v0.1.11

Migrations are now one file, and starting several tasks at once can no longer race on them (#12). The release workflow's last check also says why when the registry refuses a lookup (#11).

Database

• The schema is one migration per dialect, 00001_initial. Migrations 2 and 3 are folded into it, and the schema they build is unchanged.
• On Postgres, startup migrations take an advisory lock, so several tasks starting together migrate one at a time. Before this, two tasks could apply the same migration side by side and one would exit with a duplicate-key error.
• Coming from v0.1.10, delete the records of the folded migrations once v0.1.11 is running, or the next migration numbered 2 will be skipped: DELETE FROM goose_db_version WHERE version_id IN (2, 3);. After that, v0.1.10 can't be redeployed as a rollback.

Releases

• The Verify what was published job asks the registry for each tag's digest directly and reports the registry's own reason when it refuses.

v0.1.11-beta.1

Prerelease from the public repository. The same product as v0.1.10. It exercises the release's new check of its published addresses (#11), which reads image digests from the registry API and logs any refusal with its status.

v0.1.10

The first stable release of Panorama. It contains the fixes from a real deploy test of v0.1.10-beta.3 (#9) and moves the build to Go 1.27.3 (#10).

Deploying on AWS

• IngressCidr takes up to four CIDRs, and the new IngressPrefixListId takes a managed prefix list.
• The stack owns the database's and Container Insights' log groups, with LogRetentionDays, and deletes them with itself.
• A new RunTaskNetwork output feeds aws ecs run-task.
• The shipped template leaves out its comments, so it stays well under the 51,200-byte limit for aws cloudformation deploy.
• The manual now names --region on every aws command, and gives monthly costs and a cheaper evaluation setup.

Signing in without SSO

• Until single sign-on is configured, a personal gateway token signs a browser in to the console.

Bedrock refusals

• The provider check streams like real traffic and tries the models your routes use first.
• Settings → Model providers shows Bedrock's own reason for the latest refused request, and tells apart the Anthropic use case form, a model not offered to the account, an SCP, IAM, Marketplace and a retired model.

CLI and policy

• Flags work in any position. A stray argument is refused rather than silently dropping the flags after it.
• panorama policy apply reports unchanged routes and writes only what changed.
• A route change is served within about a second on every replica.

Security

• Built with Go 1.27.3, which fixes GO-2026-6809 in crypto/x509.

v0.1.10-beta.3

Prerelease from the public repository.

v0.1.10-beta.2

Prerelease from the public repository.

v0.1.10-beta.1

First prerelease from the public repository.