v0.1.0-beta.1

Container image published to GHCR — SBOM + SLSA provenance attested, cosign-signed:

ghcr.io/icebergai/icebergebs:0.1.0-beta.1

Pull, verify (cosign / attestation), and deploy instructions: docs/RELEASING.md.

What's Changed

• Improve static detection findings by @general-grivas in #1
• [codex] Condense detection findings UI by @general-grivas in #2
• [codex] Add threat intelligence lookups by @general-grivas in #3
• Offload bcrypt + package inspection off the event loop; throttle API-key last_used_at write by @richardmhope in #21
• Remediate medium code-review issues: M1–M5, D2 by @richardmhope in #44
• D1 (#11): Replace hand-rolled migrations with Alembic by @richardmhope in #45
• Low-priority code-review cleanups: D3, D4, D5, #17, #18, #19 by @richardmhope in #46
• Document SameSite-only CSRF stance (#16); housekeeping (#20) by @richardmhope in #47
• Preserve history on delete_user; cap threat-intel output (#28) by @richardmhope in #48
• Add data retention pruning for history tables (#22) by @richardmhope in #49
• Surface fetch health + add /healthz & /readyz (#26) by @richardmhope in #50
• Document Postgres-by-default for SOC scale (#27) by @richardmhope in #51
• Paginate + filter + search GET /api/extensions and dashboard (#23) by @richardmhope in #52
• Add CSV/JSON export of the filtered extension set (#25) by @richardmhope in #53
• Add bulk import: POST /api/extensions/bulk + UI paste box (#24) by @richardmhope in #54
• Add CI: tests + static checks (ruff, mypy, bandit, pip-audit) + badges by @richardmhope in #55
• Remove SQLite; run on PostgreSQL only (dev, test, prod) by @richardmhope in #56
• Push delete cleanup into the schema via FK ON DELETE actions by @richardmhope in #57
• Align routes with FastAPI skill: dependency aliases, router prefix/tags, Annotated by @richardmhope in #58
• Use return-type annotations instead of response_model= (FastAPI skill) by @richardmhope in #59
• Fix permission-change host-perm gap, harden UI JSON, dedup permission tiers by @richardmhope in #69
• Tech-debt cleanup: dedup filter params, O(1) finding dedupe, redundant except by @richardmhope in #70
• Add SOAR-fed inventory + exposure (blast radius) (#29) by @richardmhope in #71
• Fix correctness bugs from Fable review (#72–#75) by @richardmhope in #80
• Harden against races and XFF spoofing from Fable review (#76, #77) by @richardmhope in #83
• Defer inventory scoring of unknown extensions to the scheduler (#78) by @richardmhope in #82
• Manage dependencies with uv against a committed lockfile by @richardmhope in #110
• Add OSS governance files: LICENSE, SECURITY.md, CONTRIBUTING.md, CODE_OF_CONDUCT.md by @richardmhope in #111
• Add Dependabot across uv, github-actions, docker, and docker-compose by @richardmhope in #112
• Bump astral-sh/uv from 0.11.23 to 0.11.28 in the docker-images group by @dependabot[bot] in #116
• Adopt SemVer and a CHANGELOG alongside the build-N counter by @richardmhope in #117
• Rename Marvin to IcebergEBS by @richardmhope in #118
• Add issue templates and a pull request template by @richardmhope in #120
• Record the verified repository security controls by @richardmhope in #119
• ci: SHA-pin all GitHub Actions and disable credential persistence (#96) by @richardmhope in #121
• ci: add blocking lint-workflows job (zizmor + actionlint) (#97) by @richardmhope in #122
• ci: add signed, attested release pipeline; stop publishing mutable :latest (#99) by @richardmhope in #124
• ci: add CodeQL SAST workflow for python + javascript (#98) by @richardmhope in #123
• auth: secret_key min-length validation + reject over-72-byte passwords (#67) by @richardmhope in #125
• security: add CSRFOriginMiddleware as defence-in-depth over SameSite=Lax (#107) by @richardmhope in #127
• deploy: harden docker-compose — no-new-privileges, cap_drop, read-only, healthchecks (#102) by @richardmhope in #129
• deploy: forward RETENTION_DAYS + FETCH_INTERVAL_MINUTES in Compose/Helm (#87) by @richardmhope in #128
• app: HSTS + minimal CSP baseline at the application layer (#66) by @richardmhope in #126
• ci: add a vulture dead-code gate to the lint job (#101) by @richardmhope in #131
• helm: complete pod security baseline — seccomp, no SA token, PDB (#104) by @richardmhope in #130
• helm: add default-deny NetworkPolicies with named hops (#103) by @richardmhope in #132
• helm: require an explicit immutable image.tag, no mutable :latest (#88) by @richardmhope in #135
• deploy: automatic Postgres backups + restore runbook (#86) by @richardmhope in #134
• ci: add a Playwright UI smoke job (#100) by @richardmhope in #136
• fetch: retry/backoff transport + per-store circuit breaking (#108) by @richardmhope in #133
• app: observability baseline — structured logs, scheduler visibility, nginx fields (#89) by @richardmhope in #137
• app: graceful shutdown with recoverable alerts (#109) by @richardmhope in #139
• docs: add review-bot + multi-PR workflow guidance to CLAUDE.md by @richardmhope in #140
