v1.2.0

1.2.0 (2026-07-08)

Features

• ingest: archive raw Watchman Sonic MQTT payloads (b834035)
• security: nginx security headers + XFF hardening (KERO-M5) (e6a1e47)
• security: rate-limit change-password endpoint (KERO-M5) (ba89e37)
• security: SSRF guard for operator-set URLs (KERO-M5) (63e0dfd)

Bug Fixes

• aggregate per-reading HDD into daily hdd_data rows (KERO-H1) (3aae742)
• close SettingsService.get cache race (KERO-L3) (fe7f98c)
• deps: bump frontend deps to clear Dependabot alerts (bac051a)
• document real rate-limit keying; expose FORWARDED_ALLOW_IPS knob (KERO-H2) (d1f3c8f)
• ingest: suppress refill/leak flags on Watchman Sonic multipath misreads (e29098e)
• move blocking notify and DNS lookups off the event loop (KERO-M1) (90d702e)
• name detect_refill's air-gap threshold (KERO-L7) (136939d)
• noise: catch 60min+jitter spikes, drop noisy rows from walkers, clean orphan periods (cf2b13b)
• noise: chain through suppressed rows so multi-reading drifts get marked (58af3c2)
• noise: direction-aware sanity gate + manual-log refill anchor (a2d9974)
• noise: keep sanity bound active across chain-noise gaps (9785a37)
• noise: order analysis_results by latest_analysis_date, not latest_reading_date (56e1da9)
• noise: skip noise_suppressed rows when picking 'latest reading' (650016b)
• pin backend deps via constraints; cache Docker dep layer (KERO-M4) (91e2bb7)
• price-fetch failure cooldown; derive cache path from DB dir (KERO-M3) (7c34a68)
• raw-capture retention sweep; upsert cost_analysis per day (KERO-L5) (9a667fd)
• real source for upcoming_month_hdd (KERO-L8) (3bbd22d)
• remove dead code (KERO-L1) (6708f42)
• return 503 from /api/health when degraded (KERO-M2) (6bb371d)
• share ECharts lifecycle via useEchart helper (KERO-L4) (04d6a99)
• share trusted-readings clause across analysis and notifier (KERO-H3) (97415a3)
• single pytest config, drop stale warning filters (KERO-L2) (5eeac04)
• UI healthcheck probes 127.0.0.1 instead of localhost (a2f7c75)
• validate refill_date as YYYY-MM-DD HH:MM:SS at entry (KERO-L6) (e09909b)

v1.1.0

1.1.0 (2026-05-09)

Features

• mqtt: add topic_readings_publish setting + LilyGO-shaped subscribe default (e7b4c03)

v1.0.1

1.0.1 (2026-05-09)

Bug Fixes

• ci: drop paths-ignore from build-images so tag pushes always trigger (f357d2d)

v1.0.0

1.0.0 (2026-05-09)

Features

• auth: Phase 2.5 — argon2id session-cookie auth + security hardening (3138b64)
• ui: post-setup onboarding wizard — MQTT, tank, boiler (b1a0362)
• ui: Records page filter bar — date range + litres/%/used/temp/refill/leak (e30b070)

Bug Fixes

• avg_daily uses simple 7-day delta (not per-pair walker sum) (bc64d8a)
• cost.py per-pair walker also uses net × time-weighted PPL (60e02dc)
• trends 90d/365d 422, forecast horizon clip, hw-split label (e74d762)
• trends/costs/forecast chart data windows + math (b0c0b17)
• ui: TankHeroPanel — tank/bars wrapper width + cost-to-fill string coercion (9d72dfb)
• ui: tighten first-run wizard so a fresh deploy doesn't trip on stale defaults (f250ad3)
• ui: Trends loadYear uses desc order so the heatmap shows recent months (982356d)