v0.11.0

GraphNest v0.11.0

Compatibility: pre-1.0 pilot; Kubernetes 1.25 or newer. No migrations and no
configuration changes. Adds graphnest login and logout: an OAuth sign-in with
PKCE over an RFC 8252 loopback redirect, which needs GRAPHNEST_MCP_OAUTH on the
server. OAuth access tokens now also authenticate GET /v1/repositories,
GET /v1/repositories/{id}, GET /v1/graph/repositories/{id}/status and
POST /v1/graph/uploads; existing API tokens and MCP clients keep working.
Security: images include SBOMs, provenance, and GitHub attestations. The
graphnest binaries ship with SHA-256 checksums, a dependency inventory and
build provenance attestations. Publishing with an OAuth token needs the new
graph:write scope plus the repository publication grant; OAuth tokens still
cannot mint or manage credentials. The CLI keeps its login in a 0600 file per
server.

Immutable artifacts

• ghcr.io/balcsida/graphnest/application@sha256:7f01310f854630ea12eda915b19d3738f7327ac6f27b1594f054ad3406a0701d
• ghcr.io/balcsida/graphnest/node@sha256:4ad93596a84515965ea177e8ccc199f51c6b86b196c4bd9fcf869de5d3b5c78b
• oci://ghcr.io/balcsida/graphnest/charts/graphnest:0.11.0@sha256:d87e82e455b5600d22068811f2a71b3473b9ba5286763987f32759401ca8faaf

Verification

gh attestation verify "oci://ghcr.io/balcsida/graphnest/application@sha256:7f01310f854630ea12eda915b19d3738f7327ac6f27b1594f054ad3406a0701d" --repo "balcsida/graphnest"
gh attestation verify "oci://ghcr.io/balcsida/graphnest/node@sha256:4ad93596a84515965ea177e8ccc199f51c6b86b196c4bd9fcf869de5d3b5c78b" --repo "balcsida/graphnest"
gh attestation verify "graphnest-0.11.0.tgz" --repo "balcsida/graphnest"

Command-line tool

The graphnest command imports a local CodeGraph index without installing CodeGraph. Download the binary for your platform and graphnest_0.11.0_checksums.txt from the release assets, then verify and run it:

sha256sum -c --ignore-missing graphnest_0.11.0_checksums.txt
gh attestation verify graphnest_0.11.0_<os>_<arch> --repo "balcsida/graphnest"
chmod +x graphnest_0.11.0_<os>_<arch>
./graphnest_0.11.0_<os>_<arch> doctor

What's Changed

• feat(cli): sign in with graphnest login (OAuth PKCE, RFC 8252) by @balcsida in #149
• chore(release): prepare v0.11.0 by @balcsida in #150

Full Changelog: v0.10.0...v0.11.0

v0.10.0

GraphNest v0.10.0

Compatibility: pre-1.0 pilot; Kubernetes 1.25 or newer. Migrations 038 and
039 keep one active v1 and two active v2 graph generations (published and
SCIP-derived) per repository and need a drained rollout: pause graph, SCIP
and index writers, migrate, deploy, then resume writers, as
docs/graph-storage.md describes. Reverting the binary alone is not a rollback.
Repositories indexed before this release need their SCIP index uploaded again
for the current indexed commit. No configuration changes are required. Adds
the graphnest command-line tool, which imports an existing CodeGraph index,
verifies it against the commit and publishes it as a v2 graph generation.
Security: images include SBOMs, provenance, and GitHub attestations. The
graphnest binaries ship with SHA-256 checksums, a dependency inventory and
build provenance attestations; server images do not link its SQLite reader.

Immutable artifacts

• ghcr.io/balcsida/graphnest/application@sha256:5c763f6d68716d047c4f77c8fbef577d3e566afad5bb2e1186d177a6764e8417
• ghcr.io/balcsida/graphnest/node@sha256:124296729e9cee13eb293942a279a67b284fc3073c8fd2b2cf1eac96c0bebd89
• oci://ghcr.io/balcsida/graphnest/charts/graphnest:0.10.0@sha256:442127acc6f9bf4fbe6407e6ae1f1b351633c374eb0ce133c8d20704d441be7e

Verification

gh attestation verify "oci://ghcr.io/balcsida/graphnest/application@sha256:5c763f6d68716d047c4f77c8fbef577d3e566afad5bb2e1186d177a6764e8417" --repo "balcsida/graphnest"
gh attestation verify "oci://ghcr.io/balcsida/graphnest/node@sha256:124296729e9cee13eb293942a279a67b284fc3073c8fd2b2cf1eac96c0bebd89" --repo "balcsida/graphnest"
gh attestation verify "graphnest-0.10.0.tgz" --repo "balcsida/graphnest"

