v1.4.4

fogwall 1.4.4

A security patch for the SCM API's require-validated-head check. No default developer push workflow changes; operators running the SCM API proxy with pull/merge request head validation enabled should read the breaking-changes note below.

Breaking changes & upgrade notes

• require-validated-head now requires an approved or forwarded push record, not just any record — previously, a commit fogwall blocked and that was then pushed straight to the fork still satisfied head validation, because any push record for that SHA counted regardless of status. Only APPROVED or FORWARDED records count now. A PR whose head was only ever a blocked push will newly be refused — this is the intended fix, not a regression (#727). See docs/configuration/scm-api.md.

Security

• Fixed a require-validated-head bypass — a commit fogwall blocked, then pushed directly to the fork (bypassing the proxy), still validated its pull/merge request because fogwall only checked for the existence of a push record, not its outcome (#727).

Bug fixes

• Fixed pull/merge requests from differently-named forks being refused — require-validated-head looked up the head commit in <head-owner>/<upstream-name>, so a fork renamed from its upstream always failed validation. GitHub requests now resolve the head via GitHub's own compare; Gitea/Forgejo resolve it via the fork relationship, cached for 6 hours (#727).

Upgrade

1. Pull the new images — no config or database changes required.
2. If pull/merge requests are unexpectedly refused after upgrading, confirm the head commit's push record is APPROVED or FORWARDED rather than BLOCKED or another status — this is the corrected behavior, not a bug.

Full Changelog: v1.4.3...v1.4.4

v1.4.3

fogwall 1.4.3

This is a maintenance patch release: one configuration-loading fix plus dependency and base-image updates. The default developer push workflow is unchanged.

Bug fixes

• A YAML anchor/alias resolving to a list still failed at startup — the 1.4.2 fix covered config validation and hot reload but not the loader that parses fogwall.yml and mounted overrides on startup, so a config sharing a list across sections through an anchor still crashed fogwall on boot. The startup loader now resolves anchors the same way. (#679)

Dependencies

• Java, frontend npm, base image and GitHub Actions updates. (#682, #684, #685, #686, #688)

Upgrade

1. Pull the 1.4.3 image (or 1.4/latest, which now point at this release).
2. No configuration changes, no database migration and no REST changes — restart with the new image.

Full Changelog: v1.4.2...v1.4.3

v1.4.2

fogwall 1.4.2

This is a security patch release. Any deployment with secret scanning enabled should upgrade — the default developer push workflow is otherwise unchanged.

Security

• Secret-scan subprocesses no longer inherit fogwall's full environment — GitleaksRunner spawned gitleaks (and the git child it invokes via gitleaks git) with the parent process's complete environment, so every env-sourced secret in fogwall's configuration (database password, provider API tokens, OIDC client secret, LDAP/AD bind passwords) was readable by that subprocess. This mattered more than a typical subprocess because the scanner binary can be downloaded and unpacked by fogwall at runtime when commit.secret-scanning.auto-install is enabled, so the process reading the environment could be third-party code fetched at startup. Each subprocess (the diff scan, the git-mode scan, the object-visibility preflight, and the PATH probe) now gets an explicit environment built from an allowlist (PATH, HOME, TMPDIR, locale variables) instead of the inherited one. Scope is the secret-scanning path only — a deployment that does not enable it is unaffected. (#672)

Bug fixes

• A YAML anchor/alias resolving to a list failed to load — a config value shared across sections via a YAML anchor now resolves correctly instead of failing at startup. (#673)

Upgrade

1. Pull the 1.4.2 image (or 1.4/latest, which now point at this release).
2. No configuration changes and no database migration — restart with the new image.

Full Changelog: v1.4.1...v1.4.2

v1.4.1

fogwall 1.4.1

A maintenance and hardening release. The default developer push workflow is unchanged. One behaviour change matters if you drive configuration through hot-reload — see below.

