v1.0.3

Added

• Worker inventory search covers names, IDs, queues, hosts and status across the
  complete registry, with pagination instead of truncating after 100 workers.
• Jobs can export all matching records across pages, with a 10,000-job scan
  limit, cancellation when the target changes and explicit live-queue limits.
  Page exports remain available for Jobs and DLQ.

Changed

• Project typechecks use Bun's native bun check, and formatting uses native
  bun fmt with the existing style and ignore policy. The redundant oxfmt
  dependency is removed; TypeScript remains for Twoslash and the lint guard API.
• The public Bunqueue client and default managed-server command now use
  Bunqueue 2.9.20. Setup instructions and demo data follow the same package pin;
  saved commands and explicit environment overrides retain precedence.
• MCP setup and discovery match all 79 tools in Bunqueue 2.9.20. PostgreSQL
  fleet and upgrade validation now assert schema 21.
• The mobile Jobs page offers a compact statistics summary with expandable
  detail and keeps row actions visible during horizontal scrolling.
• npm releases are published through npm trusted publishing (OIDC) with a
  signed provenance attestation, instead of a long-lived NPM_TOKEN. The
  package is packed with Bun in a job that holds no credential; a separate job
  only downloads that tarball and publishes it with the npm CLI.
• Dependency updates collected from the pending Dependabot pull requests:
  React and React DOM 19.3, Zod 4.6 and happy-dom 20.14 (the newest releases
  within the existing ranges, slightly newer than the ones the Dependabot pull
  requests proposed), VitePress 2.0.0-alpha.20 and
  @shikijs/vitepress-twoslash 4.4.3. The documentation's code tooltips pin
  @shikijs/vitepress-twoslash to exactly 4.4.3: 4.5 requires floating-vue
  5.4, whose menu component no longer has the popper that the plugin patches,
  so every documentation page logged "Failed to patch FloatingVue". The Docker
  image now serves the dashboard from Caddy 2.10 (previously 2.8).
• The workflows use the Node 24 releases of their GitHub actions:
  actions/checkout v7, actions/setup-node v7 (the npm publishing job, still
  pinned by commit), actions/attest-build-provenance v4,
  actions/configure-pages v6 and github/codeql-action v4.
• The release workflow's two checkouts no longer persist the GitHub token in
  the repository's Git configuration, so dependency installation and packaging
  cannot reuse it; neither job runs an authenticated Git command (the release
  tag is created through the GitHub API).

Fixed

• Jobs follow queue and state changes in browser history. Selection and page
  generations reset across queue, page and server changes, including a rapid
  switch back to the original server, and obsolete callbacks cannot revive them.
• DLQ CSV downloads contain the visible filtered rows in their displayed order
  and identify the exported page in the filename.
• Successful workflow reloads clear obsolete initialization errors.

Security

• bun audit --audit-level=high passes again after advisories published since
  1.0.2: the overrides move DOMPurify (used by Mermaid) to 3.4.17, which
  fixes a critical SAFE_FOR_TEMPLATES bypass and a high-severity IN_PLACE
  issue, and ip-address to 10.7.4; Hono, used by the MCP SDK in development,
  moves to a patched release within its range. Mermaid 12.2 and its strict,
  browser-only documentation renderer resolve the remaining KaTeX advisory;
  happy-dom, body-parser and fast-uri also use patched versions. The full
  dependency audit reports no vulnerabilities.
• Workflow status GET requests no longer import modules or initialize workers.
  Initialization uses an idempotent POST protected by the agent's authentication
  policy. Configuration and status reads also require the configured agent
  token because their snapshots can include environment secrets.

What's Changed

• ci: publish to npm through trusted publishing by @egeominotti in #63
• chore(deps): apply the pending Dependabot updates and patch new advisories by @egeominotti in #64
• fix: support Bunqueue 2.9.20 and native Bun tooling (1.0.3) by @egeominotti in #76

Full Changelog: v1.0.2...v1.0.3