Campus SmartMap v1.6.1

Security maintenance release.\n\n- Isolates trusted branch and release jobs from pull-request dependency caches.\n- Explicitly disables setup-node v7 automatic package-manager caching in every Quality and Security install job.\n- Retains full Quality and Security verification on immutable v* tags.\n\nThe exact v1.6.1 tag passed tag-triggered app, build, dependency, database integration, adversarial RLS, sensitive-file, CodeQL, and zizmor gates. The four cache-poisoning code-scanning findings are closed on main.

Campus SmartMap v1.6.0

Highlights\n\n- Private offline-first student schedule with conflict guidance, backup/restore, calendar export, and optional account sync\n- Complete long-route navigation, shared facility/room search, and explicit route camera control\n- Hardened image ingestion and previews with decoded WebP normalization, including HEIC/HEIF\n- Auditable AI chat operations with bounded feedback, release-bound traces, health checks, retention, alerting, deterministic evaluations, and resilient Gemini fallback\n- Resilient public event reads that do not cache transient failures\n- Protected-main governance, least-privilege SHA-pinned CI, CodeQL, secret scanning, Dependabot, dependency review, private vulnerability reporting, and documented residual-risk ownership\n- Full local Supabase reset, navigation integration, adversarial RLS matrices, and release-tag verification in CI\n\n## Verification\n\nThe exact v1.6.0 tag passed both tag-triggered workflows: Quality (app plus database/RLS) and Security. Production is deployed from the same verified commit, HSTS and application security headers are live, the Events route is healthy, and the authenticated daily retention job was exercised successfully.\n\nSee CHANGELOG.md and the production security baseline.

Campus SmartMap v1.6.0

Campus SmartMap v1.5.0

First public open-source release of Campus SmartMap for VSU. Includes reproducible local Supabase setup, security hardening, contribution and governance documentation, protected CI, and the audited clean-history launch.