v0.1.6

0.1.6 (2026-05-24)

⚠ BREAKING CHANGES

• runtime: Strait now requires PostgreSQL, Redis, and Sequin at startup; deployments without Redis or Sequin must add them before upgrading.

Features

• api: surface 402 quota_exceeded with structured body on plan rejections (bc1715d)
• app: add at-a-glance summary strips to runs schedules and webhooks (4f67e69)
• app: add optimistic updates for delete, dlq, and retry-run mutations (2ec7895)
• app: add per-route document titles and align breadcrumb labels (3b3634e)
• app: app design overhaul — pagination, a11y, optimistic updates, UI polish (c14abf9)
• app: wire server-side cursor pagination across list pages (1844274)
• billing: add cloud-only Stripe SLA credit-note issuer (ea9631d)
• billing: add dunning state machine with scheduled ticker (3f6fbce)
• billing: add Prometheus-backed uptime source for SLA calculator (87538ab)
• billing: add SLA credit calculator and issuance pipeline (2c752dc)
• billing: dispatch billing.payment_succeeded on payment recovery (61eea90)
• billing: dispatch schedule.suspended and workflow.registration_rejected events (d8dcd48)
• billing: Wave 3 entitlements snapshot + Wave 4 plan enforcement tightening (8c75807)
• billing: wire billing event dispatcher into enforcer, dunner, downgrade, sla (3a95c2d)
• billing: wire cloud-only Stripe SLA credit issuer into services (c7fbd19)
• runtime: require redis and sequin (df5a78a)
• webhook: add billing event dispatcher adapter (c477bba)

Bug Fixes

• api-keys: atomically create rotated keys (8318b39)
• api: account for cli device-code rate budget (57bdae5)
• api: align cli polling with route limits (42b5017)
• api: align trigger dry-run limit checks (bce9f9a)
• api: audit trigger mutation outcomes (ad35c5b)
• api: authorize workflow topology endpoints (41517b8)
• api: avoid audit writes for rejected run tokens (5ce3e86)
• api: avoid caching webhook signing secrets (320d502)
• api: complete idempotency after request commit (9377c29)
• api: count bulk triggers in rate limits (18a7648)
• api: encrypt endpoint signing secrets (b2f4b1f)
• api: enforce bulk trigger daily budget (303296d)
• api: enforce key lifetime on rotation (a56a4ab)
• api: enforce RBAC for DLQ admin scopes (c4c63e2)
• api: enforce trigger permissions for event dispatch (c367383)
• api: enforce workflow trigger scopes for events (80d5f03)
• api: fail closed for event source signatures (54ff2e3)
• api: fail closed on dlq audit writes (8da1a3b)
• api: fail closed on outbox audit writes (7579520)
• api: filter dlq listing by environment (eb115e7)
• api: filter webhook deliveries by environment (0464c76)
• api: gate batch cron overlap policy (40d3f0b)
• api: gate on-failure job chaining (5999eb6)
• api: guard run resources by environment (394c95a)
• api: harden billing and environment bulk access (e960c25)
• api: include inherited role permissions in grant checks (24bc4d7)
• api: mint usable rbac sse tokens (f4702da)
• api: preserve environment scope in sse tokens (2c80002)
• api: preserve idempotency path case (dff0daf)
• api: preserve rotation webhook secret (90e8d1a)
• api: prevent cross-project workflow clones (64f26e3)
• api: prune expired cli device codes (1e57849)
• api: redact outbox audit details (ad53e69)
• api: redact rotation webhook audit url (24b7a25)
• api: redact webhook delivery urls (c631710)
• api: remove stale timeline nolint (71ee70b)
• api: require durable audit export events (0999d23)
• api: require org scope for billing controls (8406052)
• api: require project scope for group and job analytics (10239bc)
• api: require project-wide outbox admin access (f49ef91)
• api: require rbac manage for workflow policies (b8fd0b5)
• api: require secrets write for environment variables (48dc345)
• api: require webhook scope for test endpoint (c010250)
• api: restrict project budget mutations by scope (2dc710a)
• api: return retryable webhook errors (51e3fdf)
• api: scope admin dlq list by environment (672ae6d)
• api: scope event trigger stream messages (99cc2e2)
• **api...

v0.1.5

Bug Fixes

• release: unblock v0.1.4 publish + adopt release-please (0ecbf2c)
• security: document upstream CVEs blocking publish-images workflow (b803683)

---

This release was tagged manually after release-please got stuck on PR #160 (the bad fallback PR title chore: release master from the now-removed custom title pattern). Future releases will be fully automated.

