v0.0.5-alpha

Since the last release the platform has grown substantially toward a beta-ready collaborative Explore experience. The main user-facing addition is a structured Explore data catalog: detail pages for core reference objects (hospitals, indications and indication groups, infections, dispatch areas, states, secondary transports), a classification glossary, orientation maps, coverage-year heatmaps with hospital privacy, and stable public UUIDs for catalog resources. Supporting work includes a redesigned footer and navigation, XML sitemap and robots.txt, an operational control-center dashboard, Remember Me login, password-strength feedback, and clearer German terminology (“Zuweisungen”). Under the hood, translations were split into feature domains, console commands were standardized, EasyAdmin was upgraded to v5, and architecture ADRs plus Deptrac (report-only with baseline) were introduced to lock in the target bounded-context design.

In parallel, the release hardens the product for safer multi-centre use. A focused security track (SEC-001–SEC-020) addresses registration enumeration, XSS and CSV formula injection, rate limiting, import path containment and permission re-checks, export fail-closed behaviour, session cookies, Live Component auth, and related controls, with matching regression tests. Test architecture and CI were strengthened (PHPUnit suite boundaries, broader coverage uploads via Codecov, Deptrac cleanup), documentation was reorganized into numbered guides and operations runbooks, and dependencies were kept current positioning the codebase for the beta release.

What's Changed

Features

• feat(admin): operational control center dashboard and extended entity coverage (#261) by @nplhse in #296
• feat(explore): Cache explore filter reference data to reduce per-request database load by @nplhse in #300
• feat(import): allow administrators to download original import source files by @nplhse in #301
• feat: live password strength feedback by @nplhse in #314
• feat(allocation): replace explore detail integer IDs with UUID v4 public IDs by @nplhse in #316
• feat: Add Content-Security-Policy report-only mode for production by @nplhse in #321
• feat: Redesign site footer with structured navigation and deployment metadata by @nplhse in #322
• feat(shared): add permission-aware application sitemap page by @nplhse in #323
• feat(architecture): introduce Deptrac report-only with baseline by @nplhse in #336
• feat: Improve the Sitemap and add a robots.txt by @nplhse in #359
• feat: Improve Explore page by embedding a useful data catalog by @nplhse in #393
• feat: Polish the explore catalog by @nplhse in #395

Bugfixes

• fix: stop import-generated Assessment entries from polluting the audit log (#288) by @nplhse in #291
• fix: Reject Excel uploads in the import workflow by @nplhse in #295
• fix(admin): align EasyAdmin CRUD lifecycle signatures with EA 5 by @nplhse in #297
• fix(allocation): eager-load relations on allocation detail page (#269) by @nplhse in #299
• bugfix: Monthly reminder uses the same reporting period as the month users are asked to upload by @nplhse in #311
• bugfix: Fix monthly reminder SMTP rate limiting and add delivery tracking (#302)` by @nplhse in #312
• bugfix: Fix filter persistence, add indications, and speed up the filter drawer by @nplhse in #313
• bugfix: Localize predefined Analysis Library system views by @nplhse in #315
• fix(translations): update German translations to use "Zuweisungen" instead of "Allokationen" by @nplhse in #358
• fix(security): close SEC-020 regression gaps by @nplhse in #392
• fix: Finally making the RememberMe Badge work during login by @nplhse in #394

Security

• security: Prevent Registration username/email Enumeration (SEC-001) by @nplhse in #371
• security: sanitize blog index preview HTML (SEC-002) by @nplhse in #372
• security: neutralize CSV formula injection in exports (SEC-003) by @nplhse in #373
• security: require auth for Live Component mount path (SEC-004) by @nplhse in #374
• security: Explore list rate limit by @nplhse in #376
• security: Add rate limiters for Register, Reset, Import, and Exports by @nplhse in #377
• security: persist audit entry for import source downloads by @nplhse in #378
• security: Validate favorite Toggle referer redirect by @nplhse in #380
• security: Contain ImportFileStorage Paths under Imports BaseDir by @nplhse in #379
• security: Require ROLE_PARTICIPANT for /import via access_control by @nplhse in #381
• security: Slim public /health JSON payload by @nplhse in #383
• security: Disable media upload directory indexes by @nplhse in #384
• Security: Pin explicit session cookie settings by @nplhse in #388
• security: Resolve login failure username from form field by @nplhse in #387
• security: Re-check Import permissions in Worker by @nplhse in #390
• security: Fail closed on empty export hospital intersection by @nplhse in #391

