Release 3.0.1

[kmcginnes]

This patch release improves error handling, refactors the proxy server for testability, and hardens the application protection mechanisms. Error messages surface richer diagnostics — status codes, response bodies, and cause chains — so troubleshooting is more useful. We also upgraded to Vite 8, cutting build time by 60% and bundle size by 5%.

• Bug fixes — new empty state when no connections are configured instead of misleading "No Schema Available", Docker entrypoint now respects custom config directories (thanks @theneelshah!), Podman container permissions fix
• Error handling — the error details dialog now surfaces status codes, response bodies, and cause chains so you can diagnose issues without digging through logs. Invalid proxy requests return proper 400 errors instead of cryptic 500s. Connection failures and CORS mismatches get targeted error messages.
• Tooling & docs — Vite 8 upgrade cuts build time by 60% and bundle size by 5%, reorganized docs into guides and references, updated README
• Application hardening — tighter CORS defaults, supply chain hardening, automated vulnerability scanning, least-privilege CI permissions, and a new security policy for reporting vulnerabilities
• Proxy server — previously untestable parts of the proxy server now have 170+ tests (up from 56), making future changes safer and more reliable

HTTPS Configuration

Previous versions had a bug where the Docker entrypoint ignored custom config directory paths, which could cause your HTTPS settings to be silently skipped. While fixing this, we also discovered that when HTTPS was enabled but certificate generation or discovery failed, the server would silently fall back to HTTP instead of reporting the problem. The server now exits with a clear error in this scenario. If you were unknowingly relying on this fallback behavior, ensure your certificates are in place before upgrading or explicitly disable HTTPS. See the HTTPS Connections documentation for details.

New Contributors

Welcome and thank you to our first-time contributor!

• @theneelshah made their first contribution in fix: use CONFIGURATION_FOLDER_PATH in docker-entrypoint.sh for custom config directory #1598

All Changes

• Update readme intro by @kmcginnes in Update readme intro #1567
• Switch to proseWrap preserve by @kmcginnes in Prose wrap #1568
• Use permalinks in the changelog by @kmcginnes in Use permalinks in the changelog #1569
• Rename additionaldocs directory to docs by @kmcginnes in Rename additionaldocs directory to docs #1570
• Reorganize documentation into guides structure by @kmcginnes in Reorganize documentation into guides structure #1571
• Move reference documentation to docs/references/ by @kmcginnes in Move reference documentation to docs/references/ #1572
• Set explicit minimum permissions on GitHub Actions workflows by @kmcginnes in Set explicit minimum permissions on GitHub Actions workflows #1573
• Update dependencies and remove stale overrides by @kmcginnes in Update dependencies and remove stale overrides #1574
• Bump version to 3.1.0 by @kmcginnes in Bump version to 3.1.0 #1587
• Fix air routes sample permission error on Podman by @kmcginnes in Fix air routes sample permission error on Podman #1588
• Rename issue templates for consistent ordering by @kmcginnes in Rename issue templates for consistent ordering #1591
• Update GitHub issue and PR templates by @kmcginnes in Update GitHub issue and PR templates #1592
• Add issue type REST API instructions to GitHub skill by @kmcginnes in Add issue type REST API instructions to GitHub skill #1597
• Fix: use CONFIGURATION_FOLDER_PATH in docker-entrypoint.sh for custom config directory by @theneelshah in fix: use CONFIGURATION_FOLDER_PATH in docker-entrypoint.sh for custom config directory #1598
• Update dependencies and remove stale fast-xml-parser override by @kmcginnes in Update dependencies and remove stale fast-xml-parser override #1603
• Add git conventions skill by @kmcginnes in Add git conventions skill #1606
• Change version to 3.0.1 by @kmcginnes in Change version to 3.0.1 #1607
• Clean up Docker image and add Trivy scan to CI by @kmcginnes in Clean up Docker image and add Trivy scan to CI #1609
• Show empty connection state instead of misleading 'No Schema Available' by @kmcginnes in Show empty connection state instead of misleading 'No Schema Available' #1611
• Disable schema sync queries when no connection exists by @kmcginnes in Disable schema sync queries when no connection exists #1612
• Add GRAPH_EXP_DEV_PORT and .env.local documentation by @kmcginnes in Add GRAPH_EXP_DEV_PORT and .env.local documentation #1613
• Update dependencies to latest compatible versions by @kmcginnes in Update dependencies to latest compatible versions #1615
• Decouple proxy server startup from module-level side effects by @kmcginnes in Decouple proxy server startup from module-level side effects #1628
• Add tests for process-environment.sh and fix POSIX compliance by @kmcginnes in Add tests for process-environment.sh and fix POSIX compliance #1629
• Update lodash to latest version by @kmcginnes in Update lodash to latest version #1631
• Extract proxy server into testable modules by @kmcginnes in Extract proxy server into testable modules #1632
• Extract SSL cert logic into testable setup-ssl.sh script by @kmcginnes in Extract SSL cert logic into testable setup-ssl.sh script #1637
• Validate graph database connection URL with Zod schema by @kmcginnes in Validate graph database connection URL with Zod schema #1639
• Fail fast when HTTPS is requested but certificates are missing by @kmcginnes in Fail fast when HTTPS is requested but certificates are missing #1640
• Pin @tanstack/eslint-plugin-query to 5.96.2 by @kmcginnes in Pin @tanstack/eslint-plugin-query to 5.96.2 #1641
• Improve error details with richer diagnostic information by @kmcginnes in Improve error details with richer diagnostic information #1644
• Add security policy and security audit workflow by @kmcginnes in Add security policy and security audit workflow #1648
• Remove ExplorerInjector component by @kmcginnes in Remove ExplorerInjector component #1649
• Improve error details and handle proxy connection errors by @kmcginnes in Improve error details and handle proxy connection errors #1650
• Update Vite to version 8 by @kmcginnes in Update Vite to version 8 #1651
• Harden supply chain security settings by @kmcginnes in Harden supply chain security settings #1652
• Improve CORS defaults and upstream header forwarding by @kmcginnes in Improve CORS defaults and upstream header forwarding #1653

Full Changelog: v3.0.0...v3.0.1

---

This discussion was created from the release Release 3.0.1.