Qualflare

Changelog

New features, improvements, and fixes across Qualflare.

RSS
v0.1.0minor
CLIFeature

Native Maestro reporter: a step per command, with screenshots

Maestro results used to reach Qualflare as JUnit XML — one line per flow, with a status, a duration and a failure message. Everything Maestro actually did was left on the CI worker. qualflare-maestro changes that: it wraps maestro test, reads what Maestro leaves behind, and reports a step for every command, named from your flow's own YAML.

brew install qualflare/tap/qualflare-maestro
qualflare-maestro -- maestro test .maestro/
qf my-project collect ./qualflare-results

Maestro's exit code passes through unchanged, so the command drops into CI in place of maestro test.

What lands in a report that JUnit XML could not carry:

  • A step per command, nested under runFlow, repeat and retry on Maestro 2.10+. An optional command that did not succeed becomes a skipped step.
  • Maestro's own screenshots, attached to the step that took them.
  • Tags and metadata read from the flow file, including qualflare.* properties.
  • Runs that died before Maestro wrote anything — invalid YAML, no device — which previously produced no file at all, and so no launch.

Values passed with --env and MAESTRO_* environment variables are replaced with ${NAME} in report text, so values handed to a flow that way are not carried along with its results. The reporter makes no network calls of its own, and it works with both of Maestro's debug-output layouts (2.6.x and 2.10+).

It needs Maestro 2.6.0 or newer, and qf 0.1.24 or newer for screenshots. Full setup is on the Maestro test reporting page, and the limitations are listed in the repository.

v2.4.1patch
AppSecurity

Shared Security Responsibility Model page now has a standing review commitment

Our Shared Security Responsibility Model page now states explicitly how we keep it current: we review it at least annually, and immediately after any change material enough to shift what's described there. From now on, any change to that page's ownership split gets an entry here under Security — this entry is the first one.

We've also made the invitation to give feedback on that page explicit — if anything on it doesn't match what you're seeing, or you think a responsibility should be split differently for your use case, email support@qualflare.com. That's always been true in practice; now it's said plainly.

v2.4.0minor
Autumn Release
AppFeature

New search and filters for the changelog

You can now search changelog entries by keyword and narrow the timeline by product and category. Filters combine with search.

  • Search matches entry titles, bodies, and version numbers
  • Product filter: App, CLI, API
  • Category filter: Feature, Bug Fix, Improvement, Integration, Maintenance, Security
v2.3.1patch
APIBug Fix

Fixed intermittent 500s on large test report uploads

Reports over 50MB could intermittently fail with a 500 error during ingestion. This was caused by a race condition in the report-parsing worker pool under high concurrency. Uploads of any size now complete reliably.

v1.8.0minor
CLIImprovement

Faster CLI uploads with parallel chunking

qualflare upload now splits large result files into parallel chunks instead of uploading sequentially. In our testing, a 200MB Playwright report that used to take ~90 seconds to upload now completes in under 20.

No config changes needed — this is on by default for files over 10MB.

v2.3.0minor
APIIntegration

SAML SSO for Enterprise workspaces

Enterprise workspaces can now configure SAML-based SSO for member login, in addition to the existing OAuth providers. Set it up from Workspace Settings → Security.

v2.2.4patch
AppSecurity

Session token rotation on password change

Previously, changing your account password did not invalidate existing session tokens on other devices. Sessions are now rotated immediately whenever a password change is confirmed, so a compromised device is fully signed out the moment the password is updated elsewhere.

This closes a gap where a stolen session token could outlive an intentional password reset. We recommend reviewing your active sessions under Account Settings → Security if you haven't changed your password recently.

A few related changes shipped alongside this:

  • Active session list now shows device, browser, and approximate location
  • "Sign out all other sessions" action added to Account Settings
  • Session tokens are now scoped to a single IP range and re-validated on major network changes

We audited every code path that reads a session token to confirm none of them cached a token past its rotation point — this was a multi-week effort across the API and both frontends, and we're glad to finally ship it.