0.0.0-alpha.1

Changelog

Unreleased (2025-08-04)

⚠ BREAKING-CHANGE

• The /vulnerabilities search paramteres are changed from 'average_severity'and 'average_score' to 'base_severity' and 'base_score'

• The upgraded parser aligns with RFC 9535, and notlonger supports the $.[] notation. It must be converted into $[].
  This is important for the group extraction with OIDC, specifically
  with AWS Cognito.

• This changes the prefix of the API from/api/v1 to /api/v2 as this is the successor API of trustification (v1).

• Breaks the migrations as this PR rewrites the historyto use UUID instead of i32 from the start.

Features

• add delete method to Storage trait (119f02f), closes guacsec#1864
• add scores and severities to response (608d059)
• query field names may include any character except \ (69133f1), closes
  guacsec#1849
• analysis: reduce memory consumption by ~15% (403ae57)
• analysis: expose cache usage (5496e5f)
• analysis: provide for status details (c984add)
• analysis: ensure parallel loads await each other (f000857)
• start exctracting vulnerability scores from cvss v4 and v2 (3dac8f7)
• analysis: log graph cache size during startup (251aac7)
• import SBOM attachments from Quay repositories (498a1f4)
• analysis: add counter for cache hit/miss (4d5fa9d)
• analysis: track number and size of evictions (6382952)
• implement validation of labels (e8a3d13), closes guacsec#1708
• implement PURL extraction endpoint (976666f), closes guacsec#1665
• Setting compression to None will remove the header (d84a29d), closes guacsec#1682
• allow using path style for S3 (5c2bdd8), closes guacsec#1678
• parse and store cvss3 scores for cve files (474f82e)
• allow string arrays to be queried in the q= syntax (42f99b9), closes guacsec#1558
• refactored license type management in CSV license export (guacsec#10) (3cf0d1a),
  closes guacsec#10
• analysis: log cache eviction note on info level (895a360)
• allow control populating the cache after ingestion (cc8d4ff)
• allow providing the format type during the upload (advisory) (4c2ab4c)
• allow providing the format type during the upload (99fbae2)
• filter SBOM's and Advisories by labels (7bcb993), closes guacsec#491
• now supporting json objects for in-memory queries (16f6a57)
• support unlimited multi-part field names for json columns (513bcdc)
• support nested fields within in-memory query contexts (c4d3661)
• query json objects with ':' to delimit column name and key (ad808aa), closes
  guacsec#491
• return a list of valid fields in a query error message (6978eb1)
• add api/v2/analyis/latest/component (a61b511)
• allow upload gzip compressed files (16d6066)
• a new dataset containing a few sboms and osv advisories that had issues in
  correlation (8f150ce)
• collect and report SBOM supplier information (26c0bf2)
• add analyze endpoint for purl-based vulnerability scan (0709de3)
• add score to response (6718869), closes guacsec#1473
• add pg_stats to the compose database (9a2efbc)
• expose the group of an SBOM package (4cccd4f)
• allow purl's to be included in purl queries (cd9ce84)
• filter components by partial matches of a purl and/or cpe (f61f172), closes
  guacsec#1280
• drop redundant functions and refactor loops (6174528)
• add endpoint to process multiple purls (e8aaae0)
• adds metric of running importers (14acaa4)
• enable multiple importer replicas to coordinate their work (ad6abd0), closes
  guacsec#1307
• add sbom node checksum entities (0ff50c6)
• introduct e2e tests based on hurl (009b7d9)
• add RH processing for SPDX as well (2b09639)
• add RH prod/comp relationships (82c8013)
• make max concurrent importers configurable (6acf514)
• introduce new dataset (ds4) (0a421bf)
• upgrade OTEL to 0.28 (f8ee2af)
• introduct db context in graph and put status cache there (ab602f6)
• implement ingestion of SPDX and CDX external references (e66cbf3)
• add db parameter group, with current settings (dbddabb)
• Upgrade postgresql to 17 (1be139d)
• add custom metrics, and an initial cache size metric (110c7db)
• Gathering metrics at development time (9f2764d)
• Seeing OTEL traces at development time (27e5482)
• create AncestorOf relationship from cdx pedigree/ancestors (532a12a), closes
  guacsec#1151
• create VariantOf relationship from cdx pedigree/variants (63f9ada), closes
  guacsec#1147
• add a way to find related SBOMs by CPE (52fce44)
• allow locating by CPE (0693b5c)
• show relationships in response from /api/v1/purl/{key} (efc9394), closes
  guacsec#1131
• add some OSV examples to DS3 (0d08059)
