v1.3.2

Security patch release. No breaking changes to the developer push workflow under default config.

Security

• Base images: temurin 25.0.3 → 25.0.4+7, clearing 17 CVEs (3 High) across OpenJDK and Ubuntu-noble packages. (#517)
• Rejected pushes no longer persist objects. A refused push's objects (leaked secrets, blocked binaries) used to
  stay in the shared repo mirror; each push now uses an isolated quarantine store and only accepted pushes are
  promoted. No config needed. (#508)
• Dependencies: 19 Java libraries bumped (Spring, Spring Security, Jackson). (#507)
• Credentials decoded as UTF-8, fixing spurious auth failures for non-ASCII passwords. (#516)

Operator notes — commit attribution policy (#509)

commit.identity-verification renamed to commit.attribution-policy.

• Rename required. The old key is now accepted-but-ignored (startup WARN); left in place, the policy reverts to
  defaults (committer: warn, author: off). If you ran it in strict, upgrading without renaming silently stops it
  blocking.
• Now enforced on SSH, not just HTTP. Under strict, previously-unchecked SSH pushes can now be blocked.
• Config: CONFIGURATION.md → Commit attribution policy

Fixes

• Public repo clones through /push work again. A regression in 1.3.1 challenged every fetch for credentials,
  which broke anonymous clones of public repositories and failed outright in CI. Fogwall now asks upstream whether
  the repo is served anonymously before deciding whether to challenge. (#519)

Also

• Dependabot: exclude eclipse-temurin from the docker cooldown so base-image CVE bumps aren't deferred. (#517)
• CI, docs, and grouped dependency bumps (CodeQL/Actions/npm). (#504, #510, #511, #512, #513, #515, #518)

Upgrade

1. Rename commit.identity-verification → commit.attribution-policy if set.
2. Note attribution strict now applies to SSH.
3. No DB migration, no REST changes. Pull the new images.