• services: keep stored metadata on a transient scrape mis-parse (#142) by @richardmhope in #158
• db: stamp pre-Alembic databases at the baseline, then upgrade (#143) by @richardmhope in #159
• scoring: broad host patterns (:///, http(s):///*) score as critical (#141) by @richardmhope in #157
• docs: reconcile all documentation with the as-built system by @richardmhope in #161
• deploy: coordinated Postgres 16→18 (+ nginx 1.31) across compose, backup, and CI by @richardmhope in #160
• ci: bump github-actions to latest, SHA-pinned (supersedes #115) by @richardmhope in #162
• refactor: extract the shared extension query layer into app/extension_queries.py by @richardmhope in #172
• perf: load only the last two install-count readings for scoring (#146) by @richardmhope in #173
• refactor: single-source PackageAnalysis serialization + render defaults (#164) by @richardmhope in #174
• refactor: extract dashboard() stat/URL helpers out of routes/ui.py (#165) by @richardmhope in #175
• refactor: break fetch_and_store into stage helpers (#166) by @richardmhope in #176
• refactor: consolidate the ownership 404 gate into get_owned_or_404 (#169) by @richardmhope in #177
• refactor: single-source the alert webhook payload via build_alert_payload (#168) by @richardmhope in #178
• refactor: move findings-grouping out of routes/ui.py into app/findings_view.py (#170) by @richardmhope in #179
• fix: run startup pending-alert recovery in the background (#155) by @richardmhope in #180
• refactor: typed accessors for the JSON-in-str Extension columns (#167) by @richardmhope in #181
• fix: escape CSV export against spreadsheet formula injection (#147) by @richardmhope in #182
• fix: interactive add/refresh handles TransportError like the scheduler (#148) by @richardmhope in #183
• fix: run retention prune at startup, not only 24h after boot (#145) by @richardmhope in #184
• fix: tolerate malformed findings in ExtensionOut instead of 500ing (#150) by @richardmhope in #185
• fix: validate username / email / inventory asset_id inputs (#154) by @richardmhope in #186
• fix: dashboard tolerates a non-numeric page param instead of 422ing (#152) by @richardmhope in #187
• refactor: extract get_alert_log into a neutral query module (#149) by @richardmhope in #189
• fix: leave the dev DB bootable after the test suite, and self-heal stale stamps (#113) by @richardmhope in #190
• fix: deliver every pending alert event, not one per type (#144) by @richardmhope in #191
• refactor: replace nginx with Caddy as the edge reverse proxy (#188) by @richardmhope in #192
• build(deps): Bump caddy from 2.8-alpine to 2.11-alpine in the compose-images group by @dependabot[bot] in #193
• fix: restore per-IP rate limit on POST /login lost in the Caddy migration (#196) by @richardmhope in #203
• fix: corrupt pending-alert marker no longer loops forever or crashes a refresh (#197) by @richardmhope in #204
• fix: scheduler jobs no longer skip due fires as misfires (#198) by @richardmhope in #205
• fix: adopt an unstamped create_all'd head schema as head, not baseline (#199) by @richardmhope in #206
• fix: align Helm Caddy pin with Compose and guard the drift (#200) by @richardmhope in #207
• fix: close two holes in the single-canonical-header guarantee (#201) by @richardmhope in #208
• fix: forward and document the rate-limit tuning knobs (#202) by @richardmhope in #209
• feat: self-host the frontend — no third-party CDN at runtime (#85) by @richardmhope in #210
• build(deps): Bump astral-sh/uv from 0.11.28 to 0.11.29 in the docker-images group across 1 directory by @dependabot[bot] in #194
• feat: strict script-src 'self' CSP — @alpinejs/csp + component registry (#106) by @richardmhope in #211
• feat: adopt the IcebergAI house design system (#105) by @richardmhope in #213
• refactor: sweep the legacy --ink-N tokens and remove the alias bridge (#212) by @richardmhope in #215
• feat: outbound proxy for all egress — routing transport, admin config + connectivity test (#216) by @richardmhope in #217
• feat: SSO via OIDC — Authlib flow, provider adapters, JIT provisioning, admin config (#32) by @richardmhope in #218
• docs: move the per-module architecture reference into a path-scoped rule by @richardmhope in #222
• fix(ui): stop '/' hijacking text fields; move account menu to rail foot by @richardmhope in #223
• fix(ui): stop '/' shortcut hijacking text fields; move account menu to rail foot by @richardmhope in #225
• docs: add README screenshots + reusable demo-seed and capture scripts by @richardmhope in #238
• fix(sso): scope OIDC identity match to the provider — cross-provider identity spoofing (#226) by @richardmhope in #239
• fix(fonts): serve variable fonts as one file per subset, not per-weight copies (#236) by @richardmhope in #240
• fix(sso): fail closed on Entra groups-overage instead of demoting admins (#227) by @richardmhope in #241
• fix(sso): re-sync verified email on returning OIDC login (#233) by @richardmhope in #242
