Skip to content

Fulla v1.1.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Sep 15:30
· 42 commits to master since this release
v1.1.1
e4c2156

[1.1.1] - 2026-09-10

Added

  • frontend: Add en/zh-CN i18n via vue-i18n curated catalogs (ADR-0013)
  • Decision items #88-3 / #105 / #110 — client_id logout identification, coverage ratchet gate, signing-key rotation keystore
  • frontend: Reactive error locale, AOT i18n precompile + size gate, image build smoke
  • claude: Distill session experience into skills, rules, commands and hooks
  • claude: Add deployment runbook skill for docker env split and WSL prod staging

Fixed

  • admin: Nginx absolute_redirect off — redirects dropped the mapped host port
  • release: Splice curated breaking-change entries into release notes
  • frontend: Address PR #156 review — locale switcher reactivity, a11y, hardening
  • Issues batch 2 — #122/#144/#145/#146
  • #157 review: Session demotion after forced change, lockout on wrong old_password, dual-key revoke, mfa_pending ordering, gate assertions
  • tests: Drop unused execSql helper breaking -Werror=unused-function on GCC/Clang
  • #157 review round 2: Erase-first all re-writable session keys, lockout read side, portal-aware redirect, RNG fail-closed, JSON-only change endpoint
  • i18n: Integrate the forced-password-change form into the #156 catalogs
  • #176 review: RSA-only key guard, unopenable-pem hard fail, rotation-proof script assertions, JWKS cache note, workflow paths
  • ci: De-flake the expiry boundary test; make the gcov report pass loud and locatable
  • #176 review round 2: POST end_session client_id spec, keystore-dir gate test, baseline-keyed ratchet exemption, keystore filename hardening, changelog
  • ci: Grant pull-requests: read on the frontend call job for the image-smoke paths filter
  • frontend-user: Isolate image build type-check from cross-app test imports
  • oauth2: Device approval crash — shared-callback fix in DeviceCodeService
  • health: /health/ready Redis timeout guard; dashboard survives Redis outages
  • portal: Resume OAuth after login; drop zombie sessions; stop burning codes
  • identity: Generate usernames for blank registrations + backfill NULL rows
  • config: Point FULLA_VUE_CLIENT_SECRET at the OAuth2Plugin client entry
  • config: Drop the hardcoded vue-client secret from config.prod.json
  • server: Address PR #180 review M1/M2/M4/M5/M7
  • portal: Address PR #180 review M3/M6/M9
  • claude: Refresh stale facts and repair commit/format hooks
  • release: Codex review — SDK guide tag/push mismatch + regenerate openapi.json

Documentation

  • readme: Add PyPI and Go SDK badges
  • changelog: Fix compare links after v1.1.0
  • changelog: English for the v1.1.0 breaking entries
  • changelog: Unify the changelog in English
  • community: Add community health files (#106)
  • root: Neutralize vendor-specific CLAUDE.md / CODEBUDDY.md (#113)
  • issues: Add internal tracking issue template
  • website: Fix stale MIT references; land ubuntu-24.04 doc sync

Testing

  • scripts: Dedupe full-test manual endpoint layer via ctest JUnit proof (#119)
  • identity: Cover the new blank-username branches (coverage ratchet)

CI/Build

  • deps: Bump the actions-minor group across 1 directory with 2 updates
  • deps: Bump actions/upload-artifact from 4.6.2 to 7.0.1
  • deps: Bump docker/build-push-action from 6.9.0 to 7.3.0
  • deps: Bump actions/setup-python from 5.6.0 to 7.0.0
  • deps: Bump actions/download-artifact from 4.3.0 to 8.0.1

Miscellaneous

  • docker: Shrink the build context (node_modules, dist, docs, website, clients, benchmarks)
  • migrations: Ratify V029 into the migration-check baseline
  • api-diff: Ratify PortalUrl.h (additive) and the NOT NULL model regen
  • coverage: Seed the ratchet baseline from PR #176's own green CI run
  • deps-user: Bump the user-frontend-minor group
  • deps-admin: Bump the admin-frontend-minor group
  • deps: Coordinated frontend majors — TS7 (side-by-side TS6 API), vite 8, eslint 10, vue-router 5, plugin-vue 6
  • config: Dual loopback redirect URIs for vue-client; run_server path fix
  • hygiene: Scrub developer-local absolute paths from tracked files
  • api-diff: Ratify baseline for the env-override path fix
  • migrations: Ratify baseline for V030/V031
  • api-diff: Ratify baseline for DeviceCodeService callback signatures
  • claude: Remove dead OpenSpec commands and superseded release skill

Verification

Images are signed with cosign (keyless, GitHub OIDC):

cosign verify ghcr.io/voidvec/fulla-backend:1.1.1 \
  --certificate-identity-regexp 'https://github.com/voidvec/fulla/.github/workflows/release.yml.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

SPDX SBOMs for the three images and the source tree are attached,
as is the SDK tarball checksum:

sha256sum -c fulla-sdk-1.1.1-linux-x86_64.tar.gz.sha256
Assets 8
Loading