v0.7.0

What's Changed

Breaking changes

• feat(import)!: one list of notes per dive, in a diver's words, with nothing a paired file already supplied by @aleskiontherun in #349
• feat(auth)!: a session asked for as extended idles out late, and a refresh retried inside a grace continues the session by @aleskiontherun in #358

Features

• feat(import): say which notes are about each dive row by @aleskiontherun in #346
• feat(import): put each dive's conversion findings on its row by @aleskiontherun in #347
• feat(import): keep conversion groups to findings on no dive row by @aleskiontherun in #348
• feat(contacts): a contact carries its position by @aleskiontherun in #350
• feat(dives): surface conditions fetched from Open-Meteo by the worker fill a dive's air temperature, weather and waves by @aleskiontherun in #356
• feat(dive-conditions): preview what the conditions worker would fill for a time and place by @aleskiontherun in #357
• feat(dives): a dive's fixes are the first of its files' that has one, and each file publishes its own by @aleskiontherun in #360
• feat(dives): a dive's fixes follow its files' attach order across recordings by @aleskiontherun in #361
• feat: an Idempotency-Key header makes a create safe to send twice by @aleskiontherun in #359
• feat: dive drafts, logged from either device by @aleskiontherun in #362
• feat(import): read Shearwater Cloud database and XML exports by @aleskiontherun in #368
• feat(openapi): the schema is served at /api/v1/openapi.json on every instance by @aleskiontherun in #371
• feat(auth): API keys for a diver's own tools by @aleskiontherun in #372
• feat(docs): Scalar renders /docs, and the schema declares a bearer header by @aleskiontherun in #373
• feat(dives): a profile stores, serves and exports the heart rate the computer measured by @aleskiontherun in #376
• feat(storage): the usage response counts files and the dives and certifications holding them by @aleskiontherun in #377
• feat(openapi): name the credentials each operation accepts by @aleskiontherun in #380

Fixes

• fix(import): list a line a dive's second file repeats once by @aleskiontherun in #352
• fix(deps): update dependency pillow to v13 [security] by @renovate[bot] in #353
• fix(recordings): a shared serial and a start within tolerance settle two files of one dive by @aleskiontherun in #367
• fix(deps): dnspython 2.9.0 by @aleskiontherun in #370
• fix(config): APP_NAME defaults to OpenDiving by @aleskiontherun in #374
• fix: harden token revocation, request and import bounds, and background jobs by @aleskiontherun in #383

Other changes

• build: upgrade Python to 3.15 by @aleskiontherun in #354
• docs: the iOS app is in development, not parked, and the part-for-day rule has a third copy by @aleskiontherun in #355
• test: mint fix-order rows' storage keys per write by @aleskiontherun in #363
• chore(deps): divejson 0.34.0 by @aleskiontherun in #369
• chore(deps): update astral-sh/setup-uv action to v10.3.3 by @renovate[bot] in #364
• chore(deps): update axllent/mailpit docker tag to v1.32 by @renovate[bot] in #365
• chore(deps): update docker/login-action action to v4.7.0 by @renovate[bot] in #366
• chore(renovate): rebase only on conflict by @aleskiontherun in #378
• chore(deps): lock file maintenance by @renovate[bot] in #375
• docs(routes): operation descriptions are written for a caller by @aleskiontherun in #379
• docs(openapi): describe every query parameter and request body field by @aleskiontherun in #381
• docs(openapi): title the document "{APP_NAME} API" by @aleskiontherun in #382
• chore(release): v0.7.0 by @opendiving-release-bot[bot] in #384

Full Changelog: v0.6.0...v0.7.0

v0.6.0

What's Changed

Breaking changes

• feat(species)!: a species' registry entries travel as external_ids, and the import matches on the worms entry by @aleskiontherun in #295
• fix(api)!: answer a gear-service list filter naming nothing of the caller's with an empty page by @aleskiontherun in #323
• fix(api)!: refuse non-finite floats and out-of-range integers on write schemas by @aleskiontherun in #331