• add two example entries fro GHSA data (e08aacb)
• create GeneratedFrom relationship from CycloneDX dependencies (88fa55c),
  closes guacsec#1131
• add average_severity to PurlStatus (4a7ae84)
• allow disabling the request logging (88c8632)
• allow start year and years filtering for osv (74fa0e6)
• reimplament vulnerability endpoint logic and api so we can retrieve purls
  for affected sboms (7c2c140)
• allow processing CDX 1.6 (3c3870f)
• add ingestion time to source documents (f5b9bff)
• find purls for affected packages (1354501)
• allow more postgres database options (0f36466), closes guacsec#1000
• provide scores in sbom details response (a3b8e6d)
• correlate vulnerabilties for purls using product statuses (9ee0d13)
• enable custom trust anchors for swagger oidc (96ab4c9)
• imporve migration to migrate data as well (915982d)
• csaf correlation - correlate vulnerability to purls and sboms (8bc4adb)
• provide additional information (9d38b76), closes guacsec#962
• query json columns using dot notation, e.g. field.key~log4j (15f52f6)
• add a store for user preferences (57006c2)
• add the "reserved" field for vulnerabilities (2654563), closes guacsec#964
• allow ignoring missing (404) files when importing (3e51716)
• add size of documents and sbom data license (1164a4f)
• enable compression of docs stored on S3 (ab9c056), closes guacsec#925
• introduce ability to apply a Query to any random context (d12d942)
• CI pipeline to build, package, test, and deploy each merged PR (2db0f71),
  closes guacsec#804
• populate cpe_key in organization and product tables (feb9d9f)
• implement optional fs storage compression (10518de)
• create versioned purls from OSV (5d02060)
• add an endpoint to get the counts of sboms per purl (d7ac133)
• deprecate advisories when receiving an upload or deleting one (3123d2b)
• ingest products from csaf documents (2c55fde)
• add an endpoint for release information (0b234ea)
• now showing thread id's in log output (0d200fd)
• support compressed upload (14c356c)
• allow importing complete datasets (9722fdc)
• sort importers by enabledness (7c65d51)
• implement patch for updating importer configurations (ac104b4)
• allow disabling the GraphQL endpoint, and do so by default (ea6e6ed)
• add depth to GitWalker for faster clones by limiting history (8da2fe5)
• speed up initial clones of git repos (31cc15f)
• add progress support, backed by the database (bf0a017)
• add MEM_LIMIT_MB env var to configure threshold for tests (35d1cdd)
• replace SyncAdapter with SyncIoBridge to reduce RAM usage (684154d)
• add basic progress support, first just via tracing (4d6d366)
• refactor temp file creation to reduce S3 usage (f9727a2)
• allow creating the embedded database in a different directory (b6766cb)
• improve product details to return basic sbom data (6d3a777)
• allow configuring fetch retries (d1b3ce6)
• allow setting a size limit when importing SBOMs (83dcde7)
• allow using a dedicated working dir for dumps (9cc1302)
• Add maven version comparison SQL function. (7efd883)
• add an xtask for generating a pre-loaded DB dump (59889af)
• S3 storage backend (978a2be), closes guacsec#621
• add PurlService method that can gc dead purls. (11b0ede)
• Add api to delete Vulnerabilities. (ad0f2fb), closes guacsec#563
• Add api to delete Advisories. (220863f), closes guacsec#563
• add the ability to specify a branch for importing OSV (c31462c)
• Add api to delete products (807dcb5), closes guacsec#563
• Add api to delete sboms (2e6b810), closes guacsec#563
• add rapidoc support (c5df2c5)
• add trustd subcommand to export openapi spec (0ffc786)
• new convention for organizing integration tests (f653c02)
• add import warnings to the report (b59a19b)
• use v5 uuid upsert for CPEs (1fd7470)
• add cpe creator (7c5ee80)
• ingest products from sboms (d5ec88c)
• add more data to the products API (0983ac3)
• allow canceling import runs (7c53e9e)
• add sha384 and sha512 to the SBOM and advisory (bf67cdc)
• add GIN index for labels (3319040)
• add more labels to imported documents, allow user defined labels (87b6a6e)
• return description as well (63a0edd)
• allow setting labels during upload (34d2c06)
• return labels when fetching sboms or advisories (dd54b9f)
• implement setting labels for SBOMs (cf59c85)
• implement setting labels for advisories (22741d5)
• enable backslash to escape operators in filter expressions (5e66c77), closes
  guacsec#434
• extract organization name from CVE (1065ab3)
• add CWE for vulnerabilities (181719d)
• implements labels using jsonb (d6b4302)

