Unstable 0.3.13-unstable.20260831040815

What's Changed

• feat: Adopt centralized release workflows by @rubenvdlinde in #673
• refactor: Delegate MappingService to OpenRegister's mapping engine by @rubenvdlinde in #671
• Release: merge development into beta by @github-actions[bot] in #674
• feat: OpenSpec implementation by @rubenvdlinde in #682
• fix: Revert licence to agpl for App Store compatibility by @rubenvdlinde in #664
• refactor: Move website/ to docusaurus/ pattern (docs/ at root) by @rubenvdlinde in #666
• feat: Add 3 integration adapter OpenSpecs by @rubenvdlinde in #678
• [Docs] Feature overview with standards compliance by @rubenvdlinde in #700
• feat: Enrich all OpenSpec specifications by @rubenvdlinde in #693
• feat: use ObjectServiceMapperAdapter from OpenRegister by @bbrands02 in #723
• Updated workflow to only trigger on pr create and on push by @remko48 in #725
• fix: add top and left spacing to empty-state messages across all object types by @bbrands02 in #729
• fix: align list header search and actions on one row with top spacing by @bbrands02 in #730
• chore(sbom): remove per-app SBOM workflow + checked-in SBOM (release-asset only) by @rubenvdlinde in #735
• chore(ci): onboard openconnector to the central reusable Quality workflow by @rubenvdlinde in #736
• chore: add .github/CODEOWNERS for auto-review-request by @rubenvdlinde in #738
• feat(openspec): openconnector-adopt-or-abstractions — RuleService cleanup + retention dedupe by @rubenvdlinde in #739
• feat(openspec): openconnector-legacy-quality-cleanup tracking change by @rubenvdlinde in #741
• feat(docs): adopt @conduction/docusaurus-preset + move to openconnector.conduction.nl by @rubenvdlinde in #747
• chore(docs): sync @conduction/docusaurus-preset lockfile to 1.5.1 by @rubenvdlinde in #757
• chore(docs): @conduction/docusaurus-preset 2.6.1 by @rubenvdlinde in #758
• ci(docs): deploy from documentation branch (not development) by @rubenvdlinde in #760
• docs(journeydoc): bootstrap capture-driven user documentation (ADR-030) by @rubenvdlinde in #764
• chore(security): require 24h cooldown on npm packages by @rubenvdlinde in #766
• spec(openconnector): bring all changes under ADR-032 20-task cap (Wave 2) by @rubenvdlinde in #770
• feat(docs): wire AI-crawler baseline (preset 3.4.0 + validator + llms.txt) by @rubenvdlinde in #776
• feat(docs): per-app OG card + accurate llms.txt links by @rubenvdlinde in #777
• chore(docs): use validator bin from preset 3.5.0 by @rubenvdlinde in #778
• chore(docs): consolidate docusaurus/ into docs/ for fleet consistency by @rubenvdlinde in #779
• chore(docs): bump preset to ^3.6.0 + sync lockfile by @rubenvdlinde in #781
• chore(deps): upgrade preset lockfile to 3.6.1 (unbreaks deploy) by @rubenvdlinde in #783
• chore(deps): preset lockfile 3.6.1 -> 3.6.2 (validator patch) by @rubenvdlinde in #788
• chore(deps): preset lockfile 3.6.2 -> 3.7.0 (sitemap lastmod auto-applies) by @rubenvdlinde in #792
• fix(quality): clean development to 0 failing CI checks by @rubenvdlinde in #794
• chore(deps): preset lockfile 3.7.1 -> 3.8.0 (BreadcrumbList + TechArticle + IndexNow) by @rubenvdlinde in #795
• chore(deps): preset lockfile 3.8.0 -> 3.9.0 (TechArticle gate) by @rubenvdlinde in #799
• fix(docs): descriptive homepage title (#80) by @rubenvdlinde in #801
• fix(docs): hand-written meta descriptions (#81) by @rubenvdlinde in #803
• chore(docs): bump @conduction/docusaurus-preset to 3.10.0 (#79) by @rubenvdlinde in #805
• fix(phpcs): clean lib/ to 0 errors and re-enable code-quality gate by @rubenvdlinde in #808
• feat(manifest-v2): adopt universal widget manifest (skip v1) by @rubenvdlinde in #811
• fix(build): pin @vueuse/core to ^11 + add ts-loader rule by @rubenvdlinde in #812
• fix(backend): cross-DB SQL + dropped ObjectService::getRegisters by @rubenvdlinde in #813
• chore(brand): align app-store hex to canonical cobalt #21468B by @rubenvdlinde in #762
• chore: Harmonize .gitignore with shared template by @rubenvdlinde in #703
• spec(openconnector): add 4 connector-category capabilities (ADR-019) by @rubenvdlinde in #767
• feat: Add OpenSpec sync and issue triage workflows by @rubenvdlinde in #679
• fix: resolve cross-entity slug references during configuration import by @bbrands02 in #727
• feat(pdok): PDOK Locatieserver adapter (closes #751) by @rubenvdlinde in #752
• feat(manifest-v2): LogIndex typed-primitive wrapper for /sources/logs by @rubenvdlinde in #823
• chore: remove dead .php-cs-fixer.dist.php and stray psalm copy.xml by @rubenvdlinde in #842
• chore: sync canonical root configs + mechanical phpmd cleanup by @rubenvdlinde in #849
• feat(i18n): Wrap all frontend strings and complete translations (236→453 keys) by @rubenvdlinde in #717
• fix(sync): scope-check cleanup candidates before unscoped delete by @rubenvdlinde in #851
• fix(controllers): accept string UUIDs on action endpoints by @rubenvdlinde in #852
• chore(cleanup): retire orphan trees + dashboard widget chain by @rubenvdlinde in #853
• feat(dashboard): KPI tiles + charts + action handlers + manifest polish by @rubenvdlinde in #854
• fix(tests): restore phpunit harness on chain-E (closes #844) by @rubenvdlinde in #855
• feat(sync): port Twig endpoint templating + event-trigger guard from #745 (re-open) by @rubenvdlinde in #856
• fix(user-login): cherry-pick CORS preflight + session-token + basic-auth from #555 (re-open) by @rubenvdlinde in #857
• fix(phpcs): auto-fix 91 sniff violations from Tier-4 cascade by @rubenvdlinde in #866
• feat(actions): bespoke modals + sync picker (closes #835 #836 #847) by @rubenvdlinde in #867
• chore(deps): bump PHP requirement to ^8.3 by @rubenvdlinde in #868
• fix(sync): migrate updateTargetOpenRegister delete to scoped ObjectService API by @rubenvdlinde in #871
• feat(sync): bespoke synchronization editor (closes #834) by @rubenvdlinde in #872
• feat(rules): bespoke Rule editor with visual condition + action builder (closes #833) by @rubenvdlinde in #873
• feat(mappings): bespoke 3-tab rules editor on MappingDetail (closes #832) by @rubenvdlinde in #874
• feat(logs): pre-filter logs page by parent row (closes #837) by @rubenvdlinde in #875
• docs: port README license policy + prometheus-metrics admin doc by @rubenvdlinde in #879
• fix: port findByUuid→find + _object double-wrap guard + joblogs migration by @rubenvdlinde in #880
• docs(architecture): IA design rules ADR by @rubenvdlinde in #883
• fix(sync): register 'synchronization' object type in SynchronizationDetailPage by @rubenvdlinde in #884
• chore(deps): regenerate composer.lock after #868 PHP ^8.3 bump by @rubenvdlinde in #887
