What's Changed
- Fix IPSec S2S tunnel creation and VPN list scrolling by @xTITUSMAXIMUSX in #414
- Add DHCP lease release and switch lease fetch to GraphQL by @xTITUSMAXIMUSX in #415
- Add in-app bug reporter via GitHub device flow by @xTITUSMAXIMUSX in #417
- Add IPSec operational status, reset/bounce, and isolate OpenVPN status by @xTITUSMAXIMUSX in #418
- Add adjustable dashboard card heights and widths by @xTITUSMAXIMUSX in #419
- Fixed tables calling delete and rule reorder by @xTITUSMAXIMUSX in #420
- Re-anchor firewall separators when rules are renumbered by @xTITUSMAXIMUSX in #421
- Add NetBird and Tailscale container apps by @xTITUSMAXIMUSX in #422
- Feat/api token foundation by @xTITUSMAXIMUSX in #423
- chore: remove unused Next.js starter assets from frontend/public by @MydsiIversen in #427
- feat: allow onboarding and running without a connected router by @MydsiIversen in #426
- docs: add documentation site by @MydsiIversen in #424
- docs: document onboarding skip path and zero-instance dashboard by @MydsiIversen in #431
- chore: remove XFRM suffix from VTI interface labels by @MydsiIversen in #432
- fix: enforce dedicated feature groups on six interface routers by @MydsiIversen in #433
- feat: add segment routing (SRv6) backend module by @MydsiIversen in #435
- fix: stop entrypoint from masking failed database migrations by @MydsiIversen in #440
- test: add golden-file harness for permission equivalence by @MydsiIversen in #441
- feat: add organization schema with backfill and verifier by @MydsiIversen in #442
- feat: add org-scoped connection plumbing and middleware org context by @MydsiIversen in #443
- feat: move admin surface onto org-scoped connections by @MydsiIversen in #446
- test: add adversarial suite skeleton with unscoped-connection canary by @MydsiIversen in #447
- feat: move streaming and power surfaces onto org-scoped connections by @MydsiIversen in #448
- feat: move remaining DB-backed handlers onto org-scoped connections by @MydsiIversen in #449
- docs: document organization groundwork and upgrade verification by @MydsiIversen in #450
- fix: three defects found in live-router testing by @MydsiIversen in #451
- feat: assert row organization on by-id admin mutations by @MydsiIversen in #453
- feat: FK-validate and org-confine API token allowed-ids at creation by @MydsiIversen in #455
- fix: close unauthenticated empty-system restore, require typed confirm by @MydsiIversen in #457
- feat: add audit context columns and audit the admin surface by @MydsiIversen in #459
- feat: add revocation bus so grant/token revocation closes live streams by @MydsiIversen in #461
- feat: org-scope the monitoring/console WebSockets and wire revocation by @MydsiIversen in #462
- fix: require a shared secret on internal API routes by @MydsiIversen in #464
- feat: per-instance SSH key encryption with re-encrypt migration by @MydsiIversen in #466
- feat: row-level-security foundation for organization isolation by @MydsiIversen in #469
- feat: relocate SSO grant reconciliation to a backend endpoint (DO NOT MERGE yet) by @MydsiIversen in #468
- feat: extend RLS policies to the per-user authorization tables by @MydsiIversen in #470
- feat: org ADMIN gets full access on their org's instances (flag-gated) by @MydsiIversen in #471
- feat: set site orgId explicitly on creation by @MydsiIversen in #472
- fix: RLS proof test skips cleanly without CREATEROLE by @MydsiIversen in #473
- feat: context-bootstrap bypass so org resolution works under FORCE RLS by @MydsiIversen in #474
- docs: operator runbook for enabling org enforcement by @MydsiIversen in #475