Command-line tool

The graphnest command imports a local CodeGraph index without installing CodeGraph. Download the binary for your platform and graphnest_0.10.0_checksums.txt from the release assets, then verify and run it:

sha256sum -c --ignore-missing graphnest_0.10.0_checksums.txt
gh attestation verify graphnest_0.10.0_<os>_<arch> --repo "balcsida/graphnest"
chmod +x graphnest_0.10.0_<os>_<arch>
./graphnest_0.10.0_<os>_<arch> doctor

What's Changed

• ci(release): smoke-test only the amd64 images by @balcsida in #140
• fix(graph): build graph generations from SCIP uploads by @balcsida in #141
• feat(cli): import CodeGraph indexes with the graphnest command by @balcsida in #143
• feat(graphimport): complete the CodeGraph importer with freshness verification by @balcsida in #144
• feat(cli): publish imported CodeGraph generations by @balcsida in #145
• feat(cli): import reports, doctor, release binaries and the Stage 2 gate by @balcsida in #146
• fix(scip): report a pending index upload as retryable by @balcsida in #142
• chore(release): prepare v0.10.0 by @balcsida in #148

Full Changelog: v0.9.2...v0.10.0

v0.9.2

GraphNest v0.9.2

Compatibility: pre-1.0 pilot; Kubernetes 1.25 or newer. Patch release with
no migrations and no configuration changes. Publishing an inventory snapshot
now assesses every component from stored license evidence, and retried
registry lookups no longer drop a reviewer's license conclusion.
Security: images include SBOMs, provenance, and GitHub attestations.

Immutable artifacts

• ghcr.io/balcsida/graphnest/application@sha256:b07e975aa83e41cc25b796a2ee44e437f924fbe2381cfa864d21bb8bcb407694
• ghcr.io/balcsida/graphnest/node@sha256:2fbe6c8235d8bdcae3f81e2c742cd8a69f3e6052b4fd2f6b3a7a30376a7a876b
• oci://ghcr.io/balcsida/graphnest/charts/graphnest:0.9.2@sha256:dbf1afa5b33e595b4425c947e838844c32e658c625c42fa19bef9ba1010cb023

Verification

gh attestation verify "oci://ghcr.io/balcsida/graphnest/application@sha256:b07e975aa83e41cc25b796a2ee44e437f924fbe2381cfa864d21bb8bcb407694" --repo "balcsida/graphnest"
gh attestation verify "oci://ghcr.io/balcsida/graphnest/node@sha256:2fbe6c8235d8bdcae3f81e2c742cd8a69f3e6052b4fd2f6b3a7a30376a7a876b" --repo "balcsida/graphnest"
gh attestation verify "graphnest-0.9.2.tgz" --repo "balcsida/graphnest"

What's Changed

• fix(supply-chain): assess published snapshots, keep human conclusions by @balcsida in #138
• chore(release): prepare v0.9.2 by @balcsida in #139

Full Changelog: v0.9.1...v0.9.2

v0.9.1

GraphNest v0.9.1

Compatibility: pre-1.0 pilot; Kubernetes 1.25 or newer. Patch release with
no migrations and no configuration changes. The web console updates to React
Router 8 and Recharts 3.10. Building from source now needs Node 26.10.0;
published images do not contain Node.
Security: images include SBOMs, provenance, and GitHub attestations. The
console build stage uses a digest-pinned node:26.10.0-bookworm-slim image.

Immutable artifacts

• ghcr.io/balcsida/graphnest/application@sha256:ac0f87707c0454aa45f854d8d4cd06b3bffe27c9e55cdaf3e9f8ce59975ca248
• ghcr.io/balcsida/graphnest/node@sha256:02a8e3793d809e468cac21e65e56c3a0d4deed6d4affa2915f51a6ff1ae00829
• oci://ghcr.io/balcsida/graphnest/charts/graphnest:0.9.1@sha256:282a5ba27ac8b387ca65f6df5d58382b0ea2574d837e8dd91b5cdc3fb3487edb

Verification

gh attestation verify "oci://ghcr.io/balcsida/graphnest/application@sha256:ac0f87707c0454aa45f854d8d4cd06b3bffe27c9e55cdaf3e9f8ce59975ca248" --repo "balcsida/graphnest"
gh attestation verify "oci://ghcr.io/balcsida/graphnest/node@sha256:02a8e3793d809e468cac21e65e56c3a0d4deed6d4affa2915f51a6ff1ae00829" --repo "balcsida/graphnest"
gh attestation verify "graphnest-0.9.1.tgz" --repo "balcsida/graphnest"