Fixes

• ui: prevent extract-purls endpoint from returning invalid purls
  (d2fef3f), closes guacsec#1887
• prevent calculating the total if we don't need it (ccf1cb8)
• properly filter cvss scores for the advisory (4149075)
• nested external sboms in cdx (eed044a)
• storage: ensure an empty string is "none" compression (95c9c6e)
• fundamental: change response of analyse purl endpoint (12d9ab3)
• storage: clean up the returned content encoding (d55e8d8), closes guacsec#1850
• add support for golang versions with 'v' prefix (92c92f6)
• add indexes to sbom_node_checksum (46ab4cb)
• set RUSTFLAGS for Windows binary build (52138ef)
• remove 'runs-on' from 'backport' CI job (e9968a8)
• mark advisory average scores and severites deprecated (880f425)
• prevent dumping massive amounts of log info (baeb1a2)
• don't force ansi colors, respect NO_COLOR, default on (cb02e9c)
• analysis: don't load all SBOMs when checking by name (b2cc941)
• include array fields in full-text searches (64e6e90), closes guacsec#1746
• timeout the DB ping and return "false" (c363732)
• storage: urlencode bucket name (12db42d)
• align the embedded postgres version with the CI (50e731d), closes guacsec#1674
• set vulnerability score from cve advisory (c21c65b)
• delete advisory performance (a605ad6)
• add sorting and pagination to importer report endpoint (5f1a927), closes
  guacsec#1636
• return 404 when /weakness has no results (a00a709)
• use correct env variable (29feec1)
• remove duplicate UNION in gc_purls SELECT (9297a06)
• properly evaluate the UpdateSbom permission (a0cee9f)
• show null severity in vuln when it's null in advisory (e542e2b), closes
  guacsec#1374
• support custom trust anchors, fix a "not found" issue (34274f3)
• remove advisory_vulnerability gist index (ac0c728)
• don't queue work on the worker queue if there is none (57146a1)
• fully-qualify table names in json filters (6f419f5)
• when deleting an entity, delete also a source document (and scores for the
  advisory) (4cb8ceb)
• prevent panic when handling non YAML content (d6d37cb)
• ensure that container build aligns with deployment architecture (6316078)
• Python versions PLSQL comparator (TC-2469) (ffce45d)
• ensure that an invalid CVSS does not panic (a5eceda), closes guacsec#1547
• scale test references the PR number commented (76e2d7d)
• scale test references the PR number (583d39b)
• return 400 instead of 500 in case of validation errors (a0d052c)
• correct documentation of API (1584c6a)
• prevent deadlock when inserting in parallel (0a75ac4), closes guacsec#1531
• reap crashed jobs so they don't appear "stuck" in the UI (d418222), closes
  guacsec#1499
• pythonver_cmp function to properly handle local versions (12fb17e)
• cvss scores with I:N and A:N score properly now (f5fe0c5), closes guacsec#1519
• mavenver_cmp add logic to compare builds (6992b4e)
• mavenver_cmp function fail to compare versions with build numbers properly
  (df0afbe)
• add a migration to fix null values for suppliers (8b0d1fe)
• ensure load order does not impact analysis graph dependency queries
  (55bb20d)
• TC-2388 OSV range with last_affected (564ec89)
• allow setting devmode with container keycloak (3fb1032)
• get_purl now deals with missing ns properly (9209645), closes guacsec#1456
• set title for vunerabilities with non typical description language code
  (a0de6e1)
• use patched version of spdx-rs until the fix is merged and released
  (8f1cab6), closes guacsec#1492
• /sbom/by-package api can now sort results by name (0099fb3), closes guacsec#1476
• add vulnerability details in purl details for product statuses (0f1f780)
• purl components now properly encoded in Display impl (1997349)
• prevent an OOM situation by using a stream as result (a311672)
• prevent duplicate PURLs or CPEs being returned (123348a), closes guacsec#1417
• imageindex>imagevariant external sboms (2cb286d)
• dataset test (2aa3d21)
• issues is optional for advisory (c2c3249)
• fetch vulnerability description in the queries instead of loop (50bdcfb)