Features

• feat(gear): a tank links its cylinder, a gear item carries its vessel's facts and dive time, and a service rule can run on hours by @aleskiontherun in #294
• feat(gear): backplate and wing join the gear vocabulary, and the UDDF export places them by @aleskiontherun in #296
• feat(dives): a sighting carries an abundance band beside its count by @aleskiontherun in #298
• feat(tags): every account starts with a few common tags by @aleskiontherun in #297
• feat(auth): a member's invite link admits whoever follows it, as that member's invitation by @aleskiontherun in #299
• feat(tags): cave and ice join the default tags by @aleskiontherun in #300

Fixes

• fix(auth): account email columns take every address EmailStr admits by @aleskiontherun in #303
• fix: an outside service failing no longer fails the action it follows by @aleskiontherun in #304
• fix: a name differing only in whitespace is a duplicate, not a 500 by @aleskiontherun in #305
• fix: a dive or trip write commits once, so a failed child leaves nothing behind by @aleskiontherun in #308
• fix: five small runtime bugs from the audit by @aleskiontherun in #309
• fix(api): refuse whitespace-only course and certification names by @aleskiontherun in #312
• fix(import): link the caller's own records before any skip, and clear a restored card's files by @aleskiontherun in #315
• fix(export): write a certification's agency pair as the format admits it, and read a broken stored pair by @aleskiontherun in #316
• fix: fill a recording's device and settings member by member across its files by @aleskiontherun in #317
• fix(config): list every setting in the template, and keep the remaining secrets in SecretStr by @aleskiontherun in #320
• fix(scripts): log at INFO whatever LOG_LEVEL says, and share the cache session by @aleskiontherun in #321
• fix(config): keep the Postgres and Redis passwords, and the DSNs that embed them, in SecretStr by @aleskiontherun in #325
• fix(auth): bound sign-in code guesses under concurrency, and spend per-IP limits before per-address ones by @aleskiontherun in #326
• fix(api): release the read transaction before the parse decode and the geocoder call by @aleskiontherun in #327
• fix(dives): keep a merged recording's samples when its files change by @aleskiontherun in #329
• fix(config): match CORS on the frontend's origin, and keep the DSNs derived and out of errors by @aleskiontherun in #330
• fix(auth): find an account by its address case-insensitively at sign-in by @aleskiontherun in #328
• fix(auth): answer double submits on token, link, passkey and quota writes instead of a 500 by @aleskiontherun in #332
• fix(dives): end a folded dive on the later record's tank pressure and readouts by @aleskiontherun in #334
• fix(api): write courses, dive sites and gear sets in one transaction by @aleskiontherun in #335
• fix(export): drop every code point XML 1.0 forbids from UDDF, and read file ids with their metadata by @aleskiontherun in #333
• fix(api): answer a name taken mid-request with the duplicate 422 by @aleskiontherun in #339
• fix: keep serving when the blob store fails a listing, a sweep delete or a map tile by @aleskiontherun in #336
• fix(pictures): render a crop at its frame's size, and strip a card image's metadata by @aleskiontherun in #337
• fix(import): restore a deleted dive's own files, trim names, and report only what was written by @aleskiontherun in #341
• fix(api): read a blank stored boat name, and share the contacts lookup by @aleskiontherun in #340
• fix(import): strip an imported card image's metadata as an upload's is by @aleskiontherun in #342
• fix(dives): exit a folded dive where the later record did, and backfill earlier folds by @aleskiontherun in #343

