web: v3.1.0

Features

• frontend: integrate user guide navigation links and add capture script (26bee1b)

Bug Fixes

• audit: preserve entity identities and metadata details in formatted event text (b66d420), closes #264
• audit: preserve metadata commas and retain target identities in event text (e75f138)
• audit: render request failure and retry action on audit query error (fe233e3), closes #265
• audit: traverse all pagination pages for audit logs and filtering (c4a17b3), closes #258
• evaluations: exclude closed forms from member pending queue (94480de), closes #237
• evaluations: traverse paginated assignment, form, and rule records across all pages (7d4a1f3)
• organizations: scope dashboard analytics cache keys to effective organization (f3e1505), closes #274
• organizations: traverse all API pagination pages for members and structure (ac92ef7), closes #273
• portfolio: persist and display verification comments on approved accomplishments (47dbcba), closes #251
• portfolio: render actionable error state on request failure with retry recovery (12dd659)
• portfolio: reset unsaved draft notes on accomplishment review dialog cancel (42b5a1f), closes #247
• portfolio: restrict accomplishment deletion to owners and pending/rejected status with audit logging (ec741f3)
• portfolio: traverse paginated accomplishment records across all pages (1597076)
• settings: prefer authoritative cleared organization email over stale membership (cdd7cc0)
• users: derive current membership synchronously from current user (52060bd), closes #275
• users: invalidate unit and directory caches and derive role dialog state (edbf982), closes #276

docs: v1.0.7

Documentation

• add static landing page and user guide implementation plan (d193660)

backend: v3.0.2

Bug Fixes

• evaluations: exclude closed forms from member pending queue (94480de), closes #237
• evaluations: make multi-rule assignment matrix generation atomic (c472aba), closes #239
• evaluations: record audit events on form updates and guard lifecycle mutations (06a50fb), closes #259
• evaluations: reset completed assignments on question creation and guard released forms (bc0b79b), closes #236
• organizations: exclude inactive user accounts from analytics total_users (f5b9cc5)
• organizations: isolate analytics actions to active tenant (ed96d35), closes #269
• organizations: record audit events for structure and membership mutations (4a206ee), closes #277
• portfolio: apply status and type query filters to member accomplishment queries (3f4771d)
• portfolio: enforce active membership and organization checks on accomplishment submission (6636dc7)
• portfolio: persist and display verification comments on approved accomplishments (47dbcba), closes #251
• portfolio: restrict accomplishment deletion to owners and pending/rejected status with audit logging (ec741f3)
• portfolio: return 404 for malformed accomplishment id on deletion (9071ebe)
• portfolio: serialize accomplishment deletion with database row locks (f61f6a6)
• portfolio: serialize accomplishment edits and reviews with concurrency locks (fbe9754)
• portfolio: validate organization identifiers at request boundary (a34afec)

web: v3.0.1

Bug Fixes

• audit: scope audit read endpoints and hooks by active organization (ed078d6), closes #268
• dashboard: count completed evaluation assignments using backend status (6436bb2), closes #240
• evaluations: record distinct audit action on results release (7dd9b2a), closes #263

Build and Dependencies

• deps-dev: bump postcss from 8.5.31 to 8.5.32 in /frontend (1930f62)
• deps-dev: bump postcss from 8.5.31 to 8.5.32 in /frontend (392f38d)
• deps-dev: bump typescript from 6.0.3 to 7.0.2 in /frontend (91fb385)
• deps-dev: bump typescript from 6.0.3 to 7.0.2 in /frontend (c82240e)
• deps: bump @lottiefiles/dotlottie-react from 0.17.14 to 0.20.0 in /frontend (a12aa4e)
• deps: bump @lottiefiles/dotlottie-react in /frontend (8fa7542)
• deps: bump react from 19.3.0 to 19.3.1 in /frontend (ed46fbf)
• deps: bump react from 19.3.0 to 19.3.1 in /frontend (c46d222)
• deps: bump react-hook-form from 7.86.0 to 7.91.0 in /frontend (3c2fc09)
• deps: bump react-hook-form from 7.86.0 to 7.91.0 in /frontend (deaa302)
• frontend: restore compatible dependency versions (85c31ec)

