v2026.10.20.1

Changes

• deps-dev: bump the development-dependencies group with 2 updates (#62)
• docker: bump node from 26.11.1-alpine to 26.12.0-alpine (#61)

Full diff: v2026.10.13.1...v2026.10.20.1

Verified at release

• Rollout: ksvc/www-skylar-technology reached Ready
• GET https://www.skylar.technology/health -> 200, reported version 2026.10.20.1, matching the build this run stamped
• GET https://www.skylar.technology/ -> 200
• Checked at 2026-10-20T23:28:50Z by run 39515219944

Image: ghcr.io/klaushofrichter/www-skylar-technology:v2026.10.20.1

v2026.10.13.1

Changes

• deps-dev: bump the development-dependencies group with 2 updates (#59)
• deps: bump express (#58)
• docker: bump node from 26.10.0-alpine to 26.11.1-alpine (#57)
• Give the e2e job a 15-minute timeout (#56)
• Clear the Unreleased notes published in v2026.10.07.1

Full diff: v2026.10.07.1...v2026.10.13.1

Verified at release

• Rollout: ksvc/www-skylar-technology reached Ready
• GET https://www.skylar.technology/health -> 200, reported version 2026.10.13.1, matching the build this run stamped
• GET https://www.skylar.technology/ -> 200
• Checked at 2026-10-13T20:24:23Z by run 38462463844

Image: ghcr.io/klaushofrichter/www-skylar-technology:v2026.10.13.1

v2026.10.07.1

• Updated proxy-addr (used by Express) from 2.0.7 to 2.0.8 for
  GHSA-jqcg-44mw-7w3h, a critical IP-spoofing advisory published
  2026-10-05. This site was not exposed: the flaw needs trust proxy
  configured with an IPv6-mapped subnet, and the app sets no trust proxy
  and never reads req.ip. The update clears the audit gate, which the
  advisory had turned red on main.

Changes

• deps-dev: bump the development-dependencies group across 1 directory with 2 updates (#54)
• Update proxy-addr to 2.0.8 for GHSA-jqcg-44mw-7w3h (#53)
• deps-dev: bump the development-dependencies group with 2 updates (#51)
• Clear the Unreleased notes published in v2026.10.03.1

Full diff: v2026.10.03.1...v2026.10.07.1

Verified at release

• Rollout: ksvc/www-skylar-technology reached Ready
• GET https://www.skylar.technology/health -> 200, reported version 2026.10.07.1, matching the build this run stamped
• GET https://www.skylar.technology/ -> 200
• Checked at 2026-10-08T02:10:42Z by run 37716533229

Image: ghcr.io/klaushofrichter/www-skylar-technology:v2026.10.07.1

v2026.10.03.1

• Simplified the build and deploy tooling without changing what ships. The
  changelog logic the release step runs now lives in scripts/ with unit
  tests, instead of inline in the deploy where only a real release exercised
  it. The deploy's scratch files, including a clone holding a deploy token,
  now live in the runner's per-job temp directory rather than /tmp, which
  outlived failed runs. Also: one shared Node setup instead of three copies,
  Playwright starts its own test server, and a new release no longer
  invalidates the image's dependency layers.

Changes

• Simplify build and deploy tooling without changing what ships (#49)
• Clear the Unreleased notes published in v2026.10.02.1

Full diff: v2026.10.02.1...v2026.10.03.1

Verified at release

• Rollout: ksvc/www-skylar-technology reached Ready
• GET https://www.skylar.technology/health -> 200, reported version 2026.10.03.1, matching the build this run stamped
• GET https://www.skylar.technology/ -> 200
• Checked at 2026-10-04T01:24:50Z by run 37167905089

Image: ghcr.io/klaushofrichter/www-skylar-technology:v2026.10.03.1

v2026.10.02.1

• The server now shuts down when asked. In the container, node runs as
  process 1, which ignores any signal it has no handler for — so on every
  deploy the old pod ignored Kubernetes' stop signal, sat out the full
  300-second grace period, and was then force-killed. It now closes its
  connections and exits on SIGTERM; measured, a container stop went from the
  whole grace period to under a second.
• The browser test now checks that the legal pages' "back" link actually leads
  home. It previously clicked onward without looking, and since every page
  shares the same footer, a broken back link would still have passed.

