Skip to content

v0.5.0 — host-wake hardening & security

Choose a tag to compare

View all tags
@jozer-rami jozer-rami released this 24 Jul 15:22
v0.5.0
06ccb70
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v0.5.0

Promotes the dev integration branch to main and out to production. 71 non-merge commits since v0.4.0 (28 fix · 8 feat · 12 test · 10 ci · 7 docs · 4 chore · 1 refactor).

Highlights

Host lifecycle & wake hardening

  • Bounded stateless wake, session continuity, and bundle cleanup; per-host reconciliation priority and wake-admission fixes.
  • Fenced recovery-triggered Host delete against recreation (TOCTOU); scoped wake authorization preserved across held operations.
  • Egress proxy: raised proxy_ssl_verify_depth so cross-signed root chains verify.

Security

  • Patched Next.js vulnerabilities across the UI applications.
  • SHA-pinned first-party GitHub Actions; tightened build/publish token scope to least-privilege.

Member registration

  • Restored the member-registration revoke migration; fixed TSV and migration-script upsert paths.

Registry & Publisher UX

  • Publisher default-on; hide the Publisher UI on OSS/self-hosted; publish imageRef identity fix; install Server-name Kubernetes default.

Setup & developer experience

  • minikube setup rebuilds the DB by default; admin-password gate before full local setup; full-setup SIGPIPE fix; GFS allowed-contexts fix.

Licensing

  • MPL-2.0 relicense finalized.

CI & tooling

  • @claude on-demand responder (Sonnet + Opus 4.8); phase-3 pre-merge parity gates ported to public CI with leak guards; PR-merge Telegram notifications; dispatch built-image list.

Docs

  • README redesign; LLM providers overview in the README.

Deploy

Production runs the exact image digests validated on dev at release time (per-service): control-ui, control-api/host-context-controller/rpc-proxy/workflow-recipes, profile-ui, and the channel-reader/external-rest-api/mcp-host/mcp-proxy/webhook-proxy group.

Full changelog: v0.4.0...v0.5.0

Assets 8
Loading