3.3.1

What's Changed

Bug Fixes

• Missing HSTS header on redirect (302) responses from RedirectFilter (#8705)
• docs(ui): ui-app README lists outdated PatternFly (5) and Node.js (16) versions (#8689)
• Bug: Documentation tab silently fails for PROMPT_TEMPLATE and MODEL_SCHEMA artifacts (#8656)
• ClassCastException importing OpenAPI 3.1 document with server variables (OpenApi31ServerImpl cannot be cast to OpenApi30Server) (#8505)
• Pin container base images and operator image to digest instead of mutable tags (#8194)
• Add decompressed-size and entry-count limits to /admin/import ZIP extraction (#8190)
• Add disallow-doctype-decl to DocumentBuilderAccessor and fail-closed in SchemaFactoryAccessor (#8189)
• Disable wsdl4j import dereference in WSDLReaderAccessor to prevent SSRF (#8188)
• Harden SAXParser in ContentTypeUtil.isParsableXml() to prevent XXE / SSRF / entity-expansion DoS (#8187)
• Unmapped reference error for google import in protobuf schema (#4877)

Enhancements

Other Changes

• UI: page data loaders lack request cancellation / stale response guarding rapid navigation can render the wrong artifact's data (#8879)
• bug: kafkasql contract audit log is written only to the local node - diverges across the cluster and is lost on restart (#8878)
• bug: kafkasql global contract ruleset is not replicated across nodes and is lost on restart (#8848)
• Deleting or updating a non-existent version comment returns HTTP 500 instead of 404 (#8843)
• Fix version comments error handling (#8829)
• bug: kafkasql emits ARTIFACT_CREATED / ARTIFACT_VERSION_CREATED events on a dryRun create (#8825)
• docs: generated ref-registry-all-configs.adoc is out of sync with the generator after #8524, breaking every full build (#8795)
• Boolean prompt variable name is rendered twice in the Test Prompt panel (#8790)
• Boolean prompt variables dropped from render request when checkbox is untouched (#8765)
• bug: kafkasql does not emit an event when an artifact version's state changes (#8763)
• Direct navigation to /agents is not guarded when the Agents feature is disabled (#8747)
• fix(security): HSTS header uses incorrect includeSubdomains directive (#8713)
• docs(operator): README quickstart uses literal VERSION=TODO breaking install URL (#8712)
• Example For Event Driven Architecture is not compatible with apicurio-registry version 3 (#8709)
• feat: Camel Kafka + Apicurio SerDe quickstart / archetype (#8670)
• Add diagnostic dumps to operator OLM tests on failure (#8658)
• Missing integration tests for MCP well-known discovery endpoints (#8613)
• fix: KafkaSql tests flaky in CI — topic metadata propagation race in verifyTopicConfiguration() (#8583)
• Version search with content filter returns 500 (malformed SQL: empty AND () predicate) on SQL storage (#8582)
• [UI] mutability not visible until tab change (#8503)
• Add OpenShift Console plugin for Apicurio Registry (#8484)
• OpenAPI documentation is not rendered in Edge Browser (#8455)
• [UI] Dashboard does not load current user — admin actions hidden & header shows "User" on first render (OIDC/RBAC) (#8371)
• Nested elements in Registry UI result in unesthetic border (#8310)
• CLI: Support artifact references and import/export (#8268)
• CLI: Manage configuration properties (#8267)
• CLI: Retrieve content by global ID, content ID, and hashes (#8266)
• CLI: Support search by content (#8265)
• APICURIO_STORAGE_SQL_KIND=postgresql no longer activates the datasource in 3.3.0 — hardcoded quarkus.datasource.*.active defaults defeat DatabaseConfigInterceptor (#8205)
• Ensure Content Download honors Content MIME-TYPE and it's file extension (#8172)
• CLI: Add file-based credential fallback with --allow-unsafe-credential-storage (#8161)
• UI: search from page 2+ fails to reset pagination offset (#8109)
• Document and clarify how artifact references interact with data contracts (#8104)
• CLI: Support RBAC configuration (role mappings) (#8095)
• CLI: Dynamic help text via picocli command tree walking (#8028)
• CLI: Unify handling of the default group (#8025)
• CLI: Review short property names across all commands (#8024)
• Add missing HSTS headers to error pages (#2411)