v0.8.0 — サポート切れをAWS自身の日付で判定し、既知の脆弱性を台帳に並べる

End-of-life is now judged on AWS's own support schedule, known vulnerabilities appear next to it — for your libraries (from lockfiles) and for RDS engines — and the dashboard's EOL card links to what it counted. This release adds migration 0021 (applied by migrate, as in the setup steps).

Added

• Known vulnerabilities for your libraries. On Applications & Middleware,
  each environment can Import lockfile (requirements.txt,
  package-lock.json, composer.lock, Gemfile.lock, go.mod): the file is
  parsed in memory, the libraries are recorded, and the file is discarded.
  With VULN_REFRESH_ENABLED=true (off by default) a daily job — or
  manage.py refresh_vulns --force — looks them up on OSV.dev and flags those
  also in CISA's Known Exploited Vulnerabilities catalog. Each vulnerable
  library lists its advisories with severity, fixed versions and a link; the
  summary shows how many are high/critical or known exploited. Only
  (ecosystem, package, version) is sent. Hand-entered libraries are not
  checked, and an OSV outage keeps the previous result rather than showing
  "no vulnerabilities". Dependencies are now unique per version, so two
  copies of one package (nested node_modules) are both kept.
• Known vulnerabilities for RDS PostgreSQL and MySQL engines. The same
  VULN_REFRESH_ENABLED=true job looks each engine version up in NVD (only the
  product and version are sent; an optional NVD_API_KEY lifts NVD's rate
  limit, otherwise it takes about 7 seconds per version). An instance shows a
  badge in the resource list and a collapsible CVE list in its detail panel,
  with severity, a link to NVD and a "known exploited" mark. The result is for
  the upstream version, and the panel says AWS may already have fixed some of
  it inside RDS. Aurora is skipped, since its versions don't match upstream.
  The OSV and NVD lookups are independent: one being down keeps the other's
  results and the previous records.
• More plugin seams, so a separately distributed plugin app can add a
  sign-in option or routes without the core importing it: extra apps can be
  installed with SYNCVEY_EXTRA_APPS, and an AppConfig can contribute
  login_buttons(request) (shown on the sign-in page) and urls_module.

Changed

• RDS, Lambda and EKS are now judged against AWS's own support schedule,
  in stages, once EOL data has been fetched (EOL_REFRESH_ENABLED=true).
  What matters operationally is the day AWS stops supporting a version, not
  the upstream project's. An RDS PostgreSQL/MySQL version or EKS cluster
  past standard support is shown as extended support (paid) and counted
  as nearing end-of-life; it is past end-of-life only once extended
  support ends too. A Lambda runtime past its deprecation date is shown as
  deprecated, and past end-of-life once AWS blocks updates. The
  asset's detail panel lists both dates and names its basis. Aurora keeps
  the upstream approximation (it has its own schedule), as does anything
  not covered by the fetched data, and offline installs behave as before.
  For extended support the panel says it carries an additional charge and
  links to AWS's pricing page (amounts change, so none are shown); for a
  deprecated Lambda runtime it links to AWS's runtime support policy.

Fixed

• The dashboard's end-of-life card now links to what it counted. Since
  0.7.0 it counts RDS / Lambda / EKS resources as well as declared
  dependencies, but "Review runtimes" always opened the (often empty)
  applications screen. It now offers "Review resources (N)" — the asset list
  filtered to resources past or nearing end-of-life (?eol=1, with a banner
  and a way back) — and "Review dependencies (N)", each shown only when it
  has something to open.

Full changelog: v0.7.0...v0.8.0