Tags

1.4.2

1.4.2

- CLAUDE.md is no longer tracked: it stays on disk as local Claude Code guidance, like .claude/ and the .wiki symlink

1.4.1

1.4.1

- Wiki moved out of the repo into the global hub; .wiki is now a gitignored symlink
- Async pending-job limits configurable via APP_ASYNC_MAX_PENDING_PER_PRINCIPAL / APP_ASYNC_MAX_PENDING_GLOBAL (defaults unchanged: 50 / 500)
- Configuration reference updated (README, docs EN/IT)

1.4.0

Release 1.4.0

- Add GET /api/v1/verifications/jobs: paginated, filterable jobs list (owner/status/date), role-scoped.
- Expose requestedBy owner on job views (200) and 410 DeletedJobView; realign 410 contract.

1.3.4

1.3.4 — bump runtime base to Alpine 3.24 (fixes freetype CVE-2026-23865 and fontconfig CVE-2026-34085)

1.3.3

1.3.3 — dedup same-commit CI runs on GitHub; Trivy fs scans run offline (no Maven Central 429)

1.3.2

1.3.2 — skip S3 MinIO integration test when no Docker daemon is present (green GitLab test stage)

1.3.1

Release 1.3.1

- exclude netty-nio-client (the AWS SDK async transport) from the s3
  dependency: only the synchronous S3Client is used, so the Netty stack was
  unreachable code carrying 9 known vulnerabilities (4 High, 5 Medium)
- GitLab dependency-scan job now prints the OSV report instead of aborting
  under set -e before reaching it

1.3.0

Release 1.3.0

- async job picker: over-fetch and shuffle candidates, and let a worker that
  loses the atomic claim try the next candidate within the same poll, so a
  burst arriving at N idle instances no longer gets only one instance's worth
  of jobs claimed per round
- the validation budget deadline is armed only after the claim is won

1.2.0

Release 1.2.0

- S3-compatible document storage adapter (app.storage.type=s3), enabling
  multi-replica deployments; filesystem stays the default
- documentation for the S3 backend, MinIO in docker-compose, and a new
  horizontal-scaling chapter (IT and EN)
- Italian documentation reviewed: fewer anglicisms, expanded abbreviations,
  stale versions and broken links fixed

1.1.2

Release 1.1.2 — security: CVE-2026-54291 (pgjdbc), CVE-2026-59889 (Jackson 3)

1.1.1

1.1.1

1.1.0

1.1.0

1.0.0

0.13.3

0.13.3

0.13.2

Bump Logback to 1.5.37 (CVE-2026-9828, CVE-2026-10532)

- fix(deps): logback 1.5.37 closes two HardenedObjectInputStream
  whitelist bypasses in logback-core (Object Injection via
  SimpleSocketServer/SimpleSSLSocketServer): CVE-2026-9828 (fixed
  in 1.5.33) and CVE-2026-10532 (fixed in 1.5.34). Full unit suite
  green (448 tests).

0.13.1

Bump Jackson to 2.22.1 (CVE-2026-54515)

- fix(deps): jackson-bom 2.22.1 closes the last open Jackson advisory
  (CVE-2026-54515), now published on Maven Central. Clears the final
  Dependabot alert; full unit suite green (448 tests).

0.13.0

Error catalog codes in API responses + async-dispatch auth fix

- feat(errors): stable machine-readable catalog codes on every error
  response (problem+json 'code' member, job errorCode, V5 migration)
- fix(security): persist api-key security context for async dispatches;
  keep-alive connections no longer aborted after streaming responses

0.12.4

0.12.3

0.12.3: code-review fixes (async pipeline, TSL sync, security hardening)

0.12.2