v0.9.9

Aelira v0.9.9

This corrective release repairs a scanner-to-remediator contract mismatch in v0.9.8 and restores sourced per-issue remediation outcomes in the dashboard.

Security

• The CLI lockfile resolves js-yaml 4.3.2, closing GHSA-2883-xcg3-v3hh in the shipped dependency tree.

Fixed

• Strict PDF remediation recognizes every built-in scanner issue type, including versioned PDF/UA rule labels, without requiring an intermediate enrichment step.
• Every input finding is accounted for as fixed, manual, failed, or skipped; unsupported future categories remain explicit manual work instead of disappearing from the result.
• The dashboard pairs persisted fix records with scan findings one-to-one. It distinguishes fixed, proposed, approved, rejected, failed, and unattributed outcomes without inventing results.
• Zero-issue remediation jobs now return an authoritative total_issues value.

Changed

• The scan-to-remediation integration suite now sends raw scanner output directly into strict remediation.
• A permanent regression fixture exercises the reported H1, title-metadata, and PDF/UA three-finding payload and requires 3 fixed, 0 manual, 0 failed, and 0 skipped.

Operator action required

• No database migration or new environment variable is required.
• Deploy API, worker, and dashboard from the same 0.9.9 release. Re-run any remediation that failed under v0.9.8, then confirm that fixed, manual, failed, and skipped counts sum to the total before relying on the artifact.
• Preserve every v0.9.8 operator action in CHANGELOG.md, including backup, deployment configuration, worker-health, and review requirements.

Release evidence

• Remediation-focused backend verification passed 248 tests before the final incident fixture was added; the final three-test PDF integration file also passed independently.
• Dashboard verification passed 318 unit tests, lint, and a production build.
• Live dependency audits reported no known Python vulnerabilities and zero npm vulnerabilities across the CLI and dashboard trees.
• The full local backend suite passed 5,475 tests and skipped 418. Its two environment-dependent failures were reproduced unchanged on the untouched v0.9.8 baseline: the optional equation renderer was unavailable and sandbox DNS could not resolve the redirect-loop fixture.
• An independent browser walkthrough at desktop and mobile widths showed all three incident findings with sourced Fixed outcomes and no horizontal overflow.
• Publication remains gated on the exact merged release commit, a GitHub-verified signed annotated tag, coordinated linux/amd64 and linux/arm64 image receipts, the exact seven-file SBOM set, package publication, and the final GitHub Release job. This checked-in body is consumed verbatim by .github/workflows/release.yml.