v0.1.5-nightly.20261018081318.39110572754.1

Changes in 0.1.5

Changed

• Keep heuristic profile generation independent of Anthropic credentials and client initialization.
• Embed the locked Plotly library in generated HTML instead of downloading an unversioned CDN script.
• Use the current PyGithub authentication interface, update Pydantic and the Trivy action, and document RC fuzzing and reviewed assessment evidence.

Upgrade

Existing profile inputs remain supported. Regenerate HTML reports to use the bundled Plotly library; heuristic --no-llm operation no longer needs provider credentials. Preserve custom templates and previous outputs for rollback.

Security

Generated HTML no longer relies on an unversioned external Plotly script. Required CI and source-bound RC fuzzing remain enabled; this does not establish acceptance of external LLM or deployment services.

Build provenance

nightly candidate with a version fixed before compilation.

Source: bf0160446108ef900b314bbdc5e7c7637e3e7c01

Validation: https://github.com/4alvit/iot-project-builder-profile/actions/runs/39110572754

See release-manifest.json for package hashes and version input evidence.

v0.1.5

Changes in 0.1.5

Changed

• Keep heuristic profile generation independent of Anthropic credentials and client initialization.
• Embed the locked Plotly library in generated HTML instead of downloading an unversioned CDN script.
• Use the current PyGithub authentication interface, update Pydantic and the Trivy action, and document RC fuzzing and reviewed assessment evidence.

Upgrade

Existing profile inputs remain supported. Regenerate HTML reports to use the bundled Plotly library; heuristic --no-llm operation no longer needs provider credentials. Preserve custom templates and previous outputs for rollback.

Security

Generated HTML no longer relies on an unversioned external Plotly script. Required CI and source-bound RC fuzzing remain enabled; this does not establish acceptance of external LLM or deployment services.

Build provenance

Promoted unchanged from v0.1.5-rc.1.

Source: 56c975e08ea4aeb2175d9f81c6e56f2ae93f52d9

Validation: https://github.com/4alvit/iot-project-builder-profile/actions/runs/39031951535

Promotion: https://github.com/4alvit/iot-project-builder-profile/actions/runs/39032440347

Assets and release-manifest.json are byte-for-byte copies of the verified release candidate.

v0.1.5-rc.1

Changes in 0.1.5

Changed

• Keep heuristic profile generation independent of Anthropic credentials and client initialization.
• Embed the locked Plotly library in generated HTML instead of downloading an unversioned CDN script.
• Use the current PyGithub authentication interface, update Pydantic and the Trivy action, and document RC fuzzing and reviewed assessment evidence.

Upgrade

Existing profile inputs remain supported. Regenerate HTML reports to use the bundled Plotly library; heuristic --no-llm operation no longer needs provider credentials. Preserve custom templates and previous outputs for rollback.

Security

Generated HTML no longer relies on an unversioned external Plotly script. Required CI and source-bound RC fuzzing remain enabled; this does not establish acceptance of external LLM or deployment services.

Build provenance

rc candidate with a version fixed before compilation.

Source: 56c975e08ea4aeb2175d9f81c6e56f2ae93f52d9

Validation: https://github.com/4alvit/iot-project-builder-profile/actions/runs/39031951535

See release-manifest.json for package hashes and version input evidence.

v0.1.5-beta.1

Changes in 0.1.5

Changed

• Keep heuristic profile generation independent of Anthropic credentials and client initialization.
• Embed the locked Plotly library in generated HTML instead of downloading an unversioned CDN script.
• Use the current PyGithub authentication interface, update Pydantic and the Trivy action, and document RC fuzzing and reviewed assessment evidence.

Upgrade

Existing profile inputs remain supported. Regenerate HTML reports to use the bundled Plotly library; heuristic --no-llm operation no longer needs provider credentials. Preserve custom templates and previous outputs for rollback.

Security

Generated HTML no longer relies on an unversioned external Plotly script. Required CI and source-bound RC fuzzing remain enabled; this does not establish acceptance of external LLM or deployment services.

Build provenance

beta candidate with a version fixed before compilation.

Source: 56c975e08ea4aeb2175d9f81c6e56f2ae93f52d9

Validation: https://github.com/4alvit/iot-project-builder-profile/actions/runs/39031094040

See release-manifest.json for package hashes and version input evidence.

v0.1.4-nightly.20261017075753.39015553530.1

Changes in 0.1.4

Changed

• Validate each public release candidate with bounded, network-isolated fuzz campaigns against its exact source revision.
• Require positive engine execution counts, instrumented production code and validated seed corpora; retain source-bound reports and diagnostic evidence.
• Run deterministic seed and configuration checks in ordinary CI without starting mutation campaigns on betas.

Upgrade

Use the existing installation procedure, preserve local configuration and keep the previous accepted package for rollback. This maintenance release updates release validation and does not change the application configuration format. Deployment and applicable device or integration acceptance remain separate from publication.

