v1.5.12

Improvements

• Decoupled MongoDB migrations from API startup: the server now starts with ./faynoSync only, and migrations run explicitly via ./faynoSync migrate up or ./faynoSync migrate down.

Features

• Added GET /tuf/v1/metadata/targets and GET /tuf/v1/metadata/delegated endpoints to retrieve TUF metadata for targets and delegated roles.
• Added tuf typescript example.

Fixes

• Fixed telemetry period aggregation for range=week and range=month to deduplicate repeated client_id values across days instead of summing daily set sizes.
• Updated telemetry integration coverage to validate that unique_clients, clients_using_latest_version, and clients_outdated remain deduplicated at period level.

v1.5.11

Features

• Added POST /tuf/v1/bootstrap/recovery to rebuild bootstrap Redis settings from persisted TUF metadata for already initialized repositories.
• Added asynchronous bootstrap_recovery task flow with lock protection, recovery prechecks, timeout support, and task status reporting.

Security & Access Control

• Added RBAC edit permission checks for TUF task status, artifact publish, and artifact delete endpoints.
• Added owner resolution middleware for team users so TUF artifact operations run under resolved owner context.

Reliability

• Unified bootstrap settings persistence and recovery via a shared Redis save path, including delegated role expirations and ROOT_SIGNING initialization.

API Tooling

• Updated Postman collection with bootstrap recovery API request examples.

v1.5.10

Dependencies

• Upgraded go.opentelemetry.io/otel, go.opentelemetry.io/otel/metric, go.opentelemetry.io/otel/sdk, go.opentelemetry.io/otel/sdk/metric, and go.opentelemetry.io/otel/trace to v1.43.0.

Security & Signing Improvements

• Extended TUF online signing to support multiple key types (Ed25519, ECDSA, and RSA-PSS) loaded from filesystem private keys.
• Added signer/verifier construction by key type with explicit keyid-to-key-material validation to prevent mismatched key usage.

Maintenance

• Removed legacy bootstrap generation API surface (/tuf/v1/bootstrap/generate and /tuf/v1/bootstrap/locks) and deleted obsolete generate handlers/tests.

v1.5.9

Dependencies

• Upgraded github.com/aws/aws-sdk-go-v2/service/s3 to v1.97.3.
• Upgraded github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream to v1.7.8.

v1.5.8

Dependencies

• Upgraded github.com/go-jose/go-jose/v4 to v4.1.4.

v1.5.7

Dependencies

• Upgraded Go to v1.26.1.
• Upgraded google.golang.org/grpc to v1.79.3.

v1.5.6

Maintenance

• Migrated from MinIO to Garage for default local S3 storage.

v1.5.5

Features

• Slack notifications now reuse a single mutable message per app version across artifact create, update, and delete flows, with Redis-backed state, configurable TTL, and cleanup when a version is deleted.

v1.5.4

Dependencies

• Upgraded go.opentelemetry.io/otel/sdk to v1.40.0.

Improvements

• Token create endpoint: changed response status code for token creation.

v1.5.3

Features

• API Tokens: Added API tokens for secure and scoped access to the API.

Testing

• API Tokens integration tests: Added integration tests for creating, listing, and deleting API tokens.