OpenSCM v0.8.0

Added

• Guided first run. A new install shows an empty dashboard and nothing on screen says that the order is register a system → write a test → build a policy → run it. First-time users now get a short walkthrough on the dashboard naming those four steps, each with a diagram of what it means and a link straight to the page that does it. The agent step shows the real install and configuration commands with your server URL filled in (set app_url under Settings for this) and covers approving the system afterwards, and the whole thing is dismissible with Don't show this again.

  It appears only on the dashboard — never over a page you are working on — and only for roles that can act on it: Viewers do not see it at all, and Runners get the three screens that concern them rather than authoring steps they would be denied at. Closing with Esc or the X does not dismiss it permanently, so an accidental close on step 2 does not bury something unread. Quick start in the user menu reopens it at any time.

  Upgrading does not show it to anyone who already uses OpenSCM — only to accounts created from here on, and to the administrator of a fresh install.

Changed

• PDF reports are now roughly 25× smaller. A two-page report was 2.7 MB and a seven-page one barely larger, because the old renderer embedded four complete font faces in every document regardless of what the report actually used. Fonts are now subsetted, so the same reports are 48 KB–130 KB. This matters most for the Email me the PDF flows, where every report sent was carrying ~2.6 MB of unused font data and edging towards the attachment limits some mail gateways enforce.
• Table headers now repeat on every page of a multi-page findings table. Previously only the first page was labelled, so from page 2 onwards an auditor had unlabelled columns.
• Reports use slightly tighter table rows and so run to fewer pages for the same content. No content has been removed.

Security

• Closed RUSTSEC-2026-0187 and six unmaintained-crate advisories by replacing the PDF renderer. All seven traced to a single root: genpdf, unmaintained since 2021, which pinned lopdf 0.26 and image 0.23. The advisory needed lopdf ≥ 0.42 and no version bump could reach it — the maintained genpdf fork only gets to 0.31 — so closing it meant replacing the renderer. The project now uses printpdf 0.12 (lopdf 0.44) with an in-tree layout layer, and cargo audit reports zero findings with the previous suppression removed rather than merely re-ignored.

  The exposure was always latent rather than live — the advisory requires parsing a hostile PDF and this product only ever generates them — but it sat in every dependency scan a prospective customer might run.

---