Breaking changes & upgrade notes

• Config hot-reload applies only the sections a reload file declares — a partial reload file (file watch, git source, or POST /api/config/reload) now patches the sections it names and leaves every other section at its current live value. Previously an omitted section reverted to base defaults, so a file setting only secret-scan: could reset rules: to the default deny. An explicit reload is also no longer silently dropped while a background reload is in flight. No action is needed unless you rely on partial reload files — review them against the patch semantics documented at https://rbc.github.io/fogwall/configuration/hot-reload.html. (#663)
• origin is recorded on every action (migration V18) — records now carry an origin of DASHBOARD or SCM_API, set at the entry point the request arrived at. Migration V18 adds and backfills the column and indexes (origin, resolved_user); it applies automatically on startup for JDBC, and the MongoDB store does the equivalent backfill on startup. No manual step. (#655)

New features

• Every action records which fogwall surface it came from — the entry-point origin (DASHBOARD or SCM_API) is set by fogwall rather than inferred from the forgeable User-Agent. The Activity page (formerly Contributions) gains an All / Dashboard / SCM API filter and a per-row label, and issue filing moves under Contributions as "Report an issue" (/issues redirects). (#655)

Bug fixes

• Mirror cache eviction tolerates concurrent git maintenance — deleting a cached mirror no longer fails when JGit background gc is creating and removing transient lock files under the directory. (#665)

Maintenance

• Test harness reworked around config-booted fixtures with a compose smoke suite, and the bundled gitleaks binary is now cached at build time so a GitHub outage can't fail the build. (#661, #662)

Dependencies

• Java dependencies — 14 updates across the group. (#660)
• Frontend npm dependencies — 8 updates across the group. (#657)
• GitHub Actions — CodeQL actions group, and actions/setup-java 6.0.0 → 6.0.1. (#658, #659)
• Base image — eclipse-temurin digest refresh. (#656)

Upgrade

1. Pull the new images (:v1.4.1, :latest).
2. Migration V18 applies automatically on startup (JDBC); the MongoDB store backfills origin on startup. No manual step.
3. If you drive configuration through partial reload files, review them — omitted sections are now preserved rather than reset to defaults (#663).
4. No config key renames, and REST changes are additive only (the new origin field).

Full Changelog: v1.4.0...v1.4.1

v1.4.0

fogwall 1.4.0

fogwall 1.4.0 turns the push gateway into a broader SCM control plane: it now proxies the SCM CLIs (gh, glab, tea, fj) so pull/merge requests, issues, comments and merges flow through the same inspection and audit path as pushes, and it links proxy users to their upstream SCM accounts (GitHub, GitLab, Forgejo/Gitea) for real identity enforcement. The default developer push workflow is unchanged, but operators upgrading from 1.3.2 have several config renames and tightened defaults to review below.

