v0.1.0-beta.1

Container image published to GHCR — SBOM + SLSA provenance attested, cosign-signed:

ghcr.io/icebergai/icebergebs:0.1.0-beta.1

Pull, verify (cosign / attestation), and deploy instructions: docs/RELEASING.md.

What's Changed

• Improve static detection findings by @general-grivas in #1
• [codex] Condense detection findings UI by @general-grivas in #2
• [codex] Add threat intelligence lookups by @general-grivas in #3
• Offload bcrypt + package inspection off the event loop; throttle API-key last_used_at write by @richardmhope in #21
• Remediate medium code-review issues: M1–M5, D2 by @richardmhope in #44
• D1 (#11): Replace hand-rolled migrations with Alembic by @richardmhope in #45
• Low-priority code-review cleanups: D3, D4, D5, #17, #18, #19 by @richardmhope in #46
• Document SameSite-only CSRF stance (#16); housekeeping (#20) by @richardmhope in #47
• Preserve history on delete_user; cap threat-intel output (#28) by @richardmhope in #48
• Add data retention pruning for history tables (#22) by @richardmhope in #49
• Surface fetch health + add /healthz & /readyz (#26) by @richardmhope in #50
• Document Postgres-by-default for SOC scale (#27) by @richardmhope in #51
• Paginate + filter + search GET /api/extensions and dashboard (#23) by @richardmhope in #52
• Add CSV/JSON export of the filtered extension set (#25) by @richardmhope in #53
• Add bulk import: POST /api/extensions/bulk + UI paste box (#24) by @richardmhope in #54
• Add CI: tests + static checks (ruff, mypy, bandit, pip-audit) + badges by @richardmhope in #55
• Remove SQLite; run on PostgreSQL only (dev, test, prod) by @richardmhope in #56
• Push delete cleanup into the schema via FK ON DELETE actions by @richardmhope in #57
• Align routes with FastAPI skill: dependency aliases, router prefix/tags, Annotated by @richardmhope in #58
• Use return-type annotations instead of response_model= (FastAPI skill) by @richardmhope in #59
• Fix permission-change host-perm gap, harden UI JSON, dedup permission tiers by @richardmhope in #69
• Tech-debt cleanup: dedup filter params, O(1) finding dedupe, redundant except by @richardmhope in #70
• Add SOAR-fed inventory + exposure (blast radius) (#29) by @richardmhope in #71
• Fix correctness bugs from Fable review (#72–#75) by @richardmhope in #80
• Harden against races and XFF spoofing from Fable review (#76, #77) by @richardmhope in #83
• Defer inventory scoring of unknown extensions to the scheduler (#78) by @richardmhope in #82
• Manage dependencies with uv against a committed lockfile by @richardmhope in #110
• Add OSS governance files: LICENSE, SECURITY.md, CONTRIBUTING.md, CODE_OF_CONDUCT.md by @richardmhope in #111
• Add Dependabot across uv, github-actions, docker, and docker-compose by @richardmhope in #112
• Bump astral-sh/uv from 0.11.23 to 0.11.28 in the docker-images group by @dependabot[bot] in #116
• Adopt SemVer and a CHANGELOG alongside the build-N counter by @richardmhope in #117
• Rename Marvin to IcebergEBS by @richardmhope in #118
• Add issue templates and a pull request template by @richardmhope in #120
• Record the verified repository security controls by @richardmhope in #119
• ci: SHA-pin all GitHub Actions and disable credential persistence (#96) by @richardmhope in #121
• ci: add blocking lint-workflows job (zizmor + actionlint) (#97) by @richardmhope in #122
• ci: add signed, attested release pipeline; stop publishing mutable :latest (#99) by @richardmhope in #124
• ci: add CodeQL SAST workflow for python + javascript (#98) by @richardmhope in #123
• auth: secret_key min-length validation + reject over-72-byte passwords (#67) by @richardmhope in #125
• security: add CSRFOriginMiddleware as defence-in-depth over SameSite=Lax (#107) by @richardmhope in #127
• deploy: harden docker-compose — no-new-privileges, cap_drop, read-only, healthchecks (#102) by @richardmhope in #129
• deploy: forward RETENTION_DAYS + FETCH_INTERVAL_MINUTES in Compose/Helm (#87) by @richardmhope in #128
• app: HSTS + minimal CSP baseline at the application layer (#66) by @richardmhope in #126
• ci: add a vulture dead-code gate to the lint job (#101) by @richardmhope in #131
• helm: complete pod security baseline — seccomp, no SA token, PDB (#104) by @richardmhope in #130
• helm: add default-deny NetworkPolicies with named hops (#103) by @richardmhope in #132
• helm: require an explicit immutable image.tag, no mutable :latest (#88) by @richardmhope in #135
• deploy: automatic Postgres backups + restore runbook (#86) by @richardmhope in #134
• ci: add a Playwright UI smoke job (#100) by @richardmhope in #136
• fetch: retry/backoff transport + per-store circuit breaking (#108) by @richardmhope in #133
• app: observability baseline — structured logs, scheduler visibility, nginx fields (#89) by @richardmhope in #137
• app: graceful shutdown with recoverable alerts (#109) by @richardmhope in #139
• docs: add review-bot + multi-PR workflow guidance to CLAUDE.md by @richardmhope in #140
• services: keep stored metadata on a transient scrape mis-parse (#142) by @richardmhope in #158
• db: stamp pre-Alembic databases at the baseline, then upgrade (#143) by @richardmhope in #159
• scoring: broad host patterns (:///, http(s):///*) score as critical (#141) by @richardmhope in #157
• docs: reconcile all documentation with the as-built system by @richardmhope in #161
• deploy: coordinated Postgres 16→18 (+ nginx 1.31) across compose, backup, and CI by @richardmhope in #160
• ci: bump github-actions to latest, SHA-pinned (supersedes #115) by @richardmhope in #162
• refactor: extract the shared extension query layer into app/extension_queries.py by @richardmhope in #172
• perf: load only the last two install-count readings for scoring (#146) by @richardmhope in #173
• refactor: single-source PackageAnalysis serialization + render defaults (#164) by @richardmhope in #174
• refactor: extract dashboard() stat/URL helpers out of routes/ui.py (#165) by @richardmhope in #175
• refactor: break fetch_and_store into stage helpers (#166) by @richardmhope in #176
• refactor: consolidate the ownership 404 gate into get_owned_or_404 (#169) by @richardmhope in #177
• refactor: single-source the alert webhook payload via build_alert_payload (#168) by @richardmhope in #178
• refactor: move findings-grouping out of routes/ui.py into app/findings_view.py (#170) by @richardmhope in #179
• fix: run startup pending-alert recovery in the background (#155) by @richardmhope in #180
• refactor: typed accessors for the JSON-in-str Extension columns (#167) by @richardmhope in #181
• fix: escape CSV export against spreadsheet formula injection (#147) by @richardmhope in #182
• fix: interactive add/refresh handles TransportError like the scheduler (#148) by @richardmhope in #183
• fix: run retention prune at startup, not only 24h after boot (#145) by @richardmhope in https://github....