v0.2.0-beta.8

A dependency sweep: all Go modules bumped to latest available versions,
web dependencies updated, and CI image pins aligned to current stable releases.

Added

• Wake-on-connect for idle auto-sleep: a sentinel component (distroless Docker
  image, configured via operator.sentinelImage) holds advertised ports while a GameServer
  is asleep and wakes it on a genuine connection attempt. Opt-in per server via
  spec.idle.wakeOnConnect (default false). New CRD fields:
  GameServer.spec.idle.wakeOnConnect (bool) and GamePort.wakeProtocol
  (enum: minecraft|terraria|generic|none, default generic). New shared
  module gameproto/ for Minecraft and Terraria handshake parsing; UDP-only
  games use a generic packets-in-window heuristic. Works across all four expose
  modes; Hostport has asymmetric limitations documented in docs/roadmap.md.
  Costs one small pod per sleeping server.
• Load-balancer address pools: GameServers can now request a specific address
  pool or explicit public IP when exposed as LoadBalancer services, via optional
  spec.networking.addressPool and spec.networking.address CRD fields. The
  operator translates these to the cluster's load-balancer flavor (configured
  via operator.addressManager Helm value: metallb | cilium | none,
  default none): MetalLB gets pool → metallb.io/address-pool annotation and
  address → metallb.io/loadBalancerIPs; Cilium gets pool →
  gameplane.local/lb-pool label (admin mirrors it in
  CiliumLoadBalancerIPPool.spec.serviceSelector) and address →
  lbipam.cilium.io/ips. A new AddressAssignment status condition tracks the
  assignment outcome with eight reason codes (Assigned, AssignmentPending,
  PoolNotFound, AllocationFailed, AddressInUse, ServiceNotReady,
  IgnoredForExposureMode, NoAddressManagerConfigured). Dashboard support added
  for setting and viewing pool/address. See docs/networking.md.

Security

• Signing key rotated: cosign key type changed from Ed25519 to ECDSA P-256
  (cross-signed for trust continuity; see docs/key-rotation.md).
• Transparency logging enabled: all published images, the Helm chart (now
  signed for the first time), and official module bundles are signed and
  recorded in the public Sigstore Rekor transparency log. Signing is now
  fail-closed in CI (missing COSIGN_PRIVATE_KEY fails the release).

Changed

• Go dependencies: telemetry-receiver, sentinel, and mcp-server updated
  to latest go-openapi versions (github.com/go-openapi/{jsonpointer,jsonreference,swag}
  v0.2x → v1.x); operator updated with 50+ indirect dependency bumps (go-git
  v5.19.1 → v5.19.2); api's modernc.org/sqlite v1.54.0 → v1.55.0; agent and
  e2e test suite indirect dependencies (k8s.io, golang.org/x packages) brought
  current.
• Web dependencies: @tanstack/react-virtual v3.14.8 → v3.14.9,
  lucide-react v1.26.0 → v1.27.0, @types/node v26.1.1 → v26.1.2,
  globals v17.7.0 → v17.8.0, jsdom v29.1.1 → v30.0.1, postcss v8.5.23 →
  v8.5.25.
• CI image pins: setup-envtest release-0.19 → release-0.24, Kubernetes
  (envtest) 1.31.0 → 1.36.2 (now in sync with the Makefile), and kind v0.24.0 →
  v0.32.0.
• Container image defaults: restic/restic 0.18.1 → 0.19.1 (charts/gameplane/values.yaml operator.resticImage default) and nginxinc/nginx-unprivileged 1.30-alpine → 1.31-alpine (web/Dockerfile base image).
• modules/build.sh gained --tlog-upload flag (passed by the release
  pipeline for official bundles); default stays offline for air-gapped authoring.
• Module bundles are now signed by the pushed manifest digest. build.sh
  previously took the first sha256: token in oras push output, which is not
  necessarily the manifest — a layer digest printed in full would have been
  signed instead (operator verification unchanged).

Notes

• TypeScript held at 6.x: @typescript-eslint/parser@8.65.0 declares
  peerDependencies: typescript >=4.8.4 <6.1.0, so upgrading to TS 7.x would
  break type-aware linting. Reevaluate when @typescript-eslint/parser publishes
  a v8.x major that supports TS 7+.
• ESLint held at 9.x: eslint-plugin-react@7.37.5 declares no ^10 peer
  range, so upgrading to ESLint 10.x would break React linting. Reevaluate when
  eslint-plugin-react publishes a v8+ major or a 7.x patch that widens the
  peer range.
• Prometheus client_golang: telemetry-receiver's
  github.com/prometheus/client_golang v1.24.1 is at latest; no update
  available.