v0.6.0

What's Changed

Breaking changes

• feat(species)!: a species' registry entries travel as external_ids, and the import matches on the worms entry by @aleskiontherun in #295
• fix(api)!: answer a gear-service list filter naming nothing of the caller's with an empty page by @aleskiontherun in #323
• fix(api)!: refuse non-finite floats and out-of-range integers on write schemas by @aleskiontherun in #331

Features

• feat(gear): a tank links its cylinder, a gear item carries its vessel's facts and dive time, and a service rule can run on hours by @aleskiontherun in #294
• feat(gear): backplate and wing join the gear vocabulary, and the UDDF export places them by @aleskiontherun in #296
• feat(dives): a sighting carries an abundance band beside its count by @aleskiontherun in #298
• feat(tags): every account starts with a few common tags by @aleskiontherun in #297
• feat(auth): a member's invite link admits whoever follows it, as that member's invitation by @aleskiontherun in #299
• feat(tags): cave and ice join the default tags by @aleskiontherun in #300

Fixes

• fix(auth): account email columns take every address EmailStr admits by @aleskiontherun in #303
• fix: an outside service failing no longer fails the action it follows by @aleskiontherun in #304
• fix: a name differing only in whitespace is a duplicate, not a 500 by @aleskiontherun in #305
• fix: a dive or trip write commits once, so a failed child leaves nothing behind by @aleskiontherun in #308
• fix: five small runtime bugs from the audit by @aleskiontherun in #309
• fix(api): refuse whitespace-only course and certification names by @aleskiontherun in #312
• fix(import): link the caller's own records before any skip, and clear a restored card's files by @aleskiontherun in #315
• fix(export): write a certification's agency pair as the format admits it, and read a broken stored pair by @aleskiontherun in #316
• fix: fill a recording's device and settings member by member across its files by @aleskiontherun in #317
• fix(config): list every setting in the template, and keep the remaining secrets in SecretStr by @aleskiontherun in #320
• fix(scripts): log at INFO whatever LOG_LEVEL says, and share the cache session by @aleskiontherun in #321
• fix(config): keep the Postgres and Redis passwords, and the DSNs that embed them, in SecretStr by @aleskiontherun in #325
• fix(auth): bound sign-in code guesses under concurrency, and spend per-IP limits before per-address ones by @aleskiontherun in #326
• fix(api): release the read transaction before the parse decode and the geocoder call by @aleskiontherun in #327
• fix(dives): keep a merged recording's samples when its files change by @aleskiontherun in #329
• fix(config): match CORS on the frontend's origin, and keep the DSNs derived and out of errors by @aleskiontherun in #330
• fix(auth): find an account by its address case-insensitively at sign-in by @aleskiontherun in #328
• fix(auth): answer double submits on token, link, passkey and quota writes instead of a 500 by @aleskiontherun in #332
• fix(dives): end a folded dive on the later record's tank pressure and readouts by @aleskiontherun in #334
• fix(api): write courses, dive sites and gear sets in one transaction by @aleskiontherun in #335
• fix(export): drop every code point XML 1.0 forbids from UDDF, and read file ids with their metadata by @aleskiontherun in #333
• fix(api): answer a name taken mid-request with the duplicate 422 by @aleskiontherun in #339
• fix: keep serving when the blob store fails a listing, a sweep delete or a map tile by @aleskiontherun in #336
• fix(pictures): render a crop at its frame's size, and strip a card image's metadata by @aleskiontherun in #337
• fix(import): restore a deleted dive's own files, trim names, and report only what was written by @aleskiontherun in #341
• fix(api): read a blank stored boat name, and share the contacts lookup by @aleskiontherun in #340
• fix(import): strip an imported card image's metadata as an upload's is by @aleskiontherun in #342
• fix(dives): exit a folded dive where the later record did, and backfill earlier folds by @aleskiontherun in #343

Other changes

• test: a quota test's docstring says invitations made by @aleskiontherun in #301
• ci: the published-image scan uploads one SARIF run by @aleskiontherun in #302
• chore(deps): update astral-sh/setup-uv action to v10.3.0 by @renovate[bot] in #293
• build: keep the test packages out of the shipped image by @aleskiontherun in #306
• chore: delete the first-superuser script by @aleskiontherun in #307
• docs: correct DECISIONS.md, AGENTS.md and code comments that contradict the code by @aleskiontherun in #310
• refactor: remove code nothing calls by @aleskiontherun in #311
• refactor(api): one capped fetch, slot claim and answer cache for provider calls by @aleskiontherun in #314
• refactor: one registry of blob-key columns for the sweeper, purge and volume check by @aleskiontherun in #313
• refactor(api): one set of helpers for binary responses, 304s and uncacheable 404s by @aleskiontherun in #318
• refactor(worker): log through a module logger and share one purge body by @aleskiontherun in #319
• refactor(api): return the created row, share the picker-lookup dispatch, and tidy route conventions by @aleskiontherun in #322
• test: one shared FakeRedis and one async_sessions fixture by @aleskiontherun in #324
• test: hold FakeRedis to real Redis's refusals, and import the worker and scripts from the runtime image by @aleskiontherun in #338
• chore(release): v0.6.0 by @opendiving-release-bot[bot] in #344

Full Changelog: v0.5.0...v0.6.0