Other changes

• test: a quota test's docstring says invitations made by @aleskiontherun in #301
• ci: the published-image scan uploads one SARIF run by @aleskiontherun in #302
• chore(deps): update astral-sh/setup-uv action to v10.3.0 by @renovate[bot] in #293
• build: keep the test packages out of the shipped image by @aleskiontherun in #306
• chore: delete the first-superuser script by @aleskiontherun in #307
• docs: correct DECISIONS.md, AGENTS.md and code comments that contradict the code by @aleskiontherun in #310
• refactor: remove code nothing calls by @aleskiontherun in #311
• refactor(api): one capped fetch, slot claim and answer cache for provider calls by @aleskiontherun in #314
• refactor: one registry of blob-key columns for the sweeper, purge and volume check by @aleskiontherun in #313
• refactor(api): one set of helpers for binary responses, 304s and uncacheable 404s by @aleskiontherun in #318
• refactor(worker): log through a module logger and share one purge body by @aleskiontherun in #319
• refactor(api): return the created row, share the picker-lookup dispatch, and tidy route conventions by @aleskiontherun in #322
• test: one shared FakeRedis and one async_sessions fixture by @aleskiontherun in #324
• test: hold FakeRedis to real Redis's refusals, and import the worker and scripts from the runtime image by @aleskiontherun in #338
• chore(release): v0.6.0 by @opendiving-release-bot[bot] in #344

Full Changelog: v0.5.0...v0.6.0

v0.5.0

What's Changed

Breaking changes

• feat(dives)!: profile temperatures are stored, served and exported in hundredths of a degree by @aleskiontherun in #290
• feat(dives)!: a dive's time in the water is submerged_time, on the row, the wire, the parse and the export by @aleskiontherun in #291

Features

• feat(dives): the dive list carries each dive's tags by @aleskiontherun in #284
• feat(dive-form): the import section is a hideable dive form key by @aleskiontherun in #285
• feat(dive-form): the account remembers its preset, Technical has a set of its own, and "All" is reserved by @aleskiontherun in #286
• feat(species): every life-list row carries its dive site count by @aleskiontherun in #287
• feat(dives): the profile read says where the dive ends, and the card outline stops there by @aleskiontherun in #289

Fixes

• fix(profiles): a FIT file's channels fill after a recording's other files by @aleskiontherun in #288

Other changes

• chore(release): v0.5.0 by @opendiving-release-bot[bot] in #292

Full Changelog: v0.4.0...v0.5.0

v0.4.0

What's Changed

Breaking changes

• feat(location)!: a place is one object with one pair of names by @aleskiontherun in #213
• feat(export)!: the check-in details are core Diver members, and an import applies them as edited in the preview by @aleskiontherun in #214
• feat(dives)!: the profile axis is milliseconds, and a recording carries its readouts and its salinity by @aleskiontherun in #219
• feat(dives)!: a dive may carry only its date by @aleskiontherun in #220
• feat(contacts)!: contacts are records, and training centers become them by @aleskiontherun in #222
• feat(people)!: people are records on dives, trips and courses, and an instructor is one by @aleskiontherun in #228
• feat(dives)!: a sighting carries a count and a note by @aleskiontherun in #231
• feat(files)!: dive-computer files are stored compressed, and uploads stop at a per-user storage limit by @aleskiontherun in #233
• feat(dives)!: the dive form and profile extraction read through divejson, and a profile is reproducible by reader version by @aleskiontherun in #235
• feat(geocoding)!: place search through Photon, named by the place itself by @aleskiontherun in #240
• feat(places)!: a place is named through its region, and the export writes its name alone by @aleskiontherun in #245
• feat(places)!: a place has one name, and full_name leaves the wire and the mapper by @aleskiontherun in #250
• feat(maps)!: map tiles are stored once for every account, in place of per-record pictures by @aleskiontherun in #268
• feat(user)!: check-in details are their own object, with an email and lists of contacts and policies by @aleskiontherun in #275
• feat(export)!: the diver carries no handle, in DiveJSON or as a UDDF owner's name by @aleskiontherun in #280