• chore(deps): bump composer config.platform.php to 8.3 by @rubenvdlinde in #888
• Release: merge development into beta by @github-actions[bot] in #688
• chore: drop dead settings store + phpcbf cosmetic fixes (#885 #889) by @rubenvdlinde in #891
• fix(jobs): jobClass NcSelect + standalone sync picker (closes #886) by @rubenvdlinde in #893
• chore(deps): bump @conduction/nextcloud-vue beta.68 → beta.71 (advances #890) by @rubenvdlinde in #894
• chore(info.xml): canonicalize PHP min, NC version range, licence spelling by @rubenvdlinde in #895
• chore(ci): add missing canonical workflows by @rubenvdlinde in #896
• style(phpcs): fix lib/Action debt (advances #889) by @rubenvdlinde in #897
• style(phpcs): fix lib/Cron debt (advances #889) by @rubenvdlinde in #898
• style(phpcs): fix lib/Twig debt (advances #889) by @rubenvdlinde in #899
• chore(modals): drop EditMapping.vue legacy orphan tree by @rubenvdlinde in #900
• style(phpcs): fix Settings/Sections/Exception/EventListener/Http debt (advances #889) by @rubenvdlinde in #901
• chore(deps): bump nc-vue beta.71 → beta.73 + drop bootstrap-vue (closes #890) by @rubenvdlinde in #902
• feat(mapping-editor): drag-reorder + live preview (closes #876) by @rubenvdlinde in #903
• style(phpcs): fix small Controller debt (advances #889) by @rubenvdlinde in #904
• style(phpcs): fix MetricsController debt (advances #889) by @rubenvdlinde in #905
• style(phpcs): fix AppInfo/Repair/PdokUpstreamException debt (advances #889) by @rubenvdlinde in #906
• feat(sync-editor): JsonLogic conditions + mapping preview + file picker (closes #878) by @rubenvdlinde in #907
• feat(rule-editor): extended JsonLogic ops + bespoke action forms (closes #877) by @rubenvdlinde in #908
• style(phpcs): clean lib/Migration/ debt (advances #889) by @rubenvdlinde in #910
• style(phpcs): clean PdokConnector + small Service files (advances #889) by @rubenvdlinde in #911
• style(phpcs): clean lib/Service/ConfigurationHandlers/ debt (advances #889) by @rubenvdlinde in #912
• style(phpcs): clean SOAP + Settings + OrganisationBridge (advances #889) by @rubenvdlinde in #913
• style(phpcs): clean AuthenticationService + SyncContractProvider (advances #889) by @rubenvdlinde in #914
• style(phpcs): clean Ui/Jobs/Sources controllers (advances #889) by @rubenvdlinde in #916
• feat(dso): port DSO/Omgevingsloket STAM adapter to post-OR-cutover surface (#881) by @rubenvdlinde in #915
• style(phpcs): clean EndpointService.php (advances #889) by @rubenvdlinde in #917
• style(phpcs): clean ConfigurationService.php (advances #889) by @rubenvdlinde in #918
• style(phpcs): clean SynchronizationService.php (advances #889) by @rubenvdlinde in #919
• style(phpcs): clean UserService.php (advances #889) by @rubenvdlinde in #920
• style(phpcs): clean SecurityService.php (advances #889) by @rubenvdlinde in #921
• style(phpcs): clean RuleService.php (advances #889) by @rubenvdlinde in #922
• style(phpcs): clean LegacyToRegisterMigrator.php (advances #889) by @rubenvdlinde in #923
• style(phpcs): clean SoftwareCatalogueService.php (advances #889) by @rubenvdlinde in #924
• style(phpcs): clean CallService.php (advances #889) by @rubenvdlinde in #925
• style(phpcs): clean 7 controllers (advances #889) by @rubenvdlinde in #926
• style(phpcs): clean 7 services - drives #889 to 0 errors by @rubenvdlinde in #927
• fix(schemas): rule.conditions accepts object (JsonLogic shape) (closes #909) by @rubenvdlinde in #928
• chore(phpstan): regenerate baseline (544 → 141, advances #848) by @rubenvdlinde in #929
• chore(phpstan): remove 24 unread properties (advances #848) by @rubenvdlinde in #930
• chore(phpstan): fix docblock types + IRequest migration (advances #848) by @rubenvdlinde in #931
• chore(phpstan): fix possibly-undefined variables (advances #848) by @rubenvdlinde in #932
• chore(phpstan): kill dead-branch comparisons (advances #848) by @rubenvdlinde in #933
• feat(manifest): add 'View logs' header button on 5 index pages by @rubenvdlinde in #934
• fix(icons): restore pre-refactor TextBoxOutline for 'View logs' actions by @rubenvdlinde in #938
• retrofit: annotate openconnector Bucket 1 (8 methods / 9 REQs) by @rubenvdlinde in #937
• feat(menu): restore pre-refactor MDI icons across the nav menu by @rubenvdlinde in #939
• retrofit: reverse-spec object-service-shim (5 REQs / 9 methods) by @rubenvdlinde in #940
• retrofit: reverse-spec authorization-jwt (5 REQs / 9 methods) by @rubenvdlinde in #941
• retrofit: reverse-spec http-call-engine (5 REQs / 15 methods) by @rubenvdlinde in #942
• retrofit: reverse-spec events-cloudevents (5 REQs / 17 methods) by @rubenvdlinde in #943
• retrofit: reverse-spec authentication-twig (5 REQs / 22 methods) by @rubenvdlinde in #944
• retrofit: reverse-spec repair-and-app-boot (2 REQs / 2 methods) by @rubenvdlinde in #945
• retrofit: reverse-spec storage-uploads (4 REQs / 4 methods) by @rubenvdlinde in #946
• retrofit: reverse-spec organisation-bridge (5 REQs / 6 methods) by @rubenvdlinde in #947
• retrofit: reverse-spec xml-response (5 REQs / 7 methods) by @rubenvdlinde in #948
• retrofit: reverse-spec job-scheduling (5 REQs / 13 methods) by @rubenvdlinde in #949
• retrofit: reverse-spec logs-and-statistics (5 REQs / 14 methods) by @rubenvdlinde in #950
• retrofit: reverse-spec flow-token-helper (5 REQs / 21 methods) by @rubenvdlinde in #951
• retrofit: reverse-spec software-catalogus-events (5 REQs / 23 methods) by @rubenvdlinde in #952
• retrofit: reverse-spec mapping-and-search (5 REQs / 24 methods) by @rubenvdlinde in #953
• retrofit: reverse-spec rule-pipeline (5 REQs / 31 methods) by @rubenvdlinde in #954
• retrofit: reverse-spec configuration-export-import (5 REQs / 35 methods) by @rubenvdlinde in #955
• retrofit: reverse-spec user-management-and-login (5 REQs / 31 methods) by @rubenvdlinde in #956
• retrofit: reverse-spec endpoint-runtime (5 REQs / 32 methods) by @rubenvdlinde in #957
• retrofit: reverse-spec synchronization-engine (5 REQs / 97 methods) by @rubenvdlinde in #958
• feat(dashboard): drop top date-range picker — per-widget chips replace it by @rubenvdlinde in #971
• chore(nav): adopt three-section nav model + bump nc-vue to beta.97 by @rubenvdlinde in #972
• retrofit: drive openconnector spec-coverage to 0 (45 backend + 370 frontend) by @rubenvdlinde in #974
• feat(nav): add Features & roadmap item + roadmap page (three-item nav) by @rubenvdlinde in #975
• feat(preferences): generic per-user preferences endpoint by @rubenvdlinde in #976
• feat(integrations): ship 'Synced from' as a Path-2 registry leaf by @rubenvdlinde in #973
• retrofit: spec-cover preferences API + synced-from tab by @rubenvdlinde in #979
