¶ Diri Release Notes for December 2025
This release focuses on stabilizing inheritance and template behavior across all modules, expanding policy management and file handling, and delivering a major revision of Pre-DPIA workflows. It also includes multiple bug fixes, UI and stability improvements, and security updates addressing known CVEs and dependency issues.
¶ Production updates week 51
¶ 1. Inheritance and Sharing - finished
We are happy to report that the inheritance feature is fully implemented. This feature is extremely relevant if you have a large and complex organizational tree as it enables top down sharing and write protection in your Diri-instance.
- Inheritance finalized and stabilized for:
- Data Processing Activities (DPA): works in both read-only and edit modes.
- Templates: inherited templates now function correctly across Operational Risk, Cyber Security, and Privacy modules.
- Mitigations implemented to reduce item duplication when using templates (assets, threats, vulnerabilities, treatments).
¶ 2. Templates fully revised and deployed
Templates now work fully as intended, we have improved the UI to make it easier to user. Templates combined with inheritance is now a very powerful feature.
- Full template creation validated for all modules directly from the Risk Assessment dashboard (OpRisk, CyberSec, Privacy).
- Improved inheritance logic for template-based items.
- Template-related UI improvements delivered.
¶ 3. Policy Module (Expanded Functionality)
The Policy feature is still located in the Compliance (beta) module. The feature is designed for creating or uploading policies in Diri and sharing them with your collaborators throughout the organization.
- Extended policy registration with new fields:
- Type, Approved by, Visibility, Associated Tasks, Associated Treatments, Approval date, Revision date, Description, Documentation, File upload.
- Policies can be directly connected to tasks and treatments
- Policy sharing implemented:
- Within own organisation.
- Downwards in organisation hierarchy (read-only).
- Private.
- Known issues (Beta version):
- Downwards-sharing logic must be updated so higher-level admins always have visibility.
- File sharing has a known bug on policies when using downwards sharing where users in suborgs can not access attachments.
¶ 4. New File Viewing and Download Component
The new component shows if a list item has an file attachment, and provides access to it in the list. Diri now also has a file viewer component.
- New component displays all files attached to a resource, with single or multi-file download.
- Preview support for PDF and DOCX.
- Currently implemented for:
- IT Systems
- Vendors
- Treatments
- Assets
- Policies
¶ 5. Pre-DPIA (Major Revision)
The Pre-DPIA finally has received its own page which documents all conducted Pre-DPIAs. Pre-DPIA recommendations can now be over-ridden with the possibility to document the justification. The GUI for pre-dpia has been improved showing when a Pre-DPIA has already been conducted.
- New Pre-DPIA overview page with sortable table and full lifecycle support:
- Archive / restore
- Hard delete
- Pre-DPIA creation moved to modal-based workflow.
- Necessity logic is now overrideable:
- Pre-DPIA requiring DPIA can be closed without creating DPIA.
- Pre-DPIA not requiring DPIA can be escalated with justification.
- Activity page button now shows existing Pre-DPIAs when present.
- All Pre-DPIAs are now created regardless of questionnaire outcome.
¶ 6 General UI and Stability Improvements
- Improved threat list button layout.
- Multiple improvements on quality and stability, and various smaller fixes from the DevOps backlog.
- Updated risk assessment copy feature to include threats and vulnerabilities.
- Tightened couplings between templates, risk assessments, treatments, assets, threats, and vulnerabilities.
- Treatments from all modules can now be added in the bowtie.
¶ 7. Bug Fixes, CVE, and Technical Maintenance
- Fixed file attachment leakage between vendors.
- Fixed inheritance issues when creating risk assessments in newly created organisations.
- Fixed incorrect organisation context during treatment creation.
- Fixed shared items disappearing when reused in new risk assessments.
- Applied security updates and dependency maintenance, including fixes for known CVEs in Next.js and React Server Components.
- Next.js 15.1.9 (CVE-2025-48068, CVE-2025-29927)
- Updated React Server Components (CVE-2025-55182).