• refactor(sso): OIDC hygiene — validator, dead code, recovery-branch tests (#235) by @richardmhope in #243
• feat(proxy): probe enabled IdP endpoints from the connectivity test (#232) by @richardmhope in #244
• refactor: unify egress transport-chain construction; pin OIDC egress to proxy (#231) by @richardmhope in #245
• refactor(settings): align the proxy/OIDC singleton-settings pattern (#234) by @richardmhope in #246
• feat(sso): RP-initiated logout + shorter SSO session lifetime (#221) by @richardmhope in #247
• refactor(webhooks): resolve DNS via the running loop's native getaddrinfo by @richardmhope in #255
• refactor(fetchers): drop the Z→+00:00 shim before datetime.fromisoformat by @richardmhope in #256
• refactor(examples): use httpx (the project's HTTP client) instead of requests by @richardmhope in #257
• refactor(api): build ApiKeyOut/UserOut via pydantic from_attributes by @richardmhope in #258
• refactor(notifications): make ChangeEvent a validating pydantic dataclass by @richardmhope in #259
• refactor(tests): consolidate six fake-zip builders onto one conftest make_zip by @richardmhope in #260
• feat(scoring): count external domains by registrable domain (eTLD+1) by @richardmhope in #261
• perf(ci/tests): cache bcrypt in fixtures + trim CI waste (~60% faster suite) by @richardmhope in #262
• docs(ci): document the ui smoke job's non-obvious properties by @richardmhope in #264
• fix(dashboard): active filter pill readable in dark mode (var(--paper)) by @richardmhope in #265
• fix(config): tolerate the shared .env's POSTGRES_* keys (extra=ignore) by @richardmhope in #266
• fix(deploy): make ICEBERG_EBS_TRUSTED_ORIGINS configurable in both deploy stacks by @richardmhope in #267
• fix(proxy): constrain ProxySettings.mode to the enum, case-insensitively by @richardmhope in #268
• fix(inspector): stop two false positives inflating risk scores by @richardmhope in #269
• fix(frontend): polish batch (/ guard, refresh errors, stale refs, token-test CSS) by @richardmhope in #270
• docs(review-bot): distinguish a flaky stall from a terminal timed_out check-run by @richardmhope in #271
• chore(ui): tagline → 'EBS Control' in the rail and on login by @richardmhope in #272
• fix(config): fail fast on a missing credential; one config source for dev and prod by @richardmhope in #273
• fix(docker): exclude backups/ from the build context (#277) by @richardmhope in #292
• fix(inspector): scan every file that can execute, not just *.js (#275) by @richardmhope in #293
• fix(helm): make the chart's database wiring resolve; own the Postgres (#276) by @richardmhope in #294
• fix(inspector): don't let an unreadable manifest erase stored permissions (#274) by @richardmhope in #295
• docs(website): public Zensical docs site on GitHub Pages by @richardmhope in #296
• security: move canonical security headers from Caddy to the app by @richardmhope in #297
• fix: forward ICEBERG_EBS_OIDC_SESSION_MAX_AGE in Compose and Helm (#285) by @richardmhope in #298
• fix: reject invalid webhook ports at validation time (#283) by @richardmhope in #299
• feat: score the surveillance/capture permission family (#280) by @richardmhope in #300
• fix: derive UI permission tiers and risk bands from their single sources (#281) by @richardmhope in #301
• fix: scrub proxy credentials at every error sink, in every proxy mode (#228) by @richardmhope in #302
• security: bring API keys under the SSO revocation controls (#278) by @richardmhope in #303
• fix: keep one extension's failure from aborting the watchlist cycle (#282) by @richardmhope in #304
• fix: Chrome fetcher — exact-label version extraction and locale pin (#279) by @richardmhope in #305
• fix: decay install_footprint via the unused last_seen signal (#287) by @richardmhope in #306
• perf: bound the three unbounded-growth hot spots (#284) by @richardmhope in #307
• docs: sync README, help page, and website with the fable-review changes by @richardmhope in #308
• Low-priority fable-review batch: JSON guards, OIDC email trust, workflow hygiene, deploy-doc sync (#288–#291) by @richardmhope in #309
• Outbound integrations: Slack/Teams/email + Jira/ServiceNow (#37) by @richardmhope in #311
• build(deps): Bump the github-actions group across 1 directory with 6 updates by @dependabot[bot] in #310
• Reject webhook/destination URLs with embedded credentials (#79) by @richardmhope in #312
• fix(alerts): send the destination-kind descriptors to the account page by @richardmhope in #314
• fix(ui): regroup the rail by privilege, unify breadcrumbs, one search box by @richardmhope in #315
• release: cut v0.1.0-beta.1 by @richardmhope in #316
• fix(release): set up docker-container buildx driver for attestations by @richardmhope in #317

New Contributors

• @general-grivas made their first contribution in #1
• @richardmhope made their first contribution in #21
• @dependabot[bot] made their first contribution in #116

Full Changelog: https://github.com/IcebergAI/IcebergEBS/commits/v0.1.0-beta.1