v0.13.0

0.13.0 (2026-10-28)

⚠ BREAKING CHANGES

• the actor of GET /api/v1/users/me/audit-log is no longer the string system, self, or admin; fetcher reads no longer return null actors to callers without manage_fetchers; roles[].assigned_by is no longer a bare UUID.
• separate the user directory from the admin user profile (#1137)
• apply CVE accessibility to the global CVE source listing (#1133)
• require authentication for every application read (#1131)

Features

• identify acting users to every reader of an action (#1143) (8c9b34e)
• mark bot accounts in user representations (#1141) (8d50e7d), closes #1138
• require authentication for every application read (#1131) (3393c05), closes #1129
• separate the user directory from the admin user profile (#1137) (cfce2f7)

Bug Fixes

• apply CVE accessibility to the global CVE source listing (#1133) (8a6ccb1), closes #1128
• publish omittable request members without null (#1142) (cde9aca)

v0.12.0

0.12.0 (2026-10-26)

⚠ BREAKING CHANGES

• api: answer trailing-slash paths with ROUTE_NOT_FOUND (#1086)

Bug Fixes

• api: answer trailing-slash paths with ROUTE_NOT_FOUND (#1086) (25777c3), closes #1075
• start the API server without forwarded-header processing (#1088) (a2a7492)

v0.11.0

0.11.0 (2026-10-23)

⚠ BREAKING CHANGES

• api: move the OpenAPI document and docs page under /api (#1076)

Features

• add the example-data load command for a fictional dataset (#1080) (af3e98b), closes #1074
• api: move the OpenAPI document and docs page under /api (#1076) (2c283a9), closes #1073

Bug Fixes

• api: serve a pinned Swagger UI as the only interactive API docs (#1071) (c86fb72), closes #1070
• use a numeric image user and document Kubernetes deployments (#1056) (4272cac), closes #1055

v0.10.3

0.10.3 (2026-10-20)

Bug Fixes

• point project URLs to the vulnwatch repository (#1049) (15673c5)

v0.10.2

0.10.2 (2026-10-20)

Bug Fixes

• default CORS_ORIGINS to none and reject * and null origins (#1040) (d62c6a2), closes #1037
• reject forged same-site requests and harden the session cookie (#1044) (0efe301)

v0.10.1

0.10.1 (2026-10-19)

Bug Fixes

• resolve the implementation roadmap closure audit findings (#1020) (eb5f636), closes #1018

v0.10.0

0.10.0 (2026-10-17)

Features

• add IBS Product release detection (#935) (4073d0b), closes #923
• add IBS request synchronization (#967) (6cdf69a), closes #947
• add IBS track release detection (#937) (814e5e1), closes #925
• add set_track_delivery_status() and align the IBS action schema (#964) (70ff8bd), closes #946
• add the IBS client with source info and source diff (#936) (9a16af9)
• add the IBS consumer heartbeat and status endpoint (#985) (d8eb25c)
• add the IBS Product repository download boundary (#933) (18ce97c)
• add the IBS RabbitMQ consumer with package-commit acceleration (#982) (12d7c97)
• add the IBS RabbitMQ request wake-ups (#1001) (e1a8753)
• add the IBS request search, detail, diff, and history operations (#962) (019852c), closes #945
• add the IBS submission and release request lists (#961) (f8feb1f)
• add the shared IBS request reconciliation (#965) (eca7c11)

Bug Fixes

• apply request_delay in the IBS release detectors (#950) (709acab)
• bound affected-version expansion in CVE record ingestion (#997) (c21177b), closes #993
• bound decoding and media-type parsing of external HTTP responses (#999) (7334a5c), closes #994
• consolidate the fetcher request-delay contract (#957) (7a74be4)
• deps: refresh lock file for dnspython and opentelemetry fixes (d8b95f3)
• document the actual error responses in the OpenAPI contract (#992) (fdd2c23)
• handle JSON beyond the parser's limits consistently (#988) (dc1e179), closes #986
• make the request-input admissibility check linear in body size (#996) (5849992)
• make the shared HTTP client honor the proxy environment variables (#1000) (1a3ff25), closes #998
• return 422, not 500, for out-of-range dates and deep settings (#1003) (3cca5b1), closes #995
• return framework-generated API errors in the standard envelope (#991) (9a60e46)
• terminate git's process group when interrupted during start (#927) (9940351), closes #926

v0.9.0

0.9.0 (2026-10-11)