What's Changed

• Bump the "dependencies" group with 1 update across multiple ecosystems by @dependabot[bot] in #130
• Bump the "dependencies" group with 1 update across multiple ecosystems by @dependabot[bot] in #135
• chore(node): upgrade toolchain to 26.10.0 by @balcsida in #136
• chore(release): prepare v0.9.1 by @balcsida in #137

Full Changelog: v0.9.0...v0.9.1

v0.9.0

GraphNest v0.9.0

Compatibility: pre-1.0 pilot; Kubernetes 1.25 or newer. Adds a Connect an
agent page to the web console; no migrations and no configuration changes are
required.
Security: images include SBOMs, provenance, and GitHub attestations.

Immutable artifacts

• ghcr.io/balcsida/graphnest/application@sha256:96f4d268edee0b857f93a7836db16193c271e6fefa18ec7cb070f8fff5e67284
• ghcr.io/balcsida/graphnest/node@sha256:9cdf9182f9845e8c4ba370b495693ae2a16246e747ff4df9af35f734bfb60f70
• oci://ghcr.io/balcsida/graphnest/charts/graphnest:0.9.0@sha256:393f7e8386d70e5729b947e1595a7f3e22ad4fecd38cfc5af65b0ebff2ba07fa

Verification

gh attestation verify "oci://ghcr.io/balcsida/graphnest/application@sha256:96f4d268edee0b857f93a7836db16193c271e6fefa18ec7cb070f8fff5e67284" --repo "balcsida/graphnest"
gh attestation verify "oci://ghcr.io/balcsida/graphnest/node@sha256:9cdf9182f9845e8c4ba370b495693ae2a16246e747ff4df9af35f734bfb60f70" --repo "balcsida/graphnest"
gh attestation verify "graphnest-0.9.0.tgz" --repo "balcsida/graphnest"

What's Changed

• feat(webui): add Connect an agent page for MCP clients by @balcsida in #133
• chore(release): prepare v0.9.0 by @balcsida in #134

Full Changelog: v0.8.0...v0.9.0

v0.8.0

GraphNest v0.8.0

Compatibility: pre-1.0 pilot; Kubernetes 1.25 or newer. The browser console
is rebuilt as a React application served from the same binary; no migrations
and no configuration changes are required. Building from source or images now
needs Node 24 (make build, make test and the Docker image run make ui; run it
before Dockerfile.offline). The bearer token moves to the sessionStorage key
graphnest_token with a one-time migration from graphnest_admin_token; legacy
hash links into the old pages are not preserved.
Security: images include SBOMs, provenance, and GitHub attestations. The
console keeps script-src 'self' (no inline script, no eval) and now allows
inline styles for Radix UI, Recharts and Sonner; API text renders as React
text only, guarded by a test, and the token is never stored in localStorage
or a cookie.

Immutable artifacts

• ghcr.io/balcsida/graphnest/application@sha256:f9f471216b2a16eb2ed301149bd3abbd7aaac59180df724e74d9e2b446a20f80
• ghcr.io/balcsida/graphnest/node@sha256:f6c32a3f4d667ce0aa132e406d34a779adcf2896c29ebe83cdc5de979df70e31
• oci://ghcr.io/balcsida/graphnest/charts/graphnest:0.8.0@sha256:2d13a95974c8aa71deb7482a09da2ba6028ffb8fc4c37a2e8dd8315463c694d6

Verification

gh attestation verify "oci://ghcr.io/balcsida/graphnest/application@sha256:f9f471216b2a16eb2ed301149bd3abbd7aaac59180df724e74d9e2b446a20f80" --repo "balcsida/graphnest"
gh attestation verify "oci://ghcr.io/balcsida/graphnest/node@sha256:f6c32a3f4d667ce0aa132e406d34a779adcf2896c29ebe83cdc5de979df70e31" --repo "balcsida/graphnest"
gh attestation verify "graphnest-0.8.0.tgz" --repo "balcsida/graphnest"

What's Changed

• fix(mcp): drop top-level oneOf from context tool schema by @balcsida in #126
• feat(webui): rebuild the console on React and shadcn/ui by @balcsida in #128
• chore(release): prepare v0.8.0 by @balcsida in #129

Full Changelog: v0.7.0...v0.8.0

v0.7.0

GraphNest v0.7.0

Compatibility: pre-1.0 pilot; Kubernetes 1.25 or newer. Migration 037 adds
the empty graph_publication_grants table and runs automatically; no
configuration changes are required. v1 graph uploads are unchanged.
Security: images include SBOMs, provenance, and GitHub attestations. v2
graph publication requires an administrator or an explicit repository
grant; read access alone never publishes, and token, grant and indexed
commit are rechecked after parsing.