• fetch advisory issues in the queries instead of loop (4203ef6)
• improve perfromance of sbom/advisory endpoint (c78e877)
• prevent database passwords being logged (541ad10), closes guacsec#1409
• ensure we always detect a duplicate source document (92f223c), closes guacsec#1405
• prevent stack overflow (250160c), closes guacsec#1322
• terraform: only ensure the tag exists, don't require a value (6c78c45)
• prevent creating duplicate advisories when uploading in parallel (325b0fc),
  closes guacsec#1395
• ancestor query so that any external parent sboms are returned (994c701)
• don't create duplicate documents when ingesting in parallel (0ed6e7b),
  closes guacsec#1395
• upgrade antora from 3.1.9 to 3.1.10 (03eb218)
• analysis graph needs to consult graph_cache for external sboms, added tests
  (5949cff)
• external sbom cdx example and tightened related tests (4fd6dfd)
• find analysis components by q=purl (a8370b5), closes guacsec#1280
• employ a cancel token to abort the long-running git clone (9e73943)
• sbom: validate CDX files during ingestion (805f671), closes guacsec#551
• permission problem with containerized xtask dump (18aa037)
• test_sbom_details_cyclonedx_osv set thread_stack_size (b8dc811)
• years range in ds4 not properly configured (389a7df)
• apply postgres config to compose file (ab5d523)
• use predictable ids for all entities during csaf ingestion (fd74a49)
• refactor version scheme matching logic (a652369)
• make status loading one-time event for csaf importing (329f9ee)
• improve status checking by introducing the global cache (e5b62ad)
• insert affected status for versions up to the fixed ones (a568016)
• typo (5ef6db4)
• deserialize relationships filter from query params (eb03a8a), closes guacsec#1232
• add index for organizations by name (ade3bc9)
• in case of duplicate sboms, don't re-ingest content (2d7508f)
• rework the way sboms are located, by describes. (377a157)
• change describes location for cdx, adapt tests (0286f07)
• add an ai feature so that ai features are not compiled by default.
  (8735ebd), closes guacsec#1219
• re-use the same analysis service instance (1c03182)
• analysis: aggregate in way that we don't have duplicate purls/cpes
  (feb530a)
• report CPE parsing as "bad request" (efc14da)
• sbom license migration to update nulls (b048e4b)
• infinite loop when invalid file passed to Format::from_bytes (c9b7fe4)
• /api/v2/purl/{purl} now honors qualifiers, or lack thereof (a4b12cd), closes
  guacsec#1158
• improve product version range migration (ddfde89)
• urlencode purl qualifier values in the db (dc0cc84)
• use predictable ids for product related entities and additionally speed up
  csaf ingestion (80c6d09)
• optimize import of product related entities during csaf ingestion (678284e)
• improve sbom to vunerabilities correlation both in performance and accuracy
  (a98d468)
• actually set a default value, instead of null (bcf4fc2)
• ensure sbom's and adv's can be filtered/sorted by ingested date (b920d63),
  closes guacsec#1077
• use the ingested column in the sbom query (606f596), closes guacsec#1077
• report 500 in case of storage errors, align with other errors (ad97b19),
  closes guacsec#1042
• include json columns in full-text searches (c1330c2)
• enable filtering/sorting on qualified purl json fields (910c378), closes
  guacsec#888 guacsec#951 guacsec#972
• use UUID v4 instead of name for the ID of the node (a5a15c1)
• always create "described by" relationships (ddd20e8)
• change name from walker to cli (54df2e4)
• don't check if the bucket exists. (1e9b3e9)
• openapi spec for moved number_of_packages (32ceeab)
• move number_of_packages to SbomHead (186d407), closes guacsec#1006
• s3 storage config options and encoding case insensitivity (66c20fd)
• rename component to package (5436509)
• osv: treat published as optional (5952f3e)
• re-walk all files if the commit cannot be found (1fd508f)
• have a default empty array (d5d9d33)
• add missing "number_of_vulnerabilities" field (6d6433c)
• add missing "number of packages" field (538070a)