Features

• add BaseGitFetcher and the GIT_CLONE_BASE_DIR setting (#887) (52a05c7)
• add the CISA KEV catalog fetcher (#861) (13829f6), closes #849
• add the CVE affected-versions read endpoint (#867) (30e55b0), closes #864
• add the CVE record parser (#883) (e814f13)
• add the CVE source failure retry evaluator (#904) (4ca7b54)
• add the EPSS score fetcher (#855) (c842aa1), closes #848
• add the Git operations utility (#885) (879fc7b), closes #877
• add the GitHub Security Advisories fetcher (#869) (f9d54d1)
• add the Linux Kernel CVE fetcher and the git-worker runtime (#890) (57c5209), closes #880
• add the Linux Kernel CVE record mapping (#889) (aebeb70), closes #879
• add the MITRE CVE fetcher (#897) (24705e1), closes #882
• add the MITRE CVE record mapping (#896) (f1c7e6f), closes #881
• add the NVD CVE fetcher (#911) (beba746)
• add the NVD CVE record mapping (#908) (acab48a)
• add the OSV advisory fetcher (#863) (327b413), closes #850
• add the Red Hat CVE fetcher and its production-registry isolation (#852) (0bdc493)
• reduce external CVSS vectors to their Base metrics (#873) (e5d70e3), closes #868
• share the NVD Source API cache across on-demand fetches (#913) (f809288)

Bug Fixes

• derive KEV "missing" from the run start, not its finish (#862) (57973fd), closes #860
• initialize redbeat config before generating entry keys (#858) (a7d1a0a), closes #854
• reject secret header values that are not valid at startup (#914) (86e574e), closes #910
• reject surrogate code points in external and request strings (#916) (414a895)

v0.8.0

0.8.0 (2026-10-06)

Features

• add deactivation impact preview and manage-user deactivate (#828) (4aed0d5)
• add log redaction processor for secrets and credential URIs (#839) (6fe691f), closes #802
• add manual role management and final-VA-loss unassignment (#812) (258fc35)
• add the all-CVE default-version CVSS recalculation runner (#842) (72c6042)
• add the CVSS recalculation lease operations and execution fence (#841) (654a23f)
• add the default CVSS version setting mutation and PATCH endpoint (#844) (9ea11a1)
• add the default-CVSS impact preview and its endpoint (#840) (40b947a)
• add the manage-user update command (#816) (cd1d2b9)
• add the manual CVSS recalculation admission and its endpoint (#843) (e7391c3)
• add user deactivation and the deactivate endpoint (#822) (bbfb050)

Bug Fixes

• resolve CLI users by username only and bound CLI input (#818) (dbfa2e6)

v0.7.0

0.7.0 (2026-10-04)

Features

• add AIMAAS threshold sync and Product eligibility recalculation (#770) (5b1222d)
• add automatic Ticket reference ingestion (#754) (477a0b7)
• add CVE fetcher per-CVE finalization and the default CVE catch-up (#801) (1a9329f)
• add CVE fetcher registry, source status, and catch-up task (#760) (342a232)
• add CVE list, CVE detail, and CVE source listing endpoints (#752) (6272db6)
• add CVE refetch endpoint and create/associate freshness refresh (#804) (e88f462)
• add on-demand CVE fetch publication and the fetch_single_cve task (#803) (f3b8f5c)
• add post-ingest CVE package resolution (#796) (97419b6)
• add source-neutral CVE upsert with Ticket composition (#759) (3c2b79c)
• add the AIMAAS Product lifecycle synchronization fetcher (#769) (c457503)
• add the lifecycle transition evaluator and reconciliation (#771) (01f91c4)
• add the maintainer workbench queries and endpoints (#776) (c9ee9e4)
• add the package addition endpoint and Product catalog backfill (#795) (03e9a10)
• add the package addition orchestration (#792) (5889754)
• add the package-record creation boundary (#777) (142e1cd), closes #774
• add the Product catalog list query and endpoint (#767) (5f2abd7)
• add the SMELT maintained-package client (#788) (b007667)
• add the SMELT package maintainership client (#778) (d637811)
• add the SMELT Product catalog synchronization fetcher (#768) (7ad3069)
• add Ticket convergence publication, drains, and operator rerun (#794) (6c5fcd4)
• add trusted-external CVSS batch and CVE-rejection boundary (#756) (288d446), closes #749

Bug Fixes

• reject NUL characters in consumer-supplied API input (#791) (c6869c7)
• reject NUL characters in persisted external strings (#790) (2c1696b)