v0.9.1

Fixed

• Remediated CVE-2026-89161 and other fixed Debian package vulnerabilities in
  the Dagster base image by applying security upgrades during the runtime
  build. Scheduled image scans and signed-image fixture refreshes now track
  base and hardened variants independently instead of scanning the same
  digest twice (#718, #719).
• Replaced the SHA-1 branch-to-port hash used by the k3d local-dev harness
  (scripts/k8s/) with SHA-256 (#698).
• Hardened helm/kubectl invocations against CLI-supplied argument and
  path issues flagged by SonarCloud: resolved CWE-88/CWE-22 risks in
  CLI-supplied args and paths (#700), satisfied taint tracking for k8s
  name/context validation (#701), resolved --chart-dir to an absolute path
  before use in the helm command (#702), and validated the
  helm/kubectl --timeout value before building the command argument
  (#705).

What's Changed

• chore(images): refresh signed-images fixture by @github-actions[bot] in #694
• docs: remove merged PR review ledger, fix stale feat/k8s branch references by @RonaldHensbergen in #697
• Replace SHA-1 with SHA-256 in k3d branch-to-port hash by @RonaldHensbergen in #698
• fix: resolve SonarCloud quality gate failure (CWE-88/CWE-22 on CLI-supplied args and paths) by @RonaldHensbergen in #700
• fix: satisfy SonarCloud taint tracking for k8s name/context validation by @RonaldHensbergen in #701
• fix: resolve --chart-dir before use in helm command (SonarCloud S8705) by @RonaldHensbergen in #702
• fix: validate helm/kubectl --timeout before building command argument (SonarCloud S8705) by @RonaldHensbergen in #705
• docs: explain SonarCloud PR-vs-main quality gate scope discrepancy by @RonaldHensbergen in #704
• docs: refresh roadmap to v0.9.0 and drop good-first-issue label references by @RonaldHensbergen in #707
• chore: add @vanderheijden86 as Kubernetes render-target codeowner by @RonaldHensbergen in #706
• chore(images): refresh signed-images fixture by @github-actions[bot] in #709
• chore(deps): update dependency renovate to v44.80.0 by @renovate[bot] in #708
• Bundle CHANGELOG dating into weekly version-bump PR by @RonaldHensbergen in #657
• chore(deps): update all dependencies by @renovate[bot] in #710
• chore(deps): update dependency java-jdk to v25 by @renovate[bot] in #711
• chore(deps): update all dependencies by @renovate[bot] in #712
• chore(images): refresh signed-images fixture by @github-actions[bot] in #713
• chore(deps): update all dependencies by @renovate[bot] in #715
• chore(images): refresh signed-images fixture by @github-actions[bot] in #716
• Lead README with the data platform composition problem by @RonaldHensbergen in #720
• Remediate Dagster CVE scan findings by @RonaldHensbergen in #721
• fix(deps): update all dependencies by @renovate[bot] in #717
• chore(images): refresh signed-images fixture by @github-actions[bot] in #722
• chore(deps): update all dependencies by @renovate[bot] in #723
• chore(images): refresh signed-images fixture by @github-actions[bot] in #724
• chore(release): bump version to 0.9.1 by @github-actions[bot] in #696

Full Changelog: v0.9.0...v0.9.1

v0.9.0

Removed

• Removed jinja2 from the CLI package's runtime dependencies; it was only ever imported by images/dagster/generate_config.py, a Docker build-time script, and is now installed explicitly in images/dagster/requirements.txt instead. Added a new test extra (and updated Makefile, CONTRIBUTING.md, and CI) since the test suite still exercises generate_config.py directly (#470).