Changes

• Shut down on SIGTERM, and make the e2e back-link check real (#47)
• Clear the Unreleased notes published in v2026.09.29.1

Full diff: v2026.09.29.1...v2026.10.02.1

Verified at release

• Rollout: ksvc/www-skylar-technology reached Ready
• GET https://www.skylar.technology/health -> 200, reported version 2026.10.02.1, matching the build this run stamped
• GET https://www.skylar.technology/ -> 200
• Checked at 2026-10-02T18:21:30Z by run 37046815561

Image: ghcr.io/klaushofrichter/www-skylar-technology:v2026.10.02.1

v2026.09.29.1

• Builds of main now publish only :main. They used to push :latest and
  :<sha> too, the same tags the production deploy writes, so :latest
  meant whichever workflow ran last, and a main build of a released commit
  could replace the image the cluster pins. The deploy is now the only writer
  of :<sha>, :v<version> and :latest, so :latest is always the release.

Changes

• deps-dev: bump the development-dependencies group with 2 updates (#45)
• Have main builds publish only :main, leaving release tags to the deploy (#44)
• Clear the Unreleased notes published in v2026.09.23.3

Full diff: v2026.09.23.3...v2026.09.29.1

Verified at release

• Rollout: ksvc/www-skylar-technology reached Ready
• GET https://www.skylar.technology/health -> 200, reported version 2026.09.29.1, matching the build this run stamped
• GET https://www.skylar.technology/ -> 200
• Checked at 2026-09-29T16:23:52Z by run 36597327233

Image: ghcr.io/klaushofrichter/www-skylar-technology:v2026.09.29.1

v2026.09.23.3

• The container now declares its user as 1000:1000 instead of node — the
  same user, written as a number, so the image is verifiably non-root on its
  own. Prepares for kube-setup's container security policy (requirement 7):
  the app was confirmed to run with every capability dropped, privilege
  escalation blocked and the default seccomp filter applied.

Changes

• Declare the container user numerically for kube-setup requirement 7 (#42)
• deps-dev: bump the development-dependencies group with 2 updates (#41)
• Clear the Unreleased notes published in v2026.09.23.2

Full diff: v2026.09.23.2...v2026.09.23.3

Verified at release

• Rollout: ksvc/www-skylar-technology reached Ready
• GET https://www.skylar.technology/health -> 200, reported version 2026.09.23.3, matching the build this run stamped
• GET https://www.skylar.technology/ -> 200
• Checked at 2026-09-23T18:01:47Z by run 35899579660

Image: ghcr.io/klaushofrichter/www-skylar-technology:v2026.09.23.3

v2026.09.23.2

• Node is now pinned to an exact release (26.10.0) in both Dockerfile stages,
  instead of the floating node:26-alpine. The floating tag let every build
  pick up whatever Node 26 was newest that day — v26.8.2 became v26.10.0 in
  v2026.09.23.1 without appearing in any change. A new Node release now arrives
  as a Dependabot PR, and CI reads the version from the Dockerfile, so that PR
  is tested on exactly the Node it will ship.

Changes

• Pin Node to an exact release and have CI read it from the Dockerfile (#39)

Full diff: v2026.09.23.1...v2026.09.23.2

Verified at release

• Rollout: ksvc/www-skylar-technology reached Ready
• GET https://www.skylar.technology/health -> 200, reported version 2026.09.23.2, matching the build this run stamped
• GET https://www.skylar.technology/ -> 200
• Checked at 2026-09-23T15:37:23Z by run 35882805696

Image: ghcr.io/klaushofrichter/www-skylar-technology:v2026.09.23.2

v2026.09.23.1

Changes

• deps-dev: bump the development-dependencies group with 2 updates (#37)
• deps: bump compression in the production-dependencies group (#36)

Full diff: v2026.09.14.1...v2026.09.23.1

Verified at release

• Rollout: ksvc/www-skylar-technology reached Ready
• GET https://www.skylar.technology/health -> 200, reported version 2026.09.23.1, matching the build this run stamped
• GET https://www.skylar.technology/ -> 200
• Checked at 2026-09-23T15:03:29Z by run 35878654964

Image: ghcr.io/klaushofrichter/www-skylar-technology:v2026.09.23.1

v2026.09.14.1

Changes

• deps-dev: bump the development-dependencies group with 2 updates (#34)
• Clear the Unreleased notes published in v2026.09.12.2

Full diff: v2026.09.12.2...v2026.09.14.1

Verified at release

• Rollout: ksvc/www-skylar-technology reached Ready
• GET https://www.skylar.technology/health -> 200, reported version 2026.09.14.1, matching the build this run stamped
• GET https://www.skylar.technology/ -> 200
• Checked at 2026-09-14T17:30:29Z by run 34875101120

Image: ghcr.io/klaushofrichter/www-skylar-technology:v2026.09.14.1