v0.18.0

Upgrading to 0.18.0 — launch hardening, and several things you must read first

This is not a feature release. It is the set of things that were false and would have been found
by strangers: production with no second copy of anyone's work, an unbounded invite mailer, no
Content-Security-Policy, a first-touch flow handing out dead links, and an Elastic-License product
calling itself open source.

It outgrew its own scope — 47 issues against the 26 it was organised with. The items below are the
ones that change behaviour you can observe. The generated list of commits further down does not.

Read before you pull

Account addresses become case-insensitive. Email uniqueness used to rest on an application-side
fold with no database guarantee, which means two accounts differing only in case may already
exist. The upgrade adds the constraint, and it will not start if such a pair is present. There
is one query to run before you pull:
Account addresses become case-insensitive in 0.18.0.

A custom field keyed like a later-added query name was silently shadowed, and could not be
renamed out of the collision. If you have such a field, the upgrade tells you:
Shadowed custom field keys from 0.18.0.

New bounds, each of which can turn a slow request into an error

Connection acquisition is bounded. One principal could be entitled to more connection-seconds
per minute than the pool actually has.
Details.

PostgreSQL is bounded and tuned. Among other things, the planner was being told there was 4 GB
of cache on a host with 1909 MB of RAM.
Details.

Free text is bounded. Over-long values used to answer 500; five email fields had no length
cap at all.
Details.

Attachment storage is capped per workspace.
Details.

Expensive reads are bounded by concurrency, not only by rate.
Details.

Security and privacy

A Content-Security-Policy where there was none. A per-account throttle on password-reset and
resend-verification mail. A cap on invitation mail, which any verified account could previously
send to arbitrary addresses without limit. Account deletion, which until now was a promise in
the interface and nothing behind it. And a beta notice that says what happens to your data.

Account-critical mail is no longer handed to the executor before its token row commits, and a
rolling deploy during a mail backlog no longer drops up to a hundred committed messages.

Accessibility

Text contrast failed WCAG 1.4.3 on 480 rendered elements, and a single design token caused a third
of them. Taxonomy colours are now chosen against a contrast guard; ten of the fifteen seeded ones
were unreadable as text.

Operations

Production had no backups. It has them now, and the restore has been rehearsed. Daily snapshots
had been running against a detached volume for five days with nothing noticing. Nine alert rules
had been delivering to alerts@example.com, and the comment beside them called that "no delivery".
Grafana crash-looped on any alert rule identifier over 40 characters, which meant production had no
alerting at all. Production was also running July's compose file, so two shipped features were not
actually running.

Licensing

Hamstrack is source-available under the Elastic License 2.0, not open source under the OSI
definition. The product had been describing itself the other way, and no longer does.

---

Full Changelog: v0.17.0...v0.18.0