Added

• Added a Kubernetes runtime target: cds render/cds validate/cds security/cds test/cds up/cds down/cds state now accept --target helm alongside the existing Docker Compose target. cli/k8s_renderer.py renders the resolved plan as a Helm chart (Secrets, ConfigMaps, Deployments/StatefulSets and PVCs, release-scoped Services), cli/k8s_security.py runs Kubernetes-specific security checks (effective per-container root/non-root posture), and cli/k8s_runner.py provides bounded helm upgrade --install plus kubectl wait/rollout status lifecycle operations. Includes a sibling-safe, per-worktree k3d local-dev harness (scripts/k8s/, make k3d-*) with an isolated k3s CI proof workflow, a TenderNed procurement-data Superset/Dagster analytics demo wired through the new target, and docs/kubernetes.md (#608).
• Added scripts/ai_profile_review.py, an optional AI-assisted guardrail/simplification review for CDS profiles: it runs cds validate/cds plan and then asks an LLM to flag repository-convention violations and simplification opportunities not already covered by schema/contract validation, seeing only profile YAML and the resolved plan (secrets are always placeholders, never resolved values). Supports --json and --dry-run, and a vendored single-seam LLM client (scripts/_vendor/llm/) with three explicit providers (copilot_cli, azure_openai, ollama) and no silent fallback (#652).
• Added scripts/compose_to_module.py, a scaffolding tool that automates the mechanical parts of docs/from-docker-to-cds-profile.md: it converts an existing docker-compose.yml into a starter module.yaml, lifting ports/environment into a configSchema, replacing literal values with ${config.*} placeholders, and detecting secret references, hardcoded connection strings, and dependencies on other compose services (flagging well-known infra images for binding to an existing shared contract and provider module instead of being scaffolded anew) (#670).
• Added config.image.registry (dockerhub default | ghcr) to the orchestration/dagster and bi/superset module schemas, so config.image.source: registry can pull the same signed image publish-images.yml already publishes to GHCR, not just Docker Hub; existing profiles are unaffected since the default keeps them pointed at Docker Hub (#613).
• Promoted the dbt transformation module from modules-experimental/ to
  modules/transformation/, with production-suitable hardening and
  PostgreSQL/DuckDB warehouse support (#594).
• Added regression tests for planner default materialization in nested configSchema structures: array-item object defaults filled in per-item without overwriting explicitly provided sibling properties, and partially provided nested objects preserving explicit falsy values (False/0) while still materializing omitted siblings (#459).
• Added CLI-level test coverage asserting cds validate reports precise diagnostic codes and data paths for common validation failures: a module entry missing a required field (E010) and a consume binding with an unresolvable contractRef (E041) (#460).
• Added cli.loader.save_generated_profile() and cli.main.generate_profile() so a runtime/programmatically composed profile can be persisted at its normal profiles/<name>/profile.yaml location (honoring CDS_PROFILE_PATH), then handed to the existing validate_profile()/build_plan() entry points completely unchanged -- same relative module-source resolution and extends/environment-overlay semantics as any hand-authored profile. Refuses to write outside the profiles root or silently overwrite an existing profile without force=True. Exposed as a new cds generate-profile <file> CLI command (reads JSON/YAML from a file path or - for stdin, with --name/--force options) (#349).
• Added test_fetch_profile_rejects_dockerfile_copy_traversal_escaping_source_repo, a regression test proving a Dockerfile COPY/ADD source containing .. that Path.glob() matches outside the source repository is rejected as a stable GetError (via the existing _add_copy_action guard from #454), not an unhandled ValueError (#475).
• Pinned build, twine, and yamllint's CI-installed versions, and the renovate npm package version used by renovate-config-validator, matching this repo's existing exact-pin convention for CI-only tooling (e.g. ruff==0.16.6), addressing SonarCloud's githubactions:S8544 findings triaged in #622. Added matching Renovate custom managers so these pins stay up to date automatically.

Fixed

• Set the Docker Hub short description for every published image (dagster, superset, dbt, dlt) via peter-evans/dockerhub-description's short-description input, instead of relying on it being set manually per repository. dbt and dlt were missing it entirely since their Docker Hub repositories were auto-created by CI without ever going through that manual step.
• Fixed a quadratic (super-linear) regex backtracking hazard in cli/preflight.py's _ENV_REFERENCE pattern, used to scan rendered Compose YAML for ${VAR...} references: an unterminated reference could make the identifier and suffix capture groups' overlapping character classes retry every possible split point. Required the suffix group to start with one of its actual delimiters (:, ?, -), making the two groups' character classes disjoint, flagged by SonarCloud as python:S8786.
• images/superset/init.sh now uses [[ ... ]] instead of [ ... ] for its conditional tests, addressing SonarCloud's shelldre:S7688 findings triaged in #622.

Changed

• Raised the coverage-enforced cli/ coverage gate from 65% to 80%, matching actual measured coverage and the industry norm for a security-focused tool (pyproject.toml's [tool.coverage.report] fail_under) (#471).

