# Changelog

All notable changes to RootGuard are documented here, generated from the
commit history at release time. See [ROADMAP.md](ROADMAP.md) for what's
still ahead.
## [1.0.12] - 2026-11-10

### Fixed

- Clear the nightly findings from 2026-11-09 ([#806](https://github.com/foxly-it/rootguard/pull/806))
- Stop failing after a successful install ([#807](https://github.com/foxly-it/rootguard/pull/807))
- Close the expiry tracking issue once nothing is due ([#808](https://github.com/foxly-it/rootguard/pull/808))

### Maintenance

- Bump the npm group ([#802](https://github.com/foxly-it/rootguard/pull/802))
- Bump debian ([#804](https://github.com/foxly-it/rootguard/pull/804))
- Bump jsdom in /rootguard-webapp/frontend ([#803](https://github.com/foxly-it/rootguard/pull/803))
- Bump the actions group across 1 directory with 2 updates ([#805](https://github.com/foxly-it/rootguard/pull/805))

## [1.0.11] - 2026-11-06

### Fixed

- Review the new sqlite and zlib findings ([#793](https://github.com/foxly-it/rootguard/pull/793))
- Update AdGuard Home to v0.107.80 ([#796](https://github.com/foxly-it/rootguard/pull/796))
- Override minimatch to close GHSA-g3hv-75wg-m249 ([#797](https://github.com/foxly-it/rootguard/pull/797))
- Follow AdGuard Home v1.0's filter route, test UI and updates ([#798](https://github.com/foxly-it/rootguard/pull/798))
- Narrow the Go exceptions to cosign, recheck the Debian ones ([#799](https://github.com/foxly-it/rootguard/pull/799))
- Offer new AdGuard Home pins on existing installations ([#800](https://github.com/foxly-it/rootguard/pull/800))

## [1.0.10] - 2026-11-05

### Fixed

- Clear the image's HIGH findings, recheck GO-2026-5932 ([#792](https://github.com/foxly-it/rootguard/pull/792))

### Maintenance

- Bump the npm group ([#787](https://github.com/foxly-it/rootguard/pull/787))
- Bump the base-images group across 6 directories with 3 updates ([#788](https://github.com/foxly-it/rootguard/pull/788))
- Bump docker/login-action ([#789](https://github.com/foxly-it/rootguard/pull/789))
- Refresh drifted package pins ([#791](https://github.com/foxly-it/rootguard/pull/791))

## [1.0.9] - 2026-10-31

### Fixed

- Unbreak Unbound CI on Ubuntu 26 runners, pin libcurl 8.23.0-r0 ([#786](https://github.com/foxly-it/rootguard/pull/786))

### Maintenance

- Refresh drifted package pins ([#780](https://github.com/foxly-it/rootguard/pull/780))
- Bump the npm group ([#781](https://github.com/foxly-it/rootguard/pull/781))
- Bump the base-images group across 6 directories with 4 updates ([#782](https://github.com/foxly-it/rootguard/pull/782))
- Bump actions/setup-python ([#783](https://github.com/foxly-it/rootguard/pull/783))

## [1.0.8] - 2026-10-24

### Fixed

- Pin brotli-libs 1.2.1-r0, update undici and zod (#778) ([#779](https://github.com/foxly-it/rootguard/pull/779))

## [1.0.7] - 2026-10-23

### CI

- Propose a security release when the published one has fixed findings (#772) ([#773](https://github.com/foxly-it/rootguard/pull/773))
- Run the pin bot every 6 hours (#775) ([#776](https://github.com/foxly-it/rootguard/pull/776))

### Documentation

- Release history for v1.0.6 ([#771](https://github.com/foxly-it/rootguard/pull/771))

### Maintenance

- Refresh drifted package pins ([#774](https://github.com/foxly-it/rootguard/pull/774))
- Refresh drifted package pins ([#777](https://github.com/foxly-it/rootguard/pull/777))

## [1.0.6] - 2026-10-21

### Added

- Move runtime stage to distroless/static-debian12 (#695) ([#696](https://github.com/foxly-it/rootguard/pull/696))
- Bump docker:29-cli base, narrow bundled-binary suppressions (#703) ([#706](https://github.com/foxly-it/rootguard/pull/706))

### CI

- Push and open the fix PR with PIN_REFRESH_TOKEN ([#698](https://github.com/foxly-it/rootguard/pull/698))
- Warn ahead of expiring .trivyignore.yaml suppressions (#710) ([#711](https://github.com/foxly-it/rootguard/pull/711))
- Also cover the Alpine apk pins (#712) ([#713](https://github.com/foxly-it/rootguard/pull/713))
- Add scan-images.sh, a local image scan that matches CI exactly (#714) ([#715](https://github.com/foxly-it/rootguard/pull/715))
- Gate upstream vulnerability findings only on PRs that touch them (#719) ([#720](https://github.com/foxly-it/rootguard/pull/720))
- Let Dependabot cover every shipped ecosystem (#721) ([#722](https://github.com/foxly-it/rootguard/pull/722))
- Restore trivy's vulnerability DB from a nightly-seeded cache (#723) ([#724](https://github.com/foxly-it/rootguard/pull/724))
- Auto-merge bot PRs once CI is green (#727) ([#734](https://github.com/foxly-it/rootguard/pull/734))
- Stop compiling arm64 images under QEMU ([#737](https://github.com/foxly-it/rootguard/pull/737))
- Test the documented upgrade path instead of bypassing upgrade-test (#725) ([#726](https://github.com/foxly-it/rootguard/pull/726))
- Hold TypeScript at <7 until typescript-eslint supports it (#749) ([#750](https://github.com/foxly-it/rootguard/pull/750))
- Keep @types/node majors with the Node runtime (#757) ([#758](https://github.com/foxly-it/rootguard/pull/758))

### Fixed

- Suppress unfixed libexpat CVE-2026-93990 (#687) ([#688](https://github.com/foxly-it/rootguard/pull/688))
- Unblock CI after upstream Debian/Alpine/npm security updates ([#691](https://github.com/foxly-it/rootguard/pull/691))
- Unblock CI after Go 1.26.9 and upstream package security updates ([#704](https://github.com/foxly-it/rootguard/pull/704))
- Curl pin refresh for Unbound + suppress CVE-2026-78669 in bundled cosign/compose ([#708](https://github.com/foxly-it/rootguard/pull/708))
- Libexpat 2.9.0 (DSA-6566-1) + bridge trivy's DB lag ([#716](https://github.com/foxly-it/rootguard/pull/716))
- Suppress unreachable CVE-2026-9538 in perl-base (#743) ([#744](https://github.com/foxly-it/rootguard/pull/744))
- Pin libexpat 2.9.0-r0, suppress unreachable x/text CVE in cosign (#745) ([#746](https://github.com/foxly-it/rootguard/pull/746))
- Drop 22 trivy suppressions that no longer match anything (#718) ([#748](https://github.com/foxly-it/rootguard/pull/748))
- Match whole name=version tokens in the pin bots (#767) ([#768](https://github.com/foxly-it/rootguard/pull/768))
- Go 1.26.10 for all binaries, cosign v3.1.4, docker:29-cli 29.9.1 (#766) ([#769](https://github.com/foxly-it/rootguard/pull/769))

### Maintenance

- Bump the actions group with 3 updates ([#707](https://github.com/foxly-it/rootguard/pull/707))
- Bump the base-images group across 6 directories with 3 updates ([#735](https://github.com/foxly-it/rootguard/pull/735))
- Refresh drifted package pins ([#747](https://github.com/foxly-it/rootguard/pull/747))
- Bump the go group across 2 directories with 2 updates ([#728](https://github.com/foxly-it/rootguard/pull/728))
- Bump the npm group across 1 directory with 10 updates ([#729](https://github.com/foxly-it/rootguard/pull/729))
- Bump jsdom in /rootguard-webapp/frontend ([#730](https://github.com/foxly-it/rootguard/pull/730))
- Bump vitest in /rootguard-webapp/frontend ([#731](https://github.com/foxly-it/rootguard/pull/731))
- Bump globals in /rootguard-webapp/frontend ([#732](https://github.com/foxly-it/rootguard/pull/732))
- Bump vitest ([#751](https://github.com/foxly-it/rootguard/pull/751))
- Bump vite to 8 together with @vitejs/plugin-react 6 (#759) ([#760](https://github.com/foxly-it/rootguard/pull/760))
- Bump typescript in /rootguard-webapp/frontend ([#752](https://github.com/foxly-it/rootguard/pull/752))
- Bump @types/node ([#763](https://github.com/foxly-it/rootguard/pull/763))
- Bump lucide-react in /rootguard-webapp/frontend ([#765](https://github.com/foxly-it/rootguard/pull/765))
- Refresh drifted package pins ([#770](https://github.com/foxly-it/rootguard/pull/770))

### Other

- Revert the temporary 1.0.5 upgrade-test bypass ([#686](https://github.com/foxly-it/rootguard/pull/686))

### Testing

- Wait for the enabled download button in the Logs test (#738) ([#739](https://github.com/foxly-it/rootguard/pull/739))
- Free the scenario container name before reusing it (#740) ([#741](https://github.com/foxly-it/rootguard/pull/741))
- Add scrollMargin to the IntersectionObserver mock (#755) ([#756](https://github.com/foxly-it/rootguard/pull/756))
- Disable git auto-maintenance in the pin resolver's scratch repo (#761) ([#762](https://github.com/foxly-it/rootguard/pull/762))

## [1.0.5] - 2026-09-22

### Other

- Revert the temporary 1.0.4 upgrade-test bypass ([#679](https://github.com/foxly-it/rootguard/pull/679))
- Add rootguard-docker-proxy to the real release pipeline ([#680](https://github.com/foxly-it/rootguard/pull/680))
- Tolerate WebApp's own 502 during the core/webapp swap ([#682](https://github.com/foxly-it/rootguard/pull/682))
- Allow POST /containers/{id}/rename ([#684](https://github.com/foxly-it/rootguard/pull/684))
- TEMPORARY bypass of upgrade-test gate for 1.0.5 only ([#685](https://github.com/foxly-it/rootguard/pull/685))