• we normally use camel case (5fbbd9a)
• ai: Reduce tooling description duplication. Move the input description
  into the the tooling parameters. (6f0377a)
• performance issue in update_deprecated_advisory (03e2637)
• xtask generate-dump (def9856)
• test failure due to .DS_Store files being present (b5df115)
• don't clear qualifiers when ingesting CSAF (506e81b)
• use a combination of namespace and tracking id as document id (f542219)
• openapi.yaml github action execution (471a472)
• update openapi spec (28c332a), closes guacsec#866
• avoid workflow failures in forks (501f453)
• init logger only once, use tracing setup (258ce7c)
• handle NONE and NOASSERTION as relationship targets (ae78b03), closes guacsec#552
• declare uuid dependency and v5 feature (7dc1889), closes guacsec#839
• prevent uploading compressed files which might exhaust the memory (9145a6e)
• ensure UUIDs are stable, and we have a stable insertion order (12ef030)
• use stable order for CPEs to prevent deadlocks on the DB (08eb107)
• store documents when ingesting a dataset (600dd36)
• allow ingesting YAML based OSV (54da44c)
• able to run pm-mode in container (bc57113)
• restore hard-coded base paths in CVE/ClearlyDefined walkers (f3a9fe9)
• restore hashes in SBOM fetch api (df89982), closes guacsec#733
• disable format detection for importers (26eda5d), closes guacsec#715
• fix performance regression, speeds things up ~10x (3af6cdf)
• prevent dumping the full CSAF document into the tracing context (f66ef06)
• importer openapi definitions (aad7e20)
• use the current working directory in the podman -v arg. (ddfdc85)
• add lifetime to avoid a storage impl clone (0822a73)
• a couple of openapi fields reverted to not being required. (2858271)
• PurlService - purl_by_purl bug (a5e07a2)
• refactor sbom dto objects to better represent data model (b551051)
• delete operations were missing from api docs. (bdd3b38)
• generate config schema and ensure they are up-to-date (6ff7e9b)
• use load_one pattern to load all organizations for mulitple products
  (537c640)
• use load_many pattern to efficiently load versions for multiple products
  (020ad82)
• make storage CLI options mutually exclusive (e03fda1), closes guacsec#631
• remove usage of FileSource and document how to use csaf walker to ingest
  local files (398ebf5)
• sbom_node FK constraints (37d396f)
• issue with duplicate packages (399645a)
• only force devmode if the embedded OIDC is requested (4bc17f3)
• add the deleteSbom api operationId. (ca3a047)
• define the schema type of the if-match headers. (c198f04), closes guacsec#580
• Add openapi operation ids (738d10b), closes guacsec#580
• increase recursion limit (3130c74)
• strum build error (4608dff)
• remove "ui" feature (7f12f71), closes guacsec#559
• remove non-normative data from advisory vulnerability (1a2714a), closes
  guacsec#543
• auto-create vulnerabilities using upsert (e516b42)
• swagger-ui for product details (b42ed10), closes guacsec#545
• swagger-ui docs for organization (c787eb3), closes guacsec#544
• ensure that descriptions are not growing with every insert (f7c4f06)
• also check for vuln-id to create all entries (0dc4583)
• apply the CPE fix also for the language (dc7c328)
• prevent the creation of duplicate CPEs (130e41f)
• use the "last_success" time for the next "since" (2456d9e)
• only add the package manager category as a name for that package (1b39eaa)
• used for both advisories and SBOMs (1d536b7)
• retrying later on change means, accepting it now (e3e9c15)
• catch cases of invalid SPDX references and report them as such (094ef8b)
• bump pg-embed to avoid github rate-limiting during tests (7e62347)
• clean up a few openapi issues around labels (94a47eb)
• this file actually belongs to migration 230 (29a52a0)
• the q param now works for /api/v1/sbom/{key}/packages (f36b558), closes
  guacsec#434
• allow ingesting spdx SBOMs with files (1f2145e)
• relationship direction for "documentDescribes" (058ee24)
• link with specific node, not any node of the SBOM (8d87482)

