1.5.2

What's Changed

• chore(deps): bump the client-minor-patch group in /client with 4 updates by @dependabot[bot] in #205
• chore(deps): bump the server-minor-patch group in /server with 2 updates by @dependabot[bot] in #208
• chore(deps): bump the client-minor-patch group across 1 directory with 3 updates by @dependabot[bot] in #209
• fix(uniformbuilder): pick combat badges by family, not award priority by @SyniRon in #210

Full Changelog: 1.5.1...1.5.2

1.5.1

What's Changed

• fix(ci): open sprite PRs with an App token, not GITHUB_TOKEN by @SyniRon in #191
• chore(ci): add CODEOWNERS and Dependabot auto-merge by @SyniRon in #190
• chore(deps): bump mysql2 from 3.23.0 to 3.23.1 in /server in the server-minor-patch group by @dependabot[bot] in #192
• chore(deps): bump docker/login-action from 4.4.0 to 4.5.1 in the actions-minor-patch group across 1 directory by @dependabot[bot] in #193
• chore(deps): bump apexcharts from 5.16.0 to 6.5.0 in /client by @dependabot[bot] in #195
• chore(deps): bump the client-minor-patch group across 1 directory with 9 updates by @dependabot[bot] in #194
• Update documentation by @HWqs in #165
• chore(deps): bump brace-expansion from 5.0.8 to 5.0.9 in /server by @dependabot[bot] in #196
• fix(client): treat empty user search as no results instead of error by @JensGryspeert in #170
• chore(deps): bump the server-minor-patch group in /server with 2 updates by @dependabot[bot] in #197
• chore(deps): bump docker/login-action from 4.5.1 to 4.6.0 in the actions-minor-patch group by @dependabot[bot] in #198
• chore(deps): bump the client-minor-patch group in /client with 8 updates by @dependabot[bot] in #199
• chore: finish the CavApps rename by @SyniRon in #200
• fix(server): log error summaries instead of whole error objects by @SyniRon in #202

Full Changelog: 1.5.0...1.5.1

Third-row medals, an award constants refactor, and a repaired sprite generator

This release rewrites medal placement in the uniform builder so a third row works, moves the award and MOS string literals into a constants module, and repairs the award sprite generator that the refactor had quietly broken.

Uniform builder

• Third-row medal placement, rewritten (#189, thanks @Vercin-G). A third row was never really intended, and the code that half-handled it could not be adjusted without untangling it first. That section is rewritten so a third row lays out correctly, and it now errors if anything larger is attempted. Fixes #179.
• Badge logic restored and rewritten (#176, thanks @Vercin-G). The badge changes did not carry over through the refactor. Combat badge selection was also rewritten to be readable, and the aviator badge awardPriority values were corrected.
• Award and MOS constants, and a data-driven registry (#130, thanks @JensGryspeert). Award types, ribbon attachment types and MOS codes move into a single constants/ module, and AwardRegistry builds its Map by looping over AWARD_CATALOG instead of ~100 imperative set() calls. Adding an award is now a one-line entry. No behavior change.

Award sprite generator

The generator deletes the contributor's source PNGs and empties manifest.json when it succeeds, so a run that does only part of the work and still exits 0 is worse than a crash. Three bugs of that shape are fixed here.

• Repaired after #130 (#177). The generator read each award's placement by matching AwardRegistry.jsx as text. #130 moved that data into awardCatalog.js, the matcher stopped finding anything, and every upload failed. The two PRs touched disjoint files, so the merge was clean and nothing flagged it. It reads the catalog now, and a test covers it.
• Two silent failures now fail loudly (#178). A placement field left out of the catalog with art supplied anyway, and a repeated priority. Both used to warn and carry on, consuming the source art and emptying the manifest on the way out.
• Sheets reconciled against the catalog (#180). A forgotten replace key inserted a tile onto a row that already had one, pushing every award below it down a row on both sheets. Against the real 105-award catalog that shifted 67 ribbons and 44 medals into their neighbour's art, with no diagnostics and exit code 0. The medal sheet's stray transparent row is cropped as well.