## [1.0.5] - 2026-09-22

### Other

- Revert the temporary 1.0.4 upgrade-test bypass ([#679](https://github.com/foxly-it/rootguard/pull/679))
- Add rootguard-docker-proxy to the real release pipeline ([#680](https://github.com/foxly-it/rootguard/pull/680))
- Tolerate WebApp's own 502 during the core/webapp swap ([#682](https://github.com/foxly-it/rootguard/pull/682))
- Allow POST /containers/{id}/rename ([#684](https://github.com/foxly-it/rootguard/pull/684))

## [1.0.5] - 2026-09-22

### Other

- Revert the temporary 1.0.4 upgrade-test bypass ([#679](https://github.com/foxly-it/rootguard/pull/679))
- Add rootguard-docker-proxy to the real release pipeline ([#680](https://github.com/foxly-it/rootguard/pull/680))
- Tolerate WebApp's own 502 during the core/webapp swap ([#682](https://github.com/foxly-it/rootguard/pull/682))

## [1.0.5] - 2026-09-22

### Other

- Revert the temporary 1.0.4 upgrade-test bypass ([#679](https://github.com/foxly-it/rootguard/pull/679))
- Add rootguard-docker-proxy to the real release pipeline ([#680](https://github.com/foxly-it/rootguard/pull/680))

## [1.0.4] - 2026-09-22

### Documentation

- Post-1.0.3 cleanup - dedupe CHANGELOG.md, refresh ROADMAP/project-state ([#673](https://github.com/foxly-it/rootguard/pull/673))

### Other

- Revert the temporary 1.0.3 upgrade-test bypass ([#672](https://github.com/foxly-it/rootguard/pull/672))
- Allow GET /containers/{id}/logs, fixes Logs & Diagnose ([#675](https://github.com/foxly-it/rootguard/pull/675))
- Re-bump docker-proxy pin, PR #669's fix was never deployed ([#677](https://github.com/foxly-it/rootguard/pull/677))
- TEMPORARY bypass of upgrade-test gate for 1.0.4 only ([#678](https://github.com/foxly-it/rootguard/pull/678))

## [1.0.4] - 2026-09-22

### Documentation

- Post-1.0.3 cleanup - dedupe CHANGELOG.md, refresh ROADMAP/project-state ([#673](https://github.com/foxly-it/rootguard/pull/673))

### Other

- Revert the temporary 1.0.3 upgrade-test bypass ([#672](https://github.com/foxly-it/rootguard/pull/672))
- Allow GET /containers/{id}/logs, fixes Logs & Diagnose ([#675](https://github.com/foxly-it/rootguard/pull/675))
- Re-bump docker-proxy pin, PR #669's fix was never deployed ([#677](https://github.com/foxly-it/rootguard/pull/677))

## [1.0.4] - 2026-09-22

### Documentation

- Post-1.0.3 cleanup - dedupe CHANGELOG.md, refresh ROADMAP/project-state ([#673](https://github.com/foxly-it/rootguard/pull/673))

### Other

- Revert the temporary 1.0.3 upgrade-test bypass ([#672](https://github.com/foxly-it/rootguard/pull/672))
- Allow GET /containers/{id}/logs, fixes Logs & Diagnose ([#675](https://github.com/foxly-it/rootguard/pull/675))

## [1.0.3] - 2026-09-21

### Other

- Bump stale docker-proxy pin, fixes shipped but never deployed ([#667](https://github.com/foxly-it/rootguard/pull/667))
- Allow Core/Updater's self-referential compose-file bind ([#669](https://github.com/foxly-it/rootguard/pull/669))
- TEMPORARY bypass of upgrade-test gate for 1.0.3 only ([#671](https://github.com/foxly-it/rootguard/pull/671))

## [1.0.2] - 2026-09-21

### Added

- Serve German and English marketing pages on separate URLs ([#639](https://github.com/foxly-it/rootguard/pull/639))

### Documentation

- Catch up project-state.md/release-history.md to v1.0.1 ([#635](https://github.com/foxly-it/rootguard/pull/635))
- Add two new guides targeting broader search intent ([#638](https://github.com/foxly-it/rootguard/pull/638))
- Verify and document rootless Docker daemon compatibility ([#642](https://github.com/foxly-it/rootguard/pull/642))
- Rootless Docker fully verified end to end, close out the roadmap item ([#645](https://github.com/foxly-it/rootguard/pull/645))
- Log the two 1.0.2 review rounds in security-audit-log.md ([#660](https://github.com/foxly-it/rootguard/pull/660))
- Add extension API design draft for #186 ([#665](https://github.com/foxly-it/rootguard/pull/665))

### Fixed

- Add a curl/sudo preflight check, skip sudo when already root ([#636](https://github.com/foxly-it/rootguard/pull/636))
- Repair icons corrupted by the 1.0.1 version bump, plus an SEO pass ([#637](https://github.com/foxly-it/rootguard/pull/637))
- Unbreak the build - bind9-dnsutils' own pin went stale ([#641](https://github.com/foxly-it/rootguard/pull/641))

### Maintenance

- Bump the actions group across 1 directory with 3 updates ([#652](https://github.com/foxly-it/rootguard/pull/652))

### Other

- Wire rootguard-docker-proxy into the stack ([#640](https://github.com/foxly-it/rootguard/pull/640))
- Detect rootless Docker and adapt without forcing either mode ([#643](https://github.com/foxly-it/rootguard/pull/643))
- Allow Core's real rootguard-unbound exec calls ([#644](https://github.com/foxly-it/rootguard/pull/644))
- Fix unauthenticated session-fsync DoS and audit gaps ([#647](https://github.com/foxly-it/rootguard/pull/647))
- Validate Cmd/Entrypoint/User/NetworkingConfig and more ([#646](https://github.com/foxly-it/rootguard/pull/646))
- Tolerate corrupted history entries, fix rollback scope, dedup runner ([#649](https://github.com/foxly-it/rootguard/pull/649))
- Fix sudo PWD loss, cleanup traps, and two races ([#648](https://github.com/foxly-it/rootguard/pull/648))
- Fix status accuracy on no-op checks and ctx plumbing in verify ([#650](https://github.com/foxly-it/rootguard/pull/650))
- Webapp frontend: fix number-field NaN handling and dedupe helpers ([#651](https://github.com/foxly-it/rootguard/pull/651))
- Move Post-1.0/Future to the top, newest items first ([#653](https://github.com/foxly-it/rootguard/pull/653))
- Close volume bind-mount escape, validate Healthcheck/Env/SecurityOpt ([#655](https://github.com/foxly-it/rootguard/pull/655))
- Audit/rate-limit update-check routes, fix service-logs error mapping ([#657](https://github.com/foxly-it/rootguard/pull/657))
- Reject public IPv6 ranges in reverse-DNS discovery ([#659](https://github.com/foxly-it/rootguard/pull/659))
- Fix flaky installer tests racing a fixed 2-second deploy deadline ([#662](https://github.com/foxly-it/rootguard/pull/662))
- Close TOCTOU gap between control-plane update and self-update ([#663](https://github.com/foxly-it/rootguard/pull/663))

## [1.0.1] - 2026-09-17

### Added

- Add rootguard-docker-proxy, a filtering Docker socket proxy ([#632](https://github.com/foxly-it/rootguard/pull/632))

### Documentation

- Record rootguard-docker-proxy's landing in the roadmap and threat model ([#633](https://github.com/foxly-it/rootguard/pull/633))

### Fixed

- Suppress 5 new libxml2 CVEs unfixed in trixie ([#631](https://github.com/foxly-it/rootguard/pull/631))
- Include blockpage and attestation-proxy in the live service status ([#634](https://github.com/foxly-it/rootguard/pull/634))

### Other

- Update site and README for shipped 1.0, add release confetti ([#621](https://github.com/foxly-it/rootguard/pull/621))
- Make the 1.0 release celebration an actual surprise ([#622](https://github.com/foxly-it/rootguard/pull/622))
- Migrate public documentation to MkDocs Material at /docs/ ([#623](https://github.com/foxly-it/rootguard/pull/623))
- Fix unreadable MkDocs header/search text contrast ([#624](https://github.com/foxly-it/rootguard/pull/624))
- Add worked-example guides, inline HTTPS/threat-model docs, fix header ([#625](https://github.com/foxly-it/rootguard/pull/625))
- Consolidate thin subpages, fix header still not matching the main site ([#626](https://github.com/foxly-it/rootguard/pull/626))
- Re-add a light color scheme to the docs for accessibility ([#627](https://github.com/foxly-it/rootguard/pull/627))
- Add real WebApp screenshots to the docs ([#628](https://github.com/foxly-it/rootguard/pull/628))
- Homepage redesign: trust facts, real-screenshot showcase, cohesive polish ([#629](https://github.com/foxly-it/rootguard/pull/629))
- Full-width animated status card, showcase countdown bars, fix stale docs links ([#630](https://github.com/foxly-it/rootguard/pull/630))

## [1.0.0] - 2026-09-14

### CI

- Docker-Layer-Cache für alle Multi-Arch-Builds + Go-Modul-Cache-Fix ([#551](https://github.com/foxly-it/rootguard/pull/551))
- Timeout-minutes und concurrency-Gruppen ergänzen ([#558](https://github.com/foxly-it/rootguard/pull/558))
- Wait-Loops in wiederverwendbare Composite Actions extrahieren ([#559](https://github.com/foxly-it/rootguard/pull/559))
- Trivy-Install-Logik in install-trivy.sh vereinheitlichen ([#560](https://github.com/foxly-it/rootguard/pull/560))
- Unabhängige Checks in ci.yml parallelisieren ([#561](https://github.com/foxly-it/rootguard/pull/561))
- CVE-2026-74860 (libxml2) unterdruecken ([#568](https://github.com/foxly-it/rootguard/pull/568))
- Kleinere Hygiene-Funde aus dem zweiten Review-Durchlauf beheben ([#574](https://github.com/foxly-it/rootguard/pull/574))
- Docker-Layer-Cache für alle bisher ungecachten Image-Scans ergänzen ([#575](https://github.com/foxly-it/rootguard/pull/575))

