v0.4.0 — Safer unattended operation

v0.4.0 — Safer unattended operation

This release consolidates the audit improvements delivered in the v0.4.0 cycle.

Upgrade notes

• Direct invocations must set SYNC_MODE explicitly to rolling, prospective, or full_history. The supplied Compose configuration already sets rolling.
• HTTP Ghostfolio origins remain supported for the Docker Compose default http://ghostfolio:3333, but the connector now emits a clear warning before credentials can travel over HTTP. Use HTTPS or a trusted isolated network.
• In CRON mode, the image now includes a local liveness healthcheck for the scheduler process. It only detects that the scheduler has disappeared; it does not prove a scheduled run completed or send an alert. Use restart: unless-stopped as documented.

Security and reliability

• Docker build downloads now require HTTPS (including redirects) and TLS 1.2 or newer, while retaining the existing SHA256 verification.
• The Python dependency hash-lock approach was evaluated and documented. It is intentionally not enabled until a reviewed, multi-architecture wheel-only lock is available.
• The user documentation, troubleshooting guidance, recovery material, and architectural decision records now describe the supported DEGIRO scope and its operational tradeoffs.

No financial write behavior changed in this release.

What's Changed

Features

• feat: add local scheduled process healthcheck by @flowcool in #58

Fixes

• fix: require explicit DEGIRO synchronization mode by @flowcool in #55
• fix: warn before cleartext Ghostfolio credential transport by @flowcool in #56

Documentation

• docs: clarify supported DEGIRO scope and setup by @flowcool in #53
• docs: record DEGIRO credential API and matching trade-offs by @flowcool in #54

Maintenance and dependencies

• build: restrict artifact downloads and evaluate Python hash locking by @flowcool in #57

Full Changelog: v0.3.0...v0.4.0