Skip to content

Release v0.6.0 #115

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
balcsida merged 2 commits into from
Sep 23, 2026
Merged

Release v0.6.0 #115

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c2da09a
docs: prepare v0.6.0 changelog
balcsida Sep 23, 2026
5c27e9e
chore(release): bump Helm chart to v0.6.0
balcsida Sep 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
54 changes: 47 additions & 7 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,34 @@ the compatibility and migration notes before upgrading.

## [Unreleased]

## [0.6.0] - 2026-09-23

This release adds the opt-in Dependencies & Licenses module: a preserved
inventory of each managed repository's GitHub dependency-graph SBOM export,
exact-version license evidence from explicitly configured package registries,
portfolio queries and exports, standards-based SBOM imports, review workflows,
and read-only MCP tools. Everything is disabled by default; with
`GRAPHNEST_SUPPLY_CHAIN` unset the server behaves as in v0.5.0 apart from the
additive migrations below.

### Upgrade guidance

- Migrations 033 through 036 add the `supply_chain_*` tables; they run
automatically at startup, cascade from `repositories`, and touch nothing
else. No configuration changes are required. ([#105], [#108], [#110], [#111])
- The module is opt-in and durable-mode only: set `GRAPHNEST_SUPPLY_CHAIN=true`
(Helm: `server.supplyChain.enabled`) to start collection. It never contacts
a package registry unless a `GRAPHNEST_SUPPLY_CHAIN_REGISTRY_<ECOSYSTEM>_URL`
route is configured, and a GitHub dependency-graph export is always reported
as an unbound observation (`subject_assurance: unknown`) with `NOASSERTION`,
`NONE`, and `UNLICENSED` never mapped to a license. ([#106], [#108])
- Snapshot retention defaults to ten snapshots per stream
(`GRAPHNEST_SUPPLY_CHAIN_RETAIN_SNAPSHOTS`); the current snapshot and any
snapshot referenced by a review record are always kept. ([#113])
- The GitHub dependency-graph collector has been exercised against recorded
GHES fixtures only; live GHES and registry behaviour still require
environment-specific validation (`docs/supply-chain-pilot-checklist.md`).

### Added

- Opt-in Dependencies & Licenses inventory (`GRAPHNEST_SUPPLY_CHAIN=true`,
Expand All @@ -18,6 +46,7 @@ the compatibility and migration notes before upgrading.
(`subject_assurance: unknown`) and license fields are preserved verbatim.
Migration 033 adds the `supply_chain_*` tables; with the module disabled
nothing else changes. See ADR-0017 and `docs/execplans/supply-chain.md`.
([#104], [#105], [#106], [#107])
- Exact-version license evidence for npm, NuGet, and Maven components from
explicitly configured registry routes (`GRAPHNEST_SUPPLY_CHAIN_REGISTRY_*`),
parsed with a bounded SPDX 2.3 expression parser against the pinned SPDX
Expand All @@ -27,14 +56,14 @@ the compatibility and migration notes before upgrading.
or unknown and are shown in the component table and a new evidence detail
view (`GET /v1/supply-chain/repositories/{id}/component`). No route means no
outbound license traffic. Migration 034 adds the evidence, enrichment-job,
and assessment tables.
and assessment tables. ([#108])
- Portfolio read APIs over the caller's authorized repositories: an overview
whose every count names its denominator, keyset-paginated unique
coordinates with ecosystem, search, license, and assessment filters,
bounded facets, a coordinate detail listing authorized occurrences, a CSV
export with provenance columns and formula-safe cells, and a snapshot
comparison that separates component, declared-license, and edge changes
from document metadata changes.
from document metadata changes. ([#109])
- Standards-based imports of SPDX 2.3 JSON and CycloneDX 1.6 JSON into
declared `import:<subject>:<label>` streams (`POST /v1/supply-chain/imports`),
with format detection from the document, explicit rejection of other
Expand All @@ -44,21 +73,21 @@ the compatibility and migration notes before upgrading.
(`PUT /v1/supply-chain/upload-grants`). A derived SPDX export
(`GET /v1/supply-chain/exports/{id}/derived.spdx.json`) names GraphNest as
creator, links the preserved original, and carries assessments as comments
only. Migration 035 adds imports and upload grants.
only. Migration 035 adds imports and upload grants. ([#110])
- Review workflows: a queue of occurrences needing review, human license
conclusions recorded as immutable evidence, scoped approve/reject/exception
decisions with optimistic concurrency on the evidence fingerprint
(`409 stale_basis`), versioned policies evaluated over the SPDX expression
tree with a clearly labelled example fixture and no auto-approval of
unknowns, repository-scoped review grants, and an append-only audit trail
under `/v1/supply-chain/review/*` and `/v1/supply-chain/policies`.
Migration 036 adds the review tables.
Migration 036 adds the review tables. ([#111])
- Read-only MCP tools `search_dependency_inventory`,
`find_component_repositories`, and `inspect_component_license` over the
same authorized services as REST.
same authorized services as REST. ([#112])
- Retention for inventory snapshots (`GRAPHNEST_SUPPLY_CHAIN_RETAIN_SNAPSHOTS`)
that always preserves the current snapshot and any snapshot referenced by
a review record, plus bounded collection and job history.
a review record, plus bounded collection and job history. ([#113])

## [0.5.0] - 2026-09-18

Expand Down Expand Up @@ -281,7 +310,8 @@ MCP client sign-in, and an expanded experimental graph-analysis foundation.
Published images retain SBOMs and provenance; images and charts use immutable
digests and GitHub attestations. ([#36])

[Unreleased]: https://github.com/balcsida/graphnest/compare/v0.5.0...HEAD
[Unreleased]: https://github.com/balcsida/graphnest/compare/v0.6.0...HEAD
[0.6.0]: https://github.com/balcsida/graphnest/compare/v0.5.0...v0.6.0
[0.5.0]: https://github.com/balcsida/graphnest/compare/v0.4.3...v0.5.0
[0.4.3]: https://github.com/balcsida/graphnest/compare/v0.4.1...v0.4.3
[0.4.2]: https://github.com/balcsida/graphnest/compare/v0.4.1...v0.4.2
Expand All @@ -304,3 +334,13 @@ MCP client sign-in, and an expanded experimental graph-analysis foundation.
[#94]: https://github.com/balcsida/graphnest/pull/94
[#99]: https://github.com/balcsida/graphnest/pull/99
[#100]: https://github.com/balcsida/graphnest/pull/100
[#104]: https://github.com/balcsida/graphnest/pull/104
[#105]: https://github.com/balcsida/graphnest/pull/105
[#106]: https://github.com/balcsida/graphnest/pull/106
[#107]: https://github.com/balcsida/graphnest/pull/107
[#108]: https://github.com/balcsida/graphnest/pull/108
[#109]: https://github.com/balcsida/graphnest/pull/109
[#110]: https://github.com/balcsida/graphnest/pull/110
[#111]: https://github.com/balcsida/graphnest/pull/111
[#112]: https://github.com/balcsida/graphnest/pull/112
[#113]: https://github.com/balcsida/graphnest/pull/113
4 changes: 2 additions & 2 deletions deploy/helm/graphnest/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,6 @@ apiVersion: v2
name: graphnest
description: Generic Kubernetes chart for the GraphNest single-node pilot
type: application
version: 0.5.0
appVersion: 0.5.0
version: 0.6.0
appVersion: 0.6.0
kubeVersion: ">=1.25.0-0"
Loading