v1.0.0rc1

This first release candidate of 1.0.0 lets owners invite users to their
services by link and limits how many services each user may register. It is
a prerelease, for testing the release before 1.0.0. Deployments of 0.6.0 keep
their data, but the new limit applies right away, registrations and
updates with organization fields other than name and url are rejected,
and overlays that restrict owners or give the policies as a list must add or
remove the new rules of invitations: read the upgrade
steps
first. See the
documentation for
details.

Breaking changes

• Access control: users other than admins may register at most 50 services
  each (custom.access_control.max_services_per_user; null for no limit);
  further registrations return 409 Conflict with the code
  services-limit. The app adds who registered the services stored before
  (their only user owner) on startup and counts them (new collection
  service_counts): check how many services your users registered, and
  raise the limit in the same rollout if needed. Services that admins
  registered before the upgrade count for the admin, unless reset as
  described in the upgrade steps. Restart the app once after the rollout,
  so that changes by 0.6.0 pods during the rollout are counted (#124, #286;
  #290, #292)
• Access control: the base config has three new policy rules,
  owners-manage-invitations, owners-revoke-invitations and
  accept-invitations. Overlays that give policies as a list must add
  them, or the invitation endpoints return 403 Forbidden. Overlays that
  stopped owners from granting roles by removing or restricting
  owners-change-permissions must also set owners-manage-invitations and
  owners-revoke-invitations to null; the app warns on startup if owners
  can create invitations, but no rule lets them grant roles to users (#101,
  #274; #290, #292)
• API: registrations and updates reject organization fields other than
  name and url (400 Bad Request), so services can no longer store and
  serve unbounded data: clients that send further fields must drop them.
  Stored services with such fields are still served, and the app warns of
  them on startup; the upgrade steps show how to clean them up (#311, #314)

Features

• Invitations: owners (and admins) invite users to their services by link,
  for the role owner or maintainer
  (POST /services/{serviceId}/invitations), list and revoke them; the
  invited user accepts with the token (POST /invitations/accept), which
  grants the role to their own identifier. Invitations are single-use,
  expire after custom.access_control.invitations.expiry_days (default: 7,
  at most 3650), are limited per service (max_per_service, default: 20),
  stored as token hashes only (new collection invitations), and those of
  owners only grant their role while their creator is still an owner
  (those of admins don't depend on the admin role) (#101, #274;
  #290, #292)
• Services per user: a limit on the services each user may register, served
  in the service info's registration rules (#124, #286)
• Helm chart: cloudRegistry.replicas sets the number of the app's pods,
  and with more than one, a PodDisruptionBudget
  (cloudRegistry.podDisruptionBudget) lets node drains evict one at a
  time; the chart requires foca-common 0.3.0 (#307, #310)

Security

• Image: the app's dependencies are installed from uv.lock, with hash
  checks, and Dependabot updates the lock (ecosystem uv instead of pip)
  (#125, #278)
• Image: the build backend (setuptools, setuptools-scm) is installed with
  hash checks too, in a separate build stage (#282, #289)
• Invitations: the email address of a user who accepted an invitation is
  stored and shown only if the identity provider marks it as verified
  (email_verified) (#290, #292)
• Image: the build context excludes local .env* files, also inside
  cloud_registry/ (#312, #315)
• Release: the publish job checks the name and SHA-256 of the packaged
  chart before it attests, signs and releases it, and attests and signs
  exactly that file (#295, #296)
• CI: the job that pushes the dev images installs setuptools-scm from the
  lock, with hash checks, instead of an unpinned version (#288, #305)
• Image: the scans accept the advisories CVE-2026-97688, CVE-2026-59890
  and GHSA-xmj3-9gf7-h52w of the urllib3 and setuptools copies that pip
  vendors, until 2027-01-31: pip only runs at build time, the app uses the
  installed urllib3 2.8.0, and the image installs no setuptools (#325,
  #326)