### Changed

- Router.go auf Go-1.22-Method-Pattern vereinheitlichen ([#553](https://github.com/foxly-it/rootguard/pull/553))
- Gemeinsamen useInterval-Hook fürs Frontend-Polling ([#554](https://github.com/foxly-it/rootguard/pull/554))
- Validate() in unbound/settings.go aufteilen ([#556](https://github.com/foxly-it/rootguard/pull/556))
- DNS-/Blockpage-Port-Check in Preflight() zusammenfassen ([#557](https://github.com/foxly-it/rootguard/pull/557))
- Overview.tsx auf useOverviewData()-Hook umstellen ([#562](https://github.com/foxly-it/rootguard/pull/562))
- Stack.tsx auf useStackData()-Hook umstellen ([#563](https://github.com/foxly-it/rootguard/pull/563))
- Unbound.tsx auf useUnboundData()-Hook umstellen ([#564](https://github.com/foxly-it/rootguard/pull/564))
- Connect/blockpage-reload zwischen deploy und restoreDeploy dedupen ([#572](https://github.com/foxly-it/rootguard/pull/572))
- Docker-CLI-Runner in rootguard-core dedupen ([#571](https://github.com/foxly-it/rootguard/pull/571))
- AdGuard.tsx auf useAdGuardData()-Hook umstellen, withBusy-Lücken in Unbound/Stack-Hooks schließen ([#573](https://github.com/foxly-it/rootguard/pull/573))
- JSON-Helfer zwischen api- und httpapi-Package dedupen ([#570](https://github.com/foxly-it/rootguard/pull/570))

### Documentation

- Zweite Review-Runde (Sicherheit, Duplizierung, Simplification, CI) protokollieren ([#576](https://github.com/foxly-it/rootguard/pull/576))
- Record the 30-day soak test's final result in ROADMAP.md ([#602](https://github.com/foxly-it/rootguard/pull/602))
- Record the third full-repo review (correctness, for 1.0.0) ([#605](https://github.com/foxly-it/rootguard/pull/605))
- Record round 3's follow-up pass in the security audit log ([#618](https://github.com/foxly-it/rootguard/pull/618))

### Fixed

- Rate-limit DELETE /api/auth/sessions/{id} ([#550](https://github.com/foxly-it/rootguard/pull/550))
- Correct the inline theme script's CSP hash ([#579](https://github.com/foxly-it/rootguard/pull/579))
- Reload blockpage after the standalone AdGuard bootstrap endpoint rotates its token ([#580](https://github.com/foxly-it/rootguard/pull/580))
- Run restoreDeploy's cleanup on a context detached from the request ([#581](https://github.com/foxly-it/rootguard/pull/581))
- Implement Unwrap() on statusRecorder so ResponseController works through it ([#582](https://github.com/foxly-it/rootguard/pull/582))
- Pass ROOTGUARD_ADMIN_USER/WEB_BIND/WEB_PORT into Core's own environment for compose re-invocation ([#585](https://github.com/foxly-it/rootguard/pull/585))
- Detach rollback from update's own context in rootguard-core's updater ([#586](https://github.com/foxly-it/rootguard/pull/586))
- Enable blockpage in the soak backup-restore drill's deploy config ([#588](https://github.com/foxly-it/rootguard/pull/588))
- Don't delete staged AdGuard credentials on an ambiguous configure failure ([#590](https://github.com/foxly-it/rootguard/pull/590))
- Bring attestation-proxy reachability check back in sync with Core ([#593](https://github.com/foxly-it/rootguard/pull/593))
- Stop updater's load() from leaving m.selected nil ([#595](https://github.com/foxly-it/rootguard/pull/595))
- Propagate Core's own status code from HandleServiceAction ([#598](https://github.com/foxly-it/rootguard/pull/598))
- Stop ContentModal from stealing focus on unrelated re-renders ([#600](https://github.com/foxly-it/rootguard/pull/600))
- Unblock the blockpage's reload button and harden its JS against CSP/storage/API edge cases ([#583](https://github.com/foxly-it/rootguard/pull/583))
- Add the missing webapp healthcheck to compose.release.yaml/compose.integration.yaml ([#587](https://github.com/foxly-it/rootguard/pull/587))
- Re-normalize Unbound volume ownership after a restore rollback ([#589](https://github.com/foxly-it/rootguard/pull/589))
- Stop the Expert Editor from deleting indentation on multi-line suggestions ([#601](https://github.com/foxly-it/rootguard/pull/601))
- Stop reporting a permanent error for a disabled Blockpage ([#603](https://github.com/foxly-it/rootguard/pull/603))
- Return 405 instead of 404 for a registered path hit with the wrong method ([#604](https://github.com/foxly-it/rootguard/pull/604))
- Stop a slower, superseded load() from overwriting a newer one ([#599](https://github.com/foxly-it/rootguard/pull/599))
- Make the Unbound healthcheck actually check the DNS response, not just dig's exit code ([#584](https://github.com/foxly-it/rootguard/pull/584))
- Dedup private-domain entries during unbound.conf import ([#591](https://github.com/foxly-it/rootguard/pull/591))
- Stop ImportUnboundConf from mutating the caller's ReverseZones ([#594](https://github.com/foxly-it/rootguard/pull/594))
- Stop restore from rolling back untouched local directories on ErrNotClean ([#596](https://github.com/foxly-it/rootguard/pull/596))
- Make Unbound Apply's post-activation snapshot best-effort ([#597](https://github.com/foxly-it/rootguard/pull/597))
- Surface a visible error when Overview's service restart fails ([#606](https://github.com/foxly-it/rootguard/pull/606))
- Stop the Expert Editor from discarding drafts on a language switch ([#607](https://github.com/foxly-it/rootguard/pull/607))
- Stop the restore preview's port field from storing NaN ([#608](https://github.com/foxly-it/rootguard/pull/608))
- Tolerate a transient curl failure in wait_for_installed ([#611](https://github.com/foxly-it/rootguard/pull/611))
- Defer revoking the diagnostic report's object URL ([#609](https://github.com/foxly-it/rootguard/pull/609))
- Harden docker-entrypoint.sh's setup and trust-anchor init ([#610](https://github.com/foxly-it/rootguard/pull/610))
- Stop pages.yml from deploying a zero-byte project-data.json ([#612](https://github.com/foxly-it/rootguard/pull/612))
- Make inject.sh's error messages actually reachable ([#613](https://github.com/foxly-it/rootguard/pull/613))
- Stop release-version-bump.yml's tag filter using its own SemVer regex ([#614](https://github.com/foxly-it/rootguard/pull/614))
- Cover 2 missing env vars in the digest-pin assertion ([#616](https://github.com/foxly-it/rootguard/pull/616))
- Anchor resolve-release-pin-commit.sh's path-scope regex ([#615](https://github.com/foxly-it/rootguard/pull/615))
- Translate the 72 destructive-action audit log events ([#617](https://github.com/foxly-it/rootguard/pull/617))
- Resync current_id on every updater status read ([#619](https://github.com/foxly-it/rootguard/pull/619))
- Resync current_id on every control-plane status read ([#620](https://github.com/foxly-it/rootguard/pull/620))

### Maintenance

- Refresh drifted Debian package pins ([#577](https://github.com/foxly-it/rootguard/pull/577))
- Refresh drifted Debian package pins ([#578](https://github.com/foxly-it/rootguard/pull/578))
- Bump golang.org/x/mod in /rootguard-updater ([#592](https://github.com/foxly-it/rootguard/pull/592))

### Other

- Toten BackupRestorePreview-Struct entfernen ([#555](https://github.com/foxly-it/rootguard/pull/555))
- Rate-Limit auf Unbound-Custom-/Import-Preview ergänzen ([#567](https://github.com/foxly-it/rootguard/pull/567))
- Toten Code entfernen (Backend + Frontend) ([#569](https://github.com/foxly-it/rootguard/pull/569))
- Updater-Control-Plane-Endpunkte absichern und dedupen ([#566](https://github.com/foxly-it/rootguard/pull/566))

### Testing

- Doppelte Test-Fixture-Bootstraps zusammenfassen ([#565](https://github.com/foxly-it/rootguard/pull/565))

## [1.0.0-rc.5] - 2026-09-09

### Documentation

- Document the 1.0.0-rc.3 broken-release incident and 1.0.0-rc.4 recovery ([#521](https://github.com/foxly-it/rootguard/pull/521))
- Sync German translations and fix stale claims from today's fixes ([#544](https://github.com/foxly-it/rootguard/pull/544))
- Add versioned 1.0.0 migration/rollback instructions ([#545](https://github.com/foxly-it/rootguard/pull/545))

### Fixed

- Stop permanently GPU-promoting the hero dashboard mockup ([#523](https://github.com/foxly-it/rootguard/pull/523))
- Make the hero dashboard mockup's resting state fully untransformed ([#524](https://github.com/foxly-it/rootguard/pull/524))
- Suppress CVE-2026-86140 (libxml2) in Unbound's image scan ([#533](https://github.com/foxly-it/rootguard/pull/533))
- Route GitHub Releases self-update discovery through the attestation proxy ([#532](https://github.com/foxly-it/rootguard/pull/532))
- Give Blockpage a real self-update path ([#534](https://github.com/foxly-it/rootguard/pull/534))
- Refuse a control-plane update while the updater self-update is busy ([#535](https://github.com/foxly-it/rootguard/pull/535))
- Check the attestation proxy's real /healthz endpoint, not just TCP ([#536](https://github.com/foxly-it/rootguard/pull/536))
- Bound backup-restore uploads to 2 concurrent, not the shared 30 ([#537](https://github.com/foxly-it/rootguard/pull/537))
- Suppress CVE-2026-84445 (grpc-go xDS DoS) in bundled cosign/compose ([#541](https://github.com/foxly-it/rootguard/pull/541))
- Run upgrade-test on both amd64 and arm64, not just amd64 ([#540](https://github.com/foxly-it/rootguard/pull/540))
- Harden attestation-proxy URL handling before RC5 ([#548](https://github.com/foxly-it/rootguard/pull/548))