Breaking changes & upgrade notes

• Server mode routing — /server/ is now canonical, /push/ is a deprecated alias. The mode formerly called "store-and-forward" is now "server mode", served at /server/<provider>/<owner>/<repo>.git. Existing /push/… remotes keep working through the alias, so nothing breaks on upgrade, but move remotes and scripts to /server/ — the alias will be removed in a future release. The dashboard REST field pushPath is renamed serverPath. (#538, #540)
• SSH is now a property of a provider entry, not a separate provider. One providers: entry serves both HTTP and SSH to the same upstream, and identity/permissions/OAuth links apply across both. A top-level ssh:// uri no longer enables SSH and warns at startup — consolidate any separate github-ssh-style entries into the HTTP entry. Additive config only, no DB migration. See https://rbc.github.io/fogwall/configuration/ssh-transport.html (#531, #534)
• commit.identity-verification renamed to commit.attribution-policy. The old key still binds with a startup deprecation warning and will be removed in a future release. The legacy commit.*.email.domain.allow / local.block keys are likewise kept as deprecated aliases for one minor release. See https://rbc.github.io/fogwall/configuration/commit-attribution.html (#146, #552)
• Tightened push size defaults. A new server.max-object-size-bytes (default 512 MiB, 0 = off) bounds the decompressed size of any single object, and the shipped size defaults are lower than before. These apply only to deployments that omit the keys — operators who relied on the previous 256 MiB / 100 MiB behaviour should set the old values explicitly when upgrading. (#532)
• Forwarded-header trust is now an explicit setting. server.trust-forwarded-headers (default true) gates the forwarded-header filter. The default keeps existing ingress deployments working unchanged, but set it deliberately — when on, the listener must be reachable only through the ingress that sets the headers. See https://rbc.github.io/fogwall/configuration/server.html (#587, #635)
• Dashboard API mutations are now default-deny. Every POST/PUT/PATCH/DELETE under /api requires ROLE_ADMIN unless it is an explicit user-facing exception (own profile, push review, issues, OAuth links). Reads are unchanged. Custom integrations that called a mutating endpoint as a non-admin will now get a 403. (#647)
• Controls that cannot run now fail closed. Malformed pushes, a validation control whose dependency is unwired, and a secret scan whose objects cannot be resolved now block the push instead of silently passing; admin self-approval whose entitlement cannot be verified is rejected. Correctly-wired deployments see no change. (#532, #547, #558, #643)
• Database migrations V15, V16 and V17 apply automatically on startup (SCM API entities, SCM token/login cache, SCM API merge records). No action required.

New features

• Contribution lifecycle through the SCM API proxy. Open, edit, comment on, close and merge pull/merge requests and issues via gh, glab, tea and fj routed through fogwall, with the same content inspection applied to outbound PR/MR and comment bodies and a full audit record of every mutation. Enabled per provider under scm-api. See https://rbc.github.io/fogwall/configuration/scm-api.html and https://rbc.github.io/fogwall/admin/scm-api.html (#264, #565, #578, #606, #619)
• SCM OAuth account linking with strict identity mode. Link proxy users to their GitHub, GitLab or Forgejo/Gitea accounts; in strict mode a push identity resolves only from OAuth-imported SSH keys and the push record names the account the token actually belongs to. See https://rbc.github.io/fogwall/configuration/scm-oauth.html (#40, #380, #528, #575, #599, #603)
• PROPOSE and MAINTAIN permission grants. PROPOSE allows opening PRs/MRs, issues and comments; MAINTAIN bundles push, propose and merge. Both assignable from the dashboard. See https://rbc.github.io/fogwall/configuration/permissions.html (#563, #564, #600, #604, #633)
• require-validated-head control for contributions. Refuses a PR/MR-create whose head commit has no fogwall push record, keyed on the commit SHA. On by default. (#572, #619)
• Commit-trailer policy and unified email-match rules. Enforce Signed-off-by and Co-Authored-By trailers and match author/committer/trailer emails through one rule model; annotated tag messages are now content-validated and taggers held to the committer email policy. See https://rbc.github.io/fogwall/configuration/commit-attribution.html (#146, #474, #541, #552)
• OpenTelemetry observability. Traces, metrics and log correlation across the push and SCM API proxy paths, opt-in via config. See https://rbc.github.io/fogwall/configuration/observability.html (#327, #641, #642, #648)
• Fetch toggle and configurable clone depth for server mode. Run a push-only gateway by disabling clone/fetch globally or per provider, and set the local mirror clone depth. (#476, #478, #537)
• Dashboard: admin, setup and inspection. Admin navigation grouped behind a dropdown with a responsive drawer; an in-app developer setup guide that generates git config and remote routing; an admin page to inspect and invalidate the local mirror cache; advanced push-record filters; error toasts with server detail and a per-provider SCM API availability badge; and an audit log of every administrative action with actor, target and outcome. (#98, #288, #340, #475, #548, #555, #585, #607, #626, #627, #628, #634)
• Runtime build version and commit exposed at runtime and in the dashboard. (#579, #596)