Security

RC publication rejects absent or invalid source-bound fuzz reports. The fuzz runner bounds corpus paths, file types and size. No application vulnerability or new target-device acceptance is claimed by these tooling changes.

Build provenance

nightly candidate with a version fixed before compilation.

Source: d23903384dccc5ccbc42aee0baa192c8a4d46d19

Validation: https://github.com/4alvit/iot-project-builder-profile/actions/runs/39015553530

See release-manifest.json for package hashes and version input evidence.

v0.1.4-nightly.20261016082317.38873283534.1

Changes in 0.1.4

Changed

• Validate each public release candidate with bounded, network-isolated fuzz campaigns against its exact source revision.
• Require positive engine execution counts, instrumented production code and validated seed corpora; retain source-bound reports and diagnostic evidence.
• Run deterministic seed and configuration checks in ordinary CI without starting mutation campaigns on betas.

Upgrade

Use the existing installation procedure, preserve local configuration and keep the previous accepted package for rollback. This maintenance release updates release validation and does not change the application configuration format. Deployment and applicable device or integration acceptance remain separate from publication.

Security

RC publication rejects absent or invalid source-bound fuzz reports. The fuzz runner bounds corpus paths, file types and size. No application vulnerability or new target-device acceptance is claimed by these tooling changes.

Build provenance

nightly candidate with a version fixed before compilation.

Source: 2ad43d3053b70d7dcd9300cd4ec46195a3148722

Validation: https://github.com/4alvit/iot-project-builder-profile/actions/runs/38873283534

See release-manifest.json for package hashes and version input evidence.

v0.1.4

Changes in 0.1.4

Changed

• Validate each public release candidate with bounded, network-isolated fuzz campaigns against its exact source revision.
• Require positive engine execution counts, instrumented production code and validated seed corpora; retain source-bound reports and diagnostic evidence.
• Run deterministic seed and configuration checks in ordinary CI without starting mutation campaigns on betas.

Upgrade

Use the existing installation procedure, preserve local configuration and keep the previous accepted package for rollback. This maintenance release updates release validation and does not change the application configuration format. Deployment and applicable device or integration acceptance remain separate from publication.

Security

RC publication rejects absent or invalid source-bound fuzz reports. The fuzz runner bounds corpus paths, file types and size. No application vulnerability or new target-device acceptance is claimed by these tooling changes.

Build provenance

Promoted unchanged from v0.1.4-rc.1.

Source: 8c3bba2d1dd184460038dd1e850aeb884076b8c5

Validation: https://github.com/4alvit/iot-project-builder-profile/actions/runs/38624571879

Promotion: https://github.com/4alvit/iot-project-builder-profile/actions/runs/38625944121

Assets and release-manifest.json are byte-for-byte copies of the verified release candidate.

v0.1.4-rc.1

Changes in 0.1.4

Changed

• Validate each public release candidate with bounded, network-isolated fuzz campaigns against its exact source revision.
• Require positive engine execution counts, instrumented production code and validated seed corpora; retain source-bound reports and diagnostic evidence.
• Run deterministic seed and configuration checks in ordinary CI without starting mutation campaigns on betas.

Upgrade

Use the existing installation procedure, preserve local configuration and keep the previous accepted package for rollback. This maintenance release updates release validation and does not change the application configuration format. Deployment and applicable device or integration acceptance remain separate from publication.

Security

The release gate rejects absent or invalid fuzz evidence and unsafe seed inputs. No application vulnerability or new target-device acceptance is claimed by these tooling changes.

Build provenance

rc candidate with a version fixed before compilation.

Source: 8c3bba2d1dd184460038dd1e850aeb884076b8c5

Validation: https://github.com/4alvit/iot-project-builder-profile/actions/runs/38624571879

See release-manifest.json for package hashes and version input evidence.

v0.1.4-beta.1

Changes in 0.1.4

Changed

• Validate each public release candidate with bounded, network-isolated fuzz campaigns against its exact source revision.
• Require positive engine execution counts, instrumented production code and validated seed corpora; retain source-bound reports and diagnostic evidence.
• Run deterministic seed and configuration checks in ordinary CI without starting mutation campaigns on betas.

Upgrade

Use the existing installation procedure, preserve local configuration and keep the previous accepted package for rollback. This maintenance release updates release validation and does not change the application configuration format. Deployment and applicable device or integration acceptance remain separate from publication.

Security

The release gate rejects absent or invalid fuzz evidence and unsafe seed inputs. No application vulnerability or new target-device acceptance is claimed by these tooling changes.

Build provenance

beta candidate with a version fixed before compilation.

Source: 8c3bba2d1dd184460038dd1e850aeb884076b8c5

Validation: https://github.com/4alvit/iot-project-builder-profile/actions/runs/38623412493

See release-manifest.json for package hashes and version input evidence.

v0.1.3

Changes in 0.1.3

Fixed

Load built-in profile templates from memory so Markdown and HTML rendering works when the installed Python package is read-only. Existing templates in a supplied template directory or the package's template directory retain priority; missing templates use the built-in defaults without writing files there.