• [change request] openconnector notifications by @rubenvdlinde in #978
• fix(integrations): Synced-from provider returns contracts (was always empty/500) by @rubenvdlinde in #980
• fix: resolve hydra mechanical gates (spdx, nc-input-labels, modal-isolation) by @rubenvdlinde in #988
• fix(ci+manifest): green the validate check (tooling + action conformance) by @rubenvdlinde in #989
• feat(integration): synchronization contract provider + synced-from-leaf regression e2e by @rubenvdlinde in #982
• fix: real bugs from fleet quality sweep (phpcs, Exception guard, undeclared prop, publiccode) by @rubenvdlinde in #992
• test(e2e): 95-test Playwright spec coverage suite for all 7 openspec groups by @rubenvdlinde in #993
• fix(security): clear Bucket-B (ADR-023 + auth/routing) by @rubenvdlinde in #994
• refactor(CallService): decompose call() to cut complexity (behavior-preserving) by @rubenvdlinde in #995
• test(gate-19): e2e-coverage zero-uncovered — annotate all 44 spec scenarios by @rubenvdlinde in #998
• refactor: migrate deprecated IConfig app-values to IAppConfig by @rubenvdlinde in #997
• fix(gate19): add @e2e exclude to 4 backend retrofit specs by @rubenvdlinde in #999
• fix(security): redact secrets from CallLog request/response by @rubenvdlinde in #1013
• fix(gate-19): replace whole-spec excludes with real UI Playwright tests by @rubenvdlinde in #1014
• fix(jobs): per-job error handling + restore session user across cron pass (#1005, #1006) by @rubenvdlinde in #1018
• fix(sync): write *_log rows once instead of create-then-update against append-only schemas (#1007) by @rubenvdlinde in #1020
• fix(tests): unblock CallService/JobService/SyncService unit suites — ObjectEntity mock no longer relies on magic getUuid (#1015) by @rubenvdlinde in #1023
• fix(callservice): TLS verify guard + temp cert hygiene + async cleanup + bounded rate-limit headers (#1011, #1012) by @rubenvdlinde in #1022
• fix(sync): test-mode no-writes + originId dedupe + write-amp + defensive cleanup + no auto-create-source (#1008, #1009, #1010, #1016, #1017) by @rubenvdlinde in #1021
• test: align ConfigurationService + SynchronizationContractProvider tests with current implementation (#1024) by @rubenvdlinde in #1026
• test: align Endpoint/IBabsConnector/Job tests with current implementation (#1025) by @rubenvdlinde in #1027
• fix(deps): bump @conduction/nextcloud-vue to beta.108 — fix table view em-dash (#996) by @rubenvdlinde in #1019
• Release: merge development into beta by @github-actions[bot] in #892
• fix(security): bump symfony/http-foundation to 7.4.13 (CVE-2026-48736) by @rubenvdlinde in #1029
• fix: restore CI green — PHPUnit, PHPStan, PHPCS by @rubenvdlinde in #1030
• fix(deps): use pre-built beta.108 git-SHA while Actions OIDC is blocked by @rubenvdlinde in #1031
• fix(security): C1 DSO signature gate, C2 endpoint write bypass, C3 JWT algo pin by @rubenvdlinde in #1033
• fix(security): H1 JWK temp file, H2 HS512, M4 base64url, L1 iat/nbf, L2 hash_equals by @rubenvdlinde in #1034
• fix(security): H3 job_log on executeJob failure, M1 log-before-timeline, L4 error surfacing by @rubenvdlinde in #1035
• fix(security): M2 header normalisation, M3 users/groups ACL, L3 redact regex by @rubenvdlinde in #1036
• test(e2e): add UI specs and Playwright tests for Sources, Consumers, Webhooks, Jobs, CloudEvents by @rubenvdlinde in #1032
• fix(security): bump twig/twig to ^3.27.0 (CVE-2026-48805/06/07/08, CVE-2026-46636) by @rubenvdlinde in #1037
• fix(ci): clear PHPStan/PHPUnit/PHPCS/ESLint debt — check:strict green by @rubenvdlinde in #1039
• fix(security): wave-3 critical fixes by @rubenvdlinde in #1040
• fix(security): wave-5 — close C2 partial-fix in parseDynamicXsd (XXE/SSRF) by @rubenvdlinde in #1042
• fix(security): wave-7 critical C1-C4 (JWT silent error + OAuth token validation + stack trace + SSRF on token endpoints) by @rubenvdlinde in #1043
• fix(security): mark source encryptedToken/encryptedApiKey/mtls.* write-only (#242, closes #245) by @rubenvdlinde in #1046
• fix(security): make rule inbound-apiKey impersonation map write-only (#147 last residual) by @rubenvdlinde in #1047
• docs(sources): app-side credential injection + refreshed add-source walkthrough by @MWest2020 in #1045
• docs(openspec): endoflife-date-source ff spec — endoflife.date source preset by @rubenvdlinde in #1052
• spec: or-integration-provider (openconnector#824) by @rubenvdlinde in #1053
• feat(sources): endoflife-date-source — endoflife.date source preset + EOL registers by @rubenvdlinde in #1054
• spec: dashboard-http-datasource — governed HTTP/JSON resolve façade (launchpad live-data leaf) by @rubenvdlinde in #1055
• feat(dashboard-http-datasource): governed read-only resolve facade + archive by @rubenvdlinde in #1056
• fix(sync): coerce bare-scalar source items (#1050) + correct REQ-002 array sourceType (#1051) by @rubenvdlinde in #1057
• i18n(schema): author openconnector property titles in English + NL l10n by @rubenvdlinde in #1060
• feat(sources): Wave 0 — 10 live-verified gathering connectors formalized + scheduled by @rubenvdlinde in #1061
• chore(deps): bump @conduction/nextcloud-vue to ^1.0.0-beta.221 by @rubenvdlinde in #1062
• i18n(l10n): complete en/nl runtime translation coverage by @rubenvdlinde in #1064
• feat(vue3): migrate to Vue 3 + @conduction/nextcloud-vue@2, flip sync-contract leaf to renderMode:mount, harden the leaf 500 by @rubenvdlinde in #1063
• docs(openspec): openconnector-flow-nodes — source-call + synchronization-run flow nodes by @rubenvdlinde in #1067
• fix(endpoints): authenticate a Nextcloud session + template the upstream path by @rubenvdlinde in #1072
• fix(security): route the three missed XML call sites through SafeXmlParser by @rubenvdlinde in #1070
• fix(events): EventAction was a no-op offered to users in the job form by @rubenvdlinde in #1071
• fix(sync): bound synchronization chaining, and make the sync rule real by @rubenvdlinde in #1073
• chore(rules): drop the SoftwareCatalogus-specific custom rule by @rubenvdlinde in #1074
• fix(flow): register the flow nodes — the resilience guard disabled them by @rubenvdlinde in #1076
• i18n(l10n): fill missing auth string + l10n CI gate by @rubenvdlinde in #1085
• fix(events): CloudEvent recursion guard compared ids to slugs and never fired by @rubenvdlinde in #1086
• fix(events): write the UUID FK event, not the legacy integer eventId by @rubenvdlinde in #1089
• fix(events): EventAction was a no-op offered to users in the job form by @rubenvdlinde in #1090
• fix(flow): register the flow nodes — the resilience guard disabled them by @rubenvdlinde in #1091
