v0.7.0

0.7.0 (2026-10-04)

Features

• api: certificate overview summary endpoints per org and across orgs (52c76d0)
• audit: HMAC-signed head anchor detects tail truncation (e7ecda5)
• auth: optional setup token, API key maximum lifetime and per-user cap, clear response when setup commits but sign-in fails (869d6ff)
• backup: audit a failed on-demand backup (236c9ae)
• cfctl: warn on stderr when the bearer token would go over cleartext http (b00b7c4)
• db: prune old issuance attempts and hook runs, with supporting indexes (ca680e6)
• monitor: go unreachable only after two consecutive failed checks (80c9cde)
• notify: retry deliveries with capped exponential backoff over about five hours (74e789e)
• notify: signed timestamp and V2 webhook signature alongside the existing one (cdbae80)
• sites: show how many clients a site delete detaches (196d40e)
• web: default the audit range to 30 days while searching; keep a populated list on a failed refresh (0d58b99)
• web: setup token field in the wizard and API key policy in the create sheet (d16105a)

Bug Fixes

• acme: clamp Retry-After to 24h and guard duration overflow (03cbe06)
• acme: report a cancelled context when the CA reply races the cancellation (c05d1b4)
• acme: wrap the underlying error alongside the cancellation (da57f5d)
• agent: answer ACME challenges while a reconcile is running (5cee4d4)
• agent: create new parent directories 0755 again, keep the stale temp sweep (966636f)
• agent: guard agent state shared between heartbeats, renewals and reconciles (b81b1c2)
• agenthub: bound each OnMessage call well under the idle timeout (7e0d59c)
• agent: install a grant's files all-or-nothing and tolerate hooks without a command (7282970)
• agent: let an in-flight reconcile finish when the session drops (f93b1d8)
• agent: private parent dirs for secret files and sweep stale temp siblings (cfa805a)
• agent: raise the agent websocket read limit to 8 MiB (8eb536c)
• agent: reject a non-https agent URL at enrolment and identity load (dd2becf)
• agents: a failed settings reload serves the stale value for a full TTL (964250c)
• agents: consume the enrolment token before loading CA material (ff67fc9)
• api: apply the SSRF URL policy to DNS credential URL fields (8019c94)
• api: apply the URL policy to an ACME CA directoryUrl (94df9fc)
• api: block org delete on channels and monitors; audit and warn about clients detached by a site delete (99a6f44)
• api: cache the readyz database ping and KEK canary for a few seconds (c059205)
• api: cap agent REST bodies at agentproto.MaxMessage (db4eb24)
• api: check the CRL issuer serial before unsealing and bound the CRL cache (195b7e8)
• api: document 400 on the attempts list now that it takes a query parameter (98a3ce8)
• api: extend the import read deadline only after authentication and authorization (6393b1a)
• api: extend the read deadline for the certificate import upload (2f54141)
• api: fixed detail for an unrecorded vault revocation, no database text (d1cc9fd)
• api: grandfather a vault-kv target's path only while its mount is unchanged too (8363046)
• api: hide the Vault settings address from principals without settings write (e058ecd)
• api: leave imported off a failed import preview (12e1a4f)
• api: make the overview needs_look flag NULL-safe and sort urgent rows before manual-DNS extras (727a4d5)
• api: raise the agent websocket read limit to 8 MiB (ebaa7a7)
• api: refuse deleting a certificate that a monitor expects, and show the reason in the bulk delete toast (77a97da)
• api: report the certificates created before an import failed (540c54e)
• api: require keys:export for agent grants that deliver a private key (26e9f31)
• api: require keys:export to make an in-use layout key-bearing (2ff38d1)
• api: return the signer's safe detail in the CA 502 and log the wrapped error (7c06dc7)
• api: show the Vault address in key status only to settings writers (410f2aa)
• api: withhold other users' OIDC details from callers without global users:read (1146299)
• audit: bind the anchor bootstrap to the chain with an anchor_initialized event (45514a0)
• auth: audit only the first rate-limited hit per client per window; rate-limit OIDC start and setup (dac3791)
• auth: cap argon2 parameters read from a stored hash and rehash on login when they differ (442d7f3)
• authn: require https for OIDC issuers outside loopback (b657dc4)
• auth: password rehash on login is a compare-and-swap so it cannot undo a concurrent reset (8adb2d4)
• backup: fsync scheduled archives and their directory, and prune orphaned tmp files (495df11)
• backup: keep a corrupt chunk during a table load reported as tampering (ae17411)
• backup: report a restore into a populated database as an audit conflict, not tampering (c95e6fd)
• backup: spool each table to a private temp file instead of buffering it in memory (c01e0b3)
• backup: spool in the OS temp dir by default with CF_BACKUP_SPOOL_DIR, memory fallback and a lock that protects live spools from the sweep (43f24c6)