### Maintenance

- Bump the actions group across 1 directory with 2 updates ([#520](https://github.com/foxly-it/rootguard/pull/520))
- Minor cleanups from the 2026-09-08 external review ([#538](https://github.com/foxly-it/rootguard/pull/538))
- Bump @vitest/mocker and vitest ([#542](https://github.com/foxly-it/rootguard/pull/542))
- Bump vitest in /rootguard-webapp/frontend ([#543](https://github.com/foxly-it/rootguard/pull/543))

## [1.0.0-rc.4] - 2026-09-05

### Fixed

- Include README.md in the pin-commit's path scope ([#517](https://github.com/foxly-it/rootguard/pull/517))
- CRITICAL - anchor accepts both tag-less and tag+digest image references ([#519](https://github.com/foxly-it/rootguard/pull/519))

## [1.0.0-rc.3] - 2026-09-05

### Added

- Bring rootguard-attestation-proxy into self-update management ([#484](https://github.com/foxly-it/rootguard/pull/484))

### Documentation

- Refresh stale README product-preview screenshots ([#409](https://github.com/foxly-it/rootguard/pull/409))
- Note the 1.0.0-rc.2 cut in ROADMAP.md's 0.9 exit note ([#482](https://github.com/foxly-it/rootguard/pull/482))
- Add rootguard-attestation-proxy to README's component table ([#486](https://github.com/foxly-it/rootguard/pull/486))
- Catch up threat-model/architecture/site to the proxy's self-update status ([#487](https://github.com/foxly-it/rootguard/pull/487))
- Summarize 2026-09-05 internal security review round (WIP, will finalize before push) ([#511](https://github.com/foxly-it/rootguard/pull/511))
- Bring roadmap.html and index.html up to date ([#514](https://github.com/foxly-it/rootguard/pull/514))

### Fixed

- Give bump-site-versions.sh/check-site-facts.sh the version they're actively cutting ([#480](https://github.com/foxly-it/rootguard/pull/480))
- Suppress newly-surfaced CVE-2026-16742 in rootguard-unbound's base image ([#485](https://github.com/foxly-it/rootguard/pull/485))
- Share one self-update manager for updater and attestation-proxy ([#488](https://github.com/foxly-it/rootguard/pull/488))
- Bump curl/libcurl apk pin to 8.22.0-r0 ([#506](https://github.com/foxly-it/rootguard/pull/506))
- Log a warning when ROOTGUARD_SKIP_ATTESTATION disables attestation gates ([#500](https://github.com/foxly-it/rootguard/pull/500))
- Anchor image-prefix policy check to the digest delimiter ([#501](https://github.com/foxly-it/rootguard/pull/501))
- Rate-limit /api/router-import/fritzbox/discover ([#502](https://github.com/foxly-it/rootguard/pull/502))
- Rate-limit /api/backups/restore/preview ([#503](https://github.com/foxly-it/rootguard/pull/503))
- Rate-limit unbound forward-check and reverse-dns discover routes ([#504](https://github.com/foxly-it/rootguard/pull/504))
- Fix self-referential relative bind-mount in compose.integration.yaml ([#508](https://github.com/foxly-it/rootguard/pull/508))
- Validate target_images overrides against the pinned repository ([#509](https://github.com/foxly-it/rootguard/pull/509))
- Verify the container image actually swapped after compose up ([#510](https://github.com/foxly-it/rootguard/pull/510))
- Hard-block access-control rules that reach beyond private space ([#507](https://github.com/foxly-it/rootguard/pull/507))
- Install-demo-section never collapsed to one column on mobile ([#513](https://github.com/foxly-it/rootguard/pull/513))
- Bump libuuid apk pin to 2.41.6-r1 ([#515](https://github.com/foxly-it/rootguard/pull/515))

### Maintenance

- Bump the actions group across 1 directory with 2 updates ([#429](https://github.com/foxly-it/rootguard/pull/429))

### Other

- Bring current, disclose AI-assisted code review ([#489](https://github.com/foxly-it/rootguard/pull/489))

## [1.0.0-rc.2] - 2026-09-01

### Added

- Local DNSSEC test zone for CI/release gates instead of real internet ([#442](https://github.com/foxly-it/rootguard/pull/442))

### CI

- Pin compose.release.yaml, .env.release.example, and site/*.html to 1.0.0-rc.1 [skip ci]
- Always bypass Core's live resolution in upgrade-test, not per-version

### Changed

- Consolidate atomic-file-write duplication into a shared package ([#385](https://github.com/foxly-it/rootguard/pull/385))
- Split rootguard-updater/main.go (851 lines) into files by concern ([#386](https://github.com/foxly-it/rootguard/pull/386))
- Share SemVer validation between the two release workflows ([#387](https://github.com/foxly-it/rootguard/pull/387))
- Close the atomic-write duplication gap, revisiting round 1's shared-module call ([#404](https://github.com/foxly-it/rootguard/pull/404))

### Documentation

- Record the v1.0.0-rc.1 cut and the upgrade-test bootstrap fix
- Warn beta.14-or-earlier installations they need a manual RC update
- Cross-reference the digest-resolution duplication between the two updaters ([#388](https://github.com/foxly-it/rootguard/pull/388))
- Add docs/release-process.md, an architecture-level map of release-alpha.yml ([#406](https://github.com/foxly-it/rootguard/pull/406))
- Trim rootguard-webapp/Dockerfile from 123 to 60 lines ([#405](https://github.com/foxly-it/rootguard/pull/405))
- Split docs/project-state.md into current-state, release-history, and security-audit-log ([#407](https://github.com/foxly-it/rootguard/pull/407))
- README/SECURITY/release-history/site still described an old alpha/beta series ([#416](https://github.com/foxly-it/rootguard/pull/416))
- Stale component lifecycle wording + delete dead per-component SECURITY.md files ([#423](https://github.com/foxly-it/rootguard/pull/423))
- Fix eight broken SECURITY.md links left by round 4's deletion; add repo-wide markdown link check ([#427](https://github.com/foxly-it/rootguard/pull/427))
- Record round 6's two repo-settings findings (one fixed, one open) ([#435](https://github.com/foxly-it/rootguard/pull/435))
- Document the correct shellcheck invocation for semver-compare.test.sh ([#437](https://github.com/foxly-it/rootguard/pull/437))
- Audit log was missing the ci.yml AdGuard-check real-domain fix ([#444](https://github.com/foxly-it/rootguard/pull/444))
- Document docker_engine_cp_cve_unknown preflight advisory (round 15 small item) ([#472](https://github.com/foxly-it/rootguard/pull/472))