• fix(security): route the three missed XML call sites through SafeXmlParser by @rubenvdlinde in #1092
• fix(ci): restore the shared workflows — openconnector had no working CI by @rubenvdlinde in #1093
• test(l10n): parity opt-in so coverage gate stays green by @rubenvdlinde in #1099
• fix(lint): resolve 16 dot-notation errors blocking CI by @rubenvdlinde in #1100
• perf(source-test): don't persist a CallLog for interactive connection tests by @rubenvdlinde in #1084
• feat(sources): finish the 'Test connection' UI (wire the orphaned modal end-to-end) by @rubenvdlinde in #1049
• fix(triggers): IAppManager::isEnabledForAnyUser() is gone in NC34 — Tables/Forms/workflowengine triggers never registered by @rubenvdlinde in #1101
• docs(spec): withdraw REQ-009's no-canvas prohibition, require the shared canvas by @rubenvdlinde in #1095
• Merge remote-tracking branch 'origin/docs/appside-injection-walkthrough' into docs/appside-inje by @rubenvdlinde in #1096
• docs(openspec): market-gap wave — 7 ff changes from 2026-07 competitive deep-research by @rubenvdlinde in #1097
• docs(openspec): wave-3 net-new competitive feature specs (8 changes) by @rubenvdlinde in #1098
• fix(events): event_message subscription ref must use the subscription uuid FK (delivery was 100% dead) by @rubenvdlinde in #1102
• feat(icons): adopt the ADR-077 semantic icon vocabulary by @rubenvdlinde in #1107
• fix(licence): pin apexcharts to its MIT range — 1.9.0+ is revenue-gated by @rubenvdlinde in #1108
• feat(icons): extend ADR-077 to page, widget and action icons by @rubenvdlinde in #1110
• ci: disable the Tests workflow — it startup_fails, blocking every PR and all e2e by @rubenvdlinde in #1111
• fix(sync): stream file downloads to disk and record the contract before file rules by @rjzondervan in #1087
• fix(appinfo): feature-detect optional apps via real IAppManager API by @rjzondervan in #1104
• feat(files): fetch a single object's files concurrently with pipelined saves by @rjzondervan in #1105
• feat(vue3): finish the Vue 3 migration — nc-vue 2.1.0-vue3.8, drop the tree-shaking workaround, isolate e2e, lint to zero by @rubenvdlinde in #1112
• chore(vue3): close the nc-vue preset rule gap and verify the live-subscription teardown by @rubenvdlinde in #1114
• fix(e2e): accept BASE_URL so the CI Playwright job can resolve its target by @rubenvdlinde in #1115
• chore(deps): pin @conduction/nextcloud-vue to 2.1.0-vue3.16 (drops the caret) by @rubenvdlinde in #1116
• chore(quality): make psalm + phpstan real in check:strict by @rubenvdlinde in #1118
• fix(ci): make composer check:strict able to fail on tests by @rubenvdlinde in #1119
• test(user-login): assert 401, not 400, for invalid credentials by @rubenvdlinde in #1120
• fix(quality): phpmd DevelopmentCodeFragment could never fire on namespaced code by @rubenvdlinde in #1121
• ci(e2e): make the shared E2E Tests (Playwright) job green by @rubenvdlinde in #1122
• ci: give every eligible job a measured timeout-minutes by @rubenvdlinde in #1125
• ci: align workflows with fleet standard (ConductionNL/.github) by @remko48 in #1113
• fix(security): refresh roave guard via web-token/jwt-library (unblocks stale advisories pin) by @rubenvdlinde in #1124
• fix(ci,observability): seed the OR register for Newman; revive 10 metrics dead since the OR cutover by @rubenvdlinde in #1126
• fix(deps): nc-vue 3.0.0-vue3.2, un-bundle a Vue 2 dialogs, repair 50 dead bindings by @rubenvdlinde in #1133
• feat(nav): repackage navigation by data direction; Store, merged dead letters, Environments as a Source widget (ADR-079/080) by @rubenvdlinde in #1132
• fix(nav): repoint the two nested stats-block route objects at the merged Dead letters page by @rubenvdlinde in #1134
• fix(deps): root @nextcloud/l10n 3.x (app would not boot) + nc-vue 3.0.0-vue3.4 by @rubenvdlinde in #1136
• feat(mapping): contribute Twig functions to OpenRegister; deprecate the local copy by @rubenvdlinde in #1135
• fix(apphost): stop MetricsController's extends from 500-ing every route by @rubenvdlinde in #1137
• chore(ci): remove dead Forgejo/Codeberg CI residue by @rubenvdlinde in #1139
• fix(ui): NcButton native-type is inert on @nextcloud/vue 9 — the Add tier form never submitted by @rubenvdlinde in #1140
• fix(composer): make test:all a real gate — the guard made it incapable of failing by @rubenvdlinde in #1138
• chore(deps): @conduction/nextcloud-vue 3.0.0-vue3.6 by @rubenvdlinde in #1141
• ci(quality): enable the Code Quality gates this repo was silently skipping by @rubenvdlinde in #1143
• chore(deps): move to @conduction/nextcloud-vue 2.2.0-vue3.1 by @rubenvdlinde in #1145
• chore(phpmd): make the lib/Migration UnusedFormalParameter exclude actually work by @rubenvdlinde in #1147
• chore(deps): move to @conduction/nextcloud-vue 2.2.0-vue3.3 by @rubenvdlinde in #1149
• chore(phpmd): burn down the mechanically-safe PHPMD findings (553 -> 532) by @rubenvdlinde in #1148
• fix(notification): decline unknown notifications without logging a warning each time by @rubenvdlinde in #1142
• ci(quality): move hydra-gates-ref v1.0.1 -> v1.3.0 (residual gate-24 is a real gap, documented) by @rubenvdlinde in #1153
• chore(license): normalise licence declarations to EUPL-1.2 by @rubenvdlinde in #1154
• fix(gates): a real server↔JS leaf parity check — gate-24 was verifying nothing by @rubenvdlinde in #1155
• fix(license): remove a stray Nextcloud GmbH copyright block we cannot relicense by @rubenvdlinde in #1156
• ci: enable the coverage ratchet (both coverage jobs were dead) by @rubenvdlinde in #1151
• ci(quality): stop the release PR cancelling every push run on development by @rubenvdlinde in #1158
• chore(ci): stop pinning hydra-gates — track the package at @main by @rubenvdlinde in #1159
• fix(ci): compare the coverage ratchet against the measured merge base by @rubenvdlinde in #1161
• ci: publish an installable build of development by @rubenvdlinde in #1162
• fix(security): PHP_CodeSniffer 3.13.5 → 3.13.6 (CVE-2026-67434, OS command injection) by @rubenvdlinde in #1163
• chore(deps): clear the critical + high npm advisories and CVE-2026-67434 (phpcs) by @rubenvdlinde in #1164
• chore(deps): axe-core is a testing library — move it to devDependencies by @rubenvdlinde in #1166
• fix(gateway): analytics is admin-only, and a failed activation no longer 500s by @rubenvdlinde in #1165
• chore(deps): remove 4 dead remark packages — nothing invokes them by @rubenvdlinde in #1168
• fix: declare NC 32 as the floor — openregister cannot install below it by @rubenvdlinde in #1173
• chore(deps): remove dead runtime deps — bare axios, @FortAwesome, @vue/compat by @rubenvdlinde in #1171
