Hashavatar 1.3.0

hashavatar-website 1.3.0 Release Notes

Status: release candidate

Summary

1.3.0 prepares the website for the stable hashavatar 1.3.0 renderer and
adopts its migration-oriented prepared-request workflow without changing the
website's public avatar API.

These notes describe the crates.io-backed release candidate before the website
is tagged.

Changed

• Bumped hashavatar-website and the renderer dependency to 1.3.0.
• Migrated normal avatar and Open Graph rendering to immutable prepared
  requests that own derived identities rather than raw identity input.
• Bound strict style validation, effective family capabilities, resource
  accounting, typed semantic cache keys, and WebP output to one prepared tuple.
• Added regression coverage for the prepared request's declared RGBA resource
  budget.
• Preserved existing pixels, URL parameters, response formats, and S3
  object-key layout.

Verification

The complete release gate, all application tests, application smoke test, SBOM
generation, reproducibility check, and normal Wolfi container build pass
against the published renderer.

Hashavatar Website 1.2.0

hashavatar-website 1.2.0 Release Notes

Status: release candidate

Summary

1.2.0 prepares the website for the stable hashavatar 1.2.0 renderer and
validates the new migration contracts against the complete application.

These notes describe the crates.io-backed release candidate before the website
is tagged.

Changed

• Bumped hashavatar-website and the renderer dependency to 1.2.0.
• Adopted the renderer's authoritative family capability metadata for website
  controls, telemetry normalization, and style handling.
• Enabled strict style validation after unsupported family layers have been
  canonicalized to their neutral values.
• Replaced the website's manually assembled cache identity with the renderer's
  typed semantic WebP asset key.
• Preserved the existing public URL parameters and S3 object-key layout.
• Updated Tokio to 1.53.1 and taiki-e/install-action to v2.84.0.

Verification

The complete release gate, all application tests, application smoke test, SBOM
generation, reproducibility check, and normal Wolfi container build pass
against the published renderer.

Hashavatar Website 1.1.2

hashavatar-website 1.1.2 Release Notes

Status: release candidate

Summary

1.1.2 is the next stable patch release for the API, renderer dependency,
Rust toolchain, dependency graph, and CI tooling.

These notes describe the release candidate and should be checked against the
final tag before publishing.

Changed

• Bumped hashavatar-website to 1.1.2.
• Updated the renderer dependency to hashavatar 1.1.2.
• Updated the project toolchain and MSRV to Rust 1.97.0.
• Updated lru to 0.18.1 and refreshed all compatible transitive crates.
• Updated the AWS SDK dependencies to their latest compatible releases.
• Updated taiki-e/install-action to v2.83.0 and verified the remaining
  GitHub workflow actions are current.
• Updated the Docker builder and project documentation for Rust 1.97.0 and
  release 1.1.2.

Security

• Grouped IPv6 rate-limit identities by /64 and moved telemetry limiting
  ahead of bounded JSON extraction.
• Enabled explicit TLS clients for S3 and remote OTLP exporters, and rejected
  non-local plaintext custom S3 endpoints.
• Rejected unknown avatar style values instead of silently substituting
  defaults.
• Hardened embedded JSON, drawing arithmetic, and object-key identity hashing.
• Pinned GitHub actions and container bases to immutable revisions, enabled
  image SBOM/provenance attestations, and added deployment resource ceilings.
• Pinned the Fluxheim deployment image and removed live APK package installation
  from the runtime image build.
• Updated the digest-pinned Fluxheim Wolfi deployment image to v1.7.6.

Verification

cargo outdated --workspace --root-deps-only
HASHAVATAR_API_GATE_PODMAN=1 scripts/stable_release_gate.sh check
podman compose -f deploy/podman-compose.yml config

Hashavatar Website 1.1.1

hashavatar-website 1.1.1 Release Notes

Status: draft

Summary

1.1.1 is the next stable patch release for the API, renderer dependency,
documentation, and build tooling.

These notes are based on the current working tree and should be rechecked
against the final tag before publishing.

Changed

• Bumped hashavatar-api to 1.1.1.
• Updated the renderer dependency to hashavatar 1.1.1.
• Refreshed the lockfile with current compatible crate updates.
• Updated GitHub workflow tooling where newer action versions are available.
• Kept the project Rust toolchain pinned to Rust 1.96.0.
• Updated the README for the 1.1.1 service and renderer versions.
• Expanded the website language note to state that translations are
  AI-assisted best effort and that native-speaker fixes are welcome.

Verification

cargo outdated --workspace --root-deps-only
scripts/checks.sh
scripts/smoke_local.sh
scripts/podman_smoke.sh

Hashavatar Website 1.1.0

hashavatar-website 1.1.0

This release updates hashavatar-api to the hashavatar 1.1.0 renderer and expands the public demo site while tightening several security and release-path details.