Fixes

• The migration to namespaced subjects
  (python -m cloud_registry.namespace_subjects) also namespaces the
  creators and acceptors of invitations, so that open invitations of owners
  stay valid (#290, #292)
• Very large custom.access_control.invitations.expiry_days are refused on
  startup, instead of failing every invitation with 500 (#290, #292)
• /service-info reports max_unused_service_types: 0 in the controlled
  mode of service types (#313, #316)
• The default documentationUrl in /service-info points at the
  documentation (https://cloud-registry.readthedocs.io/) instead of the
  repository (#327, #328)
• Helm chart: the default image is fully qualified
  (docker.io/elixircloud/cloud-registry), like MongoDB's, so that
  container runtimes that refuse short names (e.g., CRI-O, Podman) pull it;
  adapt image allow-lists, admission policies and mirror rules that match
  the short name elixircloud/cloud-registry (#320, #321)

Documentation

• Upgrade steps from 0.6.0: invitations, the services limit, services that
  admins registered, and restarting after the rollout; access control:
  stopping owners from granting roles also by invitation, revoking the open
  invitations of members who leave an owner group; operations: the log lines
  of invitations and the services limit; API reference of the newer modules
  (#290, #292)
• API: only operations with path, query or header parameters reject extra
  query parameters; upgrade steps: how to clean up stored services with
  extra organization fields (#311, #314; #313, #316)
• Configuration and access control: an example of entitlement-style groups
  (#318, #319)
• Chart README: the upgrade steps to 1.0.0rc1 (#320, #321)
• Upgrade steps from 0.6.0: the fully qualified default image of the Helm
  chart; stored services: services whose organization lacks name or url
  fail responses, also of the whole list, and how to find and fix them;
  configuration: no identity provider named, and max_unused_service_types: 0 lets users other than admins add no types at all (#323, #324)
• README: the new logo, with a variant for dark mode (#297, #298)
• API docs: "Cloud Components" instead of the deprecated "ELIXIR Cloud
  Components" (#302, #304)
• Contributing: links the organization's contributing guide instead of
  repeating it, and no longer overrides it on GitHub (#301, #309)

Maintenance

• CI uses the organization's shared actions for image scans and the gate
  job, pinned by commit to .github v1.0.0 (#270, #271, #283; #285, #287)
• CI: the lint, test, chart and docs jobs install the locked dependencies
  (uv sync --locked), so that Dependabot's updates of uv.lock are
  tested (#291, #306)
• CI: a PR title job checks the titles of pull requests, under the
  CI passed gate (#303, #308)
• CI: the test of the chart check runs it with the options of GitHub's
  default shell (#299, #300)

Commits

• feat: invite users to services by link by @uniqueg in #274
• build: install locked, hash-checked dependencies by @uniqueg in #278
• ci: use the shared scan-image and gate actions by @uniqueg in #283
• feat: limit services per user by @uniqueg in #286
• ci: pin the shared actions to v1.0.0 by @uniqueg in #287
• build: hash-check the build backend in the image by @uniqueg in #289
• fix: address rc1 pre-release review findings by @uniqueg in #292
• chore: prepare release 1.0.0rc1 by @uniqueg in #294
• ci: check chart artifact before signing by @uniqueg in #296
• docs: replace the README logo by @uniqueg in #298
• ci: fix chart check test shell and comment by @uniqueg in #300
• build(deps): bump the github-actions group across 1 directory with 2 updates by @dependabot[bot] in #284
• build(deps): bump the pre-commit group across 1 directory with 2 updates by @dependabot[bot] in #280
• docs: drop the deprecated ELIXIR Cloud name by @uniqueg in #304
• ci: install locked setuptools-scm in push job by @uniqueg in #305
• ci: run the checks on the locked dependencies by @uniqueg in #306
• docs: stop overriding the org contributing guide by @uniqueg in #309
• ci: check PR titles under the gate by @uniqueg in #308
• fix: reject extra fields in organizations by @uniqueg in #314
• fix: exclude .env files from the build context by @uniqueg in #315
• fix: align service info and query parameter docs by @uniqueg in #316
• docs: add entitlement-style groups example by @uniqueg in #319
• docs: finalize the 1.0.0rc1 release docs by @uniqueg in #321
• docs: fix final review lows for 1.0.0rc1 by @uniqueg in #324
• feat(chart): set the number of app replicas by @uniqueg in #310
• fix: accept pip's vendored urllib3/setuptools by @uniqueg in #326
• fix: point the default docs URL at the docs by @uniqueg in #328

Full Changelog: v0.6.0...v1.0.0rc1