v1.0.0-beta.4

What's Changed

• Fix IPSec S2S tunnel creation and VPN list scrolling by @xTITUSMAXIMUSX in #414
• Add DHCP lease release and switch lease fetch to GraphQL by @xTITUSMAXIMUSX in #415
• Add in-app bug reporter via GitHub device flow by @xTITUSMAXIMUSX in #417
• Add IPSec operational status, reset/bounce, and isolate OpenVPN status by @xTITUSMAXIMUSX in #418
• Add adjustable dashboard card heights and widths by @xTITUSMAXIMUSX in #419
• Fixed tables calling delete and rule reorder by @xTITUSMAXIMUSX in #420
• Re-anchor firewall separators when rules are renumbered by @xTITUSMAXIMUSX in #421
• Add NetBird and Tailscale container apps by @xTITUSMAXIMUSX in #422
• Feat/api token foundation by @xTITUSMAXIMUSX in #423
• chore: remove unused Next.js starter assets from frontend/public by @MydsiIversen in #427
• feat: allow onboarding and running without a connected router by @MydsiIversen in #426
• docs: add documentation site by @MydsiIversen in #424
• docs: document onboarding skip path and zero-instance dashboard by @MydsiIversen in #431
• chore: remove XFRM suffix from VTI interface labels by @MydsiIversen in #432
• fix: enforce dedicated feature groups on six interface routers by @MydsiIversen in #433
• feat: add segment routing (SRv6) backend module by @MydsiIversen in #435
• fix: stop entrypoint from masking failed database migrations by @MydsiIversen in #440
• test: add golden-file harness for permission equivalence by @MydsiIversen in #441
• feat: add organization schema with backfill and verifier by @MydsiIversen in #442
• feat: add org-scoped connection plumbing and middleware org context by @MydsiIversen in #443
• feat: move admin surface onto org-scoped connections by @MydsiIversen in #446
• test: add adversarial suite skeleton with unscoped-connection canary by @MydsiIversen in #447
• feat: move streaming and power surfaces onto org-scoped connections by @MydsiIversen in #448
• feat: move remaining DB-backed handlers onto org-scoped connections by @MydsiIversen in #449
• docs: document organization groundwork and upgrade verification by @MydsiIversen in #450
• fix: three defects found in live-router testing by @MydsiIversen in #451
• feat: assert row organization on by-id admin mutations by @MydsiIversen in #453
• feat: FK-validate and org-confine API token allowed-ids at creation by @MydsiIversen in #455
• fix: close unauthenticated empty-system restore, require typed confirm by @MydsiIversen in #457
• feat: add audit context columns and audit the admin surface by @MydsiIversen in #459
• feat: add revocation bus so grant/token revocation closes live streams by @MydsiIversen in #461
• feat: org-scope the monitoring/console WebSockets and wire revocation by @MydsiIversen in #462
• fix: require a shared secret on internal API routes by @MydsiIversen in #464
• feat: per-instance SSH key encryption with re-encrypt migration by @MydsiIversen in #466
• feat: row-level-security foundation for organization isolation by @MydsiIversen in #469
• feat: relocate SSO grant reconciliation to a backend endpoint (DO NOT MERGE yet) by @MydsiIversen in #468
• feat: extend RLS policies to the per-user authorization tables by @MydsiIversen in #470
• feat: org ADMIN gets full access on their org's instances (flag-gated) by @MydsiIversen in #471
• feat: set site orgId explicitly on creation by @MydsiIversen in #472
• fix: RLS proof test skips cleanly without CREATEROLE by @MydsiIversen in #473
• feat: context-bootstrap bypass so org resolution works under FORCE RLS by @MydsiIversen in #474
• docs: operator runbook for enabling org enforcement by @MydsiIversen in #475