Security

• Closed an admin self-approval bypass of self-certify. An admin could approve their own push through admin override without holding self-certify, forwarding it end to end in the transparent proxy. Self-review now always runs the self-certify gate; admin override is redefined as break-glass for another user's push only, and a stale unentitled approval demotes to ERROR on re-push. (#643)
• Default-deny authorization for dashboard API mutations — a newly added mutating endpoint fails closed for non-admins instead of inheriting any-authenticated access. (#647)
• Secret scanning now reaches quarantined push objects. Since rejected-push objects moved to a quarantine store, gitleaks (which shells out to git) could not resolve the pushed commits and recorded a false PASS; the quarantine object directory is now exposed to the scan, which fails closed if the tip is unresolvable. (#558)
• Bounded decompressed push size and fail-closed malformed pushes to cap resource use and reject truncated/malformed packs. (#532)
• Fail closed on missing control dependencies and bound permission-regex matching against pathological patterns. (#547)
• Stopped leaking configured API-key length via comparison timing, and routed unknown-op request diagnostics through slf4j with Cookie/Proxy-Authorization redaction. (#535)
• OIDC ID tokens are always fully validated; two authorization read-path bugs affecting config-declared users were fixed (both already fail closed). (#524, #559)

Bug fixes

• Nested repository paths are preserved — GitLab subgroup paths are no longer truncated to two segments by URL rules and permissions. (#577, #590)
• Repository paths match case-insensitively in access rules and grants. (#576, #595)
• Push options are rejected in both proxy modes. (#594)
• Signed pushes are rejected by name instead of being misreported as multi-branch. (#536)
• One lifecycle record per push in server mode, not three. (#533)
• checkTrailers push feedback is consistent with the other validation steps. (#608, #609)
• Adding a config-declared user to a group no longer 500s. (#631)
• Abandoned pending pushes expire and are superseded in transparent proxy mode. (#591, #615)

Performance

• Virtual-thread request handling finished — shared heartbeat scheduler and thread configuration. (#452, #557)
• Repository-cache concurrency — per-key clone lock, per-repo push serialization, and a server-tuned JGit pack cache. (#556, #561)

Maintenance

• PMD static analysis with a starter ruleset, constructor injection throughout the dashboard, a canonical PushStepKind identity for hooks and filters, a chain-drift guard test, a captured-fixture UI regression suite, and the guides split into pages published with mdBook. (#543, #549, #560, #586, #612, #613, #637, #639)
• Renamed the contribution surface: "Contributions" in the UI, "SCM API" in config and internals. (#650)

Dependencies

• Java — grouped dependency updates plus a netty transitive pin at 4.1.137.Final. (#529, #583, #624, #629)
• Frontend (npm) — grouped dependency updates. (#525, #526, #584)
• GitHub Actions — grouped action and CodeQL updates. (#522, #523)

Upgrade

1. Review the config renames above and update your YAML: store-and-forward//push/ → server mode and /server/, SSH consolidated into the provider entry, commit.identity-verification → commit.attribution-policy. The old keys still bind with a deprecation warning, so this can be staged.
2. If you relied on the previous push size limits, set server.max-object-size-bytes and the size keys explicitly — the shipped default...

v1.3.2

Security patch release. No breaking changes to the developer push workflow under default config.

Security

• Base images: temurin 25.0.3 → 25.0.4+7, clearing 17 CVEs (3 High) across OpenJDK and Ubuntu-noble packages. (#517)
• Rejected pushes no longer persist objects. A refused push's objects (leaked secrets, blocked binaries) used to
  stay in the shared repo mirror; each push now uses an isolated quarantine store and only accepted pushes are
  promoted. No config needed. (#508)
• Dependencies: 19 Java libraries bumped (Spring, Spring Security, Jackson). (#507)
• Credentials decoded as UTF-8, fixing spurious auth failures for non-ASCII passwords. (#516)

Operator notes — commit attribution policy (#509)

commit.identity-verification renamed to commit.attribution-policy.