Immutable artifacts

• ghcr.io/balcsida/graphnest/application@sha256:aa4f00d30002824ddcf080da7ec550ae04bc729ec7efe8c4f8e671c04b3551e2
• ghcr.io/balcsida/graphnest/node@sha256:0e5b3cb8ddcbe971a301c778bdbe8a6eb6f7c3eebd539add233bb4a7933ddc92
• oci://ghcr.io/balcsida/graphnest/charts/graphnest:0.7.0@sha256:a12e5df9f9e93cd8cb4ff0ccd7420963e883416e31bccc2ef41972e03b4ceea1

Verification

gh attestation verify "oci://ghcr.io/balcsida/graphnest/application@sha256:aa4f00d30002824ddcf080da7ec550ae04bc729ec7efe8c4f8e671c04b3551e2" --repo "balcsida/graphnest"
gh attestation verify "oci://ghcr.io/balcsida/graphnest/node@sha256:0e5b3cb8ddcbe971a301c778bdbe8a6eb6f7c3eebd539add233bb4a7933ddc92" --repo "balcsida/graphnest"
gh attestation verify "graphnest-0.7.0.tgz" --repo "balcsida/graphnest"

What's Changed

• fix(webui): keep search rail controls inside the sidebar by @balcsida in #122
• feat(graph): add repository-scoped graph publication by @balcsida in #123
• feat(graph): add symbol callers, callees and impact tools by @balcsida in #124
• chore(release): prepare v0.7.0 by @balcsida in #125

Full Changelog: v0.6.1...v0.7.0

v0.6.1

GraphNest v0.6.1

Compatibility: pre-1.0 pilot; Kubernetes 1.25 or newer. Patch release with
no migrations and no required configuration changes. The optional Helm value
server.extraEnv defaults to empty.
Security: images include SBOMs, provenance, and GitHub attestations.
Enrichment backfill uses the existing route-bound fetcher and adds no new
outbound destinations; server.extraEnv renders into a ConfigMap and is for
non-secret values only.

Immutable artifacts

• ghcr.io/balcsida/graphnest/application@sha256:27a4067de26ae6dc6b40518e4a9f2c6fa228c1ed97ad8cd3756e3c283a1fe7a9
• ghcr.io/balcsida/graphnest/node@sha256:dc5e700c99a5f1ee81836865cf4ef0bedd8677695dc4116032b49e8a334945ee
• oci://ghcr.io/balcsida/graphnest/charts/graphnest:0.6.1@sha256:74452669adc8b8a3f3a93d4d540223f3e916d70acf978b413465353c364157d1

Verification

gh attestation verify "oci://ghcr.io/balcsida/graphnest/application@sha256:27a4067de26ae6dc6b40518e4a9f2c6fa228c1ed97ad8cd3756e3c283a1fe7a9" --repo "balcsida/graphnest"
gh attestation verify "oci://ghcr.io/balcsida/graphnest/node@sha256:dc5e700c99a5f1ee81836865cf4ef0bedd8677695dc4116032b49e8a334945ee" --repo "balcsida/graphnest"
gh attestation verify "graphnest-0.6.1.tgz" --repo "balcsida/graphnest"

What's Changed

• docs(supply-chain): record the stack merge and v0.6.0 release by @balcsida in #116
• fix(supply-chain): honour HTTPS_PROXY on license registry routes by @balcsida in #117
• feat(graph): add type hierarchy analysis by @balcsida in #119
• feat(supply-chain): backfill enrichment at start and add Helm extraEnv by @balcsida in #118
• fix(githubapp): continue reconcile past a default-branch 404 by @balcsida in #120
• chore(release): prepare v0.6.1 by @balcsida in #121

Full Changelog: v0.6.0...v0.6.1

v0.6.0

GraphNest v0.6.0

Compatibility: pre-1.0 pilot; Kubernetes 1.25 or newer. Migrations 033
through 036 add the supply_chain_* tables and run automatically; the
Dependencies & Licenses module stays disabled unless GRAPHNEST_SUPPLY_CHAIN
is set, so no configuration changes are needed.
Security: images include SBOMs, provenance, and GitHub attestations. The new
module makes no outbound registry requests without an explicitly configured
route, blocks private and metadata addresses by default, bounds document and
component sizes, and keeps license assessments separate from evidence.