• backup: write the backup file via CreateTemp and fsync file and directory (4ee1ed1)
• cfctl: guard the 202 JSON bodies against a non-JSON response (58086fe)
• cfctl: report a non-JSON success response instead of dereferencing nil (b72658b)
• challenge: check host and address credential fields against the SSRF policy (51e2c69)
• challenge: drop stored credential keys a provider schema update retired (468d82a)
• challenge: EDNS0 and TCP retry on truncated TXT propagation answers; alias keys keep stored secrets on update (2e69d77)
• challenge: report a failed step after releasing the router lock (c7bd65c)
• challenge: resolve credential hostnames and refuse blocked or metadata targets (f52b1bb)
• config: reject credentials, query and fragment in the base URL; read CF_SETUP_TOKEN[_FILE] (fb73f82)
• delivery: redeploy server grants when their deploy target is edited (c733b3a)
• deploy: lock vault-kv targets in the rename check, certificate before target everywhere (b5e78f2)
• deploy: publish e2e service ports on loopback only (b526957)
• deploy: refuse colliding vault-kv server grant paths and confine org targets to their own prefix (ed6fa30)
• deploy: reject duplicate vault-kv key names and layout file collisions (b792a78)
• deploy: require the org prefix as literal text at the start of a vault-kv path template (5b11dc4)
• httpx: honour Retry-After on 429 and unwrap NAT64/6to4 addresses before classifying (e4c35c6)
• httpx: return the 429 error when Retry-After outlasts the deadline (2851a5f)
• importer: count all inflated tar.gz bytes against the cap (02c0a8d)
• importer: keep foo_ecc beside foo and detect layouts a few directories deep (0a113c9)
• issuance: atomic rate ledger reservation under a per-CA advisory lock (0576ca2)
• issuance: audit certificates already imported when a later entry fails (da0f4ca)
• issuance: climb the CAA lookup to the TLD per RFC 8659 (9e9a548)
• issuance: drop expired leaves from the CRL and prune them on revoke (d9285cf)
• issuance: grandfather mustStaple only when the effective CA is unchanged (ee31c0e)
• issuance: grandfather unchanged over-cap rule and resolver lists on update (3b9721d)
• issuance: hide and prune expired manual DNS pending records (0e6a210)
• issuance: keep an expired certificate expired when a renewal fails (6a2c4bd)
• issuance: keep an issuance counted when storing it fails (468cf30)
• issuance: keep enqueueing due certificates when housekeeping fails (6c0daea)
• issuance: keep housekeeping from ever stopping renewals (24ff570)
• issuance: lock a vault PKI CA's mount and role while it is in use (ae3c0ea)
• issuance: record a vault revocation on a detached, bounded context (7cd66a8)
• issuance: refuse a duplicate ACME account email before registering at the CA (10d4607)
• issuance: refuse a not-yet-valid or older uploaded version unless allowOlder (0f30ea4)
• issuance: refuse deleting a private CA that has live issued versions (d8290ae)
• issuance: refuse mustStaple with a private CA and document the B2, B16 and B18 rules (3653d11)
• issuance: revoke a vaultpki version without holding locks across the Vault call (df10d26)
• issuance: validate per-rule resolvers and cap rules at 50 and resolvers at 10 on write (d336f21)
• issuance: validate the name of an uploaded certificate like a created one (9794909)
• jobs: give long-running workers explicit timeouts instead of river's 1-minute default (7b4c74f)
• localca: allow a self-signed certificate only at the top of an imported bundle (669206d)
• localca: refuse to issue under an expired or nearly expired issuing certificate (81c765b)
• localca: verify imported chains, floor key and signature strength, reject expired roots, unique issuing CN, accept EC PARAMETERS keys (a5e2948)
• metrics: log a failed refresh and serve the last snapshot until the cache TTL passes (27b23ba)
• monitor: a queued check for a deleted or disabled monitor is dropped, not retried (be2a881)
• monitor: compare the failure counter in the transition compare-and-set (4caf2bb)
• monitor: emit the event in the same transaction as the state transition (e2e8d85)
• monitor: enforce the per-org cap under a row lock so concurrent creates cannot exceed it (e9e4891)
• monitor: guard the per-org cap with an advisory lock instead of locking the org row (c53b782)
• monitor: reset the failure counter when a monitor is enabled or disabled (2d2235e)
• monitor: say expired for an expired leaf in the event summary and the state chip (da1e53d)
• notify: a failing SMTP QUIT after accepted delivery is logged, not a send failure (08dc795)
• notify: allowlist the detail keys monitor events actually carry (f5c4a3f)
• notify: do not keep outbound connections alive for per-send clients (2348024)
• notify: skip already delivered deliveries and retry the delivered mark, not the send (b3a8b8f)
• oidc: single-flight discovery with a brief failure cache; dotted groups claim path (9e877f3)
• render: keep JKS trust aliases from overwriting the key entry (04918e2)
• second review pass, hardening, performance and Go 1.25 (f1be399)
