Skip to content

v0.5.0 — new identity, real CI, and the bugs that found

Choose a tag to compare

View all tags
@harshitwandhare harshitwandhare released this 14 Aug 23:51
· 25 commits to main since this release
v0.5.0
f6fa324
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Turning security gates on is what made this release worth cutting. Three of the fixes below were live vulnerabilities nothing was looking for.

Try it: https://atlas-ra.vercel.app

The site was loading no fonts at all

tailwind.config.ts referenced --font-sans, but nothing defined it and body never applied font-sans. Every page had been rendering in the browser's default serif. It read as a deliberate editorial choice in screenshots; it was unstyled default.

New visual identity

IBM Plex Sans for text, Space Grotesk for display, IBM Plex Mono for code and event badges — self-hosted through next/font. An indigo signal colour on cool blue-black, with a dot-matrix backdrop.

Emerald is demoted to exactly one job: the semantic done / approved / verified state. Brand and success were previously the same green, so "this is ATLAS" and "this task passed" looked identical — on a dashboard about verification state, that was the wrong signal.

A real pipeline

Was: two jobs, floating action tags, no permissions block, one Python version, no dependency or secret scanning.

Now: lint + format, mypy --strict, tests on 3.10/3.11/3.12, evals, gitleaks over full history, pip-audit, licence check, npm audit, tsc --noEmit, and build. CodeQL and OpenSSF Scorecard weekly, plus a security heartbeat every third day. Actions pinned by commit SHA, with Dependabot watching them.

What the gates found

  • cryptography 49.0.0 carried PYSEC-2026-3552 → 50.0.0.
  • Next.js 14.2.35 carried a high-severity Image Optimizer DoS advisory → 15.5.23. The app uses no next/image and no async request APIs, so the migration surface was empty.
  • brace-expansion, fast-uri, glob, nanoid, js-yaml, postcss, and sharp all sat inside advisory ranges.
  • 15 backend files were unformatted.
  • The API reported version 0.1.0 while the package was 0.4.1.

Also fixed

  • The hero event stream sliced its step list, so the card grew as steps appeared and shoved the page down. Steps now stay mounted and fade in, reserving full height from first paint.
  • The preview notice claimed atlas serve would switch the hosted page to real data. Browsers block an https origin from calling http://localhost, and the API allows only http://localhost:3000 as a CORS origin — it never could.
  • The README architecture diagram rendered as a sprawl of crossing edges. Replaced with the task lifecycle, verified against mermaid 11 before committing.

Full changelog: https://github.com/harshitwandhare/atlas-ra/blob/main/CHANGELOG.md

Assets 2
Loading