v0.22.7

What's Changed

• Fix RESEED silently no-op'ing on a stdin-piped demo deploy by @haksungjang in #445
• Exclude .git metadata from preserved scan-source tarballs and viewer by @haksungjang in #446
• Phase 1: fix the e2e regression, gate release images, measure branch coverage, and document review reality by @haksungjang in #447
• Phase 2: dependency reproducibility, config preflight, and two audit PII gaps by @haksungjang in #448
• Dedupe Redis fail-open logging and surface it on /health/ready by @haksungjang in #449
• Give every default-queue Celery task a time limit by @haksungjang in #451
• Make the deploy crash-recovery restart respect COMPOSE_FILE by @haksungjang in #452
• Ship example Prometheus alerting rules for the metrics already exposed by @haksungjang in #453
• Define measured RPO/RTO for backup and restore by @haksungjang in #455
• Suppress CVE-2026-84445 in .trivyignore (grpc-go via cosign) by @haksungjang in #457
• Add backend HPA and document a self-hosted Postgres/Redis HA path by @haksungjang in #459
• Batch the SBOM persist path's catalog lookups (#398) by @haksungjang in #460
• Convert flat teams into an unlimited-depth group hierarchy by @haksungjang in #464
• Fail open on a Redis outage in the WS connection registry by @haksungjang in #465
• Add on-demand ticket-status refresh for vulnerability findings by @haksungjang in #466
• Batch scan_components/license_findings/component_dependency_edges inserts by @haksungjang in #467
• Replace OFFSET with keyset pagination in the three CSV exports that reach real depth by @haksungjang in #468
• Expose running image version/commit/build-time and add hardening + Postgres tuning guides (#441) by @haksungjang in #469
• Warn at install time when RWX persistence has no storageClassName set by @haksungjang in #470
• Document server-generated output as English-only by @haksungjang in #471
• Wire ErrorBoundary crash reports to a backend capture path by @haksungjang in #473
• Expand a11y axe coverage to 20 screens, add keyboard-only and reduced-motion tests (#425) by @haksungjang in #472
• Split every non-critical route with React.lazy() (#421) by @haksungjang in #474
• Keep compose backups out of the container layer by @haksungjang in #450
• Let SCAN_SOURCE_RETENTION drop the source tree but keep the SBOM by @haksungjang in #454
• Document DB role-separation env vars, fix KO anchor mismatches by @haksungjang in #475
• Fix nightly verify-specs and e2e failures from the group-hierarchy rename by @haksungjang in #476
• Add offline install bundle for air-gapped deployments (#400) by @haksungjang in #477
• Pass --skip-snippets to scanoss-py, closing a fingerprint-egress gap by @haksungjang in #478

Full Changelog: v0.22.6...v0.22.7