What's Changed
- chore: sync development with main (v1.17.2) by @agigante80 in #291
- docs(roadmap): close P0, open P1 v1.18 Payment alerts by @agigante80 in #292
- feat(notifications): validated Handlebars message templates (#257) by @agigante80 in #293
- feat(alerts): missing-payment alerts from Actual schedules (#258, #271) by @agigante80 in #295
- chore(forge-kit): refresh vendored governance scripts and ticket-standards doc by @agigante80 in #310
- chore: sync development with main (v1.17.3) by @agigante80 in #311
- fix(hooks): pre-push fails on test failures; jest ignores .claude/ worktrees (#315) by @agigante80 in #316
- chore(deps): production dependency group and vulnerable transitives (#312) by @agigante80 in #317
- ci: actions/upload-artifact v4 to v7 (#314) by @agigante80 in #318
- chore(deps): js-yaml, knip, puppeteer dev bumps (#313) by @agigante80 in #320
- fix(dashboard): Basic auth splits on the first colon only (#281) by @agigante80 in #321
- fix(config): validate trustProxy shape regardless of CONFIG_STRICT (#278) by @agigante80 in #322
- docs: action pinning and branch-guard claims match what is enforced (#282) by @agigante80 in #323
- fix(alerts): schedule alert review findings F1-F8 (#297) by @agigante80 in #319
- feat(dashboard): serve Chart.js from npm instead of a CDN (#244) by @agigante80 in #324
- fix(sync): make auto-retry after a failed sync fire (#273) by @agigante80 in #325
- feat(security): helmet security headers and a strict CSP for the dashboard (#243) by @agigante80 in #329
- fix(config): configurable timezone instead of hardcoded Europe/Madrid (#266) by @agigante80 in #327
- security(ci): SHA-pin every GitHub Action and guard against regression (#249) by @agigante80 in #333
- docs(security): add root SECURITY.md (#254) by @agigante80 in #334
- fix(dashboard): apply the History tab server filter (#288) by @agigante80 in #336
- fix(templates): low findings from the #257 review (#294) by @agigante80 in #331
- fix(sync): hung-call hardening follow-ups from the #272 review (#284) by @agigante80 in #340
- fix(ws-logs): hardening follow-ups from the #242 review (#280) by @agigante80 in #339
- feat(dashboard): persist payment alert snapshot and serve GET /api/dashboard/payments (#260) by @agigante80 in #343
- fix(schedule-alerts): stop digest and immediate-mode budget starvation (#337, #338) by @agigante80 in #344
- fix(dashboard): throttle review lows from #246 (#286) by @agigante80 in #342
- chore: bump version to 1.18.0 by @agigante80 in #345
- Release v1.18.0 by @agigante80 in #346
Full Changelog: v1.17.3...v1.18.0