1.9

Changelog

Features

• feat(admin): mask vault tokens in API responses and preserve across updates
• feat(i18n): translate remaining hardcoded admin panel strings
• feat(web): add expiry timeline component showing upcoming certificate expirations (#111)
• feat(web): make certificate table column headers sortable (#110)
• feat(web): redesign admin panel to match main dashboard visual language (#100)
• feat: webhook alerting for certificate expiry (#99)

Bug fixes

• fix(admin): key login rate limit by trust_proxy ClientIP (#66)
• fix(admin): log when admin routes are not registered (#64)
• fix(admin): treat masked vault token placeholders as blank (#65)
• fix(backend): Track B hardening (admin, middleware, vault, metrics, docs) (#54)
• fix(backend): enforce configured-mount allowlist on GetIntermediateCA (#73)
• fix(backend): never pair wildcard CORS origin with credentials (#74)
• fix(build): migrate minimum release age config to pnpm-workspace.yaml
• fix(metrics): warn when per_certificate metrics are enabled (#67)
• fix(middleware): gate X-Forwarded-* on trust_proxy config (#63)
• fix(ui): single-column CA passport and equal-height status buttons
• fix(web): Track A remainder (expiry toast, modal races, sonner, shell extract, admin tests) (#49)
• fix(web): activate role=button rows and cards on Space key
• fix(web): add aria-label to certificate search input
• fix(web): correct CSV formula-injection test for RFC-wrapped cells
• fix(web): drop role=img from interactive Donut so segment buttons reach AT
• fix(web): guarantee non-empty aria-label on clickable cert rows and cards
• fix(web): guard formatDate/formatTime against invalid date strings
• fix(web): handle clipboard copy failures on insecure contexts
• fix(web): ignore stale certificate list responses (#58)
• fix(web): refresh public config thresholds on each load (#59)
• fix(web): restore two-column layout and add accessible title to issuer view
• fix(web): simplify footer layout and remove unused theme tokens (#70)
• fix(web): surface admin logout and mutation API errors (#60)
• fix(web): surface cert load failures in refresh toast (#57)
• fix(web): sync to the active i18n language
• fix(web): treat unparseable cert expiry as expired (#61)
• fix(web): use /api/config expiration thresholds in dashboard (#48)
• fix: repoint lint:css at the real frontend CSS tree (#76)

Performance

• perf(web): debounce URL state writes during typing
• perf(web): precompute CommandPalette search haystack once per cert list (#77)
• perf(web): skip background polls while the tab is hidden

Refactoring

• refactor(web): debounce cert search filtering and reuse counts (#62)
• refactor(web): move status badge inline with certificate name in table and cards
• refactor(web): progressively disclose certificate and issuer details
• refactor(web): replace chevron icons with explicit Details text in certificate rows and cards
• refactor(web): simplify certificate dashboard around triage

Other

• Feat/app skills (#107)
• Fix/web reliability (#109)