What's Changed
Bug Fixes
- Missing HSTS header on redirect (302) responses from RedirectFilter (#8705)
- docs(ui): ui-app README lists outdated PatternFly (5) and Node.js (16) versions (#8689)
- Bug: Documentation tab silently fails for PROMPT_TEMPLATE and MODEL_SCHEMA artifacts (#8656)
- ClassCastException importing OpenAPI 3.1 document with server variables (OpenApi31ServerImpl cannot be cast to OpenApi30Server) (#8505)
- Pin container base images and operator image to digest instead of mutable tags (#8194)
- Add decompressed-size and entry-count limits to /admin/import ZIP extraction (#8190)
- Add disallow-doctype-decl to DocumentBuilderAccessor and fail-closed in SchemaFactoryAccessor (#8189)
- Disable wsdl4j import dereference in WSDLReaderAccessor to prevent SSRF (#8188)
- Harden SAXParser in ContentTypeUtil.isParsableXml() to prevent XXE / SSRF / entity-expansion DoS (#8187)
- Unmapped reference error for google import in protobuf schema (#4877)
Enhancements
Other Changes
- UI: page data loaders lack request cancellation / stale response guarding rapid navigation can render the wrong artifact's data (#8879)
- bug: kafkasql contract audit log is written only to the local node - diverges across the cluster and is lost on restart (#8878)
- bug: kafkasql global contract ruleset is not replicated across nodes and is lost on restart (#8848)
- Deleting or updating a non-existent version comment returns HTTP 500 instead of 404 (#8843)
- Fix version comments error handling (#8829)
- bug: kafkasql emits ARTIFACT_CREATED / ARTIFACT_VERSION_CREATED events on a dryRun create (#8825)
- docs: generated
ref-registry-all-configs.adocis out of sync with the generator after #8524, breaking every full build (#8795) - Boolean prompt variable name is rendered twice in the Test Prompt panel (#8790)
- Boolean prompt variables dropped from render request when checkbox is untouched (#8765)
- bug: kafkasql does not emit an event when an artifact version's state changes (#8763)
- Direct navigation to
/agentsis not guarded when the Agents feature is disabled (#8747) - fix(security): HSTS header uses incorrect includeSubdomains directive (#8713)
- docs(operator): README quickstart uses literal VERSION=TODO breaking install URL (#8712)
- Example For Event Driven Architecture is not compatible with apicurio-registry version 3 (#8709)
- feat: Camel Kafka + Apicurio SerDe quickstart / archetype (#8670)
- Add diagnostic dumps to operator OLM tests on failure (#8658)
- Missing integration tests for MCP well-known discovery endpoints (#8613)
- fix: KafkaSql tests flaky in CI — topic metadata propagation race in verifyTopicConfiguration() (#8583)
- Version search with content filter returns 500 (malformed SQL: empty AND () predicate) on SQL storage (#8582)
- [UI] mutability not visible until tab change (#8503)
- Add OpenShift Console plugin for Apicurio Registry (#8484)
- OpenAPI documentation is not rendered in Edge Browser (#8455)
- [UI] Dashboard does not load current user — admin actions hidden & header shows "User" on first render (OIDC/RBAC) (#8371)
- Nested elements in Registry UI result in unesthetic border (#8310)
- CLI: Support artifact references and import/export (#8268)
- CLI: Manage configuration properties (#8267)
- CLI: Retrieve content by global ID, content ID, and hashes (#8266)
- CLI: Support search by content (#8265)
- APICURIO_STORAGE_SQL_KIND=postgresql no longer activates the datasource in 3.3.0 — hardcoded quarkus.datasource.*.active defaults defeat DatabaseConfigInterceptor (#8205)
- Ensure Content Download honors Content MIME-TYPE and it's file extension (#8172)
- CLI: Add file-based credential fallback with --allow-unsafe-credential-storage (#8161)
- UI: search from page 2+ fails to reset pagination offset (#8109)
- Document and clarify how artifact references interact with data contracts (#8104)
- CLI: Support RBAC configuration (role mappings) (#8095)
- CLI: Dynamic help text via picocli command tree walking (#8028)
- CLI: Unify handling of the default group (#8025)
- CLI: Review short property names across all commands (#8024)
- Add missing HSTS headers to error pages (#2411)