v2.7.0

Container images

docker pull ghcr.io/bablsoft/accessflow-backend:2.7.0
docker pull ghcr.io/bablsoft/accessflow-frontend:2.7.0

Multi-arch: linux/amd64, linux/arm64.

Helm chart

helm repo add accessflow https://bablsoft.github.io/accessflow
helm repo update
helm install accessflow accessflow/accessflow --version 2.7.0 \
  --namespace accessflow --create-namespace

What's Changed

• chore(website): SEO audit follow-up — entity disambiguation, titles, icons by @babltiga in #1015
• feat(website): add /compare/ hub and four competitor comparison pages by @babltiga in #1037
• chore(deps): bump shedlock.version from 7.10.0 to 7.10.1 in /backend by @dependabot[bot] in #1038
• chore(deps-dev): bump eslint-plugin-react-refresh from 0.5.5 to 0.5.6 in /frontend by @dependabot[bot] in #1039
• chore(deps-dev): bump @types/node from 26.1.2 to 26.5.1 in /frontend by @dependabot[bot] in #1041
• chore(deps-dev): bump typescript-eslint from 8.69.0 to 8.70.0 in /frontend by @dependabot[bot] in #1040
• chore(deps): bump react-dom and @types/react-dom in /frontend by @dependabot[bot] in #1042
• chore(deps): bump org.springdoc:springdoc-openapi-starter-webmvc-ui from 3.1.0 to 3.1.1 in /backend by @dependabot[bot] in #1043
• chore(deps): bump software.amazon.awssdk:bom from 2.54.13 to 2.54.17 in /backend by @dependabot[bot] in #1044
• feat(AF-868): service-account identity model, schema, and lookup by @babltiga in #1046
• feat(AF-869): carry API key id downstream, block service-account sign-in by @babltiga in #1047
• feat(AF-871): admin CRUD, key issuance, rotation and revocation for service accounts by @babltiga in #1048
• test(e2e): make notifications-bell.spec.ts race-free under the parallel project by @babltiga in #1049
• feat(AF-872): enforce per-service-account MCP tool allow-lists at invocation by @babltiga in #1050
• feat(AF-873): retry 429 in every CI wrapper and the Terraform provider by @babltiga in #1052
• feat(AF-873): rate-limit API-key traffic per identity by @babltiga in #1051
• feat(AF-874): on-behalf-of attribution for API-key callers by @babltiga in #1053
• feat(AF-875): service-accounts admin pages, badges, and i18n by @babltiga in #1054
• chore(website): X profile link in every footer + marketing context bootstrap by @babltiga in #1055
• chore(marketing): Product Hunt launch plan by @babltiga in #1056
• feat(AF-877): bind deployment environments to datasources, unique sort_order by @babltiga in #1057
• fix(deploygov): translate the raced routing-policy priority violation to 409 by @babltiga in #1058
• feat(AF-878): schemachange persistence foundation by @babltiga in #1059
• feat(AF-879): schema change-set authoring, DDL gate and REST API by @babltiga in #1060
• feat(website): add Cloudflare AI Search chat bubble to every page by @babltiga in #1061
• feat(website): keep the chat conversation across page navigations by @babltiga in #1062
• feat(AF-880): schemachange promotion service — ladder gate, freeze, request-group execution by @babltiga in #1063
• chore(website): re-cut og-image at v2.6, make the PH launch plan date-independent by @babltiga in #1064
• feat(AF-881): schemachange drift job, findings and read API by @babltiga in #1065
• feat(AF-882): schemachange notifications and audit fan-out by @babltiga in #1067
• feat(AF-883): schema change set authoring, promotion ladder and drift UI by @babltiga in #1068
• feat(AF-1066): decision-trace viewers and effective-access index by @babltiga in #1069
• chore(deps): bump software.amazon.awssdk:bom from 2.54.17 to 2.55.1 in /backend by @dependabot[bot] in #1070
• fix: bind documented snake_case filters on query list endpoints by @babltiga in #1071
• chore(deps): bump @codemirror/state from 6.7.4 to 6.7.5 in /frontend by @dependabot[bot] in #1072
• fix: disable Modulith Moments so the scheduling switch holds by @babltiga in #1073
• chore(deps-dev): bump globals from 17.11.0 to 17.12.0 in /frontend by @dependabot[bot] in #1074
• chore(deps): bump react-i18next from 17.0.13 to 17.0.14 in /frontend by @dependabot[bot] in #1075
• chore(deps): bump dayjs from 1.11.21 to 1.11.23 in /frontend by @dependabot[bot] in #1076
• feat(AF-923): scheduled job registry, execution history and monitor UI by @babltiga in #1078
• chore: add UI screenshots to impl-gh-issue PR descriptions by @babltiga in #1081
