SPARC v1.8.10

First release since v1.8.6 — bundles the container CVE-baseline remediation, the org SCA SBOM producer, the API document stuck-in-pending fix, and dependency bumps.

Security

• Container CVE-baseline remediation (#621): openssl bumped to the patched 3.0.20-1~deb12u2; Ruby default-gem CVEs (net-imap, erb, zlib) remediated via Gemfile pins (resolv-style override); oauth2 → 2.0.22; thruster Go-1.26.2 stdlib HIGHs accepted with reverse-proxy compensating controls (no upstream build on Go ≥1.26.3). false_positive dispositions exempted from the 30-day review cadence in the findings validator.
• Org-wide SCA rollup producer (#619): emits a CycloneDX SBOM to s3://sparc-prod-security-artifacts/sca/sparc/{<date>,latest}/ on push-to-main + daily, via the shared container-build-sign reusable workflows (umbrella container-build-sign#12).

Fixes

• API-created documents no longer stuck in pending (#618): metadata-only API creates (CDEF/profile/SSP/SAR/SAP/POA&M) resolve to completed on save; full parse lifecycle (enqueued/started/succeeded/failed) is structured-logged with document + job ids; new StuckDocumentReaperJob transitions genuinely-stalled file parses to failed with a user-visible message. (User email/in-app notification deferred — #623.)
• Dev docker compose up fixed (#561): added zlib1g-dev to the web/sidekiq runtime installs so the zlib gem native extension compiles (regressed after #620's gem pin).

Dependencies

• solid_cable 4.0.0 (#561), image_processing 2.0.2 (#615), caxlsx 4.5.0 + aws-sdk-rds 1.315.0 (#624), pagy 43.5.6 + aws-sdk-s3 1.225.1 + bootsnap 1.24.6 (#625).

Deploy validation

After the signed image publishes, validate on the deployed instance with the Layer 2 Playwright smoke (tests/ui-smoke/): point SPARC_SMOKE_BASE_URL at the instance (+ an SA token for the authenticated/a11y walks). This exercises solid_cable in the production cable adapter, which local dev (async adapter) does not.