• refactor(notificaties): read the callback credential where the denial is by @rubenvdlinde in #1169
• fix: clear eight hydra gates — a11y, relation dialect, icons, and 25 dead e2e waits by @rubenvdlinde in #1175
• fix: clear gate-46/49/51 — the ADR-023 spec this app never wrote, 16 untitled properties, three 500 paths by @rubenvdlinde in #1178
• test(e2e): unblind the six storage_migrated-gated specs by @rubenvdlinde in #1179
• test(e2e): the API Products index scenario by @rubenvdlinde in #1181
• chore(ci): remove tests.yml — a disabled override fully covered by code-quality.yml by @rubenvdlinde in #1160
• chore(deps): pin nextcloud/ocp to ^32.0 (via symfony/console ^7.4) and fix the API drift it was hiding by @rubenvdlinde in #1182
• fix(migration): a FAILED row count dropped the table it was meant to protect by @rubenvdlinde in #1184
• test(e2e): give the 4 skipped catalog/config-import-export blocks a real tracker (#1187) by @rubenvdlinde in #1188
• ci(quality): drop the hydra-gates-require-full-coverage escape hatch by @rubenvdlinde in #1152
• fix(spec): repoint SafeXmlParser's @SPEC tags at a requirement that exists by @rubenvdlinde in #1189
• fix(e2e): retain-on-failure traces + a globalTimeout under the 45m CI cap by @rubenvdlinde in #1193
• fix(phpcs): stop the SpecTagSniff instructing the pattern gate-46 rejects by @rubenvdlinde in #1194
• fix(apphost): register OpenRegister's autoloader before touching AppHost by @rubenvdlinde in #1157
• ci(main): restore the missing push trigger — main built NOTHING by @rubenvdlinde in #1199
• fix: reach two advertised-but-unreachable capabilities, declare two admin gates, drop the NC 35 claim by @rubenvdlinde in #1198
• test: contract-test the 16 public endpoints that shipped without one by @rubenvdlinde in #1200
• docs(spec): trace FlowDetailPage's 27 methods to the requirements they implement by @rubenvdlinde in #1201
• fix: close gate-16 and gate-20, and record the one relation OpenRegister cannot resolve by @rubenvdlinde in #1202
• chore(deps): pin @conduction/nextcloud-vue to 2.2.0-vue3.7 by @rubenvdlinde in #1204
• chore(deps): pin @conduction/nextcloud-vue to 2.2.0-vue3.9 by @rubenvdlinde in #1205
• Restore the editor surfaces and repair the forms the manifest migration flattened by @SudoThijn in #1206
• fix(ci): green the development push run — phpmd and the J4 endpoint journey by @rubenvdlinde in #1207
• docs(spec): close gate-46 — point every @SPEC at a canonical target by @rubenvdlinde in #1208
• test(coverage): close gate-25 (16) and gate-26 (9) with real tests by @rubenvdlinde in #1209
• test(gate-19): anchor real coverage, and make two false waivers true by @rubenvdlinde in #1210
• test(gate-19): 11 real browser tests (349 → 338) + enable gate-33 axe-core by @rubenvdlinde in #1211
• gate-19 338 → 332 with six real browser tests — and they found every OR picker in the app was empty by @rubenvdlinde in #1216
• feat(openconnector): rename the ours-set, mark the wire schemas by @rubenvdlinde in #1213
• fix(user): drop the deprecated PROPERTY_TWITTER, from both paths by @rubenvdlinde in #1220
• fix(deps): bump phpcsstandards/phpcsutils to 1.2.3 (CVE-2026-65954) by @rubenvdlinde in #1221
• fix(security): enforce the action guard on 8 unguarded logs/traces endpoints (#1217) by @rubenvdlinde in #1218
• test(endpoint): stop a test name from claiming a 404 it never asserts by @rubenvdlinde in #1223
• fix(db): select the SQL dialect from getDatabaseProvider(), with MariaDB named by @rubenvdlinde in #1226
• fix(sync): a 200 nobody can parse is a FAILED page, not an empty source by @rubenvdlinde in #1227
• fix(install): complete the storage cutover on the one hook a fresh install runs by @rubenvdlinde in #1224
• chore: quote the stylelint globs, add .editorconfig by @rubenvdlinde in #1230
• fix(calls): a brokered source is dispatched synchronously, not refused by @rubenvdlinde in #1233
• chore: adopt Nextcloud's coding standard, .editorconfig and NC 34 by @rubenvdlinde in #1229
• chore: delete the inert .prettierrc by @rubenvdlinde in #1235
• chore(quality): point PHPMD at the central ruleset by @rubenvdlinde in #1236
• chore(quality): adopt the central PHPStan base config by @rubenvdlinde in #1237
• chore(deps): pin @conduction/nextcloud-vue to 2.2.0-vue3.16 by @rubenvdlinde in #1238
• chore(deps): resolve conduction/hydra-gates v1.7.3 in composer.lock by @rubenvdlinde in #1239
• feat(format): adopt Nextcloud's prettier config, so styles are tabs too by @rubenvdlinde in #1240
• fix(tests): the OpenRegister stub drifted, and 11 tests failed saying nothing about it by @rubenvdlinde in #1242
• ci: enforce prettier via a format Frontend Check leg by @rubenvdlinde in #1243
• fix: configure the log pages, restore the consumer form, persist the synchronization FK by @SudoThijn in #1232
• ci(stylelint): cover css/ — two files that had never been linted by @rubenvdlinde in #1244
• fix(sync): one unreadable row must not abort the page it is on by @rubenvdlinde in #1246
• fix(security): brute-force throttle the EUDI wallet credential endpoints by @rubenvdlinde in #1248
• build(lint): migrate to eslint 10 + @nextcloud/eslint-config 9 by @rubenvdlinde in #1247
• refactor(openconnector): translate Dutch vocabulary to English, with migration by @rubenvdlinde in #1245
• fix(security): rate-limit the remaining 22 public endpoints by @rubenvdlinde in #1250
• docs: correct a comment that claimed login had no brute-force protection by @rubenvdlinde in #1251
• perf(sync): offset pagination, page-count learning, and the hang after a large run by @rubenvdlinde in #1249
• chore(deps): track @conduction/nextcloud-vue ^2.3.0 by @rubenvdlinde in #1252
• chore(deps): move @conduction/nextcloud-vue to ^2.3.0 by @rubenvdlinde in #1253
• fix(notificaties)!: restore the statutory ZGW wire field names by @rubenvdlinde in #1256
• test(notificaties): the integration fixture still sent the English keys by @rubenvdlinde in #1257
• test(e2e): MANIFEST_PAGES had drifted from the manifest, twice by @rubenvdlinde in #1258
• fix(supply-chain): make the npm cooldown actually work (gate-84) by @rubenvdlinde in #1259
• ci: run every npm job on Node 24 by @rubenvdlinde in #1260
• fix(lint): clear the tranche-A no-undef suppression by @rubenvdlinde in #1261
• fix(coverage-guard): scope the ratchet to the files a change touches by @rubenvdlinde in #1262
• fix(ui): the multi-select closed on every pick — closeOnSelect is not a prop by @rubenvdlinde in #1267
• fix(spec): give openconnector's flow surface and rate-limit suspension their own requirements by @rubenvdlinde in #1263
