v1.3.1

1.3.1 - 2026-10-22

• Rebuild Linux amd64 binaries with Go 1.27.3, including the compromised
  intermediate certificate denylist for CVE-2026-111943 in outbound HTTPS.
  Upgrade the executable and restart the service to apply the mitigation.

Operator documentation

v1.3.0

1.3.0 - 2026-10-03

• Add optional media=image|video to public asset lists, with cursor-bound
  selectors and provider type narrowing followed by current Gateway authorization.
  Preserve filename-search semantics and the eight-call / 30-second work bounds.
• Add optional logical collection search (q), root and image/video filters to
  public /catalog/collections, with query-bound cursors and non-enumerating root
  behavior under the existing eight-call / 30-second bounds.
• Include representative preview paths and media types from already eligible
  discovery candidates, without additional provider requests. Retain at-least-once
  paging; exact collection counts remain omitted because provider totals do not
  prove Gateway publication eligibility.

Operator documentation

v1.2.0

1.2.0 - 2026-09-20

• Add optional collection-scoped filename search through q on public
  /catalog/assets.
• Search uses case-insensitive multi-term substring matching over authorized
  filenames while preserving existing policy/lifecycle checks, bounded scanning,
  pagination and cursor integrity.

Operator documentation

v1.1.0

1.1.0 - 2026-09-19

• Breaking: replace the former loopback catalog routes with public GET-only
  /catalog/ discovery and credential-free CORS. Policy, lifecycle and metadata
  privacy checks remain authoritative; nginx retains shared admission protection.
• Remove unused server.public_base_url; clients use one Gateway origin and
  relative media paths. Update configuration, clients and nginx together.
• Standardize catalog terminology and update bundled guidance/smoke tooling.
• Release #66 as a documented pre-adoption v1 contract correction: no accepted
  downstream consumer depends on the former contract; the first WordPress
  consumer is blocked pending this correction. The Go module path is unchanged.

Operator documentation

v1.0.2

1.0.2 - 2026-09-19

• Clarify operator and application-integrator documentation paths and deployment navigation.
• Show how discovered preview and privacy-enabled original paths become public URLs.
• Make release-download examples version-neutral and preserve the offline documentation journey.
• Add a concise repository description and factual discovery topics.

Operator documentation

v1.0.1

1.0.1 - 2026-09-19

• Add optional privacy.expose_source_metadata, default off, guarding source metadata.
• Keep sensitive trusted timestamps, coordinates and original capability keys present
  as null while off; exact image/video originals are unavailable without provider fetches.
• Preserve qualified previews/posters; explicit opt-in enables validated sensitive
  fields and exact originals, whose bytes may contain further embedded metadata.
• Make smoke checks verify the intended source-metadata mode, defaulting to off.
• Simplify public documentation to current product and configuration terminology.

Operator documentation

v1.0.0

1.0.0 - 2026-09-18

First stable release for Linux amd64.

• Named provider roots with global and root-scoped exact directory publication
  rules, fail-closed configuration and fresh lifecycle/policy checks.
• Paginated trusted image/video collections and catalogue with safe metadata
  and stable gateway URLs for same-host consumers.
• Image previews and video posters plus exact authorized image/video originals;
  originals preserve embedded source metadata, including EXIF/GPS.
• Validated video byte ranges and inactivity-bounded original streaming.
• Hardened unprivileged systemd and loopback/nginx deployment templates that
  keep the provider and trusted catalogue private, with an aggregate nginx
  public-origin abuse envelope for request rate and concurrency.
• Deterministic bundle packaging, checksums, portable smoke checks and documented
  install, upgrade and rollback procedures.
• Operator and consumer GitHub Pages documentation, also available offline in
  the release bundle.

Operator documentation