Dependencies and CI

• Server: node-pg-migrate 9.0.0, mysql2 3.23.0, body-parser 2.3.0, brace-expansion 5.0.7 (#175, #181, #185, #186)
• Client: next 16.2.11, sharp 0.35.0 (plus an override for the transitive copy), and three rounds of minor-patch bumps (#169, #174, #182, #183, #184, #188)
• CI: actions/setup-node 7 (#173, #187)

Full changelog: 1.4.0...1.5.0

D/DEVCOM on the ADR, plus a postcss security fix

This release adds the Development Command and D/ACD to the ADR and Roster Statistics, closes a postcss XSS advisory, and moves the charts stack onto ApexCharts 5.

ADR and Roster Statistics

• D/DEVCOM and D/ACD (#158, thanks @HWqs). The ADR gets a "Development Command" section for D/DEVCOM, and D/ACD now shows under Auxiliary Combat Division. Both appear on Roster Statistics with their own chart colors, and the C/ACD group IDs were refreshed to match /roster/groups. Closes 7cav.us ticket #12005.

Security

• postcss patched for CVE-2026-41305 (#156). An override forces the patched postcss version, which closes the XSS advisory.

Charts stack

• ApexCharts 3.54 → 5.15 and react-apexcharts 1.5 → 2.1 (#161, #162, then patch bumps in #167). 1.3.0 kept react-apexcharts pinned at 1.5.0 to hold ApexCharts on 3.x; that pin is now lifted and both libraries move together.

Dev environment

• The example compose file now boots a working local stack (#155).

Dependencies and CI

• Server: form-data 4.0.6, node-cron 4.5.0, pg 8.22.0, axios 1.18.1 (#154, #159, #166)
• Client: lucide-react 1.21.0, @tanstack/react-query 5.101.1 (#160, #167)
• CI: actions/checkout 7, peter-evans/create-pull-request 8 (#163, #164)

Full changelog: 1.3.0...1.4.0

1.3.0

Platform re-baseline + Uniform Builder: Foxhole Service Ribbon

This release moves the client onto current framework majors and adds the Foxhole Service Ribbon award, plus a CI step that builds the award sprite sheets from the upload folder.

Framework upgrades

• Next.js 13.5.4 → 16.2.9 and React 18 → 19 (#150). Crossing three Next majors needed code changes, not just a version bump. The ApexCharts import now lives in a "use client" wrapper so the server page can stay a Server Component, /adr and /rosterstatistics are pinned to force-dynamic so they render against the live API at request time instead of at build time, and react-apexcharts stays at 1.5.0 to keep ApexCharts on 3.x.
• Tailwind CSS v3 → v4 (#152). The config moves to the v4 model, the old tailwind.config.js is removed, and PostCSS is updated to match.

Uniform Builder

• Foxhole Service Ribbon award (#140), with medal sizing matched to the other medals.
• CI builds the award sprite sheets from the upload folder (#139), through the new generateAwardSprites.js and its tests.
• In-place tile replace via a manifest flag, so an existing sprite swaps out without reflowing the sheet. The generator rejects mixing replace and insert on one sheet, and a replace into a partial final row works.

Fixes

• Healthcheck no longer returns 403. The server now answers GET / and /cache-timestamp without a token, so uptime checks and the root path work unauthenticated (#153).

Dependencies

• date-fns 3.6.0 → 4.4.0, a server axios bump, and grouped dependabot updates across client and server.

Deployment note

No new environment variables and no deploy changes. The framework upgrades are baked into the image at build time. If you put an external uptime check in front of the app, note that / and /cache-timestamp are now intentionally public.

Full changelog: 1.2.0...1.3.0

1.2.0

Roster history: fast heatmap tooltips (#137) + unit-visibility empty states (#136)

Two quality-of-life fixes on the roster history page, shipped via #138.