• fix(routes): point three renamed endpoints at their real methods; register FlowsIndex by @rubenvdlinde in #1264
• chore(deps): raise hydra-gates to v1.8.0 so gates 65-84 exist locally by @rubenvdlinde in #1269
• fix(e2e): the SPA-root probe always picked the prefix CI's router ignores — 12 failures and 36 invisible passes, one cause by @rubenvdlinde in #1268
• perf(listeners): defer the extended-view cascade off the delete request (gate-61 / ADR-078) by @rubenvdlinde in #1265
• fix(gate-40): associate the file-path field's label for real by @rubenvdlinde in #1266
• diag(e2e): name the manifest-bound schema the seed cannot resolve by @rubenvdlinde in #1270
• fix(phpmd): clear the run-progress and stale-sweep violations by @rubenvdlinde in #1271
• fix(phpmd): clear all naming and import findings (15 of 29) by @rubenvdlinde in #1272
• fix(phpmd): clear the last 14 findings — openconnector's phpmd is green by @rubenvdlinde in #1273
• fix(phpcs): document the three functions my phpmd change pulled into scope by @rubenvdlinde in #1274
• fix(quality): close phpcs, phpstan, E2E and Hydra Gates on development by @rubenvdlinde in #1275
• docs(spec): describe the abandoned-run sweep as REQ-006 — closes the last Hydra Gates finding by @rubenvdlinde in #1277
• fix(gates): gate-24's checker could not see the direct integrations.register() form by @rubenvdlinde in #1278
• chore(deps): add composer cooldown to dependabot.yml by @rubenvdlinde in #1281
• fix(gate-4): drop edgedesign/phpqa — 5 abandoned packages, unused by CI by @rubenvdlinde in #1283
• docs(spec): tag six changed methods with the requirements they implement by @rubenvdlinde in #1282
• docs(openspec): change proposals for the AI-tooling and leaf-integration sweep by @rubenvdlinde in #1285
• feat(flows): flow list on CnIndexPage + toolbar-driven editor hosts (ADR-096) by @rubenvdlinde in #1286
• fix(deps): paragonie/sodium_compat v2.5.0 → v2.5.2 (PKSA-32g2-byr9-drtw) by @rubenvdlinde in #1287
• feat(flow): page-level sync nodes — apply-mapping, contract, contract-commit, contract-sweep (flow-native-synchronization phase 1) by @rubenvdlinde in #1290
• feat(flow): source-paginate — one item per page (flow-native-synchronization task 1.1) by @rubenvdlinde in #1291
• feat(automation): deprecation notice + Flows affordance on Jobs, Rules, Mappings, Synchronizations (task 3.2) by @rubenvdlinde in #1292
• feat(migration): generate a flow from a Synchronization (flow-native-synchronization task 3.1) by @rubenvdlinde in #1293
• docs(flow): reference decomposed synchronization + why explode is not optional (task 2.1) by @rubenvdlinde in #1294
• chore(deps): nc-vue ^2.7.0 + flow node configForm declarations — shims dropped, vocabularies + forms declared by @rubenvdlinde in #1288
• fix(ci): least-privilege workflow permissions — clears 12 CodeQL Actions-hardening alerts by @rubenvdlinde in #1280
• fix(phpcs): clear the 1 PHPCS error in lib/Service/EndpointService.php by @rubenvdlinde in #1279
• style(phpcs): clear the 5 phpcs ERRORS (line length in t() help strings) by @rubenvdlinde in #1295
• test(e2e): the decomposed synchronization runs, writes, and is idempotent (tasks 2.3 + 2.4) by @rubenvdlinde in #1296
• feat(migration): Jobs → trigger-schedule flows, Rules → trigger-object + switch (task 3.3) by @rubenvdlinde in #1298
• fix(flow): the decomposed sync can never skip — contract-commit never wrote targetHash by @rubenvdlinde in #1297
• fix(jobs): singleRun was declared, editable, and enforced nowhere by @rubenvdlinde in #1299
• feat(migration): the generated flow leaves unchanged objects alone (completes task 2.3) by @rubenvdlinde in #1300
• chore(deps): nc-vue ^2.8.0 — flow editor nodes are reachable again by @rubenvdlinde in #1301
• docs(spec): specify run progress, deferred cascade and deferred file fetch (gate-16) by @rubenvdlinde in #1303
• docs(benchmark): task 2.2 legacy baseline measured; decomposed side blocked; two legacy defects found by @rubenvdlinde in #1304
• docs(openspec): propose ori-public-serving — openconnector serves ORI 1.4 for decidesk by @rubenvdlinde in #1302
• chore(deps): take hydra-gates v1.8.1 — the contract v1.8.0 shipped broken by @rubenvdlinde in #1305
• fix(sync): a mapped synchronization can skip again, and a contract upserts on its own identity by @rubenvdlinde in #1306
• fix(sync): ensureUuid must not mint over an identity the contract already has by @rubenvdlinde in #1307
• test(sync): cover the fallback persistContract() ensureUuid branch by @rubenvdlinde in #1308
• fix(sync): persistBulk must upsert on the contract's own identity too by @rubenvdlinde in #1309
• chore(deps): take @conduction/nextcloud-vue 2.8.2 (was 2.8.0) by @rubenvdlinde in #1310
• fix(sync): stop destroying the contract's identity before it is written by @rubenvdlinde in #1311
• docs(benchmark): D1 and D2 verified live; every wall-clock figure is now stale by @rubenvdlinde in #1312
• fix: repair deleteInvalidObjects for OpenRegister magic tables by @bbrands02 in #1313
• Release: merge development into beta by @github-actions[bot] in #1094
• fix(release): grant pull-requests: write — an incomplete caller ceiling blocks startup by @rubenvdlinde in #1317
• fix(release): grant pull-requests: write — an incomplete caller ceiling blocks startup by @rubenvdlinde in #1318
• fix(schema): engine-owned identifiers are immutable after create by @rubenvdlinde in #1316
• docs(benchmark): task 2.2 MET — the decomposed flow beats legacy by 14.6% by @rubenvdlinde in #1321
• docs(benchmark): correct 2.2 — "14.6% faster" was noise; it is a TIE by @rubenvdlinde in #1322
• feat(command): openconnector:contracts:dedupe — collapse duplicate contracts by @rubenvdlinde in #1323
• fix(spdx): add missing @author/@copyright/@license tags to DedupeContracts by @rubenvdlinde in #1324
• ci(release): drop the two duplicate legacy release workflows by @rubenvdlinde in #1326
• ci(release): route the development channel through release.yml by @rubenvdlinde in #1328
• ci(release): drop five inert legacy release workflows from main by @rubenvdlinde in #1331
• feat(migration): generate a flow for a synchronization with NO mapping by @rubenvdlinde in #1334
• chore(deps): refresh the shared Conduction locks by @rubenvdlinde in #1329
• fix(ci): give dispatched runs their own concurrency lane by @rubenvdlinde in #1337
• docs(migration): coverage measured — 16.8% → 67.1%, and my ~99% projection was wrong by @rubenvdlinde in #1339
• test(e2e): cover unmapped generation, and stop occ resolving to a dead instrument by @rubenvdlinde in #1478
• feat(flow): run-log links back to the synchronization, and a tasks file that matches the tree by @rubenvdlinde in #1480