What's Changed

• docs(changelog): retroactively add the missing 0.8.0 release section by @RonaldHensbergen in #615
• Wire dbt module to optionally target DuckDB (#593) by @RonaldHensbergen in #599
• chore(images): refresh signed-images fixture by @github-actions[bot] in #617
• docs: soften dagster hardened-variant CVE-count claim by @RonaldHensbergen in #611
• ci(images): add alpine-latest/alpine- tag aliases for hardened publish by @RonaldHensbergen in #612
• chore(images): refresh signed-images fixture by @github-actions[bot] in #618
• Expand release-tag-reminder into a full release completeness checklist by @RonaldHensbergen in #614
• feat(images): support pulling published images from GHCR, not just Docker Hub by @RonaldHensbergen in #613
• chore(images): refresh signed-images fixture by @github-actions[bot] in #628
• fix(superset): use [[ ]] instead of [ ] in init.sh conditionals (#622) by @RonaldHensbergen in #627
• chore(images): refresh signed-images fixture by @github-actions[bot] in #630
• docs(readme): add SonarCloud, CI, PyPI, and license badges by @RonaldHensbergen in #629
• chore(ci): exact-pin CI-only tool versions flagged by SonarCloud (#622) by @RonaldHensbergen in #626
• ci: run SonarCloud scan on pushes to main, not just same-repo PRs by @RonaldHensbergen in #632
• ci(biweekly-issue-audit): install and authenticate Copilot CLI by @RonaldHensbergen in #631
• Add experimental ingestion module for dlt (data load tool) by @RonaldHensbergen in #592
• Raise coverage gate to 80% and close security-module test gaps by @RonaldHensbergen in #619
• fix(preflight): remove quadratic regex backtracking in _ENV_REFERENCE by @RonaldHensbergen in #635
• ci: set Docker Hub short description for all published images by @RonaldHensbergen in #636
• chore(images): refresh signed-images fixture by @github-actions[bot] in #638
• test: add planner default-materialization and validate diagnostics-path regression tests by @RonaldHensbergen in #637
• test(getter): add regression test for Dockerfile COPY traversal escape by @RonaldHensbergen in #633
• chore(deps): update all dependencies by @renovate[bot] in #639
• chore: remove jinja2 runtime dependency, unused by the CLI by @RonaldHensbergen...

v0.8.0

Added

• cds list profiles/cds list modules/cds list images now accept --remote <owner/repo>, --ref <ref>, and --local <dir>, reusing cds get's own source-repository resolution so users can discover what's available in a remote repository or existing local checkout before running cds get against it (#500).

Fixed

• cds preflight's image supply-chain check now honors a saved security.strict project default, forcing the production image policy (registry allowlist, digest pins, signature/provenance verification) regardless of the profile's inferred environment class, matching the existing behavior of cds security --verify-images (#546).

What's Changed

• Add standalone single-module profile smoke test by @RonaldHensbergen in #548
• Fix invalid mermaid code fences and add regression test by @RonaldHensbergen in #554
• fix: keydb cache-service connectionUri never includes password wh by @Mr-Neutr0n in #555
• docs: document ifNonempty conditional interpolation syntax and semantics by @ItzSaurav in #560
• chore(deps): update softprops/action-gh-release digest to efb3536 by @renovate[bot] in #562
• Add workflow to flag first-time contributor PRs by @RonaldHensbergen in #561
• Add Traefik reverse-proxy module by @RonaldHensbergen in #549
• Update traefik Docker tag to v3.7 by @renovate[bot] in #563
• Validate image.source: registry requires a tag; warn on tag: latest by @RonaldHensbergen in #552
• docs: formalize images/ independent versioning (middle ground before a repo split) by @RonaldHensbergen in #550
• chore(images): refresh signed-images fixture by @github-actions[bot] in #566
• Update apache/superset:6.1.0 Docker digest to 59cd4af by @renovate[bot] in #567
• chore(images): refresh signed-images fixture by @github-actions[bot] in #568
• Add profile composition via extends by @RonaldHensbergen in #525
• Update all dependencies by @renovate[bot] in #571
• chore(images): refresh signed-images fixture by @github-actions[bot] in #572
• Fix symlink escape and copy failure handling in cds get by @RonaldHensbergen in #569
• Improve cds get --dry-run by reporting overwrite conflicts by @RonaldHensbergen in #565
• Update hashicorp/vault Docker tag to v2.1 by @renovate[bot] in #575
• Update all dependencies by @renovate[bot] in #586
• chore(images): refresh signed-images fixture by @github-actions[bot] in #587
• Thread security.strict into cds preflight image checks by @RonaldHensbergen in #573
• fix(state): add CREATED bucket instead of falling back to UNKNOWN by @RonaldHensbergen in #585
• Add --remote/--ref/--local to cds list by @RonaldHensbergen in #574
• chore(deps): bump pip from 26.1.2 to 26.2 by @dependabot[bot] in #588
• docs(roadmap): move PyPI publishing from near-term to completed by @RonaldHensbergen in #598
• Update all dependencies by @renovate[bot] in #600
• chore(images): refresh signed-images fixture by @github-actions[bot] in #602
• Add experimental DuckDB warehouse module by @RonaldHensbergen in #596
• feat(bi/superset): adopt image.source/image.tag config by @RonaldHensbergen in #584
• chore(images): refresh signed-images fixture by @github-actions[bot] in #606
• Update dependency dagster to v1.13.21 by @renovate[bot] in #604
• chore(release): bump version to 0.8.0 by @github-actions[bot] in #605