• Rename required. The old key is now accepted-but-ignored (startup WARN); left in place, the policy reverts to
  defaults (committer: warn, author: off). If you ran it in strict, upgrading without renaming silently stops it
  blocking.
• Now enforced on SSH, not just HTTP. Under strict, previously-unchecked SSH pushes can now be blocked.
• Config: CONFIGURATION.md → Commit attribution policy

Fixes

• Public repo clones through /push work again. A regression in 1.3.1 challenged every fetch for credentials,
  which broke anonymous clones of public repositories and failed outright in CI. Fogwall now asks upstream whether
  the repo is served anonymously before deciding whether to challenge. (#519)

Also

• Dependabot: exclude eclipse-temurin from the docker cooldown so base-image CVE bumps aren't deferred. (#517)
• CI, docs, and grouped dependency bumps (CodeQL/Actions/npm). (#504, #510, #511, #512, #513, #515, #518)

Upgrade

1. Rename commit.identity-verification → commit.attribution-policy if set.
2. Note attribution strict now applies to SSH.
3. No DB migration, no REST changes. Pull the new images.

v1.3.1

Security

This release includes hardening fixes identified during an internal security review:

• Supply-chain integrity — the gitleaks binary auto-installed by the secret-scan hook is now checksum-verified before execution (#457).
• Path/SSRF-adjacent input validation — repository owner/name segments are now validated before being used to construct the upstream URL (#458).

What's Changed

• chore(deps-dev): bump tar from 7.5.16 to 7.5.21 in /fogwall-dashboard/frontend by @dependabot[bot] in #455
• fix(secret-scan): verify gitleaks release checksum before auto-install by @coopernetes in #457
• fix(proxy): validate repository owner/name segments before URL construction by @coopernetes in #458
• fix(deps): pin plugin-classpath Jackson to 2.22.1 by @coopernetes in #459
• docs: refresh README/docs for 1.3.0, restructure for readability by @coopernetes in #460
• docs(demos): restore screenshot sources, re-record push-fail-then-fix demo by @coopernetes in #461
• chore/upgrade react router by @coopernetes in #466
• chore(deps): bump the frontend-npm-dependencies group across 1 directory with 9 updates by @dependabot[bot] in #467
• chore(deps): bump the github-actions group across 1 directory with 3 updates by @dependabot[bot] in #464
• chore(deps): bump the java-dependencies group across 1 directory with 7 updates by @dependabot[bot] in #468
• chore(deps): bump the codeql-actions group across 1 directory with 3 updates by @dependabot[bot] in #462
• fix(proxy): replace raw NUL byte in ParseGitRequestFilter; collapse pre-commit into formatAll by @coopernetes in #470
• fix(cache): key the mirror fetch cooldown by principal, not repository alone by @coopernetes in #471
• fix(approval): fail closed when the approval gate cannot read its push record by @coopernetes in #473
• fix(proxy): make transparent proxy work against private repos, and stop three false rejections by @coopernetes in #472
• fix(cache): stop two providers hosting the same repo path from sharing one mirror by @coopernetes in #480
• chore(deps-dev): bump the frontend-npm-dependencies group in /fogwall-dashboard/frontend with 5 updates by @dependabot[bot] in #482
• chore(deps): bump the java-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #483
• chore(deps): bump the codeql-actions group across 1 directory with 3 updates by @dependabot[bot] in #484
• fix(approval): scope an approved re-push to the repository it was approved for by @coopernetes in #481
• fix(config): let codeberg provider use a configured SSH uri by @coopernetes in #489
• chore: fix Gradle 10 deprecation warning and refresh CLAUDE.md by @coopernetes in #490
• fix(proxy): cap push size and refuse Git LFS uploads by @coopernetes in #491
• chore(deps): bump eclipse-temurin from 3eb81ed to 735baf2 by @dependabot[bot] in #493
• chore(deps): bump the java-dependencies group across 1 directory with 11 updates by @dependabot[bot] in #499
• fix(store-and-forward): challenge fetch/clone for credentials, not just push by @coopernetes in #498
• chore(deps-dev): bump the frontend-npm-dependencies group across 1 directory with 6 updates by @dependabot[bot] in #500
• chore(deps): bump the codeql-actions group across 1 directory with 3 updates by @dependabot[bot] in #497
• chore(deps): bump the github-actions group across 1 directory with 4 updates by @dependabot[bot] in #495
• chore: bump version to 1.3.1 by @coopernetes in #501

