0.3.406

0.3.406

CI

Required status checks were unmergeable on pull requests — four of the five required workflows (fill-defaults, no-unknowns, pin-kinds, feature-keys) had pull_request path filters narrow enough that a pins-only PR never triggered them. The contexts were never reported, leaving PRs permanently stuck on "Expected - waiting for status to be reported". Since every installer release is a pins-only change, no release could ever be merged via pull request. Fix: path filters removed from all four workflows so required contexts always report on every PR.

Pins

nightly-review + nightly-review-crd bumped to 0.1.31 — fixes a bug where blueprint findings could never resolve to a destination. normalise_subject was folding "blueprint <name>" to "blueprint-<name>", but the registry was keyed on the bare "<name>", causing an unconditional lookup miss for every blueprint finding ever produced. Both spellings are now registered, so blueprint subjects resolve correctly.

0.3.405

0.3.405

Pins snowplow and snowplow-crd to 1.12.38.

Fixes carried in 1.12.38:

• apiRef reconcile broken on 1.12.3x (#504): Any CompositionDefinition with spec.apiRef set could not reconcile. core-provider calls GET /rbac before a composition instance exists; the dial guard correctly rejected the resulting malformed path, and the shared plan builder dropped the option entirely. The read-set now derives from the stage template rather than the collapsed render.

• /list?category= returning wrong kinds silently (#508): Every discovered GVR was built with no group and no version, so KindFor resolved by plural alone. When two CRDs shared a plural, the response carried the winner duplicated and the loser absent — at HTTP 200 with no error or log.

snowplow-crd moves in lockstep only; its packaged trees are byte-identical to 1.12.37 apart from Chart.yaml's version.

One file changed: chart/files/component-pins.yaml.

0.3.404

0.3.404

Pins snowplow and snowplow-crd to 1.12.37, carrying two unreleased security fixes:

• Secret data leaked into OpenTelemetry logs. The debug-level "resolved api" log emitted every stage body, including Secret values, into otel_logs. Now suppressed.
• Credentials leaked in spans and logs. URLs with embedded credentials were not scrubbed before being recorded in outbound client spans (url.full) or log fields. A schemeless URL bypassed the sanitiser entirely — url.Parse treated the leading token as the scheme, leaving no User field to clear, so passwords round-tripped verbatim.

Also included in 1.12.37 (no installer action required): re-mint warmth gating fix, live-refresh no longer dropping a quiet key's last change, and invalidation-to-fresh measurement.

One file changed: chart/files/component-pins.yaml.

0.3.403

0.3.403

Pins

• frontend 1.6.97, frontend-crd 1.6.97 — fixes a missing Krateo brand icon in charts started by the Controller Composer. Charts without an https icon are silently excluded from the Marketplace blueprints index, so every controller created via the Controller Composer was published to GHCR but never appeared as an installable tile in the Marketplace, and the Controller Builder hub's "Next step: Register" pointed at a tile that did not exist. controllerStart.ts now sets chart.icon to the brand logo, mirroring the fix applied to the Blueprint Composer in 1.6.96 (#454). frontend-crd is a lockstep version bump only — packaged content is byte-identical to 1.6.96.

0.3.402

Generated notes are unavailable for this release. Commits in this tag:

• pins: frontend + frontend-crd 1.6.96 — #455 composer exclusion fix

0.3.401

Generated notes are unavailable for this release. Commits in this tag:

• pins: core-provider 2.13.23 — the toolchain move

0.3.400

Generated notes are unavailable for this release. Commits in this tag:

• feat(pins): incident-controller 0.2.0, portal 1.8.67 and frontend 1.6.95, Run apply (#455)

0.3.399

Generated notes are unavailable for this release. Commits in this tag:

• pins: alert-provider 0.2.47 (supersedes 0.2.46), incident-agent 0.3.0

0.3.398

Generated notes are unavailable for this release. Commits in this tag:

• pins: batch roll — portal/frontend/autopilot/agents/alerts + core-provider 2.13.22
• pins: gcp-configconnector 0.1.2 (schema fix)

0.3.397

Generated notes are unavailable for this release. Commits in this tag:

• pins: gcp-configconnector 0.1.1
• feat: Google Config Connector as an installer component (features.configConnector)