New Contributors

• @Mr-Neutr0n made their first contribution in #555
• @ItzSaurav made their first contribution in #560

Full Changelog: v0.7.0...v0.8.0

v0.7.0

Added

• Added a cds config subcommand family (get/set/unset/list) to manage persisted project-level defaults in .cds/config.json (or CDS_CONFIG_PATH), generalizing the existing single-purpose cds use command. Supported keys are profile, environment, and security.strict; a saved environment default is applied whenever --environment is omitted on any command that already accepts it, with an explicit --environment flag always taking precedence (#383, #537).
• Added the core rendering mechanism for image.source: build|registry: modules/orchestration/dagster/module.yaml gained image.source (default build) and image.tag config fields, and cli/renderer.py can now conditionally swap a service's build: key for a registry image: reference derived from the naming scheme already used by publish-images.yml, composing with the existing image.variant (--hardened) field (#532, #536).
• publish-images.yml's Docker Hub publish job now signs, SBOM-attests, and SLSA-provenance-attests pushed images with the same keyless OIDC identity as the existing GHCR job, closing the supply-chain-guarantee gap between the two registries; docs/image-signing.md documents the shared trust identity (#275, #539).

What's Changed

• feat(renderer): image.source build|registry mechanism (#532) by @RonaldHensbergen in #536
• feat(images): sign, SBOM, and attest provenance for Docker Hub publishes by @RonaldHensbergen in #539
• chore(images): refresh signed-images fixture by @github-actions[bot] in #542
• chore(deps): update all dependencies by @renovate[bot] in #543
• fix(deps): update all dependencies by @renovate[bot] in #544
• chore(images): refresh signed-images fixture by @github-actions[bot] in #545
• feat: add cds config command for persisted project defaults by @RonaldHensbergen in #537
• chore(release): bump version to 0.7.0 by @github-actions[bot] in #547

Full Changelog: v0.6.1...v0.7.0

v0.6.1

What's Changed

• chore(images): refresh signed-images fixture by @github-actions[bot] in #522
• chore: add release-tag reminder and verify GitHub release is published by @RonaldHensbergen in #524
• Fix CVE-2026-14456 (libssl3t64) in cds-dagster and cds-dbt images by @RonaldHensbergen in #529
• chore(images): refresh signed-images fixture by @github-actions[bot] in #531
• chore(release): bump version to 0.6.1 by @github-actions[bot] in #523

Full Changelog: v0.6.0...v0.6.1

v0.6.0

Added

• Added a --hardened CLI flag to cds up, cds render, and cds test, which overrides config.image.variant to hardened for any module whose configSchema exposes an image.variant property (currently only modules/orchestration/dagster) before planning, so users no longer need to hand-edit their profile YAML to select the Alpine-hardened Dagster image build (#373).

Changed

• Expanded the ruff lint scope in pyproject.toml from pyupgrade-only (UP) to also include pyflakes, bugbear, bandit, and isort (F, B, S, I), and fixed or annotated (# noqa) every finding surfaced by the wider scope across cli/, tests/, and workdirs/. This also uncovered and fixed a dormant bug in tests/test_module_isolation.py: setUpClass read a module file handle after it had already been closed, so cls.modules was always empty and test_no_cross_module_service_references silently never executed its assertions (#497, #498, #499).

