tag/2025.11) ### Announcements - 🎉 **Santa has a new Workshop!** North Pole Security is excited to announce the release of [Workshop](https://northpole.security), an official sync service specifically designed to deeply integrate with Santa. It is fully featured, scalable, and enterprise ready. Come learn more at [northpole.security](https://northpole.security). - 📣 Ready for Tahoe. This version has been validated on macOS Tahoe 26.0. - 📣 Santa will be ending support for macOS Ventura in January 2026. ### Fixed - ❗ Changes to push notification sync intervals now take effect immediately instead of waiting until the next cycle. ### Changed - ↔️ The sync service is restarted when push notifications are enabled/disabled so the new configuration can take effect. - ↔️ If Santa is unable to communicate with the sync server when push notifications are enabled, it will reschedule the next attempt for the smaller of either 10 minutes or the current push notification full sync interval. - ↔️ Sync intervals are now scheduled with a 5 second leeway (previously, there was an allowed variance of up to 50% of the sync interval time). This will make sync intervals more consistent. ## Sitemap - [Home](https://northpole.security/index.md) - [Workshop](https://northpole.security/workshop.md) - [Santa](https://northpole.security/santa.md) - [Features](https://northpole.security/features.md) - [Cookbook](https://northpole.security/cookbook.md) - [Docs](https://northpole.security/docs.md) - [Blog](https://northpole.security/blog.md) - [Glossary](https://northpole.security/glossary.md) - [About](https://northpole.security/about.md) - [Contact](https://northpole.security/contact.md)