Immutable artifacts

• ghcr.io/balcsida/graphnest/application@sha256:1ed5b190bdf6fad1c98419250fba48ee0e3e81dcde2fb90cb828047a5b9dafac
• ghcr.io/balcsida/graphnest/node@sha256:edbaf4b0e7d26cb56d789b669deed7afb205187b491c4991099e6a69083f1b87
• oci://ghcr.io/balcsida/graphnest/charts/graphnest:0.6.0@sha256:547c5ceb3e8b433c5e5a30b75d5de0bdf9e49671eb20c44e6f3cfebb064a1e0f

Verification

gh attestation verify "oci://ghcr.io/balcsida/graphnest/application@sha256:1ed5b190bdf6fad1c98419250fba48ee0e3e81dcde2fb90cb828047a5b9dafac" --repo "balcsida/graphnest"
gh attestation verify "oci://ghcr.io/balcsida/graphnest/node@sha256:edbaf4b0e7d26cb56d789b669deed7afb205187b491c4991099e6a69083f1b87" --repo "balcsida/graphnest"
gh attestation verify "graphnest-0.6.0.tgz" --repo "balcsida/graphnest"

What's Changed

• docs(supply-chain): accept ADR-0017 and the execution plan by @balcsida in #104
• feat(supply-chain): preserve GHES SBOM observations as immutable snapshots by @balcsida in #105
• feat(supply-chain): add inventory service, collector, and REST routes by @balcsida in #106
• feat(webui): Dependencies & Licenses inventory page, docs, and deployment wiring by @balcsida in #107
• feat(supply-chain): exact-version license evidence and assessments by @balcsida in #108
• feat(supply-chain): portfolio overview, components, export, and comparison by @balcsida in #109
• feat(supply-chain): SPDX and CycloneDX imports with derived SPDX export by @balcsida in #110
• feat(supply-chain): policies and review workflow by @balcsida in #111
• feat(mcp): read-only dependency inventory tools by @balcsida in #112
• feat(supply-chain): retention, operations docs, and query-plan evidence by @balcsida in #113
• Release v0.6.0 by @balcsida in #115

Full Changelog: v0.5.0...v0.6.0

v0.5.0

GraphNest v0.5.0

Compatibility: pre-1.0 pilot; Kubernetes 1.25 or newer. Migrations 031 and
032 add defaulted columns to api_tokens; no configuration changes are needed.
Security: images include SBOMs, provenance, and GitHub attestations. Fixes
delegation-only token confinement after owner demotion and forbids delegated
tokens from delegating again; updates OTLP trace exporters to v1.46.0
(GHSA-8wmf-6v46-5gfg).

Immutable artifacts

• ghcr.io/balcsida/graphnest/application@sha256:945e4db2578f30d8678b5a64e76da2b5e3818bb92c84d53f1dfee7b30019879d
• ghcr.io/balcsida/graphnest/node@sha256:97d328c2852f2af71b31ed5c72b6a95365725e371a4424b9bdaaf63577e6dabb
• oci://ghcr.io/balcsida/graphnest/charts/graphnest:0.5.0@sha256:1b0557db18ab53cf704efe4fe41297564ee3a0a3934412dcb12c8bcf4263eaec

Verification

gh attestation verify "oci://ghcr.io/balcsida/graphnest/application@sha256:945e4db2578f30d8678b5a64e76da2b5e3818bb92c84d53f1dfee7b30019879d" --repo "balcsida/graphnest"
gh attestation verify "oci://ghcr.io/balcsida/graphnest/node@sha256:97d328c2852f2af71b31ed5c72b6a95365725e371a4424b9bdaaf63577e6dabb" --repo "balcsida/graphnest"
gh attestation verify "graphnest-0.5.0.tgz" --repo "balcsida/graphnest"

What's Changed

• fix(oauth): let browsers complete MCP consent by @balcsida in #90
• fix(webui): make proxy errors on SCIP upload visible by @balcsida in #92
• fix: repair MCP search budget and graph symbol lookup by @balcsida in #93
• Bump the "dependencies" group with 4 updates across multiple ecosystems by @dependabot[bot] in #99
• build(deps): bump otlptrace exporters to 1.46.0 in /tools by @balcsida in #100
• feat(graph): expose discovery and exploration through REST and MCP by @balcsida in #91
• feat(auth): delegation-only administrator tokens for CI upload brokers by @balcsida in #94
• Release v0.5.0 by @balcsida in #101

Full Changelog: v0.4.3...v0.5.0