• chore(quality): migrate to PHPStan 2 — 44 findings to zero, plus a sync-engine bug by @rubenvdlinde in #1481
• feat(flow): openconnector.fetch-file — the one step 74 synchronizations were waiting on by @rubenvdlinde in #1526
• chore(deps): refresh the shared Conduction locks by @rubenvdlinde in #1525
• fix(notifications): repair three filters that could never match by @rubenvdlinde in #1529
• diag(e2e): why the decomposed run ends successfully after write by @rubenvdlinde in #1532
• feat: rename the app id from openconnector to integriq by @rubenvdlinde in #1533
• fix(migration): read the rule unscoped, so fetch-file is actually reachable by @rubenvdlinde in #1541
• docs(3.4): the sweep was attempted and could not run — why, and what unblocks it by @rubenvdlinde in #1530
• feat(register): rename the register slug openconnector -> integriq by @rubenvdlinde in #1544
• test(l10n): ratchet the untranslated schema strings by @rubenvdlinde in #1545
• feat(docs): move the docs host openconnector.conduction.nl -> integriq.conduction.nl by @rubenvdlinde in #1549
• feat(repair): move openconnector schemas onto the integriq application id by @rubenvdlinde in #1551
• fix(docs): publish from development, to the worker that actually serves this site by @rubenvdlinde in #1553
• test(e2e): put the skip reasons where a run can see them by @rubenvdlinde in #1552
• fix(docs): pass secrets to the reusable documentation workflow by @rubenvdlinde in #1556
• docs: drop dead Codeberg issue URLs (GitHub-only policy) by @rubenvdlinde in #1558
• chore(deps): refresh the shared Conduction locks by @rubenvdlinde in #1548
• feat: port issue templates to GitHub Issue Forms by @rubenvdlinde in #1559
• fix(e2e): seed the canvas nodes with a name instead of asserting their id by @rubenvdlinde in #1561
• fix(docs): map the Cloudflare secrets from the names that actually exist by @rubenvdlinde in #1566
• chore(ci): remove dead Forgejo/Codeberg CI configuration by @rubenvdlinde in #1567
• fix(security): an authenticated API call no longer rewrites the caller's session by @rubenvdlinde in #1569
• fix(deps): resolve nextcloud-vue 2.16.0 — 2.15.0 silently drops keyboard connections by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1573
• test(e2e): re-enable the configuration export/import suite (#1187) by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1568
• chore(ci): name the app integriq in the release.yml comment by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1580
• Release: merge development into beta by @github-actions[bot] in https://github.com/ConductionNL/integriq/pull/1319
• chore: ignore agent/test scratch and untrack generated files by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1578
• refactor(lib): move background jobs out of lib/Cron into lib/BackgroundJob by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1579
• feat(walkthrough): give Integriq a getting-started tour by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1581
• fix(manifest): rename six chart titles off the em-dash by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1589
• fix(e2e): FlowRunWorker moved to OpenRegister's BackgroundJob namespace by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1590
• fix(dependabot): target development, not the default branch by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1592
• fix(repair): remove the 13 oc_jobs rows the Cron → BackgroundJob move orphaned by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1587
• Release: merge development into beta by @github-actions[bot] in https://github.com/ConductionNL/integriq/pull/1584
• fix(l10n): backfill 5,240 .js-only strings into .json, then generate by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1599
• fix(repair): register RenameDutchColumns — it was never run anywhere by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1603
• ci: run check:l10n-js, so the browser catalogues cannot drift again by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1604
• fix(repair): register RenameDutchColumns so it actually runs by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1605
• fix(deps): development cannot npm install by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1606
• chore(ci): take the canonical coverage-guard from ConductionNL/.github by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1600
• perf(ci): one Code Quality run per commit, not two by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1614
• chore: untrack the build logs that were triggering full CI runs by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1615
• fix(release): name openconnector as this app's previous App Store id by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1610
• chore(deps): bump @conduction/nextcloud-vue to ^2.20.0 by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1613
• feat(demo-data): ship demo data for every schema integriq supplies (ADR-111) by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1616
• fix(e2e): describe-level skips must record a reason by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1624
• chore(deps): hydra-gates 1.10, so the E2E skip-discipline gate can run by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1626
• fix(ci): a push to development must reach a verdict here too by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1627
• feat(manifest): the flow pages are an index and a flow, not two custom pages by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1622
• feat(walkthrough): show where flows live, without making anyone build one by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1631
• fix(e2e): target the description field, not its helper button by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1635
• docs: add a local demo environment (integriq-compose.yaml + setup page) by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1637
• docs: make the demo verification command actually pass by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1638
• feat(setup): a wizard that offers the demo data this app already ships by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1641
• fix(e2e): settle the demo-data decision so the wizard stops masking clicks by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1643
• chore(deps): @conduction/nextcloud-vue 2.21.0 -> 2.22.1 by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1647
• feat(release): allow a release to be dispatched by hand by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1649
• chore(release): 0.3.5-unstable.20260829110819 by @github-actions[bot] in https://github.com/ConductionNL/integriq/pull/1650