Changes

• Heatmap tooltips now appear in ~100ms instead of the ~1s native browser delay — heatmap cells use a real tooltip component (new shadcn Tooltip primitive on @radix-ui/react-tooltip) instead of title attributes. Keyboard focus also reveals tooltips, and cells keep accessible names via aria-label.
• Absent units are explained instead of hidden — the unit filter bar states that only units with recorded changes in the current view are listed, and an active unit filter matching nothing shows a clear empty state naming the unit with a "Clear unit filter" button, on both Today and History tabs.
• Empty-state messaging correctly attributes the cause: unit filter vs event-type/record-type/roster-type filters, and never renders over fetch errors.

Deployment note

No new environment variables. New client dependency (@radix-ui/react-tooltip) is baked into the image at build time — no action needed.

Full changelog: 1.1.1...1.2.0

1.1.1

Restore uniform builder username autocomplete (#132)

Re-adds the username suggestions dropdown (with arrow-key navigation) to the uniform builder, which had been reverted and was missed in the 1.1.0 integration. Backed by the /userSearch endpoint shipped in 1.1.0 — no backend changes.

Changes

• Restore searchForUser helper and the autocomplete UI in the uniform builder
• Debounce (200ms) + discard stale/out-of-order responses
• Clear suggestions on fetch error (no stale, clickable names)
• Guard non-array responses; log non-array payloads instead of dropping silently
• Fail loudly on missing NEXT_PUBLIC_USERCACHE_API_URL / NEXT_PUBLIC_CLIENT_TOKEN

Deployment note

The client requires NEXT_PUBLIC_USERCACHE_API_URL set to the /userSearch endpoint (same server as NEXT_PUBLIC_DIFF_API_URL). Without it the autocomplete will not function.

Full changelog: 1.1.0...1.1.1

1.1.0

What's Changed

• Integrate roster-diff pipeline, roster history, and aviation badge rework by @SyniRon in #131

Full Changelog: 1.0.4...1.1.0

1.0.4

What's Changed

• Bump docker/login-action from 4 to 4.1.0 in the actions-minor-patch group across 1 directory by @dependabot[bot] in #125
• chore: add local docker dev setup and refresh onboarding docs by @JensGryspeert in #128
• fix(uniformbuilder): render aviator badge for MOS 155F by @JensGryspeert in #129

New Contributors

• @dependabot[bot] made their first contribution in #125

Full Changelog: 1.0.3...1.0.4

1.0.3

Maintenance release. No user-facing changes — entirely dependency hygiene and CI tooling. Staging has been running this for the past hour with the apexcharts upgrade verified against real roster data.

Dependency bumps

Client

• react 18.2.0 → 18.3.1 (+ react-dom)
• apexcharts 3.43.0 → 3.54.1
• react-apexcharts 1.4.1 → 1.5.0
• lucide-react 1.11.0 → 1.16.0
• tailwind-merge 3.5.0 → 3.6.0
• autoprefixer 10.4.16 → 10.5.0
• postcss 8.4.31 → 8.5.14

Server

• express 4.17.2 → 5.2.1 (audited surface area; v5 breaking changes don't touch this codebase)
• axios 0.25.0 → 1.16.1 (latent fix — axios-retry already required axios ≥ 1)
• compression 1.7.4 → 1.8.1
• cors 2.8.5 → 2.8.6

GitHub Actions

• actions/checkout v3/v4 → v6
• docker/login-action v3 → v4
• docker/build-push-action v5 → v7.1.0

Tooling

• Dependabot configured with a weekly cooldown to prevent PR-spam (#102)
• Removed five orphan client deps (express, date-fns, compression, cors, axios) that weren't actually imported anywhere — Next.js app doesn't need them (#116)
• Prettier is now self-hosted via a root package.json instead of the third-party creyD/prettier_action (which had a version-pinning bug); one-time Prettier 3 reformat applied across 11 files, all trailingComma: "all" cosmetic (#122)

Not in this release

Held for dedicated migration sessions, both with explanatory comments on their Dependabot PRs:

• Tailwind CSS 3 → 4 (#113) — full rewrite, needs CSS-first config migration
• Next.js 13 → 16 (#120) — three majors of breaking changes; will land paired with React 19. Worth prioritizing because 13.5.4 has ~10 unpatched advisories.

PRs: #115, #116, #121, #122, #123