### Fixed

- Enforce release attestation before activation, not just display
- Unblock ci-updater.yml's real E2E integration test after the attestation gate
- Gate the release pipeline on smoke-test/upgrade-test, not the other way around
- Pin and verify the dockerinstall.sh download in install.sh
- Pin and digest-verify the blockpage image like every other component
- Block domain-insecure and harden-dnssec-stripped: no in expert config
- Logout clears the session cookie even when persistence fails ([#370](https://github.com/foxly-it/rootguard/pull/370))
- Reject corrupt credentials.json instead of silently reverting to the env password ([#373](https://github.com/foxly-it/rootguard/pull/373))
- Destructive rate limit is per-session and closes the TOCTOU race ([#374](https://github.com/foxly-it/rootguard/pull/374))
- Preflight now checks the blockpage's port 80, not just DNS ([#375](https://github.com/foxly-it/rootguard/pull/375))
- WebApp now sends browser security headers (CSP, nosniff, frame-options, referrer-policy, permissions-policy) ([#376](https://github.com/foxly-it/rootguard/pull/376))
- Router-import client refuses redirects and restricts targets to private ranges ([#377](https://github.com/foxly-it/rootguard/pull/377))
- Pin GitHub Actions to commit SHAs, scope elevated permissions, checksum tool installs ([#378](https://github.com/foxly-it/rootguard/pull/378))
- Backup-restore's entry-limit message no longer overclaims what was found ([#379](https://github.com/foxly-it/rootguard/pull/379))
- AdGuard UI proxy's Set-Cookie rewrite parses cookies instead of string-matching ([#380](https://github.com/foxly-it/rootguard/pull/380))
- Blockpage builds the block-reason lead via DOM APIs instead of innerHTML ([#381](https://github.com/foxly-it/rootguard/pull/381))
- Install.sh quotes .env values and rejects newlines in the admin username/password ([#382](https://github.com/foxly-it/rootguard/pull/382))
- Persistence errors are no longer silently swallowed ([#383](https://github.com/foxly-it/rootguard/pull/383))
- Release notes record which commit published images were actually built from ([#384](https://github.com/foxly-it/rootguard/pull/384))
- Guided setup's first DNS stack deploy is now attestation-gated ([#389](https://github.com/foxly-it/rootguard/pull/389))
- Digest-pin builder-stage base images (golang, docker:29-cli, node) ([#390](https://github.com/foxly-it/rootguard/pull/390))
- Release pipeline no longer builds/tags/attributes provenance from a racy ref ([#391](https://github.com/foxly-it/rootguard/pull/391))
- Install.sh single-quotes .env values, closing a Compose $-expansion gap ([#393](https://github.com/foxly-it/rootguard/pull/393))
- SSRF check in FritzBox client now runs before connect(), not after ([#394](https://github.com/foxly-it/rootguard/pull/394))
- Publish to a candidate tag first, promote to the final release tag only after E2E tests pass ([#395](https://github.com/foxly-it/rootguard/pull/395))
- Blockpage no longer holds any AdGuard credential ([#396](https://github.com/foxly-it/rootguard/pull/396))
- Atomicfile.WriteFile uses os.CreateTemp instead of a fixed temp name ([#397](https://github.com/foxly-it/rootguard/pull/397))
- DNSSEC-bypass check parses the directive value, not a raw-line suffix ([#392](https://github.com/foxly-it/rootguard/pull/392))
- Backup archive now accepts exactly MaxFiles entries, not just fewer ([#399](https://github.com/foxly-it/rootguard/pull/399))
- AdGuard UI cookie rewrite no longer drops unknown Set-Cookie attributes ([#400](https://github.com/foxly-it/rootguard/pull/400))
- Blockpage theme.js no longer uses innerHTML ([#402](https://github.com/foxly-it/rootguard/pull/402))
- WebApp audit log and session inventory no longer trust X-Forwarded-For ([#401](https://github.com/foxly-it/rootguard/pull/401))
- Persist errors now surface in Status(), not just logs ([#398](https://github.com/foxly-it/rootguard/pull/398))
- Local dev compose files never forwarded ROOTGUARD_SKIP_ATTESTATION ([#408](https://github.com/foxly-it/rootguard/pull/408))
- Harden-dnssec-stripped bypass via quoted "no"/'no' ([#410](https://github.com/foxly-it/rootguard/pull/410))
- Installer never resolved unbound/blockpage image to a digest before attestation ([#411](https://github.com/foxly-it/rootguard/pull/411))
- Release tag could move onto untested commits; promotion trusted candidates blindly ([#412](https://github.com/foxly-it/rootguard/pull/412))
- Release-alpha.yml smoke test never deployed or verified the blockpage image ([#413](https://github.com/foxly-it/rootguard/pull/413))
- Updater.Manager's status.json/images.json/updates.yaml were only atomic per file ([#415](https://github.com/foxly-it/rootguard/pull/415))
- Blockpage /api/reason comment claimed $host isn't client-supplied ([#417](https://github.com/foxly-it/rootguard/pull/417))
- Surface PersistError/PersistErrorAt in the web UI ([#414](https://github.com/foxly-it/rootguard/pull/414))
- Invalid stored theme value permanently broke the blockpage toggle ([#418](https://github.com/foxly-it/rootguard/pull/418))
- FritzBox dial guard rejected zone-qualified IPv6 link-local addresses ([#419](https://github.com/foxly-it/rootguard/pull/419))
- Remove redundant unpinned apk installs from Core/Updater Dockerfiles ([#420](https://github.com/foxly-it/rootguard/pull/420))
- Release pipeline could fold untested commits into a tag; installer could pin a stale digest ([#421](https://github.com/foxly-it/rootguard/pull/421))
- Updater.Manager's status.json/images.json still had a residual multi-file window ([#422](https://github.com/foxly-it/rootguard/pull/422))
- Small round-4 cleanup items (gofmt gate, shellcheck, Dockerfile comment, blockpage smoke test, theme.js drift check) ([#424](https://github.com/foxly-it/rootguard/pull/424))
- Tag-push trigger incompatible with new model; images promoted before main-race check; no version-ordering guard ([#425](https://github.com/foxly-it/rootguard/pull/425))
- SelectImage left the new image selected even when its own persist failed ([#426](https://github.com/foxly-it/rootguard/pull/426))
- Ci-unbound.yml still used setup-go v5 without a go.sum cache path ([#428](https://github.com/foxly-it/rootguard/pull/428))
- Semver-compare.sh overflowed bash's 64-bit integer range on large versions ([#431](https://github.com/foxly-it/rootguard/pull/431))
- Image promotion still happened before the last main-race check ([#434](https://github.com/foxly-it/rootguard/pull/434))
- SelectImage's persist-failure revert left a stray empty-string map entry ([#432](https://github.com/foxly-it/rootguard/pull/432))
- Release pin-commit retry detection was unreachable, and could resolve to the wrong commit ([#436](https://github.com/foxly-it/rootguard/pull/436))
- Applying Unbound settings could return success before Unbound was ready ([#439](https://github.com/foxly-it/rootguard/pull/439))
- A reverted pin commit still resolved as a safe retry ([#438](https://github.com/foxly-it/rootguard/pull/438))
- Release-alpha.yml's SemVer tag filter had drifted, and the resolver compared SOURCE_REF as a raw string ([#441](https://github.com/foxly-it/rootguard/pull/441))
- Unbound settings rollback could fail silently under a canceled context ([#440](https://github.com/foxly-it/rootguard/pull/440))
- Real-internet DNS still leaked into blocking CI in two spots round 9 missed ([#445](https://github.com/foxly-it/rootguard/pull/445))
- Release-alpha.yml's own source_ref was the raw, possibly-abbreviated dispatch input ([#446](https://github.com/foxly-it/rootguard/pull/446))
- Six job-name collisions across unrelated workflows ([#449](https://github.com/foxly-it/rootguard/pull/449))
- Inject.sh has no Docker Desktop escape hatch; waitReady slept once too many times ([#448](https://github.com/foxly-it/rootguard/pull/448))
- Required status checks contradicted their own pull_request.paths filter ([#450](https://github.com/foxly-it/rootguard/pull/450))
- Setup.sh's split-DNS authority readiness check unreachable from Docker Desktop; container reproducibility gaps ([#452](https://github.com/foxly-it/rootguard/pull/452))
- Scenario_integration_test.go ignored DNSSEC_TEST_ZONE_DIR; drop stale TestMain ([#451](https://github.com/foxly-it/rootguard/pull/451))
- Frontend had no declared minimum Node version ([#453](https://github.com/foxly-it/rootguard/pull/453))
- Close round 10 finding 9 (Backup/Restore, Unbound, rollback checks not required) ([#454](https://github.com/foxly-it/rootguard/pull/454))
- Repin CI/test fixture base images off their EOL/unpinned tags (round 12 finding 1) ([#455](https://github.com/foxly-it/rootguard/pull/455))
- Sync package-lock.json engines field, tighten .nvmrc to 22.22.0 (round 12 finding 2) ([#456](https://github.com/foxly-it/rootguard/pull/456))
- Preserve dig error details in real-DNS-upstream diagnostics (round 12 finding 3) ([#457](https://github.com/foxly-it/rootguard/pull/457))
- Warn on unpatched Docker Engine docker-cp CVEs in preflight (round 13 finding 3) ([#458](https://github.com/foxly-it/rootguard/pull/458))
- Patch runtime image OpenSSL CVE, remove unused buildx plugin (round 13 finding 2) ([#459](https://github.com/foxly-it/rootguard/pull/459))
- Bump pinned cosign to v3.1.3, found via new image scan (round 13 finding 1 follow-up) ([#461](https://github.com/foxly-it/rootguard/pull/461))
- Add real container image vulnerability scanning to CI ([#460](https://github.com/foxly-it/rootguard/pull/460))
- Patch Blockpage's nginx base image CVEs ([#462](https://github.com/foxly-it/rootguard/pull/462))
- Patch Unbound's util-linux CVEs, scope+justify the rest ([#463](https://github.com/foxly-it/rootguard/pull/463))
- Scope trivy ignores with purls, correct 3 wrong CVE attributions ([#464](https://github.com/foxly-it/rootguard/pull/464))
- Add missing third docker-cp CVE (CVE-2026-41568) to preflight advisory ([#465](https://github.com/foxly-it/rootguard/pull/465))
- Four small round-14 improvements (push.paths, unknown-version advisory, ternary, frontend test) ([#466](https://github.com/foxly-it/rootguard/pull/466))
- Patch openssh CVEs, ignore new x/crypto and libevent CVEs (unblocks round 15 CI) ([#469](https://github.com/foxly-it/rootguard/pull/469))
- Patch newly-surfaced libexpat CVE in docker:29-cli base ([#470](https://github.com/foxly-it/rootguard/pull/470))
- Scan release-candidate images before promotion (round 15 finding 1) ([#467](https://github.com/foxly-it/rootguard/pull/467))
- Make Blockpage's image scan a required check (round 15 finding 2) ([#468](https://github.com/foxly-it/rootguard/pull/468))
- Bump Blockpage's libexpat pin to match what Alpine's mirror carries (unblocks CI) ([#473](https://github.com/foxly-it/rootguard/pull/473))
- Pin exact versions and paths in trivy ignore purls (round 15 finding 3) ([#471](https://github.com/foxly-it/rootguard/pull/471))
- Harden image scans and pin refresh automation ([#474](https://github.com/foxly-it/rootguard/pull/474))

### Maintenance

- Refresh drifted Debian package pins ([#430](https://github.com/foxly-it/rootguard/pull/430))
- Replace the hand-rolled markdown-link regex checker with lychee ([#433](https://github.com/foxly-it/rootguard/pull/433))
- Hardcoded dev-proxy LAN IP and unused vite/react scaffold assets ([#447](https://github.com/foxly-it/rootguard/pull/447))

### Other

- Homepage layout, RC messaging, and Unbound docs gaps
- Fold wiki.html into docs.html, remove the Wiki page
- Redirect stub, 404 page, sitemap/robots, canonical+favicon, stale-data guard

### Performance

- Lazy-load frontend authenticated pages, closing Vite's >500kB chunk warning ([#403](https://github.com/foxly-it/rootguard/pull/403))