Fixed

• cli/renderer.py no longer allows a module template's pure ${config.*}/${bindings.*} substitution to splice a profile-supplied dict/list verbatim into compose-dangerous service fields (command, entrypoint, environment, volumes, cap_add, security_opt, ports, and similar). This closes a compose-injection path where an untrusted profile could smuggle arbitrary command args, environment variables, or host bind mounts through module config; such templates now fail rendering with a new E072 diagnostic.
• cds get no longer writes fetched files or the tracking manifest through a pre-planted symlink at the destination path. _find_conflicts now treats any symlink destination (including a dangling one, which Path.exists() reports as absent) as a conflict, and the copy/manifest-write steps unlink any symlink at the destination before writing, so a symlink can no longer be used to redirect fetched content onto an arbitrary path outside the destination tree (#474).

What's Changed

• chore(images): refresh signed-images fixture by @github-actions[bot] in #516
• fix(cli): reject and never write through symlinked cds get destinations by @RonaldHensbergen in #509
• feat(cli): add --hardened flag to up/render/test by @RonaldHensbergen in #504
• fix: reject typed pure-substitution injection into compose-dangerous fields by @RonaldHensbergen in #502
• chore(deps): update python:3.14-slim docker digest to 83ff1d2 by @renovate[bot] in #519
• chore(images): refresh signed-images fixture by @github-actions[bot] in #520
• chore: expand ruff linting scope to cover pyflakes, bugbear, bandit, isort by @RonaldHensbergen in #497
• chore(release): bump version to 0.6.0 by @github-actions[bot] in #518

Full Changelog: v0.5.2...v0.6.0

What's Changed

• chore(images): refresh signed-images fixture by @github-actions[bot] in #516
• fix(cli): reject and never write through symlinked cds get destinations by @RonaldHensbergen in #509
• feat(cli): add --hardened flag to up/render/test by @RonaldHensbergen in #504
• fix: reject typed pure-substitution injection into compose-dangerous fields by @RonaldHensbergen in #502
• chore(deps): update python:3.14-slim docker digest to 83ff1d2 by @renovate[bot] in #519
• chore(images): refresh signed-images fixture by @github-actions[bot] in #520
• chore: expand ruff linting scope to cover pyflakes, bugbear, bandit, isort by @RonaldHensbergen in #497
• chore(release): bump version to 0.6.0 by @github-actions[bot] in #518

Full Changelog: v0.5.2...v0.6.0

v0.5.2

Changed

• find_project_root()/resolve_project_root() in cli/main.py now check for a .cds directory (CDS's own state marker, created by cds get/cds use) at each ancestor level, alongside the existing pyproject.toml/.git markers. A .cds-marked working directory is recognized as the project root immediately, instead of being shadowed by an unrelated ancestor repository (e.g. a dotfiles repo at $HOME) further up the tree (#512).
• build-python-package.yml (reused by testpypi.yml/pypi.yml) now also runs a full-stack install smoke test: it installs the built wheel with no source checkout on CDS_PROFILE_PATH/CDS_MODULE_PATH, fetches a profile via cds get --local, initializes it with cds init, and brings the full docker compose stack up, confirming every service reports healthy before the package is published (#512).

Fixed

• cds get no longer discards a malformed or unreadable .cds/get-manifest.json tracking manifest silently. Invalid JSON or a non-object root is backed up alongside the original file and reported with a WARNING naming the reason and the backup path; a manifest that cannot even be read is reported without attempting a doomed backup copy (#495).

What's Changed

• Make cds get manifest parsing fail-safe and observable by @RonaldHensbergen in #495
• chore(deps): update python:3.14-slim docker digest to 8a14a31 by @renovate[bot] in #513
• chore(release): bump version to 0.5.2 by @github-actions[bot] in #515
• fix: prefer .cds marker for project root, add full-stack install smoke test by @RonaldHensbergen in #512
• docs: add CHANGELOG entry for v0.5.2 by @RonaldHensbergen in #517

