Tags

skeleton-v2.5.2: backup.sh finds a local stack's containers from prod…

…uct.env; its --replace guards honour the prefix (ADR 0017, 0035)

For a product: nothing to do. Locally, scripts/backup.sh no longer needs CONTAINER_PREFIX.

skeleton-v2.5.1: a login from the root lands on the product's start p…

…age, not the profile (ADR 0014)

For a product: nothing to do.

skeleton-v2.5.0: a product's start page and primary colour, a place f…

…or the TU and HRZ logos (ADR 0014, 0035); the advisories of 2026-10-21 (ADR 0018)

For a product, all optional:
- list start routes in apps/web/src/product/start.ts (a new product file)
- set PRODUCT_BRAND_PRIMARY="#rrggbb" in product.env
- add the logos as branding/README.md says; apps/api/src/branding.ts names them

skeleton-v2.4.1: the advisories of 2026-10-21 (npm, Grafana, exporter…

…s, NetBox's Pillow and certifi)

skeleton-v2.4.0: a product names the browser features its application…

… uses (PRODUCT_BROWSER_FEATURES, ADR 0018, 0035)

skeleton-v2.3.0: count a product's seeded roles in the permissions sp…

…ec; Keycloak 26.8.1, NetBox's curl upgraded

skeleton-v2.2.0: importedAccount, an import's account for a person th…

…e directory no longer knows (ADR 0009)

skeleton-v2.1.0: permission requirements refined (ADR 0037); Go's Oct…

…ober CVEs accepted briefly (ADR 0018)

- erasures.create requires users.read and data-exports.any.
- A permission a role stores and also gets from another is shown included
  and locked.
- Dozzle v11.3.1, Mailpit v1.31.5. CVE-2026-78667, CVE-2026-78669 and
  CVE-2026-97031 accepted in .trivyignore.yaml until 2026-10-26.

For products: nothing has to change. allBut('users.read') and
allBut('data-exports.any') now also leave out erasures.create.

skeleton-v2.0.0: gates cover what a page calls, proven by the gate wa…

…lk (ADR 0038)

For products, before scripts/ci.sh passes:
- Drop requires/requiresSome/requiresAny from PRODUCT_NAV_LINKS: a link is
  shown on its route's gate. meta.requires may list several pairs.
- Routes whose page opens a record's panel name meta.walk: { panel: true,
  fixture?: '<name>' }; mark the list data-walk="list"; add fixtures in
  e2e/tests/product/walk-fixtures.ts.
- Fix what e2e/tests/gate-walk.spec.ts finds.

skeleton-v1.9.0: a permission includes the permissions it requires (A…

…DR 0037)

For products: nothing has to change. entry() takes { requires: [...] };
declare what your permissions need. allBut() now also leaves out every
permission that includes a left-out one.