Full Changelog: v0.1.4...v0.1.5

v0.1.3

Bug fixes

• Increase CI wait timeout to 15 minutes for security scan (549f71e)
• Enforce tenant isolation on 8 endpoints missing requireProjectMatch (0ae12ca)
• Add SSRF protection to notification senders and log drain service (2e15036)
• Reject unsigned webhooks, encrypt secrets before storage (6ec79b0)
• Scope CLI device-code keys, return 404 for cross-project triggers (b07c9a8)
• Release mutex before network I/O in MachinePool Prune/Release (84f03cb)
• Return errors from enterprise contract, fix audit event, use atomic downgrade (b8940d8)
• Make replay atomic, bound recursive CTE, add LIMIT to bulk cancel (2835ba4)
• Address 6 low-severity concurrency and correctness issues (f7b3f0e)
• Add LIMIT to unbounded queries, fix circuit breaker TOCTOU race (42921c2)
• Upsert project budget, increase spending lock TTL, parameterize SLA target (9b7e5bb)
• Enforce tenant isolation on 9 workflow handlers (276d988)
• Add nil check to QueryRow, prevent Stop-without-Start deadlock (89debe9)
• Add regex pattern length limit to prevent ReDoS (a9ae6fc)
• Prevent panics, retry 429s, bound UNION queries (4061342)
• Enforce tenant isolation on 15 workflow run handlers (fe9f139)
• Enforce tenant isolation on RBAC roles, secrets, and job groups (61a5231)
• Verify project_id on create handlers, validate sub/dep ownership (c8aaaf5)
• Add rate limiting to internal secret auth to prevent brute force (816fd58)
• Prevent privilege escalation via role creation and API key scoping (c525469)
• Add SSE connection limits and max duration to prevent exhaustion (bbcf81e)
• Reject URLs on DNS lookup failure to prevent DNS rebinding (6c5e02b)
• Apply statement_timeout at pool level to prevent runaway queries (82a815f)
• Resolve lint, race, and integration test failures (ad15012)
• Enforce tenant isolation on 5 remaining create handlers (a0edc73)
• Add Cache-Control no-store, validate payload_contains as JSON (757ed40)
• Block octal/hex IP SSRF bypass, cap max_attempts at 100 (cb5fc24)
• Enforce tenant isolation on 13 run-level handlers (0c731b5)
• Enforce timeout_secs cap on update and batch create paths (0ff950d)
• Fix executor shutdown deadlock and DLQ replay error mapping (297b54a)
• Suppress gosec G118 for context cancel in closure defer (cd07b93)
• Simplify health endpoint, move edition to internal-only (fd9117a)
• Bake edition into binary at compile time via build tags (25fe24e)
• Resolve all 79 lint issues in loadtest package (95bd134)
• Remove duplicated header nav controls (cff26b2)
• Show mobile header nav at lg breakpoint (00d5ba3)
• Resolve source_uri DB bug, TOCTOU double-build, and RowsAffected silencing (55cf55d)
• Prevent duplicate builds with FOR UPDATE SKIP LOCKED claim pattern (d7e0d19)
• Resolve integration test issues (edb58fe)
• Batch DeleteExpiredDeployments and index build_node_claimed_at (26abcef)
• Correct four issues in strait.json schema (STR-382) (ae91563)
• Address review findings from deployment hardening (f8b2033)
• Presigned URL size binding, GC cap, build_logs slim queries (2309fa7)
• Resolve four failing CI checks on PR #87 (c241a04)
• Add missing columns to job_run and job SELECT queries (4ad6cb5)
• Add missing $34 param for is_rollback in CreateRun INSERT (4229823)
• Correct SDK pre-install, update versions, add Trivy scan (54ea551)
• Harden code deployment pipeline against OWASP Top 10 (b9e41e9)
• Re-pin runtime image action SHAs after upstream re-tag (92dcef3)
• Upgrade trivy-action to v0.35.0 to fix missing setup-trivy dep (1d7c1b9)
• Skip row panels in dashboard validation tests (c89ce49)
• Fix -1 sentinel bug, add URL validation, cache ReverseProxy, full test coverage (d6755ed)
• Fix +Inf/NaN/negative depth parsing, duplicate name validation, goroutine context; add fuzz tests (cd031e8)
• Three correctness and performance fixes from code review (312967a)
• Harden build pipeline against credential leaks and supply chain attacks (c248064)
• Allowlist generated JS bundles in gitleaks config (f0bfc0c)
• Enforce RLS via per-request transaction and fail closed (fb8f811)
• GetWebhookSubscription takes only (ctx, id), not projectID (bf6d087)
• Apply fillfactor to job_runs partitions instead of parent (bbaef2d)
• Unblock integration tests — rls role, stream scan, jsonb assert (4171f6b)
• Seed TestRLS_JobSLOEvaluations through the pool, not an uncommitted tx (29b174e)
• Bump alpine to 3.22 and SOCI to 0.13.0 to patch CVEs blocking v0.1.3 release (#113) (201dd09)
• Bump alpine runtime to 3.23 to patch libcrypto3/libssl3 HIGH CVEs (#114) (33bc533)
• Move runtime stage to distroless/static to escape alpine CVE loop (#115) (e7cc5d3)
• Publish-images check-ci prefers successful CI runs over stale cancelled ones (#116) (4721bf1)
• Security always runs on master push; check-ci fails fast on missing runs (#117) (61e3ba2)
• Cosign TSA flag is --timestamp-server-url, not --tsa-server-url (#118) (ccd6cf8)
• Drop cosign TSA flag until compatible with signing-config auto-discovery (#119) (9b4a805)
• Drop cosign --oidc-issuer for signing-config compatibility (#120) (294af9d)
• Drop cosign verify-attestation steps; BuildKit attestations are OCI referrers (#121) (a8f8358)