Upgrade

No profile data or output format migration is needed. Only the chosen output directory needs to be writable. Callers that supply a custom template directory should place their overrides there explicitly; the renderer no longer creates default template files in that directory.

Security

Rendering no longer requires write access to installed application files. HTML autoescaping remains enabled for both built-in and custom templates. This release fixes an installation compatibility defect; no remotely exploitable vulnerability is claimed.

Build provenance

Promoted unchanged from v0.1.3-rc.2.

Source: 5e6f7b73f8cd5446bdd2a82cfd8f59f1d986f788

Validation: https://github.com/4alvit/iot-project-builder-profile/actions/runs/38510741511

Promotion: https://github.com/4alvit/iot-project-builder-profile/actions/runs/38511230662

Assets and release-manifest.json are byte-for-byte copies of the verified release candidate.

Complete changes since v0.1.2

Released source: 5e6f7b73f8cd.
Previous stable source: 69f3091dfdf0.

Full source history. The list includes application, dependency, CI, documentation and release changes.

All 25 merged pull requests

• #59 — security: harden code-scanning workflows and CI permissions
• #60 — ci: prepare optional runner reserve without enabling it
• #61 — docs: explain profile generation and current project discovery
• #62 — perf(esphome): avoid duplicate YAML parsing during directory scans
• #63 — [StepSecurity] Apply security best practices
• #74 — ci: request CodeRabbit autofix after completed reviews
• #75 — feat: bind release notes to source and document security evidence
• #76 — fix: render profiles from read-only installations
• #64 — Group coherent GitHub Actions updates
• #68 — Group tested Python dependency updates
• #78 — ci: analyze GitHub Actions with CodeQL
• #79 — fix: keep Bandit exclusions within directory boundaries
• #80 — refactor: simplify custom component collection
• #81 — build: update uv to patched 0.12.18
• #82 — Document verified application and release TLS key policy
• #77 — build(deps): bump the github-actions group across 1 directory with 7 updates
• #83 — fix: enforce exact TLS key minima for the GitHub scanner
• #84 — build(deps): bump the github-actions group with 4 updates
• #85 — build(deps): bump the github-actions group with 4 updates
• #86 — fix(release): require exact GitHub not-found diagnostics
• #87 — fix(release): use authoritative GitHub HTTP status
• #88 — Add frozen candidate versions and RC fuzz qualification
• #89 — Use durable release workflows and verified publication guards
• #90 — build(deps): bump the python-dependencies group with 4 updates
• #91 — build(deps): bump the github-actions group with 11 updates

All 34 commits

• fda5eaeadd2c — security: harden code-scanning workflows and CI permissions (#59)
• 795bd911fa48 — ci: prepare opt-in runner reserve while keeping GitHub defaults (#60)
• 52e6a4885afe — docs: explain profile generation and current project discovery (#61)
• 33dc7162e438 — perf(esphome): avoid duplicate YAML parsing during directory scans (#62)
• 563a274d071e — [StepSecurity] Apply security best practices (#63)
• b18f3325d592 — ci: request CodeRabbit autofix after completed reviews (#74)
• 54e2ec397c93 — docs: document contribution, security and OpenSSF evidence
• d77c9463f140 — security: record verified OpenSSF criteria and outstanding evidence
• 14721fabf3f9 — feat: require source-bound release notes and complete security evidence
• 913acbdba0b2 — style: normalize release contract test imports and formatting
• 9d4c0aea36ee — fix: validate release notes before publication state mutations
• 0bb9be436e5e — test: reject unexpected release writes and verify note history
• b5d2e70e814b — fix: accept CRLF notes without weakening source checks
• 237697da8fc1 — refactor: synchronize reviewed release metadata and workflow checks
• 6023be7b834e — Merge pull request #75 from 4alvit/codex/openssf-hardening-20261008
• d174d6206716 — fix: render profiles from read-only installations
• 394766a9ab24 — Merge pull request #76 from 4alvit/codex/readonly-profile-renderer-20261008
• 4a7dfcc9989d — chore(deps): bump actions/checkout from 4.4.0 to 7.0.1 (#64)
• b78c9c578b83 — Group tested Python dependency updates (#68)
• a24f8e2004f8 — ci: analyze GitHub Actions with CodeQL (#78)
• 1107d5f73107 — fix: verify Bandit directory discovery boundaries (#79)
• 2cd1e077f99d — refactor: separate ESPHome custom component collection (#80)
• 0befa67771ef — build: update uv to patched 0.12.18 (#81)
• b09c884840fa — Document verified application and release TLS key policy (#82)
• cc09856c21dd — build(deps): bump the github-actions group across 1 directory with 7 updates (#77)
• [ff1aa63](ff1aa6364450f6eb7ab5b94be...