v0.1.0-alpha.8 (2024-06-24)

Features

• initial product endpoints (6112344)
• add filtering/query to "find by sbom package" (93e3eaa), closes guacsec#438
• search SBOMs by PURL or package id (a4ce8ec), closes guacsec#413
• add version to sbom package (20eefb2), closes guacsec#284
• support IS [NOT] NULL in queries (5b658cb)
• add ability to translate queries (8c6f062)
• more efficient detection of advisory formats (d669658), closes guacsec#257
• Initial implementation of products (2573b01)
• add an entry for all CSAF data (bc9e6a5)
• update cyclonedx for support of 1.5 (9817ffa)
• allow configuring the OIDC UI settings (f2ad362)
• implement CVE import (f6d2cde)
• implement OSV ingestion (0bc8a20)
• add cyclonedx support (0570cfb)
• provide some default/sample data for PM mode (0d0d5a4)
• support CVE ingestion (7df5273)
• detect advisory format and location (e73a7ef), closes guacsec#144
• make LIKE queries case-insensitive by using Postgres' ILIKE (5e2e357)
• add authors field, and align id field name (857a8aa)
• fetch: allow fetching sbom packages (ec4ab6a)
• allow fetching sbom summaries and "describes" packages (ea5eab4)
• use creator for optimized imports (3014f17)
• ingestor: default to sha384 hashing and allow for algorithm
  customization (0dcbc19), closes guacsec#161
• improve performance once more using a relationship cache (5a69fd6)
• allow searching for SBOMs (8f4a3ac)
• accept human date filters (7c0f54b), closes #145
• add a NotLike operator, !~ (32e02b3), closes guacsec#148
• support OR clause values, e.g. a|b|c (bd4a4c7)
• support queries containing '&' if escaped, e.g. "M&M's" (1db672b)
• support AND/OR operators and full-text search (a2e0cdf)
• add search (507c670)
• allow preventing a reset of the database (435c5bb)
• implement SBOM upload and download over the API (47919b0)
• add a basic index document (3db1857)
• add some filesystem storage (d8ae8c6)
• add composite openapi specification and swagger ui (9f0bba4)
• implement csaf importer for server (8fcf779)
• revamp pagination according to our discussion (f42b518)
• add server for processing imports (8b3a59e)
• add optimistic locking for importer config (3910159)
• implement API for importer, based on mock backend (2f162a6)
• add authentication (0e9ff11)
• import: allow using multiple worker (beef601)
• import: add a progress meter for getting an ETA (194ed54)
• allow filtering from the command line (8f9178d)
• add sbom importer (ce533af)
• refactor importer command and create a base for adding sbom importer
  (90f1e55)
• calculate digest if not present (d5f7122)
• add configurable source for the importer (9db0e37)
• allow bootstrapping the database (8c6a2c9)
• add basic HTTP server and make configurable db connection info (84d29eb)
• add basic cli (e2deeb2)
• ingest "fixed" state for vulnerabilities (1134ea0)

