Tags

1.4.6

1.4.6

- Security: bump embedded Tomcat to 11.0.25, clearing three critical Apache Tomcat advisories affecting 11.0.0-M1 through 11.0.24 (CVE-2026-65905 DIGEST replay, CVE-2026-65182 security-constraint ordering bypass, CVE-2026-68525 FORM auth bypass)
- Security: add an expat>=2.8.4-r0 apk floor to the Alpine runtime stage for CVE-2026-66046, CVE-2026-76641, CVE-2026-76956 and CVE-2026-76957; expat arrives transitively via fontconfig and alpine:3.24 still ships 2.8.3-r0
- CI: drop the now-unused GHSA-5jmj-h7xm-6q6v suppression from osv-scanner.toml

1.4.5

1.4.5

- CI: grant actions:read to the osv-scan job so the OSV SARIF report reaches GitHub code scanning

1.4.4

1.4.4

- Security: pin libcrypto3/libssl3 to >=3.5.8-r0 in the Alpine runtime stage, clearing ten OpenSSL CVEs (CVE-2026-14456 HIGH, -18798/-63072/-63076 MEDIUM, six LOW) that survived rebuilds because CI replayed the cached apk layer

1.4.3

1.4.3

- Security: bump httpcore5/httpcore5-h2 to 5.4.3 (CVE-2026-54399, CVE-2026-54428), httpclient5 to 5.6.4 (CVE-2026-64607), and log4j2 to 2.25.5 (CVE-2026-49844); all four were transitive DoS/format issues, no API change

1.4.2

1.4.2

- CLAUDE.md is no longer tracked: it stays on disk as local Claude Code guidance, like .claude/ and the .wiki symlink

1.4.1

1.4.1

- Wiki moved out of the repo into the global hub; .wiki is now a gitignored symlink
- Async pending-job limits configurable via APP_ASYNC_MAX_PENDING_PER_PRINCIPAL / APP_ASYNC_MAX_PENDING_GLOBAL (defaults unchanged: 50 / 500)
- Configuration reference updated (README, docs EN/IT)

1.4.0

Release 1.4.0

- Add GET /api/v1/verifications/jobs: paginated, filterable jobs list (owner/status/date), role-scoped.
- Expose requestedBy owner on job views (200) and 410 DeletedJobView; realign 410 contract.

1.3.4

1.3.4 — bump runtime base to Alpine 3.24 (fixes freetype CVE-2026-23865 and fontconfig CVE-2026-34085)

1.3.3

1.3.3 — dedup same-commit CI runs on GitHub; Trivy fs scans run offline (no Maven Central 429)

1.3.2

1.3.2 — skip S3 MinIO integration test when no Docker daemon is present (green GitLab test stage)

1.3.1

Release 1.3.1

- exclude netty-nio-client (the AWS SDK async transport) from the s3
  dependency: only the synchronous S3Client is used, so the Netty stack was
  unreachable code carrying 9 known vulnerabilities (4 High, 5 Medium)
- GitLab dependency-scan job now prints the OSV report instead of aborting
  under set -e before reaching it

1.3.0

Release 1.3.0

- async job picker: over-fetch and shuffle candidates, and let a worker that
  loses the atomic claim try the next candidate within the same poll, so a
  burst arriving at N idle instances no longer gets only one instance's worth
  of jobs claimed per round
- the validation budget deadline is armed only after the claim is won

1.2.0

Release 1.2.0

- S3-compatible document storage adapter (app.storage.type=s3), enabling
  multi-replica deployments; filesystem stays the default
- documentation for the S3 backend, MinIO in docker-compose, and a new
  horizontal-scaling chapter (IT and EN)
- Italian documentation reviewed: fewer anglicisms, expanded abbreviations,
  stale versions and broken links fixed

1.1.2

Release 1.1.2 — security: CVE-2026-54291 (pgjdbc), CVE-2026-59889 (Jackson 3)

1.1.1

1.1.1

1.1.0

1.1.0

1.0.0

0.13.4

Bump deprecated GitHub Actions off Node 20; ignore .zcode/

0.13.3

0.13.3

0.13.5