• ci(docs): publish from development, and retire the old hostname by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1651
• chore(release): 0.3.6-unstable.20260829125631 by @github-actions[bot] in https://github.com/ConductionNL/integriq/pull/1652
• Merge remote-tracking branch 'origin/development' into fix/eudi-token-brute-force by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1646
• chore(release): 0.3.7-unstable.20260829132230 by @github-actions[bot] in https://github.com/ConductionNL/integriq/pull/1653
• chore(deps): @conduction/nextcloud-vue 2.22.1 -> 2.24.1 by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1654
• chore(deps): @conduction/nextcloud-vue 2.24.1 -> 2.24.2 by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1656
• chore(deps): aim dependabot at development by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1658
• chore(deps-dev): bump webpack from 5.109.2 to 5.110.1 by @dependabot[bot] in https://github.com/ConductionNL/integriq/pull/1678
• chore(deps): bump @nextcloud/router from 2.2.1 to 3.1.0 by @dependabot[bot] in https://github.com/ConductionNL/integriq/pull/1677
• chore(deps): bump marked from 12.0.2 to 18.0.11 by @dependabot[bot] in https://github.com/ConductionNL/integriq/pull/1676
• chore(deps-dev): bump sass-loader from 16.0.8 to 17.0.0 by @dependabot[bot] in https://github.com/ConductionNL/integriq/pull/1674
• chore(deps-dev): bump @cyclonedx/cyclonedx-npm from 6.0.0 to 6.0.1 by @dependabot[bot] in https://github.com/ConductionNL/integriq/pull/1672
• chore(deps-dev): bump phpmetrics/phpmetrics from 2.9.1 to 2.11.0 by @dependabot[bot] in https://github.com/ConductionNL/integriq/pull/1671
• chore(deps-dev): bump phpcsstandards/phpcsextra from 1.5.0 to 1.5.1 by @dependabot[bot] in https://github.com/ConductionNL/integriq/pull/1670
• chore(deps-dev): bump @babel/core from 7.29.7 to 8.0.1 by @dependabot[bot] in https://github.com/ConductionNL/integriq/pull/1669
• chore(deps-dev): bump phpstan/phpstan from 2.2.8 to 2.2.9 by @dependabot[bot] in https://github.com/ConductionNL/integriq/pull/1668
• chore(deps): bump vue-router from 4.6.4 to 5.3.0 by @dependabot[bot] in https://github.com/ConductionNL/integriq/pull/1667
• chore(deps): bump twig/twig from 3.27.1 to 3.28.0 by @dependabot[bot] in https://github.com/ConductionNL/integriq/pull/1666
• chore(deps): bump adbario/php-dot-notation from 3.3.0 to 3.5.0 by @dependabot[bot] in https://github.com/ConductionNL/integriq/pull/1665
• chore(deps): bump elasticsearch/elasticsearch from 8.19.0 to 9.5.0 by @dependabot[bot] in https://github.com/ConductionNL/integriq/pull/1663
• chore(deps-dev): bump nextcloud/ocp from 34.0.2 to 34.0.3 by @dependabot[bot] in https://github.com/ConductionNL/integriq/pull/1659
• docs(endpoint-runtime): reopen the spec for the id-fetch guard by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1645
• chore(sync): carry beta back into development by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1686
• chore(sync): record beta's ancestry on development by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1687
• chore(release): 0.3.8-unstable.20260830081730 by @github-actions[bot] in https://github.com/ConductionNL/integriq/pull/1685
• fix(deps): regenerate the lockfile so npm ci resolves again by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1688
• fix(deps): take vue-router 4, which is the major this app is written against by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1689
• fix(deps): align dexie on 4.4.5 so only one copy loads per page by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1691
• Release: merge development into beta by @github-actions[bot] in https://github.com/ConductionNL/integriq/pull/1601
• chore(deps): adopt stylelint 17 by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1695
• chore(deps): adopt vitest 4 by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1699
• chore(sync): carry beta back into development by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1702
• Release: merge development into beta by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1696
• chore(sync): carry beta back into development by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1706
• Release: merge development into beta by @github-actions[bot] in https://github.com/ConductionNL/integriq/pull/1707
• Release: merge beta into main by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1698
• chore(sync): carry main back into beta by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1715
• chore(sync): carry beta back into development by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1716
• chore(deps): bump the npm_and_yarn group across 1 directory with 15 updates by @dependabot[bot] in https://github.com/ConductionNL/integriq/pull/1719
• chore(release): 0.3.10-unstable.20260830174941 by @github-actions[bot] in https://github.com/ConductionNL/integriq/pull/1721
• chore(release): sync main back into development by @github-actions[bot] in https://github.com/ConductionNL/integriq/pull/1723
• chore(dependabot): hold back the four majors that cannot be adopted by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1724
• Release: merge development into beta by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1718
• Release: merge beta into main by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1717
• chore(sync): carry main back into beta by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1726
• chore(sync): carry beta back into development by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1728
• chore(dependabot): hold back vue-router 5 as well by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1747
• docs(dependabot): correct the vue-router holdback to what was measured by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1748
• fix(deps): resolve the peer chain so npm ci works by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1752
• chore(deps): take @conduction/nextcloud-vue 2.25.1 for the KPI card by @rubenvdlinde in https://github.com/ConductionNL/integriq/pull/1754
• chore(deps): bump gridstack from 12.6.0 to 13.2.0 by @dependabot[bot] in https://github.com/ConductionNL/integriq/pull/1735
• chore(deps-dev): bump @types/node from 20.19.43 to 26.4.0 by @dependabot[bot] in https://github.com/ConductionNL/integriq/pull/1738
• chore(deps): bump web-token/jwt-library from 3.4.10 to 4.2.1 by @dependabot[bot] in https://github.com/ConductionNL/integriq/pull/1732
• chore(deps-dev): bump jest and @types/jest by @dependabot[bot] in https://github.com/ConductionNL/integriq/pull/1742

Full Changelog: v0.2.20...v0.3.13-unstable.20260831040815