v0.0.8 -- "春城无处不飞花，寒食东风御柳斜。"

What's Changed

• chore(deps): bump oven/bun from 1.3.2-alpine to 1.3.14-alpine (#122) (9c8a1be)
• chore(deps): bump golang from 1.25-alpine to 1.26-alpine (#121) (eb0ab8a)
• chore: update CI actions to current versions, rewrite stale docs (cece0ce)
• fix: validation, error leaks and the last-owner guard (43b4bed)
• fix: repair checks that reported success without checking (9f9728e)
• fix(web): stop leaking tenant data across sessions in the same tab (27a7875)
• docs: document production settings and how to add a migration (5b1be1d)
• chore(web): remove unused UI layer and dependencies (5f317c7)
• refactor(web): add tests and formatting, fix double-submit and error handling (5bc36b3)
• refactor: support incremental migrations, add RBAC tests, unify logging (49451c3)
• fix: clear session active_tenant_id when a tenant is deleted (758f26e)
• fix: preallocate origins slice to satisfy CI's linter (c82aed8)
• fix: repair regressions found reviewing the previous commits (45c27d3)
• fix(web): surface form errors and hydrate tenants on session restore (dfd4ea2)
• fix: block access to soft-deleted tenants (ae45666)
• build: track web/bun.lock and restore --frozen-lockfile (10303d1)
• revert: do not track web/bun.lock (339e673)
• docs: describe sqlc instead of Gorm, drop unused SESSION_SECRET (edaf2a3)
• build: fix Docker Go version, drop CGO, add .dockerignore (63114e1)
• feat: graceful shutdown, server timeouts, login rate limit (9a26b17)
• fix: check rollback error in WithTx panic handler (01bc00e)
• chore: align local tooling with CI and fix Makefile targets (6453bd4)
• fix(web): correct health check path, drop stale react-router types (6befbfa)
• fix(security): prevent static file path traversal and harden sessions (1e519cb)
• fix: pin typescript to 6.x, typescript-eslint does not support TS 7 (ce2237c)
• docs: update readme (109f8dc)
• fix: remove bun.lock (79396ba)
• chore(deps): bump modernc.org/sqlite from 1.38.2 to 1.54.0 (#119) (491076d)
• chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 in /web (#118) (7ac26b5)
• chore(deps): bump github.com/jackc/pgx/v5 from 5.7.5 to 5.10.0 (#120) (0cc7572)
• chore(deps): bump github.com/labstack/echo/v5 from 5.3.0 to 5.3.1 (#117) (11b55f2)
• refactor: remove gorm and add sqlc (fb5c0a5)
• chore(deps): bump google.golang.org/api from 0.288.0 to 0.289.0 (#116) (f887d03)
• chore(deps): bump github.com/labstack/echo/v5 from 5.2.1 to 5.3.0 (#115) (e6d5ed9)
• chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 (#114) (5cf0b12)
• chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 in /web (#113) (04139f3)
• chore(deps): bump google.golang.org/api from 0.287.0 to 0.288.0 (#112) (dc7fad6)
• chore(deps): bump google.golang.org/api from 0.286.0 to 0.287.0 (#111) (fcdb2c2)
• chore(deps): bump gorm.io/gorm from 1.31.1 to 1.31.2 (#110) (b680df1)
• chore(deps): bump google.golang.org/api from 0.285.0 to 0.286.0 (#109) (20093b2)
• chore(deps): bump google.golang.org/api from 0.284.0 to 0.285.0 (#106) (feffe0d)
• chore(deps): bump github.com/labstack/echo/v5 from 5.1.1 to 5.2.1 (#107) (8d24de6)
• chore(deps-dev): bump @types/node from 25.9.4 to 26.0.0 in /web (#108) (76d781d)
• chore: upgrade echo to v5 (f61014d)
• fix: remove bun.lock (30c710d)
• chore(deps): bump google.golang.org/api from 0.283.0 to 0.284.0 (#105) (4fa059e)
• chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 (#104) (1ccb8ff)
• chore(deps): bump google.golang.org/api from 0.282.0 to 0.283.0 (#103) (ebd26e4)
• chore(deps): bump google.golang.org/api from 0.268.0 to 0.282.0 (#102) (9a87de1)
• chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 (#101) (76c84e1)
• chore(deps-dev): bump esbuild from 0.27.7 to 0.28.0 in /web (#100) (207b1f4)
• chore(frontend): switch package manager to bun (#99) (e04509d)
• chore(deps): bump golang.org/x/crypto from 0.50.0 to 0.51.0 (#93) (c9935c7)
• chore(deps): bump github.com/labstack/echo/v4 from 4.15.1 to 4.15.2 (#94) (13a06f0)
• chore(deps): bump react-helmet-async from 2.0.5 to 3.0.0 in /web (#90) (f3bf9a6)
• chore(deps): bump i18next from 25.10.10 to 26.2.0 in /web (#91) (1b95e90)
• chore(deps-dev): bump @vitejs/plugin-react from 5.2.0 to 6.0.2 in /web (#92) (761fbd4)
• fix: repair frontend and backend ci (#98) (2deda70)
• ci(go): align workflow and golangci with Go 1.25 (#96) (67d9f4d)
• chore(deps-dev): bump vite from 7.3.3 to 8.0.13 in /web (#88) (dbe825c)
• chore(deps): bump react-i18next from 16.6.6 to 17.0.8 in /web (#87) (da10c2c)
• chore(deps): bump lucide-react from 0.575.0 to 1.16.0 in /web (#86) (9060f08)
• chore(deps-dev): bump typescript from 5.9.3 to 6.0.3 in /web (#85) (39f56f5)
• chore(deps-dev): bump eslint from 9.39.3 to 10.0.2 in /web (#83) (29ab955)
• chore(deps): bump google.golang.org/api from 0.264.0 to 0.268.0 (#81) (5e3c376)
• chore(deps): bump github.com/labstack/echo/v4 from 4.15.0 to 4.15.1 (#82) (6fd3d18)
• chore(deps): bump lucide-react from 0.563.0 to 0.575.0 in /web (#84) (1135bca)
• chore(deps): bump google.golang.org/api from 0.262.0 to 0.264.0 (#73) (309c6f1)
• chore(deps-dev): bump eslint-plugin-react-refresh in /web (#74) (f9a8a98)
• refactor: replace Cloudflare/Replicate with Grok AI service (3d301e2)

Full Changelog: v0.0.7...v0.0.8