## [1.0.0-rc.1] - 2026-08-26

### Added

- Generalize the release-cutting pipeline to real SemVer

### Changed

- Generalize the downgrade guard to real SemVer

### Documentation

- Record the downgrade-refusal safety net and confirm beta.14 is clean

### Fixed

- Correct SemVer handling in release/install/site scripts
- Recognize hyphenated SemVer identifiers and stop losing stable-version tracking
- Validate release-cut override before side effects, real SemVer sort in install.sh
- Hyphen-tolerant tag lookup in cut workflow, overflow-safe SemVer compare

## [0.1.0-beta.14] - 2026-08-26

### Added

- Updater refuses to install an older release than what's running

### Documentation

- Record the real update-mechanism bug chain (beta.10 through beta.13)

## [0.1.0-beta.13] - 2026-08-25

### Fixed

- GitHub Releases API order isn't reliably newest-first; digestQualify bug in Core too

## [0.1.0-beta.12] - 2026-08-25

### Fixed

- Upgrade-test's final verification assumed a local tag already existed
- Update() had its own separate, still-buggy digestQualify call

## [0.1.0-beta.11] - 2026-08-25

### Documentation

- Record the real updater digest bug found while cutting beta.10

### Fixed

- Updater's digest lookup could return a stale, already-superseded digest

## [0.1.0-beta.10] - 2026-08-25

### Added

- Copy-to-clipboard button and animated install demo on the website

### Changed

- Shared generic decodeJSON helper across Core and WebApp
- Remove duplicate frontend API client, move getVersion into client.ts

### Documentation

- Record the third review round (PR #347-#350)

### Fixed

- Enforce startup secret strength, FritzBox IPv6 URLs, backup off-by-one
- Two more CI fixtures still used a short ROOTGUARD_API_TOKEN

## [0.1.0-beta.9] - 2026-08-25

### Documentation

- Record the AdGuard polish and follow-up review round in project-state

### Fixed

- Login/recovery/account rate limits could be bypassed with concurrent requests
- AdGuard filtering endpoint accepted {} as "disable filtering"
- Install.sh respects ROOTGUARD_ADMIN_USER, validates web port
- Strict JSON decode helper, recovery rate-limit race, install.sh dir check order

### Other

- Add breathing room between install.sh's output phases
- AdGuard filtering toggle as switch, restyle protection select

## [0.1.0-beta.8] - 2026-08-25

### Added

- Authenticated account settings (change username/password from the WebGUI)
- One-command installer for non-technical users
- Install.sh checks for busy ports before installing

### Documentation

- Record authenticated account settings ([#329](https://github.com/foxly-it/rootguard/pull/329))
- Remove stale DNS-flow block from the website's dashboard mockup
- Record beta.7 dashboard/AdGuard polish round and the real update-process verification
- Record the one-command installer addition
- Record account-settings ship, select styling fix, mockup fidelity, and install.sh port preflight

### Fixed

- Account update could leave a renamed-but-uncommitted session on credential-persist failure
- Three account-settings issues found in review (wrong-password logout, partial-failure state, unparsed error codes)
- AdGuard protection select didn't match the app's other dropdowns
- Misleading "Nicht konfiguriert" label for AdGuard's health badge

### Other

- Make the hero mockup structurally match the real dashboard

## [0.1.0-beta.7] - 2026-08-24

### Documentation

- Record v0.1.0-beta.6 and the release-pipeline mechanics it surfaced ([#327](https://github.com/foxly-it/rootguard/pull/327))

### Fixed

- Radial gauge overflowed its 40px metric row and got clipped by the card edge
- Dashboard cards/gauge track nearly invisible in dark mode
- Three review findings on the dashboard metrics (stale-response race, wrong sparkline ages, keyboard/AT-inaccessible tooltip)
- Metrics polling starved itself at 1s - never showing data at all
- Metrics collector ran docker stats continuously even with nobody watching
- Metrics cache could serve arbitrarily stale data after being idle
- Webapp's dashboard proxy struct dropped collected_at
- AdGuard protection-pause toggle had three real bugs

### Other

- Horizontal progress stepper for the Setup deployment steps
- Dashboard service list - fix untranslated English text, modernize layout
- Dashboard hero/metrics/system-panel redesign
- Service grid, sparkline axis, flow-arrow animation and contrast
- Gauge min/max parity, service cards, interactive chart tooltip
- CPU/filter-rate as sparklines, fix panel gap, animate arrowhead, faster initial metrics
- Pull the flow-arrow icon flush against its line

### Performance

- Avoid redundant chart recompute on hover, throttle pointer tracking, pause polling when tab hidden
- Parallelize metric fetches, refresh metrics every 1s instead of 10s
- Background-cache Core's docker stats collection, drop metrics refresh to 500ms
- Cache container status server-side and singleflight refreshes; remove DATENFLUSS card; add AdGuard protection-pause toggle

## [0.1.0-beta.6] - 2026-08-22

### Fixed

- Updater self-update compose-mount resolution, digest-less attestation, and a broken beta.5 pin ([#324](https://github.com/foxly-it/rootguard/pull/324))

## [0.1.0-beta.5] - 2026-08-22

### Added

- Discover new RootGuard releases live instead of a manual .env pin ([#320](https://github.com/foxly-it/rootguard/pull/320))
- Let the RootGuard Updater update its own image ([#322](https://github.com/foxly-it/rootguard/pull/322))

### Documentation

- Record v0.1.0-beta.4 and the release-pipeline bugs it surfaced ([#316](https://github.com/foxly-it/rootguard/pull/316))

### Fixed

- Quick-start still referenced compose.alpha.yaml under v0.1.0-beta.4 ([#313](https://github.com/foxly-it/rootguard/pull/313))
- Dispatch pages.yml explicitly after the release pin-refresh push (#314) ([#315](https://github.com/foxly-it/rootguard/pull/315))
- Actually check updater/unbound attestation instead of hardcoding not_applicable (#317) ([#318](https://github.com/foxly-it/rootguard/pull/318))

## [0.1.0-beta.4] - 2026-08-22

### Added

- Automate site-version refresh and Debian pin-drift detection ([#298](https://github.com/foxly-it/rootguard/pull/298))

### Documentation

- Explain the real host-level port-53 verification on the site ([#299](https://github.com/foxly-it/rootguard/pull/299))
- Record the real 08-22 update-exercise result ([#310](https://github.com/foxly-it/rootguard/pull/310))

### Fixed

- Bump drifted libexpat pin; refresh site to beta.3 ([#297](https://github.com/foxly-it/rootguard/pull/297))
- Retry post-restore DNS check in the soak backup-restore drill (#301) ([#302](https://github.com/foxly-it/rootguard/pull/302))
- Parameterize updater image in compose.yaml, matching core/webapp (#303) ([#304](https://github.com/foxly-it/rootguard/pull/304))
- Match the actual graphify-out/ directory name ([#305](https://github.com/foxly-it/rootguard/pull/305))
- Bump stale AdGuard Home pin from v0.107.78 to v0.107.79 (#306) ([#307](https://github.com/foxly-it/rootguard/pull/307))

### Other

- "Control Plane" -> "Control Panel" in WebGUI-visible text ([#300](https://github.com/foxly-it/rootguard/pull/300))
- Compose.alpha.yaml/.env.alpha.example -> compose.release.yaml/.env.release.example (#308) ([#309](https://github.com/foxly-it/rootguard/pull/309))

## [0.1.0-beta.3] - 2026-08-16

### Fixed

- Multiple beta.2 deploy/labeling/site-freshness bugs found live on .7 ([#295](https://github.com/foxly-it/rootguard/pull/295))

## [0.1.0-beta.2] - 2026-08-16

### Added

- Add unattended 30-day endurance test harness ([#272](https://github.com/foxly-it/rootguard/pull/272))
- Probe for non-Docker port occupants during preflight ([#289](https://github.com/foxly-it/rootguard/pull/289))
- Default the setup DNS bind address to the detected LAN IP ([#291](https://github.com/foxly-it/rootguard/pull/291))

### CI

- Add a real end-to-end backup/restore CI job ([#276](https://github.com/foxly-it/rootguard/pull/276))

### Changed

- Compaction follow-ups from code review ([#275](https://github.com/foxly-it/rootguard/pull/275))

### Documentation

- Performance and memory baseline for small/medium networks ([#277](https://github.com/foxly-it/rootguard/pull/277))
- Final accessibility and security review ([#279](https://github.com/foxly-it/rootguard/pull/279))
- Freeze supported platforms, requirements, and support policy ([#280](https://github.com/foxly-it/rootguard/pull/280))
- Fix friction points found in a no-context Quick Start walkthrough ([#281](https://github.com/foxly-it/rootguard/pull/281))
- Catch up ROADMAP.md/project-state.md/roadmap.html bookkeeping ([#282](https://github.com/foxly-it/rootguard/pull/282))

### Fixed

- Use the full canonical AGPL-3.0 text ([#273](https://github.com/foxly-it/rootguard/pull/273))
- Auth security hardening from code review ([#274](https://github.com/foxly-it/rootguard/pull/274))
- Three real bugs in the soak harness found by review ([#278](https://github.com/foxly-it/rootguard/pull/278))
- Drop the SPDX-License-Identifier line, it broke detection ([#283](https://github.com/foxly-it/rootguard/pull/283))
- Destructive-guard bug, untested PR builds, and endurance race ([#284](https://github.com/foxly-it/rootguard/pull/284))
- Retry transient port-53 bind race on deploy; reword HTTPS export warning ([#287](https://github.com/foxly-it/rootguard/pull/287))
- Ownership-timing bug, temp-file leak on guard abort, add tests ([#285](https://github.com/foxly-it/rootguard/pull/285))
- Return combined output+error as probeHostPortBusy's detail ([#292](https://github.com/foxly-it/rootguard/pull/292))
- Precise setup address help text; add frontend unit tests ([#293](https://github.com/foxly-it/rootguard/pull/293))

## [0.1.0-beta.1] - 2026-08-14

### Added

- Let the release pipeline cut a beta, not just alpha.N+1 ([#259](https://github.com/foxly-it/rootguard/pull/259))