Features

• feat(user): a portrait beside the avatar, and both keep their originals by @aleskiontherun in #215
• feat(export): the portrait's original travels in DiveJSON, and an import offers it in the preview by @aleskiontherun in #218
• feat(email): renewal reminders and a year in review by @aleskiontherun in #224
• feat(checkin): a link a dive shop opens by @aleskiontherun in #226
• feat(auth): join links admit by channel, and daily totals of accounts and sign-ins by @aleskiontherun in #234
• feat(dives): a dive carries its rating, tags, type, conditions, entry type and boat name by @aleskiontherun in #237
• feat(import): an import takes many files at once, pairs one recording's exports and keeps the originals by @aleskiontherun in #241
• feat(trips): a trip read counts its dives, their dive sites and their species by @aleskiontherun in #242
• feat(dives): each GET /dives row carries its depth outline by @aleskiontherun in #249
• feat(trips): a trip read carries its deepest dive's max_depth by @aleskiontherun in #254
• feat(sites): a dive site carries its other names, external ids, depth range, water type, altitude, entry types and tags, and counts its dives by @aleskiontherun in #256
• feat(maps): dive and trip map pictures, drawn on first view and stored by @aleskiontherun in #253
• feat(import): number imported dives as the dive form would by @aleskiontherun in #259
• feat(dives): a parsed file returns the rest of the dive it states by @aleskiontherun in #261
• feat(import): a Subsurface site arrives with its pin, its notes and its locality by @aleskiontherun in #263
• feat(species): the caller's figures for one species, sites included by @aleskiontherun in #264
• feat(import): a Suunto pair attaches its JSON first, and an Ocean exit is the fix its receiver vouched for by @aleskiontherun in #265
• feat(sites): a dive site names its map picture, drawn as a one-site dive by @aleskiontherun in #266
• feat(pickers): thin lookup rows per resource, ordered by last use by @aleskiontherun in #270
• feat(pickers): lookup rows carry what the dive form fills in by @aleskiontherun in #271
• feat(trips): a trip's dives with its candidates, their counts, and a bulk add by @aleskiontherun in #272
• feat(dives): each dive list row carries its recording count by @aleskiontherun in #273
• feat(dives): the cylinder volumes a diver used most recently by @aleskiontherun in #274
• feat(species): suggest species to the diver, their sites' first, then their own, then the catalog by @aleskiontherun in #276
• feat(admin): curate species photos — list the catalog, hide or pin a photo, refuse narrow sources by @aleskiontherun in #278
• feat(dives): a dive's figures are its time in the water, from the reader, the merge and a backfill of the untouched ones by @aleskiontherun in #279
• feat(trips): GET /user/trip-places lists every place the caller's trips went by @aleskiontherun in #281
• feat(users): dive-stats counts the diver's dive sites and names their first and last dive days by @aleskiontherun in #282

Fixes

• fix(email): settings links land on the section that holds the control by @aleskiontherun in #227
• fix(dives): a second computer's channel matching an unlabelled cylinder gives it a label by @aleskiontherun in #236
• fix(dives): a second computer's gas attribution is mapped onto the dive's labels with its channels by @aleskiontherun in #244
• fix(deps): urllib3 2.8.0 for CVE-2026-97687 and CVE-2026-97689 by @aleskiontherun in #246
• fix(dives): a recording's cylinder values fill the dive's blank cylinders it pairs with, on every ordinal by @aleskiontherun in #248
• fix(migrations): merge the dive-site and map-picture heads by @aleskiontherun in #257
• fix(import): a file lands with the bottom temperature and cylinders the dive form shows by @aleskiontherun in #260
• fix(import): a derived value's note is information, and yields at the note cap by @aleskiontherun in #262

Other changes

• refactor(user): the avatar's old columns go by @aleskiontherun in #216
• test: the note-code docstring states no count by @aleskiontherun in #217
• refactor(support): the contact form posts to /support by @aleskiontherun in #221
• refactor(contacts): the deploy-skew shim comes out by @aleskiontherun in #223
• chore(worker): arm the renewal and year-in-review crons by @aleskiontherun in #225
• docs(decisions): the export loader reads no payload by @aleskiontherun in #229
• refactor(people): the deploy-skew shim comes out by @aleskiontherun in #230
• chore(deps): update docker/build-push-action action to v7.4.0 by @renovate[bot] in #211
• chore(deps): update docker/setup-buildx-action action to v4.4.1 by @renovate[bot] in #212
• chore(deps): update astral-sh/setup-uv action to v10.2.0 by @renovate[bot] in #232
• docs(export): the DiveJSON export's docstring says the tags are the diver's by @aleskiontherun in #238
• docs(presets): DiveFormField order is canonical, not the client's form order by @aleskiontherun in #239
• docs: correct stale catalogue-filter, pagination-cap and item-cache TTL claims by @...