• security: zero the reused key bytes after the ACME parse and the backup restore keys after use (fefcdc0)
• settings: lock the section row for a PUT so the audit before and secret merge see one state (3aa0383)
• settings: probe the backup directory with a unique temp file instead of a fixed name (c8ab5fd)
• vault: log renewal-loop login and renew failures at warn level (df7a321)
• vault: refuse cross-host redirects (b3197a3)
• vault: validate the PKI role and escape every request path segment (10a55e7)
• web: accept trailing-dot hosts and zoned IPv6 in resolvers (b2095f4)
• web: accept underscores in DNS labels; correct IP name help wording (433f8d7)
• web: anchor the audit search default range to the chosen end date (c302b93)
• web: block a second submit while a certificate wizard, upload or site rename is in flight (6f0281a)
• web: block navigation while a new API key is unacknowledged (387f29e)
• web: cap the rendered lines of the attempt log (f0d6dcb)
• web: compare the settled config for CA sheet dirtiness (477c14d)
• web: drop on a chosen file, stretched-link cards, stale test result, tab filters, defaults invalidation, e2e CSP binding and forbidOnly (f08a843)
• web: drop settings save variables from the mutation cache (fd8f7c3)
• web: drop the saved settings body from the mutation state after a save (7e9cbcb)
• web: drop unknown event kinds from the URL filter instead of the whole array (9ac95a5)
• web: Escape on a flow node clears the path even when its tooltip handled the key (3f793e1)
• web: explain the disabled Save on a removed grant (f7e9255)
• web: explain why the alert sheets are read-only with a notice and hints (0d83489)
• web: flow connectors skip no-op updates; Escape in inputs and popovers keeps the path (4dd6990)
• web: focusable table rows for onRowOpen, aria-current instead of aria-selected (7995c6a)
• web: HelpTip opens a focusable popover for Learn more and labels itself (15ca90e)
• web: issuance defaults warn on reload only while a draft is unsaved (b945a66)
• web: keep chip and next-check tooltips hoverable above the card's stretched title (1d8116a)
• web: keep populated access, activity and attempt lists on a failed refresh; share the url text hook (28a028b)
• web: keep populated channel and monitor lists on a failed refetch (94bbccd)
• web: keep the grant sheet open with a removed notice when the grant disappears (1f71a8a)
• web: let a stored secret with minLength be removed (92b0fb7)
• web: let issuance number fields be cleared and range-check them inline (dfdd6b2)
• web: list every server audit action and resource type (8b1dc76)
• web: make alert sheets read-only without write access, keep port text while typing, reject duplicate headers (2417df0)
• web: make issuance defaults read-only without write access, guard every scope change, and block Save on invalid numbers (0f32625)
• web: match the whole word name when mapping CA errors to the Name field (731f2fd)
• web: merge the channel type hints so the build passes (33a1e79)
• web: offer audit.anchor_initialized in the audit action filter (8275513)
• web: offer only ACME CAs when registering an account (572fd1c)
• web: open a private CA from the keyboard on its focused row (97a4da5)
• web: open audit events on Enter and keep useOrgSlugOf stable (8c72634)
• web: open-only tables open on row click, guarding inner controls and text selection (59c8536)
• web: overview stale-poll notice, skip revoked in horizon, per-row renew/check, range presets (0e032df)
• web: poll monitors and refetch versions when a renewal lands (5d7f231)
• web: prune picked API key permissions that a scope change makes ungrantable (4322bbf)
• web: read only the tail of the audit export to check its last line (0fc54f8)
• web: read-only issuance defaults for viewers and confirm before discarding a draft (f0345c5)
• web: refetch edit seed, keep populated lists on a failed refetch, partial import and CA load errors (2d97bbb)
• web: replace history when a not-found target view is dropped (04e4e83)
• web: reset the secret field to Stored after Discard or Save (4b1f542)
• web: run one backup at a time and clear the command palette search on close (bab51e7)
• web: safe ConfirmDestructive; only leave settings when the deleted org is in the route (3b89b22)
• web: set aria-selected only on tables with a selection (4740f14)
• web: show a dash with a tooltip for layout and target without delivery read (10ea484)
• web: small form and combobox fixes (double submit, group keys, step keys, tabbable hint, argv focus, paste at caret) (b838a62)
• web: tail an attempt's log until the fetched attempt finishes (79d05c6)
• web: toast each attention row's Check and Renew result from its own promise (f77cc8c)
• web: track in-flight Check, Renew and redeploy per row (8cb8ede)
• web: validate resolver host:port and bracketed IPv6 with a port range (b6f9e06)
• web: wire setup wizard errors, focus each step and hint at https (4069a39)
• whole-codebase review findings (b30e3de)

