Stratos v5.5.1

Bug Fixes

• Viewport state is no longer written to the stored user preferences.
  isMobile and isMobileNavOpen are measured from the window by the
  dashboard's breakpoint observer, but they were persisted alongside real
  preferences and then restored over that measurement when preferences loaded.
  They are now owned by the observer alone: never stored, and left untouched by
  hydration.
• Screens that look up an endpoint's type no longer throw when that type has no
  registered entity — which happens to an endpoint left behind by a removed or
  disabled extension, or registered by an older version. entityCatalog .getEndpoint() returns nothing for an unknown type, but its signature
  promised a result, so callers dereferenced it unguarded and the failure
  surfaced as an uncaught TypeError that tore down the surrounding
  component. The affected paths were endpoint edit, connect, create,
  backup/restore, the home page, the metrics list, git registration and the
  Kubernetes summary tab. The signature is now honest about returning nothing
  and every caller handles it.
• The application delete confirmation now names the org and space when the
  wizard is opened by URL or after a refresh. It resolved all four names
  together, so a page load where the app and endpoint had arrived but the org
  and space had not showed org "?" / space "?" — losing the disambiguation
  the dialog exists to provide. Each name is now resolved on its own.
• make dev backend now allow-lists the ng serve origin, so WebSocket
  features work in the development stack. jetstream rejects cross-origin
  upgrades unless the origin is in ALLOWED_ORIGINS, and the dev target set
  none — which broke cf push, application log streams and SSH with
  request Origin ... is not authorized for Host .... A packaged console
  serves the UI from jetstream itself, so only development was affected.
• The development TLS certificate now names localhost, 127.0.0.1 and ::1
  in its subjectAltName, so https://localhost:5440 can be trusted instead of
  only clicked through. The certificate shipped in dev-ssl/ was a self-signed
  sample generated in 2017 with no extensions at all, and the setup guide told
  contributors to generate a replacement with -subj '/CN=localhost' — also
  without a SAN. Browsers have required subjectAltName since Chrome 58 and
  ignore a bare CN, so both were rejected with ERR_CERT_COMMON_NAME_INVALID
  no matter how they were trusted.
• make dev backend no longer rebuilds the backend on every run on macOS. It
  compared file dist/bin/jetstream against uname -s, but file reports
  Mach-O and never Darwin, so the check never matched and each start paid
  for a full rebuild. It now matches the binary format, as the equivalent check
  for the E2E server already did.

Maintainability

• Moved jetstream off the archived gopkg.in/yaml.v2 to go.yaml.in/yaml/v4,
  the YAML organization's maintained continuation of go-yaml. No archived YAML
  library is imported by Stratos code any more; the module survives in the
  dependency graph only because Helm, the CF CLI and the Kubernetes client
  libraries still require it.
• make dev cert generates the development TLS key pair, and make dev frontend / make dev backend generate it when it is missing. dev-ssl/ is
  no longer committed: the pair is per developer, and a private key in a public
  repository is a private key everyone has. The deployment guide's self-signed
  example gained a subjectAltName for the same reason as the dev one.

Chores

• Bumped swaggo/swag to 1.16.6 and swaggo/swag/v2 to rc5, both of which
  drop their own gopkg.in/yaml.v2 requirement, and stretchr/testify to
  1.12.1.
• Documented the supported PostgreSQL versions (14 and later, matching what the
  upstream lib/pq driver tests against) and removed the PostgreSQL 9.4 service
  plan from the Cloud Foundry database-binding example, which had been telling
  operators to provision a major that left upstream support in 2020.