v0.2.0

Verify this release

Every file is signed keylessly with Sigstore (<file>.sigstore.json) by
.github/workflows/release.yml at refs/tags/v0.2.0, and covered by SLSA
build provenance (osiris-v0.2.0.intoto.jsonl). See
DOCKER.md.

sha256sum -c SHA256SUMS
cosign verify-blob --bundle SHA256SUMS.sigstore.json \
  --certificate-identity 'https://github.com/carbon-evolution/osiris/.github/workflows/release.yml@refs/tags/v0.2.0' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com SHA256SUMS
gh attestation verify osiris-v0.2.0-standalone.tar.gz --repo carbon-evolution/osiris \
  --bundle osiris-v0.2.0.intoto.jsonl \
  --signer-workflow carbon-evolution/osiris/.github/workflows/release.yml --source-ref refs/tags/v0.2.0

Container image: ghcr.io/carbon-evolution/osiris:0.2.0 (signed with cosign, SBOM + provenance attached).

What's Changed

• chore(deps): bump body-parser from 2.2.2 to 2.3.0 in /intel by @dependabot[bot] in #3
• chore(deps): bump nanoid from 3.3.13 to 3.3.18 by @dependabot[bot] in #9
• chore(deps): bump qs from 6.15.2 to 6.16.0 in /intel by @dependabot[bot] in #11
• chore(deps-dev): bump browserslist from 4.28.2 to 4.28.9 by @dependabot[bot] in #12
• chore(deps): bump @vitest/mocker and vitest by @dependabot[bot] in #14
• chore(deps-dev): bump js-yaml from 4.2.0 to 4.3.2 by @dependabot[bot] in #17
• chore(deps): bump proxy-addr from 2.0.7 to 2.0.8 in /intel by @dependabot[bot] in #20
• fix(security): Next.js 16.4.2 + disable unused image optimizer by @carbon-evolution in #24
• fix(security): escape third-party data in map popups (XSS) by @carbon-evolution in #25
• fix(deps): upgrade sharp to 0.35.5 by @carbon-evolution in #26
• fix(docker): exclude local .cache and make the runtime cache writable by @carbon-evolution in #27
• fix(deps): upgrade maplibre-gl to 6.14.0 (last critical alert) by @carbon-evolution in #28
• ci: tests, build and audit on every PR (+ fix ensureSchema race) by @carbon-evolution in #29
• fix(cctv): allow TRIMARC snapshots through the image proxy by @carbon-evolution in #30
• feat(cctv): add Denmark public webcam source by @morein1 in #18
• ci: add CodeQL code scanning by @carbon-evolution in #31
• fix(security): address confirmed CodeQL findings by @carbon-evolution in #32
• ci: pin release workflow actions to commit SHAs by @carbon-evolution in #33
• Type-checked build, 0 ESLint errors, lint in CI by @carbon-evolution in #35
• Remove unreachable SCM supplier layer code by @carbon-evolution in #36
• chore(deps): remove unused react-map-gl by @carbon-evolution in #37
• chore(deps): bump the actions group across 1 directory with 6 updates by @dependabot[bot] in #34
• chore(types): replace explicit any in small files; ratchet no-explicit-any to error by @carbon-evolution in #40
• fix: use the shared internal origin for app-internal fetches by @carbon-evolution in #41
• fix(geo): avoid 502s and shared geolocation cache by @morein1 in #38
• feat(cctv): add verified official Denmark webcam batch 2 by @morein1 in #39
• fix: trust Vercel geo headers only on Vercel; own-key camera lookup by @carbon-evolution in #42
• ci: sign release images with Sigstore cosign; add provenance and SBOM by @carbon-evolution in #43
• fix(github-webhook): configurable target; fail closed when unconfigured by @carbon-evolution in #44
• ci: malware scan, OWASP ZAP baseline, OpenSSF Scorecard; pin all actions by @carbon-evolution in #46
• docs(security): OWASP Top 10:2025 assessment; private vulnerability reporting by @carbon-evolution in #47
• chore(types): replace explicit any in 20 more files (batch 2) by @carbon-evolution in #45
• fix(analytics): make Umami opt-in, drop visitor-IP event (OWASP A06) by @carbon-evolution in #50
• fix(security): gate recon scanner proxy; trust proxy headers only on opt-in (OWASP A01) by @carbon-evolution in #51
• fix(security): tighten CSP and add hardening headers (OWASP A02) by @carbon-evolution in #52
• chore: hold Node major bumps in Dependabot; ignore local .claude state by @carbon-evolution in #53
• chore(deps): bump the actions group with 3 updates by @dependabot[bot] in #49
• docs(security): re-rate OWASP Top 10 after #50–#52 by @carbon-evolution in #54
• ci(release): signed GitHub Releases with Sigstore signatures and SLSA provenance by @carbon-evolution in #55

New Contributors

• @dependabot[bot] made their first contribution in #3
• @morein1 made their first contribution in #18

Full Changelog: v0.1.0...v0.2.0

v0.1.0 — OSIRIS

First tagged release of OSIRIS — a global intelligence dashboard (Next.js) with an AI analyst and live map layers.

Container image

Published to GitHub Packages on release:
```bash
docker pull ghcr.io/carbon-evolution/osiris:0.1.0
docker run -p 3000:3000 ghcr.io/carbon-evolution/osiris:0.1.0
```

🤖 Generated with Claude Code