Full Changelog: v0.5.1...v0.5.2

What's Changed

• Make cds get manifest parsing fail-safe and observable by @RonaldHensbergen in #495
• chore(deps): update python:3.14-slim docker digest to 8a14a31 by @renovate[bot] in #513
• chore(release): bump version to 0.5.2 by @github-actions[bot] in #515
• fix: prefer .cds marker for project root, add full-stack install smoke test by @RonaldHensbergen in #512
• docs: add CHANGELOG entry for v0.5.2 by @RonaldHensbergen in #517

Full Changelog: v0.5.1...v0.5.2

v0.5.1

Changed

• cds get now downloads a profile and its module/runtime assets from GitHub by default (via the tarball API) instead of copying from a local checkout. Use --local <dir> to opt back into the previous local-directory behavior; --remote <owner/repo> and --ref <branch|tag|sha> select a specific fork/revision to download (#493).

What's Changed

• feat: download cds get profiles from GitHub instead of local checkout by @RonaldHensbergen in #493
• ci: add automated version-bump workflow via git-auto-semver by @RonaldHensbergen in #510
• docs: move Why CDS heading above its explanatory content by @RonaldHensbergen in #503
• chore(release): bump version to 0.5.1 by @github-actions[bot] in #511

Full Changelog: v0.5.0...v0.5.1

v0.5.0

Added

• Profile, module, and shared-contract JSON schemas are now loaded and enforced at runtime: profile shape validation is backed by cli/resources/profile.schema.json (E010), loaded module definitions by cli/resources/module.schema.json (E021), and standalone contract files in shared/contracts/ can be checked against cli/resources/contract.schema.json via cli.validator.validate_contract_file() (#413).

Changed

• Schema-backed validation is stricter than the previous hand-written checks. Profiles must now carry metadata.environment, spec.runtime, and per-module version/enabled; loaded modules must satisfy module.schema.json; profiles that previously validated may now fail (#413).

Removed

• Deleted the unused rule-set entries CDS-SEC-050/051/052/053/054 from cli/resources/rule-set.json (#354). Image policy enforcement lives solely in cli/image_verification.py (findings are still reported as CDS-SEC-050/051/052), and CDS-SEC-053 had no enforcement anywhere.
• Disabled the CDS-SEC-006 and CDS-SEC-032 rule-set entries (enabled: false) so no scope: ["none"] rule appears active; #356 and #357 track the remaining work on those rules.

Fixed

• cds security --verify-images no longer plans and renders the profile a second time for image verification; it reuses the compose the security scan already rendered (#336).
• cds-dagster and cds-dbt now pin the rebuilt python:3.14-slim base digest (a7fb1e63...) and add .trivyignore exceptions (exp 2026-11-15) for CVE-2026-53615 (util-linux libblkid, #455, #457) and the four sqlparse advisories from 2026-08-17 (CVE-2026-54284/59893/59894/71491). Neither fix is shippable yet: 2.41.5-0+deb13u1 has no base digest carrying it, and dbt-core 1.12.2 pins sqlparse<0.6.0. Expired exceptions fail the daily scan again.
• Corrected stale documentation that referenced the deleted CDS-SEC-050/051/052/053/054 rule-set entries: docs/image-signing.md, docs/threat-model.md, docs/vm-postgres-odbc-access.md, and the cli/image_verification.py module docstring.
• Added a regression guard for #354: the image-policy finding IDs CDS-SEC-050/051/052 must still be emitted by cli/image_verification.py for a non-compliant Compose fixture, and none of the deleted IDs may reappear in the rule set.
• Added a regression guard for #355: no scope: ["none"] security rule may be enabled in the bundled rule set.
• Added a regression guard for #397: a CDS_DB_PASSWORD reference with a fallback value outside CDS-SEC-040's literal list is still caught by preflight insecure-default detection.
• image-security-scan.yml's scheduled scan step never passed a trivyignores input to trivy-action, and publish-images.yml's pre-push gate passed it under the wrong input name (ignorefile instead of trivyignores); both silently ignored .trivyignore, so the approved CVE-2026-53612/53613/53614 exceptions added in #484 never took effect and the daily scan kept refiling duplicate issues (#481, #482, #483, #485, #486, #487).