Full Changelog: v1.3.0...v1.3.1

v1.3.0

New features

• SSH transport for store-and-forward — full git push/git fetch over SSH with agent forwarding, upstream host-key pinning (with opt-in TOFU), and routing across multiple SSH-configured providers. See SSH transport. (#379, #432, #451, #430, #431)
• Outbound proxy support — route upstream traffic through a corporate outbound proxy with Basic or Kerberos auth. See Outbound proxy. (#427)
• Content-pattern scanning (WARN-only) — detect structured PII/national-ID/financial identifiers (IBANs, credit cards, crypto wallets, national IDs) in diffs and commit messages using built-in pattern bundles. See Content-pattern scanning. (#446)
• Binary blob detection — flag binary content in pushed commits by MIME signature, not file extension. See Binary blob detection. (#426)
• MySQL / MariaDB backend support — new database backend options alongside Postgres/H2/Mongo. See Database backends. (#423)
• Standalone server Docker image + Helm chart — fogwall-server now ships its own image and a minimal Helm chart for Kubernetes deployment. (#421, #439, #441)
• Permission groups — group-based permission assignment instead of per-user only. See Groups. (#406, #101)
• WARN as a first-class step status — validation steps can now warn without blocking a push, surfaced distinctly in the dashboard and client output. (#440)
• Configurable open-access mode — allow IdP-authenticated users through when role mappings aren't enforced, instead of denying by default. See Role mappings. (#419)
• Policy links on attestation questions — attach a reference URL to each attestation prompt. See Attestations. (#403)
• Double-underscore env var convention — environment variable overrides can now target hyphenated config keys and provider names. See Hyphenated keys and provider names. (#402)
• Rule/permission test endpoints — admin dry-run endpoints to check how a URL rule or permission would evaluate before deploying it. (#416)
• Optional order in access rules, defaulting to YAML array position. (#418)
• Third-party license notices bundled into Docker images and a dashboard Legal page. (#424)
• Dashboard UX: hyperlinked repo/commit references in push list and push detail. (#420)

Bug fixes & security

• Fail-closed validation + SSH upstream host-key verification — validation hooks now fail closed on internal error instead of allowing the push through, and SSH forwarding verifies the upstream host key. (#448)
• Secret-scan findings are now redacted from stored diffs before persistence, not just at display time. (#437)
• Reliably cancel PENDING pushes on client disconnect or gateway error over SSH. (#430)
• Merge config-sourced user data on SSH fingerprint lookup; fixed a 403 on SSH key removal. (#431)
• Pause heartbeat messages during approval wait; hide review-related grants when require-review-permission is false. (#405)

Maintenance

• Removed a redundant provider-path check and collapsed the filter hierarchy. (#438)
• Dispatch request handling to bounded virtual threads for improved concurrency. (#453)
• CI: cover fogwall-server in the weekly scan and manual retag workflows; publish/release the standalone server image. (#439, #441)
• Dependency bumps: Java (java-dependencies group, org.cyclonedx.bom), GitHub Actions (github-actions, codeql-actions groups), and frontend npm packages. (#408, #409, #411, #412, #433, #434, #435, #436, #449)
• Docs: troubleshooting guide for large push failures behind reverse proxies; final pre-release doc/config/deployment cleanup. (#417, #443, #445)

