SkillHub v0.2.18

Personal namespaces, safer publishing and subscription flows, a richer CLI, and broader deployment and localization support.

🌟 Highlights

• Personal namespaces can be provisioned automatically for newly activated accounts, with operator-configurable naming and idempotent ownership handling.
• The CLI adds namespace workspace synchronization with sync pull, status, diff, and push, and is released as CLI 0.1.10.
• SkillHub improves package publishing, scan-task durability, subscription authorization, API label projections, and RISC-V Server/Web image support.

🚨 Breaking Changes

None for existing AMD64/ARM64 deployments. RISC-V support is intentionally limited to the Server and Web images; the Scanner and the full Compose dependency stack are not claimed as RISC-V compatible.

The Server automatically applies Flyway V44/V45 for the transactional scan-task outbox. Back up PostgreSQL before upgrading; the clean v0.2.17-to-v0.2.18 path has been validated with retained user data.

✨ Features

• Auto-provision an operator-controlled personal namespace for newly activated accounts, including runtime settings and idempotent ownership handling by @Vast-Stars in #712.
• Add namespace workspace synchronization commands and incremental fingerprint metadata to CLI 0.1.10 by @15258725278 in #724.
• Allow users to select a skill folder directly in the Web publisher; the browser creates the validated ZIP without adding a dependency by @FenjuFu in #757.
• Make Server and Web release images publishable for linux/riscv64, with explicit Scanner limitations and architecture checks by @FenjuFu in #725.
• Let operators override per-category rate-limit thresholds and the global switch through Server configuration, while preserving annotation defaults; the bundled Compose files do not yet expose these variables directly, so Compose users need an override until a follow-up release by @FenjuFu in #756.
• Return skill labels inline from listing endpoints when include=labels, using bounded batch projection by @FenjuFu in #730.
• Add Russian Web and Server localization by @michael-xiii in #700.

🐛 Bug Fixes

• Add the server namespace-manifest route required by CLI workspace sync, and keep bearer-token authentication and scope checks working behind reverse-proxy sub-paths such as /skillhub/, by @XiaoSeS in #775.
• Make CLI namespace-sync fingerprints deterministic across server and Node path ordering, preventing clean mixed-path workspaces from being reported as locally changed, by @XiaoSeS in #780.
• Preserve relative redirects from bare /skillhub to /skillhub/ behind TLS-terminating reverse proxies, preventing an HTTPS-to-HTTP downgrade by @XiaoSeS in #776.
• Preserve the Server's numeric UID/GID across the Alpine-to-Noble runtime-image change so local-storage volumes created by v0.2.17 remain writable after upgrade by @XiaoSeS in #779.
• Enforce trusted, verified OAuth identity attributes and reject merged or system accounts during external login by @XiaoSeS in #688.
• Preserve OAuth returnTo targets through provider callbacks by @gale-popai in #623.
• Prevent the login page from redirecting itself repeatedly on authentication-method 401 responses by @XiaoSeS in #759.
• Enforce current visibility and membership authorization for subscription creation and subscriber fan-out by @XiaoSeS in #765.
• Resolve author display names in skill cards with batch loading by @XiaoSeS in #764.
• Prevent scan tasks from being lost between database commit and Redis publication with a transactional outbox, retries, reclaiming, cleanup, and consumer idempotency by @bbdu3 in #752.
• Accept Windows ZIP directory entries that use backslashes by @FenjuFu in #742.
• Prefer public/global published skills for legacy plain-slug lookup by @myml in #750.
• Remove double-encoding of dashboard skill slugs by @myml in #747.
• Keep Select menus within viewport collision bounds on short or narrow screens by @FenjuFu and @XiaoSeS in #754 and #755.
• Add the OIDC provider logo used by the login flow by @qwn3213 in #734.
• Disable host-locale fallback so explicit locale selection is deterministic by @FenjuFu in #741, with Russian key parity restored by @XiaoSeS in #760.

⚡ Performance

• Batch-load labels and skill-card owner data instead of issuing one query per row by @FenjuFu in #730 and @XiaoSeS in #764.
• Use a browser-side dependency-free STORE ZIP writer for folder uploads, filtering VCS, build, and OS metadata before upload by @FenjuFu in #757.

📚 Documentation

• Add Python REST client examples covering search, resolve, download, publish, star, and rate by @FenjuFu in #702.
• Add privacy, content-safety, and public incident/governance policy evidence by @FenjuFu in #723.
• Document RISC-V scope and full-stack limitations by @FenjuFu in #725.
• Expand FAQ and troubleshooting guidance for CLI namespaces and PostgreSQL volume permissions by @FenjuFu and @XiaoSeS in #743 and #745.
• Publish the reviewed W34 and W35 weekly reports by @XiaoSeS in #739 and #771.

🔧 Chore

• Resolve the reported transitive npm dependency alerts and keep staging configuration aligned by @XiaoSeS in #746.
• Harden CSP, restrict production connections, and hide Nginx server version details by @myml in #748.
• Resolve CodeQL findings around YAML parsing, callback validation, security matching, and sensitive logging by @FenjuFu in #762.
• Allow smoke tests to target a separate Actuator endpoint by @ShinyHero666 in #689.

📖 Documentation

• Docs site: https://iflytek.github.io/skillhub/

👥 New Contributors

See the linked pull requests for contributor attribution.

Full Changelog: v0.2.17...v0.2.18