### Documentation

- Mark 0.6 beta release engineering complete ([#257](https://github.com/foxly-it/rootguard/pull/257))
- Update public site to 0.1.0-alpha.16 ([#258](https://github.com/foxly-it/rootguard/pull/258))

### Other

- Make German-only markdown docs bilingual ([#246](https://github.com/foxly-it/rootguard/pull/246))

## [0.1.0-alpha.16] - 2026-08-14

### Fixed

- Stop dropping control-plane update history in the API response ([#256](https://github.com/foxly-it/rootguard/pull/256))

## [0.1.0-alpha.15] - 2026-08-14

### Fixed

- Tolerate the WebApp being briefly unreachable mid-install ([#255](https://github.com/foxly-it/rootguard/pull/255))

## [0.1.0-alpha.14] - 2026-08-14

### Fixed

- Wait for the check to finish before starting the install ([#254](https://github.com/foxly-it/rootguard/pull/254))

## [0.1.0-alpha.13] - 2026-08-14

### Fixed

- Stop swallowing the upgrade test's own error diagnostics ([#253](https://github.com/foxly-it/rootguard/pull/253))

## [0.1.0-alpha.12] - 2026-08-14

### Fixed

- Catch curl connection failures in the upgrade test, not just bad HTTP status ([#251](https://github.com/foxly-it/rootguard/pull/251))

## [0.1.0-alpha.11] - 2026-08-14

### Documentation

- Update public site to 0.1.0-alpha.10 ([#248](https://github.com/foxly-it/rootguard/pull/248))

### Fixed

- Surface real HTTP errors from the control-plane upgrade test ([#247](https://github.com/foxly-it/rootguard/pull/247))
- Clean up mobile header nav and animate the status dot ([#249](https://github.com/foxly-it/rootguard/pull/249))

## [0.1.0-alpha.9] - 2026-08-13

### CI

- Pin compose.alpha.yaml to 0.1.0-alpha.8 image digests [skip ci]

### Other

- Verify SBOM/provenance/attestation live against v0.1.0-alpha.8 (#229, #230) ([#232](https://github.com/foxly-it/rootguard/pull/232))
- Automate release versioning and changelog generation ([#235](https://github.com/foxly-it/rootguard/pull/235))


## [0.1.0-alpha.8] - 2026-08-13

### Added

- Add safe backup retention controls ([#189](https://github.com/foxly-it/rootguard/pull/189))
- Add safe manual cleanup preview ([#191](https://github.com/foxly-it/rootguard/pull/191))
- Centralize service logs ([#201](https://github.com/foxly-it/rootguard/pull/201))
- Surface import workflows ([#203](https://github.com/foxly-it/rootguard/pull/203))

### CI

- Pin compose.alpha.yaml to 0.1.0-alpha.7 image digests [skip ci]

### Changed

- Move Unbound's in-page section nav into the main sidebar ([#180](https://github.com/foxly-it/rootguard/pull/180))
- Clarify stack operations ([#206](https://github.com/foxly-it/rootguard/pull/206))

### Documentation

- Close the digest-pin automation item, sync site to alpha.7
- Defer extension architecture until post-1.0 ([#187](https://github.com/foxly-it/rootguard/pull/187))
- Synchronize backups navigation ([#197](https://github.com/foxly-it/rootguard/pull/197))
- Align operations UI documentation ([#208](https://github.com/foxly-it/rootguard/pull/208))
- Record log allowlist separation ([#211](https://github.com/foxly-it/rootguard/pull/211))

### Fixed

- Clamp section-nav rail to never overlap expanded sidebar ([#179](https://github.com/foxly-it/rootguard/pull/179))
- Stop truncating sidebar sub-item labels, show them collapsed ([#181](https://github.com/foxly-it/rootguard/pull/181))
- Pin AdGuard and controller addresses on the DNS network ([#182](https://github.com/foxly-it/rootguard/pull/182))
- Allow managed control-plane logs ([#210](https://github.com/foxly-it/rootguard/pull/210))
- Style backup archive picker ([#213](https://github.com/foxly-it/rootguard/pull/213))
- Compact AdGuard contextual actions ([#215](https://github.com/foxly-it/rootguard/pull/215))
- Compact Unbound form controls ([#217](https://github.com/foxly-it/rootguard/pull/217))

### Other

- Sync the compose.alpha.yaml header comment version, automate it going forward
- Add bounded reverse-DNS host discovery ([#185](https://github.com/foxly-it/rootguard/pull/185))
- Add passphrase-encrypted full backup export ([#193](https://github.com/foxly-it/rootguard/pull/193))
- Add dedicated backups page ([#195](https://github.com/foxly-it/rootguard/pull/195))
- Add guided clean-install full restore ([#199](https://github.com/foxly-it/rootguard/pull/199))
- Polish Unbound cache card spacing ([#218](https://github.com/foxly-it/rootguard/pull/218))
- Rate limits and audit events for destructive actions ([#220](https://github.com/foxly-it/rootguard/pull/220))
- Formal keyboard/screen-reader re-verification of every WebGUI workflow ([#222](https://github.com/foxly-it/rootguard/pull/222))
- Verify pre-update snapshot integrity before an automatic rollback ([#224](https://github.com/foxly-it/rootguard/pull/224))
- Prove recovery from a real process kill mid-install and mid-update (#225) ([#226](https://github.com/foxly-it/rootguard/pull/226))
- Add a disaster-recovery runbook, drilled on a real separate host (#227) ([#228](https://github.com/foxly-it/rootguard/pull/228))
- Attach SBOM/provenance to every release image, verify all 5 signers (#229, #230) ([#231](https://github.com/foxly-it/rootguard/pull/231))

### Testing

- Add end-to-end scenario tests for guided Unbound settings ([#183](https://github.com/foxly-it/rootguard/pull/183))

## [0.1.0-alpha.7] - 2026-08-10

### Added

- Sticky in-page section nav, reveal-and-focus for search ([#108](https://github.com/foxly-it/rootguard/pull/108))

### CI

- Run functional checks on native arm64, not just amd64 ([#121](https://github.com/foxly-it/rootguard/pull/121))
- Add dependency, container, secret, and static-analysis scans ([#143](https://github.com/foxly-it/rootguard/pull/143))
- Add AdGuard compatibility tests against both supported channels ([#158](https://github.com/foxly-it/rootguard/pull/158))
- Complete OCI image metadata labels across all 5 components ([#162](https://github.com/foxly-it/rootguard/pull/162))
- Automate compose.alpha.yaml digest pins after each alpha release ([#165](https://github.com/foxly-it/rootguard/pull/165))

### Documentation

- Document blockpage, fix stale monorepo component links ([#104](https://github.com/foxly-it/rootguard/pull/104))
- Point blockpage redesign roadmap link at the merged PR ([#119](https://github.com/foxly-it/rootguard/pull/119))
- Refresh zone-centred host inventory + FRITZ!Box import plan ([#113](https://github.com/foxly-it/rootguard/pull/113))
- Add threat model covering the six 0.5 trust boundaries ([#144](https://github.com/foxly-it/rootguard/pull/144))
- Verify WCAG reduced-motion coverage, split it out of the contrast/focus item ([#145](https://github.com/foxly-it/rootguard/pull/145))
- Add HTTPS/reverse-proxy deployment guide, verify secure-cookie enforcement ([#146](https://github.com/foxly-it/rootguard/pull/146))
- Document AdGuard backup/restore ownership ([#151](https://github.com/foxly-it/rootguard/pull/151))
- Sync ROADMAP.md status against the public website ([#154](https://github.com/foxly-it/rootguard/pull/154))
- Fix a stale roadmap checkbox and persist a sequenced next-steps plan ([#157](https://github.com/foxly-it/rootguard/pull/157))
- Correct roadmap items against a code audit, not assumptions ([#163](https://github.com/foxly-it/rootguard/pull/163))
- Note the unbound.conf importer hardening and host-table UI polish

### Fixed

- Show Unbound expert base config always, not behind a click ([#102](https://github.com/foxly-it/rootguard/pull/102))

### Maintenance

- Stop tracking AI assistant tooling files
- Gitignore the local-only AI memory file
- Rename the local AI context file to something inconspicuous

