v0.2.0-alpha.3

Ownpace v0.2.0-alpha.3. What changed: CHANGELOG.md.

Container images (multi-arch, cosign-signed):

docker pull ghcr.io/robbes/ownpace-selfhost:0.2.0-alpha.3
docker pull ghcr.io/robbes/ownpace-api:0.2.0-alpha.3
docker pull ghcr.io/robbes/ownpace-web:0.2.0-alpha.3

Verify a signature (keyless, against the public Sigstore log):

cosign verify ghcr.io/robbes/ownpace-selfhost:0.2.0-alpha.3   --certificate-identity-regexp '^https://github\.com/Robbes/(open-migrate|ownpace|Ownpace)/'   --certificate-oidc-issuer https://token.actions.githubusercontent.com

Install: see docs/selfhost-quickstart.md; Windows without Docker: docs/windows-appliance-runbook.md.

The attached bom.json is this build's CycloneDX SBOM.

v0.2.0-alpha.2

Ownpace v0.2.0-alpha.2. What changed: CHANGELOG.md.

Container images (multi-arch, cosign-signed):

docker pull ghcr.io/robbes/ownpace-selfhost:0.2.0-alpha.2
docker pull ghcr.io/robbes/ownpace-api:0.2.0-alpha.2
docker pull ghcr.io/robbes/ownpace-web:0.2.0-alpha.2

Verify a signature (keyless, against the public Sigstore log):

cosign verify ghcr.io/robbes/ownpace-selfhost:0.2.0-alpha.2   --certificate-identity-regexp '^https://github\.com/Robbes/(open-migrate|ownpace|Ownpace)/'   --certificate-oidc-issuer https://token.actions.githubusercontent.com

Install: see docs/selfhost-quickstart.md; Windows without Docker: docs/windows-appliance-runbook.md.

The attached bom.json is this build's CycloneDX SBOM.

v0.2.0-alpha.1

Ownpace v0.2.0-alpha.1. What changed: CHANGELOG.md.

Container images (multi-arch, cosign-signed):

docker pull ghcr.io/robbes/ownpace-selfhost:0.2.0-alpha.1
docker pull ghcr.io/robbes/ownpace-api:0.2.0-alpha.1
docker pull ghcr.io/robbes/ownpace-web:0.2.0-alpha.1

Verify a signature (keyless, against the public Sigstore log):

cosign verify ghcr.io/robbes/ownpace-selfhost:0.2.0-alpha.1 \
  --certificate-identity-regexp '^https://github\.com/Robbes/(open-migrate|ownpace|Ownpace)/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Install: see docs/selfhost-quickstart.md; Windows without Docker: docs/windows-appliance-runbook.md.

This release has no SBOM (bom.json), and its tag-time security scan failed. The Security Scan that ran on this tag (run 37523297841) stopped at its dependency-audit gate on four advisories in the locked dependencies:

• seroval 1.5.6: GHSA-jp82-f5mq-hwhp (high) and a critical bypass of GHSA-mv8w-475r-vwqw (fixed in 1.6.1);
• proxy-addr 2.0.7: GHSA-jqcg-44mw-7w3h (critical);
• source-map-js 1.2.1: GHSA-68fv-2mgg-jv7q (high, development only).

The images and the Windows zip had already been published by then, so the SBOM and this text were never added.

What this means if you run v0.2.0-alpha.1:

• proxy-addr: the managed API uses the affected code only when TRUST_PROXY names an address or a subnet. A number (the hop count the documentation asks for) does not, and the self-host image sets no trusted proxy at all.
• seroval: it reaches only a development tool (React Query's devtools), which the production web build replaces with an empty stub, so it is not in the app a browser loads.
• source-map-js: a development dependency only (the audit marks it so), not part of a production install.

All four are fixed on main (seroval 1.6.11, proxy-addr 2.0.8, source-map-js 1.2.2) and in the next release, v0.2.0-alpha.2. Re-running this tag's scan would fail the same way, because the tag's lockfile still holds those versions.

v0.1.0-rc.1

v0.1.0-rc.1 — the first tagged artifact

A release candidate, deliberately. The pipeline that produces it is proven; the feature set is still moving, and a version people might pin should not imply otherwise (owner decision, workplan 0025 T2).

Cut from 2026-08-04 rather than the 08-03 commit that prepared the notes: that tree resolved socket.io-parser 4.2.6 (CVE-2026-69185, HIGH), fixed on main the following morning, and it reaches the appliance image through @openmig/worker.

See CHANGELOG.md for what works, what is built but has never read a real Microsoft 365 tenant, and what is not in it at all.