• test: Golden Rule structural proof + frontend-role grant docs by @MydsiIversen in #476
• feat: add GET /session/organizations for the org UI by @MydsiIversen in #477
• chore: regenerate OpenAPI spec to match backend by @MydsiIversen in #480
• feat: organization-aware sites UI (switcher, grouping, admin label) by @MydsiIversen in #479
• chore: drop the inert-phase DEFAULT on sites.orgId by @MydsiIversen in #482
• feat: move oauth_role_mappings writes to the backend by @MydsiIversen in #484
• docs: clarify backup is platform-admin-only and whole-system by @MydsiIversen in #485
• feat: move oauth_providers writes to the backend by @MydsiIversen in #487
• fix: let a multi-org system admin act globally without org_id by @MydsiIversen in #489
• feat: organization management endpoints (orgs + memberships) by @MydsiIversen in #491
• feat: organization management UI by @MydsiIversen in #492
• fix: promote the first user to ADMIN atomically during onboarding by @MydsiIversen in #494
• fix: firewall groups capabilities crash on x.y.z VyOS versions by @MydsiIversen in #496
• fix: org ADMIN/OWNER sees their org's sites under enforcement by @MydsiIversen in #498
• fix: friendly error when SSO role mapping denies access by @MydsiIversen in #499
• fix: org ADMIN sees org instances under enforcement; adversarial xfails now strict by @MydsiIversen in #501
• docs: organization management and enforcement have shipped by @MydsiIversen in #502
• fix: site-updates banner includes org-admin's org instances under enforcement by @MydsiIversen in #504
• fix: enforce RBAC on routing-policy config/batch/reorder endpoints by @MydsiIversen in #509
• fix: bridge firewall base chains need the filter keyword on VyOS 1.4 too by @MydsiIversen in #510
• Integrate audit fixes #511–#528 (conflicts resolved, DB suite verified) by @MydsiIversen in #529
• fix: gate backend startup on completed migrations by @MydsiIversen in #512
• chore: CI workflow running the backend suite against a real Postgres by @MydsiIversen in #513
• fix: grant FIREWALL_BRIDGE and FIREWALL_FLOWTABLES on the live paths by @MydsiIversen in #517
• fix: middleware polling-endpoint typo and silent session-resolution failure by @MydsiIversen in #518
• fix: don't hold a DB transaction across the connect reachability test by @MydsiIversen in #519
• fix: version-gating corrections in the mapper/builder layer by @MydsiIversen in #520
• fix: savepoint replace-mode restore rows like merge mode by @MydsiIversen in #521
• fix: sole OWNER cannot demote themselves into an owner-less org by @MydsiIversen in #522
• fix: reject malformed segment-routing batch operations by @MydsiIversen in #523
• fix: harden the unauthenticated onboarding surface by @MydsiIversen in #524
• fix: close the org-existence oracle and small revocation/WS gaps by @MydsiIversen in #525
• fix: users.role is backend-owned — drop the frontend UPDATE path by @MydsiIversen in #526
• fix: verify stored SSO id_tokens against the provider JWKS by @MydsiIversen in #527
• test: close the canary and Golden Rule guardrail blind spots by @MydsiIversen in #515
• test: adversarial coverage for org CRUD and token-use confinement by @MydsiIversen in #528
• fix: read the session cookie under its __Secure- name too by @MydsiIversen in #516
• fix: org row-check when granting instance/site assignments by @MydsiIversen in #514
• chore(deps): bump pyjwt from 2.10.1 to 2.13.0 in /backend by @dependabot[bot] in #530
• chore(deps): bump svgo from 3.3.3 to 3.3.4 in /docs-site by @dependabot[bot] in #533
• chore(deps): bump next from 16.2.6 to 16.2.12 in /frontend by @dependabot[bot] in #534
