v0.1.0-beta.2

Container images

• ghcr.io/shikanon/orag-api:v0.1.0-beta.2 @ sha256:1e7b7111ffb1e10751f689850adb03b1a7f068e320ab91b06db7a6cceaac04d0
• ghcr.io/shikanon/orag-console:v0.1.0-beta.2 @ sha256:67a3180d101d14e3107425edde514096df8dca0492ae8770197f2d8c3c6e0e86

Both images support linux/amd64 and linux/arm64 and include registry SBOM/provenance attestations plus keyless signatures.

Quick verification

Run make demo from this tag for the no-key migration, API, Console, ingestion, cited-query, trace, and evaluation walkthrough.

Hosted documentation: https://shikanon.github.io/orag/

See CHANGELOG.md and docs/compatibility.md for Beta limitations and migration policy.

What's Changed

• chore(deps-console): bump jsdom from 25.0.1 to 29.1.1 in /console by @dependabot[bot] in #194
• chore(deps-docker): bump alpine from 3.22 to 3.24 in /deployments by @dependabot[bot] in #189
• chore(deps-actions): bump actions/checkout from 4 to 7 by @dependabot[bot] in #188
• chore(deps): bump golang.org/x/crypto from 0.24.0 to 0.52.0 in /tests/consumer by @dependabot[bot] in #198
• chore(deps): bump google.golang.org/grpc from 1.64.1 to 1.79.3 in /tests/consumer by @dependabot[bot] in #204
• chore(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 in /tests/consumer by @dependabot[bot] in #203
• chore(deps): bump github.com/jackc/pgx/v5 from 5.5.5 to 5.9.2 in /tests/consumer by @dependabot[bot] in #202
• docs: design staged Qdrant visibility protocol by @shikanon in #206
• fix: prevent failed ingestion vector visibility by @shikanon in #207
• fix: make knowledge base deletion retryable by @shikanon in #208
• fix: make optimizer execution single-flight by @shikanon in #209
• test: verify RAG span execution timelines by @shikanon in #210
• build: remediate Go dependency vulnerabilities by @shikanon in #212
• ci: add code and supply-chain security gates by @shikanon in #214
• fix: bound fake embedding dimensions by @shikanon in #216
• ci: pin supply-chain dependencies by @shikanon in #218
• test: add continuous Go fuzzing by @shikanon in #220
• fix: keep optimizer results finite by @shikanon in #224
• fix: upgrade Eino Jinja security boundary by @shikanon in #222
• docs: design machine API keys and project authorization by @shikanon in #227
• feat(auth): add typed principal and deny-by-default policy by @shikanon in #228
• feat(auth): add secure machine API key persistence by @shikanon in #229
• feat(auth): authenticate API keys and enforce project RBAC by @shikanon in #230
• feat(auth): assign knowledge roots to projects by @shikanon in #231
• feat(auth): enforce project resource access by @shikanon in #232
• feat(auth): throttle API key usage audits by @shikanon in #233
• feat(sdk): expose project and API key lifecycle by @shikanon in #234
• feat(console): manage API keys by @shikanon in #235
• feat(console): add authenticated sessions by @shikanon in #236
• feat(auth): scope evaluations and optimizations by project by @shikanon in #237
• test: verify published beta SDK consumer by @shikanon in #238

New Contributors

• @dependabot[bot] made their first contribution in #194

Full Changelog: v0.1.0-beta.1...v0.1.0-beta.2