Chore

• chore(deps): fix Dependabot Composer updates and tune schedule (#267) by @nplhse in #273
• chore(deps-dev): bump prettier from 3.9.1 to 3.9.4 in the eslint group by @dependabot[bot] in #274
• chore(deps): raise PHP minimum to 8.4.3 for Dependabot resolution (#267) by @nplhse in #276
• chore(deps-dev): bump friendsofphp/php-cs-fixer from 3.95.10 to 3.95.11 by @dependabot[bot] in #285
• chore(deps-dev): bump phpstan/phpstan-phpunit from 2.0.16 to 2.0.17 by @dependabot[bot] in #284
• chore(deps-dev): bump phpstan/phpstan from 2.2.2 to 2.2.3 by @dependabot[bot] in #283
• chore(deps): bump phpdocumentor/reflection-docblock from 5.6.7 to 6.0.3 by @dependabot[bot] in #281
• chore(deps-dev): bump vincentlanglet/twig-cs-fixer from 3.14.0 to 4.0.2 by @dependabot[bot] in #280
• chore(deps): bump the symfony group across 1 directory with 22 updates by @dependabot[bot] in #286
• chore(admin): migrate EasyAdmin 4.29 to 5.1 by @nplhse in #289
• chore(deps): bump symfony/ux-twig-component from 2.36.0 to 3.2.0 in the symfony group by @dependabot[bot] in #306
• chore(deps-dev): bump phpstan/phpstan-phpunit from 2.0.17 to 2.0.18 by @dependabot[bot] in #310
• chore(deps): bump twig/twig from 3.27.1 to 3.28.0 by @dependabot[bot] in #309
• chore(deps): Group PHPStan and Psalm Dependabot updates by @nplhse in #317
• chore(deps-dev): bump rector/rector from 2.5.2 to 2.5.3 by @dependabot[bot] in #308
• chore(deps): bump phpstan/phpdoc-parser from 2.3.2 to 2.3.3 in the phpstan group by @dependabot[bot] in #318
• chore(deps-dev): bump prettier from 3.9.4 to 3.9.5 in the eslint group by @dependabot[bot] in #319
• chore(deps-dev): bump friendsofphp/php-cs-fixer from 3.95.11 to 3.95.13 by @dependabot[bot] in #320
• chore(deps): bump the symfony group with 5 updates by @dependabot[bot] in #328
• chore(deps): bump actions/setup-node from 6 to 7 by @dependabot[bot] in #327
• chore(deps-dev): bump friendsofphp/php-cs-fixer from 3.95.13 to 3.95.15 by @dependabot[bot] in #333
• chore(deps-dev): bump eslint from 10.6.0 to 10.7.0 in the eslint group by @dependabot[bot] in #326
• chore(deps-dev): bump rector/rector from 2.5.3 to 2.5.7 by @dependabot[bot] in #330
• chore(deps-dev): bump phpstan/phpstan-doctrine from 2.0.27 to 2.0.28 in the phpstan group by @dependabot[bot] in #329
• chore(deps): bump sentry/sentry-symfony from 5.10.0 to 5.11.0 by @dependabot[bot] in #331
• chore(deps-dev): bump brace-expansion from 5.0.6 to 5.0.7 by @dependabot[bot] in #334
• chore: Removed some obsolete Deptrac baseline rules by @nplhse in #341
• chore: Collect and upload PCOV coverage from unit and database CI jobs by @nplhse in #346
• chore: fail CI when PHPUnit suite directories drift by @nplhse in #348
• chore: upload unit and integration coverage in one Codecov step by @nplhse in #349
• chore(deps): bump easycorp/easyadmin-bundle from 5.1.0 to 5.3.0 by @dependabot[bot] in #357
• chore(deps-dev): bump friendsofphp/php-cs-fixer from 3.95.15 to 3.95.17 by @dependabot[bot] in #356
• chore(deps-dev): bump deptrac/deptrac from 4.7.0 to 4.7.1 by @dependabot[bot] in #355
• chore(deps-dev): bump zenstruck/foundry from 2.10.1 to 2.10.3 by @dependabot[bot] in #354
• chore(deps-dev): bump the eslint group with 2 updates by @dependabot[bot] in #352
• chore(deps): bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #351
• chore(deps): bump actions/download-artifact from 4 to 8 by @dependabot[bot] in #350

Refactoring

• refactor: Create dedicated ImportFileStorage service to centralize logic by @nplhse in #275
• refactor(console): clean up and harmonize Symfony console commands by @nplhse in #277
• refactor(i18n): split translations into bounded-context domains by @nplhse in #278
• refactor(architecture): decouple non-Admin contexts from Admin UI controllers by @nplhse in #337
• refactor(feedback): move admin feedback mail out of Shared TransactionalMailer by @nplhse in #338
• refactor(shared): remove Content and Allocation feature leaks from Shared by @nplhse in #339
• refactor(allocation): extract AllocationBucketQuery from repository by @nplhse in #340

Tests

• Testing/improve login smoke tests by @nplhse in #298
• test: Complete PHPUnit named suites and document test architecture by @nplhse in #342
• test: Prefer stubs over mocks for return-only collaborators in unit tests by @nplhse in #343
• test: Split oversized PHPUnit classes by behaviour by @nplhse in #344
• test: Cover hospital permission mask and voter deny paths by @nplhse in #345
• test(import): cover reject and invalid-input paths by @nplhse in #347
• test(allocation): Cover explore list access and filter edges by @nplhse in #360
• test(onboarding): cover complete failure and already-done paths by @nplhse in #361
• test(statistics): cover projection rebuild invariants by @nplhse in #362
• test(content): split PageImageContentAnalyzerTest by content type by @nplhse in #363
• Test/split dashboard controller tests by @nplhse in #364
• test(content): split PageContentValidatorTest by rule groups by @nplhse in #365
• test(allocation): split AllocationBucketQueryTest by query variants by @nplhse in #366
• test(allocation): split ListAllocationsControllerTest by behaviour by @nplhse in #367
• test: Isolate Import fixtures from shared Uploads dir by @nplhse in #382

Docs

• docs: restructure documentation into numbered information architecture by @nplhse in #290
• docs(architecture): add and accept ADRs 007–010 for beta-architecture by @nplhse in #335
• docs: add PR checklist bullet for test doubles by @nplhse in #368
• docs: Remove Test Architecture Audit by @nplhse in #369
• docs: clarify Deptrac introduction and architecture review context by @nplhse in #370
• docs: Accept collaborative Explore, require PARTICIPANT for allocation detail view by @nplhse in #375
• docs: Accept CSP report-only for beta by @nplhse in #385
• docs(security): align permission model with ImportVoter (SEC-017) by @nplhse in #389

Full Changelog: v0.0.4-alpha...v0.0.5-alpha