What's Changed

• Update all dependencies by @renovate[bot] in #428
• chore(images): refresh signed-images fixture by @github-actions[bot] in #434
• Fix URL-encode DB credentials in connection URI by @SemTiOne in #432
• Harden .env parsing and stop tracking nested .env files by @SemTiOne in #431
• Update dependency dbt-core to v1.12.1 by @renovate[bot] in #439
• chore(images): refresh signed-images fixture by @github-actions[bot] in #440
• Update all dependencies by @renovate[bot] in #441
• chore(images): refresh signed-images fixture by @github-actions[bot] in #442
• Clarify cds test smoke test and Docker-free fallback by @SemTiOne in #437
• Add shape assertions to nested-default regression tests by @SemTiOne in #438
• Update dependency ruff to v0.16.3 by @renovate[bot] in #446
• Fix security scan fail-open on rendered-compose render errors (GHSA-mx5p-cv63-6829) by @RonaldHensbergen in #433
• ci: wire cds test into pipeline for stable profile (#362) by @matheusfrta in #364
• Update dependency aquasecurity/trivy to v0.74.0 by @renovate[bot] in #447
• chore(images): refresh signed-images fixture by @github-actions[bot] in #448
• Update all dependencies by @renovate[bot] in #449
• Add cds get command for fetching profiles and assets by @RonaldHensbergen with @Copilot in #445
• fix: resolve flaky test failures on macOS and Windows in test_getter by @RonaldHensbergen with @Copilot in #450
• Reuse rendered compose for image verification by @SemTiOne in #444
• Load JSON schemas at runtime by @SemTiOne in #436
• Pin patched python:3.14-slim digest for dagster and dbt by @SemTiOne in #466
• Update all dependencies by @renovate[bot] in #458
• chore(images): refresh signed-images fixture by @github-actions[bot] in #467
• docs: explain interpolation placeholders by @tasodoufu in #462
• Update docker/setup-buildx-action digest to 37fe631 by @renovate[bot] in #477
• chore(images): refresh signed-images fixture by @github-actions[bot] in #478
• Update dependency ruff to v0.16.4 by @renovate[bot] in #479
• refactor: extract _atomic_write, MAX_NESTING_DEPTH by @FasihUrRahman in #476
• fix: resolve #480 CI failures — dependency bumps and util-linux CVE exceptions by @RonaldHensbergen with @Copilot in #484
• chore(images): refresh signed-images fixture by @github-actions[bot] in #488
• Remove dead scope-none rules, fix stale CDS-SEC docs by @SemTiOne in #443
• fix: wire .trivyignore into scan/publish workflows by @RonaldHensbergen in #491
• chore(images): refresh signed-images fixture by @github-actions[bot] in #492
• chore(images): refresh signed-images fixture by @github-actions[bot] in #494
• chore(deps): update apache/superset:6.1.0 docker digest to d4bc025 by @renovate[bot] in #496

New Contributors

• @matheusfrta made their first contribution in #364
• @tasodoufu made their first contribution in #462
• @FasihUrRahman made their first contribution in #476

Full Changelog: v0.4.0...v0.5.0

What's Changed

• Update all dependencies by @renovate[bot] in #428
• chore(images): refresh signed-images fixture by @github-actions[bot] in #434
• Fix URL-encode DB credentials in connection URI by @SemTiOne in #432
• Harden .env parsing and stop tracking nested .env files by @SemTiOne in #431
• Update dependency dbt-core to v1.12.1 by @renovate[bot] in #439
• chore(images): refresh signed-images fixture by @github-actions[bot] in #440
• Update all dependencies by @renovate[bot] in #441
• chore(images): refresh signed-images fixture by @github-actions[bot] in #442
• Clarify cds test smoke test and Docker-free fallback by @SemTiOne in #437
• Add shape assertions to nested-default regression tests by @SemTiOne in #438
• Update dependency ruff to v0.16.3 by @renovate[bot] in #446
• Fix security scan fail-open on r...

v0.4.0

Added

• Provider-neutral observability architecture foundations for #174: docs/observability.md, the shared log-sink contract, the structured-event schema, and optional profile spec.observability.logShipping validation.
• publish-images.yml now runs a trivy HIGH/CRITICAL vulnerability gate on the locally built images before pushing or signing, so a CVE disclosed after the PR-time scan blocks publication to GitHub Container Registry and Docker Hub (#274).

Full Changelog: https://github.com/RonaldHensbergen/composable-data-stack/blob/main/CHANGELOG.md#040---2026-08-11

Installation

pip install composable-data-stack==0.4.0

Also published on PyPI via trusted publishing, with build attestations.