Highlights

• Updated hashavatar-api to 1.1.0.
• Updated the renderer dependency to crates.io hashavatar 1.1.0.
• Added a large TOML-backed website translation set with RTL support where needed.
• Added a searchable, scrollable language selector for the expanded language list.
• Added privacy-policy wording that translations are AI-assisted/best-effort and can be improved on GitHub.
• Added privacy-preserving OpenTelemetry metrics for aggregate page views, clicks, outbound links, avatar generation, and visitor interaction patterns.
• Kept telemetry bounded and non-identifying: no raw IDs, tenant/style namespaces, IPs, user agents, referrers, cookies, full URLs, or free-form text in telemetry labels.

Security And Hardening

• Added rate limiting for telemetry endpoints.
• Added a dedicated telemetry rate-limit bucket.
• Improved rate limiting with a sliding-window approximation to reduce boundary bursts.
• Added early avatar size validation before render semaphore acquisition.
• Escaped shared page i18n heading/lead text before HTML body insertion.
• Restricted remote OTLP endpoints to HTTPS, while still allowing localhost loopback collectors for development.
• Preserved strict CSP behavior for inline scripts via nonces.
• Kept the language selector CSP-compatible.

Container And CI

• Updated GitHub checkout action to actions/checkout@v7.0.0.
• Fixed the Wolfi container build by copying compile-time locale config into the build stage.
• Verified the Wolfi image locally with /healthz, /, and WebP avatar generation.
• Release image tag for the fixed container build: v1.1.0-release.

Verification

• scripts/checks.sh passes.
• 68 tests pass.
• Clippy passes.
• Cargo deny and cargo audit pass.
• Local Wolfi container smoke test passes.

Hashavatar Website 1.0.3

Release notes for hashavatar-website 1.0.3:

• Updated hashavatar renderer crate to 1.0.3.
• Bumped service version and documentation references to 1.0.3.
• Refreshed Rust dependencies, including AWS SDK crates.
• Updated GitHub workflow actions.
• Updated the Podman/Fluxheim deployment example to use ghcr.io/valkyoth/fluxheim:v1.5.14-wolfi.
• Verified local checks, smoke tests, dependency policy, RustSec audit, and Wolfi container smoke test.

Hashavatar Website 1.0.2

hashavatar-website 1.0.2

Security hardening and renderer update release.

• Updated the API and demo to hashavatar 1.0.2.
• Added stricter no-cache behavior for API error responses.
• Added X-RateLimit-* headers on rate-limit responses.
• Hardened trusted-proxy client IP handling against reserved/private forwarded IPs.
• Validated S3 object prefixes and enabled explicit SSE-S3 on stored avatars.
• Improved cache-key construction to avoid delimiter ambiguity.
• Expanded browser security headers and added cross-domain policy hardening.
• Added safer hashed-identity guidance in the documentation.

Hashavatar Website 1.0.1

hashavatar-website 1.0.1

Security hardening patch release.

• Added process-wide backpressure for avatar and Open Graph rendering work.
• Sharded the in-memory rate limiter to reduce hot-path lock contention.
• Tightened S3 persistence behavior so only real missing objects trigger writes.
• Clamped S3 presigned URL TTLs to the SigV4-safe range.
• Documented /metrics proxying and trusted-proxy deployment boundaries.
• Re-enabled yanked-crate checks and crates.io index refresh for cargo audit.
• Updated to Hashavatar 1.0.1 crate.

Hashavatar Website 1.0.0

hashavatar-website 1.0.0

Stable 1.0 release of the public Hashavatar API and demo site.

Highlights

• Updated to hashavatar crate 1.0.0.
• Finalized the API/demo site for SHA-512 + WebP avatar generation.
• Added stricter security handling for rate limiting, forwarded IPs, storage links, and Open Graph rendering.
• Open Graph PNG generation now runs off the async executor with timeout protection.
• Direct persist=true avatar requests now use the stricter storage rate limit.
• Signed storage link responses return a hashed cache key instead of the raw identity-bearing cache key.
• Updated Wolfi container deployment and hardened the Podman Compose example.
• Refreshed dependencies, including direct lru 0.18.0.
• Updated documentation, security controls, and release metadata for 1.0.0.

Verification

• CI green before tagging.
• Local release gate passed.
• Local Wolfi image smoke test passed.

Hashavatar Website 0.13.0

hashavatar-website v0.13.0

This release updates the API and demo site for hashavatar 0.13.0.

Changed

• Uses the published hashavatar 0.13.0 crate.
• Adds demo/API support for the new background modes:
  • polka-dot
  • striped
  • checkerboard
  • grid
  • sunrise
  • ocean
  • starry
• Keeps the demo/API on SHA-512 identity hashing and WebP avatar responses.
• Updates README, security docs, OpenAPI-driven options, and smoke tests for the new background set.

Security and Reliability

• Applies origin-side rate limiting to /og.png.
• Raises the in-memory rate limiter capacity to 65,536 buckets.
• Avoids CSP nonce generation on non-HTML routes.
• Stops exposing signed S3 URL/object-key metadata on standard avatar responses; signed metadata is returned only through /v1/avatar/link.
• Adds regression tests and smoke coverage for the new hardening.

Validation

• Local test suite, clippy, smoke tests, dependency policy, RustSec audit, GitHub CI, and CodeQL passed before tagging.