Tests

• frontend: add Playwright requirements and evidence pipeline (9b5e6ec)

CI

• testing: provision isolated PostgreSQL test environments (f00ac86)

docs: v1.0.6

Documentation

• release: describe direct release pull requests into main (f06872e)
• release: include stack follow-up review (07c8c15)
• release: record dev to main review (d8a61b6)
• testing: define concise requirements traceability matrix (cc8b5d1)
• testing: plan PostgreSQL and Playwright testing rollout (e81f20e)

Tests

• frontend: add Playwright requirements and evidence pipeline (9b5e6ec)

CI

• testing: provision isolated PostgreSQL test environments (f00ac86)

backend: v3.0.1

Bug Fixes

• audit: attribute audit events to authoritative organization (0056420), closes #248 #261
• audit: isolate failed audit inserts (fa57666), closes #256
• audit: neutralize spreadsheet formula injection in CSV exports (fc94803), closes #262
• audit: preserve full event metadata (587dc79), closes #257
• audit: reject invalid calendar bounds (de34636), closes #266
• audit: restore actor name search (e89cde6)
• audit: scope action catalog and search (de8c76e), closes #268
• audit: scope audit read endpoints and hooks by active organization (ed078d6), closes #268
• audit: validate filter parameters and include full end date (d009753), closes #266 #267
• evaluations: enforce required question existence guard during membership auto assignment (2327578), closes #238
• evaluations: exclude revoked and inactive members from assignment generation (2cdade8), closes #235
• evaluations: protect individual assignment results (3601738)
• evaluations: record distinct audit action on results release (7dd9b2a), closes #263
• organizations: allow re-adding and reactivating inactive position assignments (552d372), closes #271
• organizations: authorize organization updates (afe4389)
• organizations: isolate join requests by tenant (9f9f8d0), closes #252
• organizations: make join request approval atomic and validate role choices (7564c78), closes #270
• organizations: protect organization audit history (f71f160)
• organizations: require active join request administrators (43b944b), closes #253
• organizations: require active organization role for positional memberships (d08bf31), closes #272
• organizations: validate membership reactivation (7192441), closes #272
• users: enforce configured password validators (8baa023), closes #278
• users: restrict global account management (7061297), closes #254
• users: scope membership details to the active organization (86c54c2), closes #255

Build and Dependencies

• deps: update django requirement from <6.2,>=6.0 to >=6.1.2,<6.2 in /backend (ad7d70b)
• deps: update django requirement in /backend (dd2f2c0)

Tests

• backend: add seeded E2E support and database evidence (db141ee)

CI

• testing: provision isolated PostgreSQL test environments (f00ac86)

web: v3.0.0

⚠ BREAKING CHANGES

• auth: browser clients must use session cookies and CSRF bootstrapping. Existing clients must sign in again; legacy token headers no longer authenticate.

Features

• users: add private profile picture uploads (f58366a)

Bug Fixes

• auth: replace browser bearer tokens with protected sessions (b700e1a)
• security: enforce browser policy and safe proof links (1899454)

Build and Dependencies

• security: declare CSP and local animation dependencies (8b54f7b)

docs: v1.0.5

Documentation

• security: explain session migration and hosting requirements (fdd34d2)
• setup: document private avatars and root environment template (09baeeb)

backend: v3.0.0

⚠ BREAKING CHANGES

• auth: browser clients must use session cookies and CSRF bootstrapping. Existing clients must sign in again; legacy token headers no longer authenticate.

Features

• users: add private profile picture uploads (f58366a)

Bug Fixes

• auth: replace browser bearer tokens with protected sessions (b700e1a)
• security: enforce browser policy and safe proof links (1899454)

Build and Dependencies

• backend: add S3 storage support (b570947)
• security: declare CSP and local animation dependencies (8b54f7b)

Documentation

• setup: document private avatars and root environment template (09baeeb)

web: v2.0.0

⚠ BREAKING CHANGES

• database: Evaluation and organization-resource endpoints require active organization context. Generic assignment writes are disabled, and raw analytics responses move to the administrator-only analytics_export action.

Bug Fixes

• database: enforce evaluation integrity and optimize queries (bc749a7)