Build

• Pin base image digests and track via dependabot (a0d96b2)

CI

• Add cloud API image build with BUILD_TAGS=cloud (f1a138d)
• Add release gate and post-push image verification (19ce63e)
• Multi-arch builds, cosign signing, SBOM, tighter tag strategy (d178e16)
• Arm64 trivy scan, cosign TSA timestamping, explicit CODEOWNERS (51e9256)
• Auto github release and SBOM diff via git-cliff (9007816)

Chores

• Remove all Fly.io references across the codebase (f3b42fe)
• Updated dependencies (362e53d)
• Updated dependencies (1222335)
• Drop strait-loadtest image and unused loadtest assets (613511e)
• Bump go.opentelemetry.io/otel/exporters/prometheus (6a43fce)
• Bump github.com/aws/aws-sdk-go-v2/service/ecr (65c86ee)
• Bump github.com/testcontainers/testcontainers-go/modules/postgres (a73b788)
• Bump actions/github-script from 8.0.0 to 9.0.0 (87f65f3)
• Bump actions/download-artifact from 4.3.0 to 8.0.1 (219b4a1)
• Bump docker/setup-buildx-action from 3.10.0 to 4.0.0 (6d7f325)
• Merge master into release-gate branch (3f5f832)
• Bump setup-buildx-action to v4 in publish-images.yml (3ce9d65)
• Bump github.com/testcontainers/testcontainers-go/modules/redis (2295637)
• Bump go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp (b1d01b2)
• Merge master into release-gate branch (c253f52)
• Bump orhun/git-cliff-action from 4.5.1 to 4.7.1 (2d3aa93)
• Bump orhun/git-cliff-action from 4.5.1 to 4.7.1 (#104) (d1b8f8b)
• Bump actions/checkout from 4.2.2 to 6.0.2 (687570a)
• Bump docker/metadata-action from 5.10.0 to 6.0.0 (82968a9)
• Bump github.com/grafana/pyroscope-go in /apps/strait (19aad12)
• Bump github.com/danielgtaylor/huma/v2 in /apps/strait (39768b6)
• Bump golang.org/x/crypto in /apps/strait (8497394)
• Bump github.com/docker/cli in /apps/strait (48cae73)