- test: Golden Rule structural proof + frontend-role grant docs by @MydsiIversen in #476
- feat: add GET /session/organizations for the org UI by @MydsiIversen in #477
- chore: regenerate OpenAPI spec to match backend by @MydsiIversen in #480
- feat: organization-aware sites UI (switcher, grouping, admin label) by @MydsiIversen in #479
- chore: drop the inert-phase DEFAULT on sites.orgId by @MydsiIversen in #482
- feat: move oauth_role_mappings writes to the backend by @MydsiIversen in #484
- docs: clarify backup is platform-admin-only and whole-system by @MydsiIversen in #485
- feat: move oauth_providers writes to the backend by @MydsiIversen in #487
- fix: let a multi-org system admin act globally without org_id by @MydsiIversen in #489
- feat: organization management endpoints (orgs + memberships) by @MydsiIversen in #491
- feat: organization management UI by @MydsiIversen in #492
- fix: promote the first user to ADMIN atomically during onboarding by @MydsiIversen in #494
- fix: firewall groups capabilities crash on x.y.z VyOS versions by @MydsiIversen in #496
- fix: org ADMIN/OWNER sees their org's sites under enforcement by @MydsiIversen in #498
- fix: friendly error when SSO role mapping denies access by @MydsiIversen in #499
- fix: org ADMIN sees org instances under enforcement; adversarial xfails now strict by @MydsiIversen in #501
- docs: organization management and enforcement have shipped by @MydsiIversen in #502
- fix: site-updates banner includes org-admin's org instances under enforcement by @MydsiIversen in #504
- fix: enforce RBAC on routing-policy config/batch/reorder endpoints by @MydsiIversen in #509
- fix: bridge firewall base chains need the filter keyword on VyOS 1.4 too by @MydsiIversen in #510
- Integrate audit fixes #511–#528 (conflicts resolved, DB suite verified) by @MydsiIversen in #529
- fix: gate backend startup on completed migrations by @MydsiIversen in #512
- chore: CI workflow running the backend suite against a real Postgres by @MydsiIversen in #513
- fix: grant FIREWALL_BRIDGE and FIREWALL_FLOWTABLES on the live paths by @MydsiIversen in #517
- fix: middleware polling-endpoint typo and silent session-resolution failure by @MydsiIversen in #518
- fix: don't hold a DB transaction across the connect reachability test by @MydsiIversen in #519
- fix: version-gating corrections in the mapper/builder layer by @MydsiIversen in #520
- fix: savepoint replace-mode restore rows like merge mode by @MydsiIversen in #521
- fix: sole OWNER cannot demote themselves into an owner-less org by @MydsiIversen in #522
- fix: reject malformed segment-routing batch operations by @MydsiIversen in #523
- fix: harden the unauthenticated onboarding surface by @MydsiIversen in #524
- fix: close the org-existence oracle and small revocation/WS gaps by @MydsiIversen in #525
- fix: users.role is backend-owned — drop the frontend UPDATE path by @MydsiIversen in #526
- fix: verify stored SSO id_tokens against the provider JWKS by @MydsiIversen in #527
- test: close the canary and Golden Rule guardrail blind spots by @MydsiIversen in #515
- test: adversarial coverage for org CRUD and token-use confinement by @MydsiIversen in #528
- fix: read the session cookie under its __Secure- name too by @MydsiIversen in #516
- fix: org row-check when granting instance/site assignments by @MydsiIversen in #514
- chore(deps): bump pyjwt from 2.10.1 to 2.13.0 in /backend by @dependabot[bot] in #530
- chore(deps): bump svgo from 3.3.3 to 3.3.4 in /docs-site by @dependabot[bot] in #533
- chore(deps): bump next from 16.2.6 to 16.2.12 in /frontend by @dependabot[bot] in #534
