v2.23.0

What's New

• Docker image for ARM64. The published image now covers both linux/amd64 and linux/arm64. Apple Silicon and other ARM64 machines run it without emulation. docker pull leogra/oss-oopssec-store picks the right variant on its own. @kOaDT
• Changelog. A new CHANGELOG.md follows the Keep a Changelog format and summarizes every release from its GitHub release notes. @Iqranawaz-debug

Bug Fixes

• Add to cart from product cards. The "Add" button and the cart icon on product cards did nothing before. Both now add one unit of the product to the cart. Visitors who are signed out, or whose session has expired, go to the login page. The button is disabled and reads "Adding..." while the request runs. The shopper stays on the product grid and the header cart count updates in place. @prashantbhudwal @kOaDT
• SIEM login form accessibility. On the SIEM monitoring login, the Username and Password labels are now tied to their inputs. @MahishaKannan

Improvements

• Breach notice. The breach notice on the News page now ends with a nod to how the store hashes passwords. @kOaDT

Maintenance / Chore

• Docker CI on both architectures. The pull request check now builds and smoke-tests the image on amd64 and arm64 runners. The smoke test also loads the native modules (better-sqlite3, libxmljs2), because starting the app does not load them. A native binary that is broken on either architecture now fails CI. The check runs whenever a file read by the image build changes: root TypeScript and config files, content/, hall-of-fame/, the curriculum and the workflow itself. @kOaDT
• Docker publishing. Images are now published through docker/github-builder. Pull requests that change the publish workflow build both platforms without pushing. The workflow can also be run by hand to push a throwaway test-<run id> tag, which never moves latest. @kOaDT
• The Dockerfile decides what ships in the image. The published image is built from a Git context, and BuildKit does not apply .dockerignore to a Git context. So the Dockerfile now excludes docs/ (except the curriculum file the app imports), tests/, cypress/, .cursor/, .husky/ and the CLI package itself. A new unit test keeps these exclusions in step with .dockerignore, so local and published images ship the same files. @kOaDT
• Dependencies. The application's own dependencies are unchanged. Updated packages:
  • Docs site: eslint-plugin-astro 3.1.0 (major), Astro 7.3.8, satori 0.35.0, @shikijs/transformers 4.5.0, ESLint 10.12.0, typescript-eslint 8.71.1, plus patch updates.
  • create-oss-store CLI: chalk 6.0.0 (major) and degit 3.10.0.
  • CI: actions/setup-node 7.1.0 and actions/upload-artifact 7.0.2.