{
  "$schema": "./releases.schema.json",
  "product": "Unifuse",
  "releases": [
    {
      "version": "v0.1.7",
      "date": "2026-10-19",
      "title": "Edge protection enforced and longer log retention",
      "entries": [
        { "type": "security", "text": "The web application firewall in front of Unifuse now blocks malicious traffic instead of only logging it." },
        { "type": "security", "text": "Threat findings from our cloud provider's security monitoring are routed straight to the engineering team's alerts." },
        { "type": "changed", "text": "Security and audit logs are now kept for 365 days." },
        { "type": "fixed", "text": "Audit logs record the true client address of each request, and failed sign-in attempts are now audited." },
        { "type": "security", "text": "The malware scanner that checks uploaded documents now runs without elevated privileges." }
      ]
    },
    {
      "version": "v0.1.6",
      "date": "2026-10-16",
      "title": "Vulnerability scan remediation",
      "entries": [
        { "type": "security", "text": "Resolved the findings from the production vulnerability scan." },
        { "type": "security", "text": "Production can only be deployed from reviewed code through the protected release pipeline." }
      ]
    },
    {
      "version": "v0.1.5",
      "date": "2026-10-16",
      "title": "Hardened edge and cache",
      "entries": [
        { "type": "security", "text": "Unifuse is served over HTTPS only, with a minimum of TLS 1.2." },
        { "type": "security", "text": "The internal cache now requires authentication and encrypts traffic in transit." },
        { "type": "fixed", "text": "Request rate limiting now works correctly in production." }
      ]
    },
    {
      "version": "v0.1.4",
      "date": "2026-10-15",
      "entries": [
        { "type": "security", "text": "The public health check no longer reveals any internal configuration details." }
      ]
    },
    {
      "version": "v0.1.3",
      "date": "2026-10-15",
      "entries": [
        { "type": "security", "text": "Application servers now run under a dedicated, least-privilege service identity." }
      ]
    },
    {
      "version": "v0.1.2",
      "date": "2026-10-14",
      "entries": [
        { "type": "fixed", "text": "Corrected a database setup step in the production deployment." }
      ]
    },
    {
      "version": "v0.1.1",
      "date": "2026-10-14",
      "entries": [
        { "type": "fixed", "text": "Each Unifuse web application is now built and served on its own host and reaches the API over its own address." }
      ]
    },
    {
      "version": "v0.1.0",
      "date": "2026-10-14",
      "title": "First production release",
      "summary": "Unifuse is live in production on Google Cloud. Institutions sign in through their own identity provider, and each institution's data is isolated at the database layer.",
      "entries": [
        { "type": "added", "text": "Enrollment, student success and campaign hubs, with the conversational agents, knowledge base and document analysis behind them." },
        { "type": "added", "text": "Single sign-on through your institution's identity provider, with automatic user provisioning (SCIM) for administrators." },
        { "type": "security", "text": "All data is encrypted in transit and at rest, and every institution's records are isolated by the database itself." },
        { "type": "added", "text": "A tamper-evident audit log of administrative and security events." }
      ]
    }
  ]
}