- chore(deps-dev): bump js-yaml from 4.2.0 to 4.3.0 in /frontend by @dependabot[bot] in #535
- feat: Add VRF BGP redistribute and redistribute table support in UI s… by @Jarnster in #538
- chore(deps): bump fast-uri from 3.1.3 to 3.1.5 in /docs-site by @dependabot[bot] in #539
- chore(deps): bump cryptography from 48.0.1 to 50.0.0 in /backend by @dependabot[bot] in #540
- chore(deps): bump sharp and next in /frontend by @dependabot[bot] in #541
- chore(deps-dev): bump brace-expansion from 5.0.6 to 5.0.9 in /frontend by @dependabot[bot] in #542
- fix: Immediate fix for Unified View within the DHCP service by @Jarnster in #543
- feat: Registry for all unified views by @Jarnster in #544
- fix(sso): Entra id_token group claims + correct OAuth error redirect by @xTITUSMAXIMUSX in #549
- deps: bump asyncssh to 2.23.1 (GHSA-2wxc-x7rj-hg8f) by @katsugtgz in #551
- chore(deps-dev): bump js-yaml from 4.3.0 to 4.3.2 in /frontend by @dependabot[bot] in #555
- chore(deps): bump nanoid from 3.3.11 to 3.3.18 in /frontend by @dependabot[bot] in #556
- feat(UI/UX): Container update status indicator by @Jarnster in #554
- feat: DDM diagnostics and hardware sensors for interfaces & system by @Jarnster in #553
- fix: Resolve GUID group claims bug in resolving role mapping by @Jarnster in #557
- feat(vrf): Add BGP address-family network configuration support (#505) by @Jarnster in #558
- docs: Generate OpenAPI spec for VRF BGP AF (91cb450) by @Jarnster
- fix(ui/ux): persist navigation shell across route changes (#532) (de8474e) by @Jarnster
- deps: Change frontend/package.json to resolve 3 vulnerabilities (66f3fa6) by @Jarnster
- readme: Replace Container Registry embed (8820dc3) by @Jarnster
- readme: Add VyMCP suggestion (413cf79) by @Jarnster
- feat: Add KVM support warning in install.sh (9a09c4b) by @Jarnster
- chore: Revise README.md (054a45d) by @Jarnster
- docker: Require SSH key env in docker-compose (e81015a) by @Jarnster
- docs: Add yarn.lock and mdx files for transceivers and HW sensors (1986362) by @Jarnster
- chore: Delete legacy zones.ts (bc3b113) by @Jarnster
- fix: Resolve GUID group claims bug in resolving role mapping (2924f84) by @Jarnster
- docs: Update OpenAPI spec regarding ContainerImageUpdateStatus (7ba242f) by @Jarnster
- feat(ui/ux): Container update status indicator (01ad0c8) by @Jarnster
- docs: Docusaurus fix broken dependencies (2536ce0) by @Jarnster
- docs: Remove unsupported 'future' field in Docusaurus.config (1894691) by @Jarnster
- docs: Update OpenAPI spec (14dfef1) by @Jarnster
- fix: Classify DDM alarm rows before measurement prefixes (cf0a14b) by @Jarnster
- improve: Applied useful codex review suggestions (21ec978) by @Jarnster
- feat: DDM diagnostics and hardware sensors for interfaces & system (e85ff0c) by @Jarnster
- fix: Interface sums not adding up correctly for VLANs (26e87bc) by @Jarnster
- fix(sso): preserve id_token group claims for Entra logins + correct OAuth error redirect (#549) (828ac17) by @xTITUSMAXIMUSX
- fix: Pydantic model validations in nhrpy.py (e2c227e) by @Jarnster
- feat: Registry for all unified views (5ec3411) by @Jarnster
- feat: Add VRF BGP redistribute and redistribute table support in UI schema (#506) (42a3d6c) by @Jarnster
- feat: Create VRF static routes with no explicit routing type (#507) (eafc3ee) by @Jarnster
- fix: forward __Secure- session cookie in the remaining API proxies (6b7add8) by @MydsiIversen
- Integrate audit fixes by @MydsiIversen
- SSO, CI workflow and org fixes by @MydsiIversen
New Contributors
- @katsugtgz made their first contribution in #551
Full Changelog: v1.0.0-beta.3...v1.0.0-beta.4