• chore(deps-dev): bump js-yaml from 4.2.0 to 4.3.0 in /frontend by @dependabot[bot] in #535
• feat: Add VRF BGP redistribute and redistribute table support in UI s… by @Jarnster in #538
• chore(deps): bump fast-uri from 3.1.3 to 3.1.5 in /docs-site by @dependabot[bot] in #539
• chore(deps): bump cryptography from 48.0.1 to 50.0.0 in /backend by @dependabot[bot] in #540
• chore(deps): bump sharp and next in /frontend by @dependabot[bot] in #541
• chore(deps-dev): bump brace-expansion from 5.0.6 to 5.0.9 in /frontend by @dependabot[bot] in #542
• fix: Immediate fix for Unified View within the DHCP service by @Jarnster in #543
• feat: Registry for all unified views by @Jarnster in #544
• fix(sso): Entra id_token group claims + correct OAuth error redirect by @xTITUSMAXIMUSX in #549
• deps: bump asyncssh to 2.23.1 (GHSA-2wxc-x7rj-hg8f) by @katsugtgz in #551
• chore(deps-dev): bump js-yaml from 4.3.0 to 4.3.2 in /frontend by @dependabot[bot] in #555
• chore(deps): bump nanoid from 3.3.11 to 3.3.18 in /frontend by @dependabot[bot] in #556
• feat(UI/UX): Container update status indicator by @Jarnster in #554
• feat: DDM diagnostics and hardware sensors for interfaces & system by @Jarnster in #553
• fix: Resolve GUID group claims bug in resolving role mapping by @Jarnster in #557
• feat(vrf): Add BGP address-family network configuration support (#505) by @Jarnster in #558
• docs: Generate OpenAPI spec for VRF BGP AF (91cb450) by @Jarnster
• fix(ui/ux): persist navigation shell across route changes (#532) (de8474e) by @Jarnster
• deps: Change frontend/package.json to resolve 3 vulnerabilities (66f3fa6) by @Jarnster
• readme: Replace Container Registry embed (8820dc3) by @Jarnster
• readme: Add VyMCP suggestion (413cf79) by @Jarnster
• feat: Add KVM support warning in install.sh (9a09c4b) by @Jarnster
• chore: Revise README.md (054a45d) by @Jarnster
• docker: Require SSH key env in docker-compose (e81015a) by @Jarnster
• docs: Add yarn.lock and mdx files for transceivers and HW sensors (1986362) by @Jarnster
• chore: Delete legacy zones.ts (bc3b113) by @Jarnster
• fix: Resolve GUID group claims bug in resolving role mapping (2924f84) by @Jarnster
• docs: Update OpenAPI spec regarding ContainerImageUpdateStatus (7ba242f) by @Jarnster
• feat(ui/ux): Container update status indicator (01ad0c8) by @Jarnster
• docs: Docusaurus fix broken dependencies (2536ce0) by @Jarnster
• docs: Remove unsupported 'future' field in Docusaurus.config (1894691) by @Jarnster
• docs: Update OpenAPI spec (14dfef1) by @Jarnster
• fix: Classify DDM alarm rows before measurement prefixes (cf0a14b) by @Jarnster
• improve: Applied useful codex review suggestions (21ec978) by @Jarnster
• feat: DDM diagnostics and hardware sensors for interfaces & system (e85ff0c) by @Jarnster
• fix: Interface sums not adding up correctly for VLANs (26e87bc) by @Jarnster
• fix(sso): preserve id_token group claims for Entra logins + correct OAuth error redirect (#549) (828ac17) by @xTITUSMAXIMUSX
• fix: Pydantic model validations in nhrpy.py (e2c227e) by @Jarnster
• feat: Registry for all unified views (5ec3411) by @Jarnster
• feat: Add VRF BGP redistribute and redistribute table support in UI schema (#506) (42a3d6c) by @Jarnster
• feat: Create VRF static routes with no explicit routing type (#507) (eafc3ee) by @Jarnster
• fix: forward __Secure- session cookie in the remaining API proxies (6b7add8) by @MydsiIversen
• Integrate audit fixes by @MydsiIversen
• SSO, CI workflow and org fixes by @MydsiIversen

New Contributors

• @katsugtgz made their first contribution in #551

Full Changelog: v1.0.0-beta.3...v1.0.0-beta.4