v0.6.0

0.6.0 - 2026-10-25

Added

• Add the custom managers the Makefile pins rely on by @BoxBoxJason in 771ee5b7

Changed

• Prepare new release by @BoxBoxJason in 01bef429
• Audit the frontend's npm dependencies on every push by @BoxBoxJason in 19c464f2
• Stop persisting the GITHUB_TOKEN in release and chart checkouts by @BoxBoxJason in ecee4026
• Gate publishing on tests and keep prereleases off floating tags by @BoxBoxJason in d1900c17
• Pass the tag to the version script through env and validate it by @BoxBoxJason in aabca5e8
• Correct the stale SESSION_SECRET comment in .env.example by @BoxBoxJason in 8325b343
• Serve FRONTEND_DIR under a Content Security Policy by @BoxBoxJason in 6257bed4
• Describe the __Host- session cookie and logout revocation by @BoxBoxJason in 6d2529cf
• Warn at startup when GITLAB_URL or PUBLIC_URL is plain http by @BoxBoxJason in 94c91ff7
• Pin dependencies by @renovate[bot] in #31

Fixed

• Date backdated issues and comments on receipt by @BoxBoxJason in ec293aaa
• Reuse /readyz's GitLab check for five seconds by @BoxBoxJason in c8e236e8
• Clear custom templates and headers on every hook heal by @BoxBoxJason in 171bf44c
• Cache allowed-group refusals like successes by @BoxBoxJason in 3dded71f
• Refuse OAuth tokens issued to other applications by @BoxBoxJason in ad4a0b2c
• Fail rendering on an unknown config.api.auth by @BoxBoxJason in e9ac7bec
• Move the metrics port to a ClusterIP Service of its own by @BoxBoxJason in cc4b7fa9
• Refuse the example CHANGEME database password by @BoxBoxJason in 9f10f90d
• Require IMAGE_TAG instead of defaulting to latest by @BoxBoxJason in 1bbc5313
• Keep the metrics listener on localhost in the env example by @BoxBoxJason in f1afc5ca
• Confine FRONTEND_DIR to its directory and skip dotfiles by @BoxBoxJason in eabf88cb
• Revoke the GitLab tokens of a session that ends by @BoxBoxJason in a20055c7
• Bind session and login cookies to the origin with __Host- by @BoxBoxJason in 0d621a59
• Require WEBHOOK_SECRET to be at least 32 characters by @BoxBoxJason in 11fdc1cc
• Resolve a reused username to its most recent holder by @BoxBoxJason in 2caafcb5
• Ignore activity whose actor ID is not a GitLab user ID by @BoxBoxJason in e13ba7c4
• Re-check exclusion inside the evaluation transaction by @BoxBoxJason in 09a1a883
• Run the hourly definition sweep under the bootstrap lease by @BoxBoxJason in 6360a6d3
• Revoke an unrecorded tier GitLab holds when superseding it by @BoxBoxJason in ce9b5328
• Only link GitLab profiles for usernames GitLab could issue by @BoxBoxJason in 885bce07
• Stop the write client replaying mutations on 5xx by @BoxBoxJason in 4895ee9d
• Keep DATABASE_DSN out of connection errors by @BoxBoxJason in f1a19a0c
• Serialize award delivery passes with a database lease by @BoxBoxJason in ebedca48
• Bind GitLab holdings to the recipient's user ID by @BoxBoxJason in ea66977f
• Update all dependencies by @renovate[bot] in #40

Removed

• Remove the possibility to hardcode secrets by @BoxBoxJason in 6ce22029

What's Changed

• chore(deps): pin dependencies by @renovate[bot] in #31
• fix(deps): update all dependencies by @renovate[bot] in #40

Full Changelog: v0.5.0...v0.6.0