Performance Improvements

• agents: a steady-state heartbeat reads without locks and skips the write transaction (640c0d6)
• agents: decrypt a cert key only when its grant uses it and open each target's secrets once per call (6eb2e2b)
• api: keep stored secret names in a column so listing targets and channels does not decrypt (301914f)
• api: omit attempt logs from the attempts list and load them per attempt (79d19f0)
• audit: index-friendly actor joins, bounded q search, trim audit indexes (17a14db)
• authn: throttle API key last-used writes to once a minute per key (cb4430c)
• flow: build the flow map in one read-only repeatable-read transaction (9cfb135)
• flow: read the certificate page and org defaults in the snapshot transaction (479f907)
• issuance: ARI poll reads the leaf with the due query, caches defaults, CAs and signers per run, and batches retry bumps (9678c6d)
• issuance: CAA check reads resolv.conf once, caches labels, looks names up in parallel (f4fd22b)
• notify: EmitBatch for the scans with per-event savepoints, and one InsertMany for the monitor scan (b0e8fca)
• sql: migration 00018 indexes, containment array lookups, batched DNS credential usage, SQL-side binding and key filters (803ed78)
• web: fetch the certificate picker list once instead of polling it (75b8f86)
• web: lazy-load settings sections and skip cloning upload bodies for the CSRF retry (c264142)
• web: memoize bindings table data and resolve subjects through maps (2ddc94c)
• web: Overview reads the summary endpoint and the palette searches server-side (512c063)
• web: poll infinite queries only while one page is loaded (8aff8af)
• webui: 404 missing static files, gzip the UI, keep source maps out of the binary (7763c13)