v1.4.0-rc.6

[s-b-e-n-s-o-n]

Summary

• Security hardening: argon2id password hashing (replacing scrypt→SHA-1 chain), login brute-force lockout, concurrent session limits, full credential redaction, destructive action confirmation headers, webhook token per-endpoint scoping, OIDC redirect URL validation
• API improvements: OpenAPI 3.1.0 spec, versioned /api/v1 path, standardized collection envelopes with pagination links, machine-readable error contract
• UI enhancements: update/rollback confirmation dialogs, SHA-1 hash deprecation banner, font size & appearance customization, mobile dashboard scroll fix, announcement banner component, theme palette refresh
• Stability: EBUSY compose trigger retry with direct-write fallback, Node.js 24 requirement, cron-parser v5 upgrade, behavior load test correctness made advisory
• Docs: DEPRECATIONS.md, comprehensive API docs, security hardening changelog, OIDC migration guidance

Test plan

• 2116 backend tests passing (100% coverage)
• 1529 UI tests passing (100% coverage)
• E2E Cucumber tests passing
• QA tested via Playwright at desktop and mobile (375x667) viewports
• Lefthook full pipeline green (biome, qlty, build, test, e2e, zizmor, snyk)
• Load test smoke passing
• Mobile dashboard scroll verified on Android 16 Chrome report

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
drydock-website	Ready	Preview, Comment	Mar 8, 2026 3:52am

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!