0.5.0 (2026-05-31)

Bug Fixes

• add pkg/utils source to module Dockerfile build context (17f991f)
• add trivyignore for pre-existing test infra findings; sanitize provider version param (f325eb9)
• address code review defects B/C/D and commit all prior fixes (8b859f4)
• address code review feedback (91dae4d)
• address code review findings (ca44377)
• address round-2 code review feedback (8f16650)
• address security review findings - remove list/watch from secrets RBAC, add trivyignore for embedded Trivy CVEs (3cf8280), closes #65
• copy pkg/utils source in server Dockerfile (40f8153)
• dedup Trivy findings, ArchiveSizeBytes fallbacks, ctrl.Result consistency (e7c66a1)
• derive version visibility from parent module/provider owner reference in stats endpoint (484618a)
• e2e: enable providerScanning in Provider Source Scan BeforeAll helm upgrade (c61fd3a)
• enforce browseAuthState visibility in handleBrowseStats (security) (4b09e28)
• enforce public-only visibility for OIDC callers without GroupBinding (efdf5e6)
• filter mostDownloaded through visibility set (security) (b590e7b)
• make: fix ports in ui-tofurc — login.v1 ports must be [min, max] range not a list (d5b255f)
• make: remove explicit version image tag — chart auto-appends -scanning suffix (f00b43b)
• make: use authz_code grant type — tofu login only supports browser-based authz_code (c73500e)
• make: use mktemp -t for macOS compatibility — suffix after XXXXXX breaks mktemp (5650e52)
• make: use short grant_type name 'device_code' in .tofurc — not the OAuth URN (c005c92)
• move pkg/utils to direct require in server go.mod (6ea5ff5)
• OIDC UI client audience + session cookie safety + Playwright regression tests (1b9407a)
• provider scanning fixes, debug logging, and e2e test coverage (6cd41c3)
• remove nil guard from source scan, add e2e test timeout, document breaking CRD change (71c1133)
• restore secrets RBAC rule for depot and version controllers (b02f426)
• security: apply per-resource visibility filtering to depot endpoints; add USER directive to Dockerfile (d9f2e9b)
• security: gate browse endpoints behind auth in OIDC mode (2f96bef)
• server: normalize version strings in enrichModuleCard/enrichProviderCard (725f095)
• server: restrict namespace list to opendepot.defdev.io/public=true labeled namespaces (000338e)
• server: scope card scan counts to latest version only (3cfe451)
• server: scope scan findings to latest version only (3eeaa28)
• ui: add execCommand fallback for clipboard in non-HTTPS contexts (6a08fec)
• ui: add missing deps and fix TypeScript build errors (ee6a23b)
• ui: address code review defects D1-D5 (0ef8799)
• ui: address security review findings for scan-findings refresh (ddb0081)
• ui: derive BASE_URL from OPENDEPOT_SERVER_HOST when OPENDEPOT_SERVER_URL is unset (21a30a4)
• ui: remove duplicated content in UsageSnippet from botched replace (f203832)
• ui: run nginx as non-root and fix logout/test issues (9a6a3b2)
• ui: unify scan findings filter bar style and fix MEDIUM/LOW chip colors (93f85d8)
• ui: use $http_host in NGINX proxy to preserve port in server-generated URLs (9a1686b)
• ui: use Dracula theme for usage snippet instead of brand palette override (7c84338)
• ui: use nightOwl theme for usage snippet (1d60623)
• updated installation guide to include details about emptyDir for stats (69dcbf5)
• updated make and helm chart to support download stats for local dev. Added resource usage to the ui (74039a4)
• use k8serr.IsNotFound for provider fetch in source scan dedup (fca8af5)
• version: add module fast-path to skip re-download when artifact is already synced (7a7393a)
• write provider binary with 0500 perms so Trivy detects gobinary (89d849c)

Features

• add Registry Explorer UI service and browse API endpoints (7f85a68)
• add registry stats and analytics dashboard (165a840)
• bubble up version sync errors with warning indicator and fix depots RBAC (84b2361), closes #04cfd0
• chart: add server.stats.emptyDir for ephemeral download tracking in local dev (23c82ec)
• compute and persist LatestVersion for providers (236db36)
• make: add ui-gpg-secret target — generate throwaway GPG keypair for provider signing (991bb7e)
• make: add ui-tofurc target to write ~/.tofurc for HTTP tofu login (f33594a)
• Merge pull request #64 from tonedefdev/feature/provider-latest-version (7bafded)
• Merge pull request #66 from tonedefdev/fix/force-auth-in-ui (d1d5a9d)
• per-version provider source scans + version selector for scan findings (7fa5da2)
• ui: add auth UI, session token forwarding, depot graph, enterprise polish (9bb72d4)
• ui: add HCL syntax highlighting to usage snippet (e18f6bb)
• ui: add HCL usage snippet card to module and provider detail pages (86e9c64)
• ui: add local quick start make targets and OIDC authz URL override (f166f20)
• ui: add scan findings refresh button on resource detail page (e04e109)
• ui: add server-side pagination and filtering to versions table (ee15d57)
• ui: hide Kind and Sort By sidebar controls on non-registry pages (235f49c)
• ui: replace hand-rolled HCL tokenizer with prism-react-renderer + prismjs HCL grammar (eee821c)