v0.6.0

GraphNest v0.6.0

Compatibility: pre-1.0 pilot; Kubernetes 1.25 or newer. Migrations 033
through 036 add the supply_chain_* tables and run automatically; the
Dependencies & Licenses module stays disabled unless GRAPHNEST_SUPPLY_CHAIN
is set, so no configuration changes are needed.
Security: images include SBOMs, provenance, and GitHub attestations. The new
module makes no outbound registry requests without an explicitly configured
route, blocks private and metadata addresses by default, bounds document and
component sizes, and keeps license assessments separate from evidence.

Immutable artifacts

• ghcr.io/balcsida/graphnest/application@sha256:1ed5b190bdf6fad1c98419250fba48ee0e3e81dcde2fb90cb828047a5b9dafac
• ghcr.io/balcsida/graphnest/node@sha256:edbaf4b0e7d26cb56d789b669deed7afb205187b491c4991099e6a69083f1b87
• oci://ghcr.io/balcsida/graphnest/charts/graphnest:0.6.0@sha256:547c5ceb3e8b433c5e5a30b75d5de0bdf9e49671eb20c44e6f3cfebb064a1e0f

Verification

gh attestation verify "oci://ghcr.io/balcsida/graphnest/application@sha256:1ed5b190bdf6fad1c98419250fba48ee0e3e81dcde2fb90cb828047a5b9dafac" --repo "balcsida/graphnest"
gh attestation verify "oci://ghcr.io/balcsida/graphnest/node@sha256:edbaf4b0e7d26cb56d789b669deed7afb205187b491c4991099e6a69083f1b87" --repo "balcsida/graphnest"
gh attestation verify "graphnest-0.6.0.tgz" --repo "balcsida/graphnest"

What's Changed

• docs(supply-chain): accept ADR-0017 and the execution plan by @balcsida in #104
• feat(supply-chain): preserve GHES SBOM observations as immutable snapshots by @balcsida in #105
• feat(supply-chain): add inventory service, collector, and REST routes by @balcsida in #106
• feat(webui): Dependencies & Licenses inventory page, docs, and deployment wiring by @balcsida in #107
• feat(supply-chain): exact-version license evidence and assessments by @balcsida in #108
• feat(supply-chain): portfolio overview, components, export, and comparison by @balcsida in #109
• feat(supply-chain): SPDX and CycloneDX imports with derived SPDX export by @balcsida in #110
• feat(supply-chain): policies and review workflow by @balcsida in #111
• feat(mcp): read-only dependency inventory tools by @balcsida in #112
• feat(supply-chain): retention, operations docs, and query-plan evidence by @balcsida in #113
• Release v0.6.0 by @balcsida in #115

Full Changelog: v0.5.0...v0.6.0