Repository navigation
release: inventory 0.6.0 production hardening - #6
Merged
Merged
Conversation
Fix lending/checkout concurrency, private IPv6 webhook validation and mobile flows. Harden the standalone PostgreSQL/Redis/private Silo stack, BullMQ worker email, restrictive-source runtime permissions, one-line installation and encrypted fresh-volume recovery. Bump all application versions to 0.6.0. Validation: 1320 Linux units,189 PostgreSQL integrations, production browser layouts, native installation/STARTTLS/restore, final app scans and all eight PR CI checks passed. Shared-service findings and deferred public-VM/provider checks are documented in docs/PRODUCTION_AUDIT_2026-10-29.md.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release Inventory 0.6.0 from dev, including the audited production hardening in #5. This promotes dev commit7cf19960d448629141875714f2b34537e78305c0 after its feature PR passed all eight checks.
The release fixes lending/checkout races, SSRF and mobile flows; completes the standalone PostgreSQL/Redis/private Silo and BullMQ worker/beat setup; and hardens the one-line installer, private-source images, backup and encrypted fresh-volume restore.
Validation:1320 Linux units,189 database integrations, both production browser layouts, actual native install and pre/post-restore STARTTLS, usable recovered keys/private objects, zero findings on both exact app images. Shared-vendor findings and accepted VM/provider rollout limits remain in docs/PRODUCTION_AUDIT_2026-10-29.md. Merge only after this dev-to-main PR passes CI; main release publishing will then be watched.