v0.2.0-alpha.1

Ownpace v0.2.0-alpha.1. What changed: CHANGELOG.md.

Container images (multi-arch, cosign-signed):

docker pull ghcr.io/robbes/ownpace-selfhost:0.2.0-alpha.1
docker pull ghcr.io/robbes/ownpace-api:0.2.0-alpha.1
docker pull ghcr.io/robbes/ownpace-web:0.2.0-alpha.1

Verify a signature (keyless, against the public Sigstore log):

cosign verify ghcr.io/robbes/ownpace-selfhost:0.2.0-alpha.1 \
  --certificate-identity-regexp '^https://github\.com/Robbes/(open-migrate|ownpace|Ownpace)/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Install: see docs/selfhost-quickstart.md; Windows without Docker: docs/windows-appliance-runbook.md.

This release has no SBOM (bom.json), and its tag-time security scan failed. The Security Scan that ran on this tag (run 37523297841) stopped at its dependency-audit gate on four advisories in the locked dependencies:

• seroval 1.5.6: GHSA-jp82-f5mq-hwhp (high) and a critical bypass of GHSA-mv8w-475r-vwqw (fixed in 1.6.1);
• proxy-addr 2.0.7: GHSA-jqcg-44mw-7w3h (critical);
• source-map-js 1.2.1: GHSA-68fv-2mgg-jv7q (high, development only).

The images and the Windows zip had already been published by then, so the SBOM and this text were never added.

What this means if you run v0.2.0-alpha.1:

• proxy-addr: the managed API uses the affected code only when TRUST_PROXY names an address or a subnet. A number (the hop count the documentation asks for) does not, and the self-host image sets no trusted proxy at all.
• seroval: it reaches only a development tool (React Query's devtools), which the production web build replaces with an empty stub, so it is not in the app a browser loads.
• source-map-js: a development dependency only (the audit marks it so), not part of a production install.

All four are fixed on main (seroval 1.6.11, proxy-addr 2.0.8, source-map-js 1.2.2) and in the next release, v0.2.0-alpha.2. Re-running this tag's scan would fail the same way, because the tag's lockfile still holds those versions.