Documentation

• Update CLAUDE.md with k8s/Hetzner infra, edition system, remove Fly.io refs (0df0018)
• Add contributor guide for the Go backend service (3d97f20)

Features

• Add end-to-end completion tracking, fix compilation and chaos bugs (c09b891)
• Add code-first job execution foundation (Phase 1) (5676a7f)
• Add build package and deployment API for code-first jobs (fb73050)
• Add build orchestrator and BuildKit integration (37598fd)
• Pin image at queue time for code-first jobs (STR-392) (b780a90)
• Phase 4 security — cache partitioning, seccomp profile, SOCI, security tests (74fb548)
• Verify tarball SHA-256 and size at confirm time (eec3016)
• Support multiple BuildKit addresses for multi-node dispatch (fdbd4af)
• Add background GC for stale pending and old failed deployments (97d4088)
• Stream build logs over SSE while build is in progress (882ef35)
• Mark runs created after rollback with is_rollback flag (a738ff0)
• Allow personality syscall for QEMU cross-compilation in BuildKit (d3881bb)
• Support authenticated private base images in BuildKit session (b63bb3a)
• Add admin endpoint to list deployments across an org (295cd3b)
• Serve strait.json schema at /schemas/v1/strait.json (STR-382) (73cc75f)
• Add deploy, auth, deployments, jobs, and init commands (ad1ae51)
• Wire IMAGE_PULL_POLICY config into K8s job container spec (5d26775)
• Instrument build pipeline with Prometheus metrics (5b7b85f)
• Add code deployments observability dashboards (eb25127)
• Tenant metrics, gvisor runtime class, and dispatcher mode (538d3b4)
• Add SOCI lazy image loading for cold-start optimization (STR-396) (1968fbf)
• Enable RLS on 16 tenant tables and FORCE on existing ones (61fb5bb)
• Add project_id to webhook_deliveries and enable RLS (0f2f264)

Other

• Merge pull request #86 from strait-dev/leonardomso/irvine (eeb8c6b)
• Merge pull request #88 from strait-dev/leonardomso/website-header-nav-fixes (9c86de8)
• Merge pull request #87 from strait-dev/leonardomso/houston (afe767e)
• Merge pull request #91 from strait-dev/leonardomso/houston (e39bbce)
• Merge pull request #92 from strait-dev/leonardomso/andorra (514345b)
• Merge pull request #103 from strait-dev/dependabot/go_modules/apps/strait/go.opentelemetry.io/otel/exporters/prometheus-0.65.0 (beb63df)
• Merge pull request #102 from strait-dev/dependabot/go_modules/apps/strait/github.com/aws/aws-sdk-go-v2/service/ecr-1.57.0 (377e115)
• Merge pull request #99 from strait-dev/dependabot/go_modules/apps/strait/github.com/testcontainers/testcontainers-go/modules/postgres-0.42.0 (2af9894)
• Merge pull request #96 from strait-dev/dependabot/github_actions/actions/github-script-9.0.0 (17de821)
• Merge pull request #94 from strait-dev/dependabot/github_actions/actions/download-artifact-8.0.1 (79936e6)
• Merge pull request #95 from strait-dev/dependabot/github_actions/docker/setup-buildx-action-4.0.0 (8a2ac06)
• Merge pull request #100 from strait-dev/dependabot/go_modules/apps/strait/github.com/testcontainers/testcontainers-go/modules/redis-0....