v0.3.0

What's Changed

Breaking changes

• feat(export)!: the DiveJSON export and import spell a dive's and a certification's number as number by @aleskiontherun in #200
• feat(courses)!: a course need not name an agency by @aleskiontherun in #201
• refactor!: create bodies stop declaring user_uuid by @aleskiontherun in #203
• feat(trips)!: a trip is a sequence of dated parts by @aleskiontherun in #206
• feat(export)!: DiveJSON trips carry their parts by @aleskiontherun in #207
• refactor(trips)!: the deploy-skew shim comes out by @aleskiontherun in #209

Features

• feat(courses): GET /courses filters by date window, agency and status by @aleskiontherun in #204
• feat(user): the check-in details a dive shop asks for by @aleskiontherun in #205

Fixes

• fix(api): serve the whole OpenAPI info block, and the real version by @aleskiontherun in #195

Other changes

• chore(deps): update axllent/mailpit docker tag to v1.31 by @renovate[bot] in #191
• chore(deps): update actions/download-artifact action to v8 by @renovate[bot] in #192
• chore(deps): update astral-sh/setup-uv action to v10 by @renovate[bot] in #193
• chore(deps): lock file maintenance by @renovate[bot] in #194
• chore(api): lay out the DiveJSON export a member and a record to a line by @aleskiontherun in #196
• docs: set a bar for DECISIONS.md entries by @aleskiontherun in #197
• docs: compact DECISIONS.md to the entry bar by @aleskiontherun in #198
• docs: DECISIONS.md titles state the rule, not the change by @aleskiontherun in #199
• refactor: list routes take no user_uuid, and a create body's user_uuid is ignored by @aleskiontherun in #202
• docs: prose names the consumer, not a plan node by @aleskiontherun in #208
• chore(release): v0.3.0 by @opendiving-release-bot[bot] in #210

Full Changelog: v0.2.0...v0.3.0

v0.2.0

What's Changed

Features

• feat(dive-form): the Recreational preset hides water type by @aleskiontherun in #186
• feat(dive-form): the Basic preset hides trip and bottom temperature by @aleskiontherun in #187
• feat(release): publish the component release instead of drafting it by @aleskiontherun in #189

Fixes

• fix(deps): update dependency httpx2 to v2.12.0 [security] by @renovate[bot] in #169
• fix(config): the placeholder refusal names a file operators have, and the CVE note stops promising alerts by @aleskiontherun in #185

Other changes

• chore: after the flip by @aleskiontherun in #183
• docs(decisions): src.scripts runs in the shipped image, and the S3 refusal names a file operators have by @aleskiontherun in #184
• ci: the PR labelling step survives a GitHub API flap by @aleskiontherun in #188
• chore(release): v0.2.0 by @opendiving-release-bot[bot] in #190

New Contributors

• @renovate[bot] made their first contribution in #169
• @opendiving-release-bot[bot] made their first contribution in #190

Full Changelog: v0.1.0...v0.2.0

v0.1.0

The first component release of the OpenDiving API — the FastAPI backend behind
opendiving/opendiving v0.1.0. Published as
ghcr.io/opendiving/opendiving-api:0.1.0 for linux/amd64 and linux/arm64.

This image is not installed on its own. The product release is
opendiving/opendiving v0.1.0,
which ships the compose file and the install script that run it alongside opendiving-web at the
same version. Versions move in lockstep across all three repositories.

Breaking

None — there is no earlier release to upgrade from. The ! markers across this repository's
history record changes made before any version existed, so they describe how the initial contract
was arrived at rather than anything an operator has to act on. example.env in the product
release is the authoritative statement of what this version expects.