Full Changelog: v1.2.1...v1.3.0

v1.2.1

What's Changed

• chore(deps): bump the java-dependencies group with 8 updates by @dependabot[bot] in #375
• chore(deps): bump the frontend-npm-dependencies group across 1 directory with 11 updates by @dependabot[bot] in #377
• chore(deps): bump actions/setup-java from 5.3.0 to 5.4.0 by @dependabot[bot] in #373
• chore(deps): bump actions/attest-build-provenance from 4.1.0 to 4.1.1 by @dependabot[bot] in #374
• chore: rename servletPath/basePath/customPath to pathSuffix throughout by @coopernetes in #378
• docs: clarify credential flow and transparent proxy streaming constraint by @coopernetes in #381
• chore(deps): bump docker/metadata-action from 6.1.0 to 6.2.0 by @dependabot[bot] in #387
• chore(deps): bump eclipse-temurin from 02aba75 to 3eb81ed by @dependabot[bot] in #392
• chore(deps): bump the java-dependencies group with 5 updates by @dependabot[bot] in #393
• chore(deps-dev): bump vite from 8.1.2 to 8.1.3 in /fogwall-dashboard/frontend in the frontend-npm-dependencies group by @dependabot[bot] in #394
• chore: group codeql dependabot updates and normalize labels by @coopernetes in #395
• chore(deps-dev): bump typescript-eslint from 8.62.1 to 8.63.0 in /fogwall-dashboard/frontend in the frontend-npm-dependencies group by @dependabot[bot] in #396
• chore(deps): bump org.postgresql:postgresql from 42.7.12 to 42.7.13 in the java-dependencies group by @dependabot[bot] in #397
• chore(deps): bump the codeql-actions group with 3 updates by @dependabot[bot] in #398
• chore(deps): bump the github-actions group with 3 updates by @dependabot[bot] in #399
• chore: bump version to 1.2.1 by @coopernetes in #400

Full Changelog: v1.2.0...v1.2.1

v1.2.0

What's Changed

• fix: correctly handle tag pushes in transparent proxy commit enrichment by @coopernetes in #338
• fix: bug fixes for 1.1.1 release by @coopernetes in #341
• chore: restrict GHA workflow token permissions to least privilege by @coopernetes in #343
• perf: benchmark suite comparing fogwall vs finos/git-proxy by @coopernetes in #342
• feat: MongoDB SCM token cache, docs refresh, demo assets by @coopernetes in #345
• docs: polish README, depersonalize config, add alert syntax, fix stale names by @coopernetes in #349
• chore(deps-dev): bump @types/node from 25.9.3 to 26.0.0 in /fogwall-dashboard/frontend in the frontend-npm-dependencies group by @dependabot[bot] in #354
• refactor(1.2.0): operations→operation rename, FogwallPermission abstraction, OAuth compat redirect by @coopernetes in #352
• fix: revert LegacyOidcCallbackRedirectFilter, document IdP redirect URI migration by @coopernetes in #355
• fix: cancel PENDING push record when git client disconnects during approval wait by @coopernetes in #356
• fix: skip RFC format check when no email policy is configured, drop commons-validator by @coopernetes in #358
• fix: decompose identity-verification into independent committer and author checks by @coopernetes in #359
• fix: S&F re-push shows full commit list and scan coverage relative to upstream by @coopernetes in #362
• ci: run all required checks and Docker build on release/* branches by @coopernetes in #365
• fix: per-commit content scanning closes intermediate-commit bypass in S&F mode by @coopernetes in #367
• feat: emit request/response schemas in OpenAPI spec for automation-relevant endpoints by @coopernetes in #368
• feat: add dark mode to dashboard UI (#46) by @coopernetes in #369
• chore: bump version to 1.2.0 by @coopernetes in #370

Full Changelog: v1.1.0...v1.2.0