• chore(deps): bump com.github.jsqlparser:jsqlparser from 5.3 to 5.4 in /backend by @dependabot[bot] in #1077
• Harden SQL statement classification and upgrade JSqlParser to 5.4 by @babltiga in #1082
• fix(AF-933): enforce per-user and per-group row-limit override by @babltiga in #1083
• feat(AF-934): per-table row-limit policies by @babltiga in #1086
• feat(AF-935): column-level authorization — deny, not just mask by @babltiga in #1087
• fix(AF-1089): match table preview allow-list to the query gate by @babltiga in #1090
• fix(AF-936): scope schema introspection to the caller's allow-list by @babltiga in #1088
• feat(AF-937): persist the effective executed SQL on the query snapshot by @babltiga in #1091
• fix(AF-1092): drop RLS-bound predicate text from cost estimates by @babltiga in #1095
• feat(AF-938): record the calling application on requests and audit rows by @babltiga in #1096
• feat(AF-939): table and schema deny-lists alongside allow-lists by @babltiga in #1097
• fix: enforce the table allow-list on request-group query members by @babltiga in #1098
• fix(AF-1099): merge denied_columns by union across a user's grants by @babltiga in #1100
• feat(AF-940): query-shape routing condition and denied_shapes grants by @babltiga in #1101
• fix(AF-1102): fail closed on OTHER statements in denied_columns by @babltiga in #1103
• feat(AF-941): bytes-scanned cost caps and estimated_bytes_scanned routing by @babltiga in #1104
• feat(AF-942): per-user data-volume budgets by @babltiga in #1105
• docs(AF-943): design aggregate disclosure guard by @babltiga in #1106
• feat(AF-944): add configurable masking strategies by @babltiga in #1107
• fix(AF-1108): make API response masking fail closed by @babltiga in #1109
• fix(AF-1110): validate XPath/regex masking field_ref on write by @babltiga in #1111
• feat(AF-945): add external policy decision hook to query routing by @babltiga in #1112
• feat(AF-946): effective-permission explorer with row-cap provenance by @babltiga in #1113
• feat(AF-1079): structured-DDL SQL review rules on JSqlParser 5.4 by @babltiga in #1114
• fix(AF-1080): treat bare date-unit operands as columns in sqlreview by @babltiga in #1115
• feat(AF-1084): record effective row limit in attestation evidence by @babltiga in #1121
• fix(AF-1085): enforce row_limit_override >= 1 in db and service by @babltiga in #1122
• chore(deps): bump tools.jackson.core:jackson-databind from 3.2.0 to 3.2.2 in /engines/elasticsearch by @dependabot[bot] in #1117
• chore(deps): bump tools.jackson.core:jackson-databind from 3.2.0 to 3.2.2 in /engines/couchbase by @dependabot[bot] in #1120
• chore(deps): bump com.fasterxml.jackson.core:jackson-databind from 2.22.1 to 2.22.2 in /engines/databricks by @dependabot[bot] in #1119
• chore(deps): bump tools.jackson.core:jackson-databind from 3.2.1 to 3.2.2 in /engines/mongodb by @dependabot[bot] in #1118
• chore(deps-dev): bump undici from 8.10.0 to 8.11.2 in /frontend by @dependabot[bot] in #1123
• docs(AF-876): service accounts chapter and website sweep by @babltiga in #1124
• fix: re-apply bootstrap service-account role on spec change by @babltiga in #1125
• chore(deps): bump brace-expansion in /frontend by @dependabot[bot] in #1126
• docs(AF-884): schema change governance roadmap, website and e2e sweep by @babltiga in #1127
• fix(AF-867): hide service accounts from SCIM and skip their inbox rows by @babltiga in #1128
• fix(AF-1129): refuse break-glass acknowledgement by the on-behalf-of human by @babltiga in #1136
• chore(deps): bump antd from 6.5.2 to 6.6.5 in /frontend by @dependabot[bot] in #1132
• chore(deps-dev): bump vite from 8.2.2 to 8.3.1 in /frontend by @dependabot[bot] in #1133
• chore(deps): bump react-router-dom from 7.18.3 to 7.18.4 in /frontend by @dependabot[bot] in #1134
• chore(deps-dev): bump jsdom from 30.0.1 to 30.1.1 in /frontend by @dependabot[bot] in #1135
• fix(AF-1130): refuse admin users API for service accounts by @babltiga in #1137
• fix(AF-1130): edit service-account attributes on the SA surface by @babltiga in #1138
• fix: validate user attribute keys and values on PUT /admin/users by @babltiga in #1139
• feat(AF-1131): warn when an approver role includes service accounts by @babltiga in #1140
• chore(release-prep): v2.7 by @babltiga in #1141

Full Changelog: v2.6.0...v2.7.0