Fixes

• appease graphql and openapi paths wrt slashes (07629a9), closes guacsec#376 guacsec#422
• honor transaction for requests (97510e7)
• return only the sbom_node, not all nodes belonging to the sbom (6349e91),
  closes guacsec#414
• provide the package describing the sbom with the summary (ea8af78)
• enable sorting advisories by average_severity (8de5be2), closes guacsec#383
• move graphql under /graphql only (f07f5fa)
• count items being processed for osv and cve (a1f8d21)
• Restore /api/v1/sbom/{key} SBOM metadata access (7bb7c69), closes guacsec#253
• the the id issue for SBOMs too (a52b6f4)
• translate the id into a hash before fetching from the storage (12c0d71)
• use newer container to fix/workaround segfault in libgit2 (16deb09)
• accept either domain or full URL (d601573)
• register types, remove infinite reference (724a788)
• reset all jobs when starting up (88ec8da), closes guacsec#355
• use correct env-vars for storage settings (a93be47)
• update cve to fix some parsing errors (d46683a)
• directly pass sha256 digest, parsing it misses the perfix (feba99a)
• client ids need to split by comma when coming from the env-var (08c1402)
• update embedded oidc to support refresh tokens (f01dcc5)
• push multi-arch image (d90dae0)
• allow swaggerui to redirect (1bb1ca1)
• ingest scores when loading CSAF docs (4719406), closes guacsec#278
• have a default limit of 25 (44d4a01), closes guacsec#287
• ensure order using primary keys, not hardcoded id fields (9f5f01f), closes
  guacsec#267
• swagger-ui by pulling in utoipa upstream fix (ed0efb1), closes guacsec#235
• using default password for PM mode (67e94c3)
• fixing openapi (ddb2694)
• handle empty search options when filtering (4a662cf), closes guacsec#219
• flatten calls during ingestion (56cbbb9)
• that index should be unique (638f467)
• if auth is disabled, don't use it for swagger ui (1929f8b)
• logging in PM mode is more sane now (eb87749), closes guacsec#135
• bump db creation timeout from the 10s default to 30s (b33699c)
• wrap trustd behavior in Infrastructure block (46d8dea), closes guacsec#135
• set the data_dir field to retain data across restarts (0bff480), closes
  guacsec#171
• ingestor: update use of HashingRead::finish (fa6617b)
• ingestor: update HashingRead::finish to return result (8d80b73)
• require qualifiers to match as well (311f199)
• improve performance by using indexes for the important queries (4b2e78a)
• properly define primary key (f24287f)
• use caches to prevent repeated lookups (3f0719b)
• do not repeat ingesting the packages (c6547d1)
• don't treat all possible query values as strings (27ff514), closes guacsec#156
• swagger endpoint path for advisory search (026916e)
• handle missing sort parameter (6464282)
• don't use limit for offset (3653677)
• ingest csaf documents in a single transaction (ad9196a)
• add test for optimistic locking and fix it (3515611)
• don't rely on PWD for test data (7cdbf0e)
• handle bad PURLs (3358a93)
• initialize logging (2ed2ca8)
• add missing column (c17e3c5)
• use explicit env-var names (a02a909)
• update after api change (4d73efc)