v0.2.0 — Wartung und Launch-Vorbereitung

Live demo: https://einvoice.sebastiankern.net — the public validator needs no login.

Peppol BIS Billing 3.0 rule set 2026.5, a CVE dependency update (Spring Boot 4.1.1, Tomcat 11.0.26, Netty 4.2.19), anonymous uploads kept in memory, a ReDoS fix in the PII scrubber, and problem type URIs that resolve.

API-visible change: problem type URIs moved from https://einvoice-at.stoicera.com/problems/ (never resolved) to https://einvoice.sebastiankern.net/problems/; the slugs are unchanged. Configurable via PROBLEM_TYPE_BASE_URI, catalogue in docs/problems.md.

Full list: CHANGELOG.md.

What's Changed

• docs: record the completion sprint — M6 closed on every item by @SebastianKrn in #24
• feat(validation): adopt Peppol BIS Billing 3.0 rule set 2026.5 by @SebastianKrn in #26
• fix(web): stop advertising the API docs on deployments that switch them off by @SebastianKrn in #27
• feat(ops): copy database dumps off-site, and prove the copy is readable by @SebastianKrn in #25
• fix(api): the OpenAPI description announced UBL support as future work it already shipped by @SebastianKrn in #28
• fix(privacy): keep anonymous uploads in memory — the page promised they never touch disk by @SebastianKrn in #29
• docs: publish API docs in production, record the session, and hand the next one a work queue by @SebastianKrn in #30
• docs(worklog): the API docs are live, and the conditional links proved themselves in production by @SebastianKrn in #31
• Abhängigkeiten: Spring Boot 4.1.x, Tomcat, Netty (CVE-Fix) by @SebastianKrn in #38
• AGENTS.md: Non-goals aus PRD §5 und Rollback-Befehl eingetragen by @SebastianKrn in #39
• AGENTS.md: Platzhalter durch echte Befehle ersetzt by @SebastianKrn in #37
• Repo-Baseline: AGENTS.md, CLAUDE.md, Copilot-Anweisung by @SebastianKrn in #36
• chore(backup): upstream the host backup scripts, record the armed off-site copy by @SebastianKrn in #35
• ci: OWASP-Job auf 90 Minuten begrenzt by @SebastianKrn in #41
• build(deps): bump phive-rules.version from 4.4.1 to 4.4.2 by @dependabot[bot] in #13
• build(deps): bump org.glassfish.jaxb:jaxb-runtime from 4.0.5 to 4.0.9 by @dependabot[bot] in #16
• build(deps): Bump eclipse-temurin from 201fbb8 to c42fecf by @dependabot[bot] in #33
• build(deps-dev): bump com.diffplug.spotless:spotless-maven-plugin from 3.8.0 to 3.9.0 by @dependabot[bot] in #15
• build(deps-dev): Bump com.tngtech.archunit:archunit from 1.4.2 to 1.5.0 by @dependabot[bot] in #32
• build(deps): bump docker/login-action from 4.5.1 to 4.6.0 by @dependabot[bot] in #12
• build(deps): bump actions/setup-java from 5.6.0 to 5.7.0 by @dependabot[bot] in #23
• build(deps): Bump docker/setup-buildx-action from 4.2.0 to 4.3.0 by @dependabot[bot] in #34
• fix(ai-assist): E-Mail-Muster im PiiScrubber begrenzt (ReDoS) by @SebastianKrn in #42
• fix(api): Problem-Type-URIs auf auflösbaren Host, Basis konfigurierbar by @SebastianKrn in #43
• docs: README mit Live-Demo, Community-Dateien, llms.txt, CHANGELOG 0.2.0 by @SebastianKrn in #44
• Portfolio-Readiness: Checkliste vor dem öffentlichen Launch, Security-Kontakt repariert by @SebastianKrn in #40

New Contributors

• @dependabot[bot] made their first contribution in #13

Full Changelog: v0.1.0...v0.2.0