### Other

- Bump the actions group across 1 directory with 6 updates ([#94](https://github.com/foxly-it/rootguard/pull/94))
- Refresh README/website for alpha.6, fix stale monorepo/UI references ([#96](https://github.com/foxly-it/rootguard/pull/96))
- Ship RootGuard Blockpage: fresh design + automatic AdGuard wiring ([#98](https://github.com/foxly-it/rootguard/pull/98))
- Redesign blockpage around AdGuard's own color language, not RootGuard's ([#100](https://github.com/foxly-it/rootguard/pull/100))
- Make Unbound tabs URL-addressable, wire precise search-to-tab navigation ([#106](https://github.com/foxly-it/rootguard/pull/106))
- Add a blockpage preview link in Setup, fix a real contrast bug found while building it ([#112](https://github.com/foxly-it/rootguard/pull/112))
- Reason-lookup backend proxying AdGuard's check_host ([#117](https://github.com/foxly-it/rootguard/pull/117))
- Show the real per-request block reason, not a static list ([#118](https://github.com/foxly-it/rootguard/pull/118))
- Visual redesign - cards and motion, not a dashboard ([#119](https://github.com/foxly-it/rootguard/pull/119))
- Fix reason card never highlighting on a real match ([#120](https://github.com/foxly-it/rootguard/pull/120))
- Accessibility verification pass: contrast, focus trap, keyboard access, zoom/reflow ([#110](https://github.com/foxly-it/rootguard/pull/110))
- Document and test fixed-base hardening directives ([#122](https://github.com/foxly-it/rootguard/pull/122))
- Refresh dashboard preview, drop off-topic nav, fix real gaps ([#123](https://github.com/foxly-it/rootguard/pull/123))
- Hover feedback for ContentModal's close button + a real contrast fix found along the way ([#124](https://github.com/foxly-it/rootguard/pull/124))
- Narrative redesign with a RootGuard fox mascot ([#125](https://github.com/foxly-it/rootguard/pull/125))
- Add jump-to-top button ([#126](https://github.com/foxly-it/rootguard/pull/126))
- Fix header GitHub link pointing at the archived component repo ([#128](https://github.com/foxly-it/rootguard/pull/128))
- Typed host-inventory backend (zone-centred local hosts) ([#129](https://github.com/foxly-it/rootguard/pull/129))
- Fix sticky section-nav unsticking early + style blockpage preview as a button ([#130](https://github.com/foxly-it/rootguard/pull/130))
- Bump nanoid to clear a high-severity advisory ([#134](https://github.com/foxly-it/rootguard/pull/134))
- FRITZ!Box TR-064 host discovery adapter ([#133](https://github.com/foxly-it/rootguard/pull/133))
- Float Unbound's section nav as an icon rail on wide viewports ([#135](https://github.com/foxly-it/rootguard/pull/135))
- Anchor the floating rail to content instead of the viewport edge ([#136](https://github.com/foxly-it/rootguard/pull/136))
- FRITZ!Box import UI - discover, rename, select, activate ([#137](https://github.com/foxly-it/rootguard/pull/137))
- Fix the section-nav rail rendering way too wide ([#138](https://github.com/foxly-it/rootguard/pull/138))
- Sync roadmap.html's 0.2 status with what actually shipped ([#139](https://github.com/foxly-it/rootguard/pull/139))
- Keep local_zones when switching resolver presets ([#140](https://github.com/foxly-it/rootguard/pull/140))
- Fix misaligned columns in the Cache & performance card ([#141](https://github.com/foxly-it/rootguard/pull/141))
- Restyle the Unbound in-page rail as a left-gutter "on this page" widget ([#142](https://github.com/foxly-it/rootguard/pull/142))
- Add session inventory and revocation ([#147](https://github.com/foxly-it/rootguard/pull/147))
- Add login/recovery rate limiting and an auth audit log ([#148](https://github.com/foxly-it/rootguard/pull/148))
- Surface AdGuard's own reported version ([#149](https://github.com/foxly-it/rootguard/pull/149))
- Add contextual deep-links from AdGuard status to native AdGuard pages ([#150](https://github.com/foxly-it/rootguard/pull/150))
- Fix a broken healthcheck on the distroless runtime image ([#152](https://github.com/foxly-it/rootguard/pull/152))
- Fix toggle-row hover background overhanging the advanced-settings card ([#153](https://github.com/foxly-it/rootguard/pull/153))
- Redesign AdGuard status panel and add filtering toggle ([#155](https://github.com/foxly-it/rootguard/pull/155))
- Close layout gaps on Setup network step and Dashboard data-flow card ([#156](https://github.com/foxly-it/rootguard/pull/156))
- Fix Unbound section-nav rail links overflowing the widget ([#159](https://github.com/foxly-it/rootguard/pull/159))
- Add cross-service Client -> AdGuard -> Unbound -> DNSSEC diagnostics ([#160](https://github.com/foxly-it/rootguard/pull/160))
- Align the section-nav rail with the tab strip and ease truncation ([#161](https://github.com/foxly-it/rootguard/pull/161))
- Fix webapp's attestation policy pointing at the archived per-repo ([#166](https://github.com/foxly-it/rootguard/pull/166))
- Migrate guided zones onto the typed host-inventory model ([#167](https://github.com/foxly-it/rootguard/pull/167))
- Extract the shared guided draft/preview/activate workflow ([#168](https://github.com/foxly-it/rootguard/pull/168))
- Enforce hostname uniqueness across zones ([#169](https://github.com/foxly-it/rootguard/pull/169))
- Import/export of the complete logical resolver configuration ([#170](https://github.com/foxly-it/rootguard/pull/170))
- Classify and adopt a hand-written unbound.conf (partial) ([#171](https://github.com/foxly-it/rootguard/pull/171))
- Fix missing spacing between Advanced-tab cards ([#172](https://github.com/foxly-it/rootguard/pull/172))
- Reverse-map forward-zone blocks in the unbound.conf importer ([#173](https://github.com/foxly-it/rootguard/pull/173))
- Reverse-map local-zone host inventory in the unbound.conf importer ([#174](https://github.com/foxly-it/rootguard/pull/174))
- Reverse-map RFC1918 reverse-zone policy, network mode, and resource ([#175](https://github.com/foxly-it/rootguard/pull/175))
- Validate zone names/addresses before classifying as guided; fix filter-chip contrast ([#176](https://github.com/foxly-it/rootguard/pull/176))
- Fix PTR trailing-dot rejection and custom-config accumulation on re-import ([#177](https://github.com/foxly-it/rootguard/pull/177))
- Show local zone hosts as a table instead of an inline chip list ([#178](https://github.com/foxly-it/rootguard/pull/178))
- Update the public roadmap page for the 0.2 Unbound work

## [0.1.0-alpha.6] - 2026-08-06

### Added

- Full-stack container integration with stable SPA routing
- Professional dashboard layout with status indicator
- Stabilize router + SPA fallback, add dashboard API + service endpoint, UI glass layout baseline
- Implement service detection engine
- Implement docker container lifecycle control
- Introduce rootguard service model
- Introduce service registry
- Select AdGuard release channel ([#46](https://github.com/foxly-it/rootguard/pull/46))
- Show cryptographic release provenance ([#47](https://github.com/foxly-it/rootguard/pull/47))
- Introduce semantic design tokens with System/Light/Dark support ([#54](https://github.com/foxly-it/rootguard/pull/54))
- Migrate Dashboard to design tokens ([#56](https://github.com/foxly-it/rootguard/pull/56))
- Migrate remaining pages to design tokens ([#58](https://github.com/foxly-it/rootguard/pull/58))
- Rework as a coherent utility bar ([#60](https://github.com/foxly-it/rootguard/pull/60))
- Consolidate language, appearance, and sign-out into a user menu ([#62](https://github.com/foxly-it/rootguard/pull/62))
- Add global, local-only search with S / Ctrl+Cmd+K ([#64](https://github.com/foxly-it/rootguard/pull/64))
- Move collapse control to bottom edge, default desktop to collapsed ([#68](https://github.com/foxly-it/rootguard/pull/68))
- Add AdGuard release channels ([#32](https://github.com/foxly-it/rootguard/pull/32))
- Verify release attestations ([#33](https://github.com/foxly-it/rootguard/pull/33))
- Stable rootguard unbound base image with dnssec, internal bind and production defaults

### CI

- Add GHCR multi-arch pipeline + improved Dockerfile
- Restore id-token/attestations permissions dropped during port

### Changed

- Remove duplicate service model file

### Documentation

- Add rootguard-blockpage roadmap item ([#84](https://github.com/foxly-it/rootguard/pull/84))
- Add expert editor fullscreen + inline base config roadmap item ([#85](https://github.com/foxly-it/rootguard/pull/85))
- Catch up ROADMAP.md/project-state.md for items 7 and 8 (missed earlier) ([#86](https://github.com/foxly-it/rootguard/pull/86))
- Mark 4 already-shipped roadmap items as done (audit finding) ([#87](https://github.com/foxly-it/rootguard/pull/87))

### Fixed

- Regenerate package-lock for CI build
- Extend service model to support detection layer fields
- Preserve service provenance fields ([#48](https://github.com/foxly-it/rootguard/pull/48))
- Bump brace-expansion and postcss to clear high-severity audit gate ([#52](https://github.com/foxly-it/rootguard/pull/52))
- Derive service KPI total from allowlist instead of hardcoded 2 ([#50](https://github.com/foxly-it/rootguard/pull/50))
- Remove distracting hero circles, fix search placement ([#66](https://github.com/foxly-it/rootguard/pull/66))
- Verify exact SLSA v1 predicate ([#34](https://github.com/foxly-it/rootguard/pull/34))
- Install unbound-anchor for automatic dnssec trust anchor generation
- Bind unbound to 0.0.0.0 for docker port mapping compatibility
- Use writable trust anchor in /var/lib/unbound (Debian 13 compliant)
- Explicit IPv4 + IPv6 binding for Docker compatibility

### Maintenance

- Gitignore local AI-assistant tooling (.claude/, CLAUDE.md) ([#76](https://github.com/foxly-it/rootguard/pull/76))
- Bump rootguard-webapp submodule for design-token theme system ([#77](https://github.com/foxly-it/rootguard/pull/77))
- Bump rootguard-webapp submodule for Dashboard design-token migration ([#78](https://github.com/foxly-it/rootguard/pull/78))
- Bump rootguard-webapp submodule, theme-tokens roadmap item complete ([#79](https://github.com/foxly-it/rootguard/pull/79))
- Bump rootguard-webapp submodule for header utility-bar rework ([#80](https://github.com/foxly-it/rootguard/pull/80))
- Bump rootguard-webapp submodule for the accessible user menu ([#81](https://github.com/foxly-it/rootguard/pull/81))
- Bump rootguard-webapp submodule for global search ([#82](https://github.com/foxly-it/rootguard/pull/82))
- Bump rootguard-webapp submodule for hero-circle/search-header fix ([#83](https://github.com/foxly-it/rootguard/pull/83))

### Other

- Add verified RootGuard product screenshots
- Sync Core API docs and WebGUI roadmap
- Integrate tested rootless Podman documentation
- Bump rootguard-webapp submodule: Dashboard KPI fix + audit-gate bump ([#75](https://github.com/foxly-it/rootguard/pull/75))
- Bump rootguard-webapp: theme-aware shadow fix for washed-out light mode ([#89](https://github.com/foxly-it/rootguard/pull/89))
- Bump rootguard-webapp: expert editor fullscreen + inline base config ([#91](https://github.com/foxly-it/rootguard/pull/91))
- Remove git submodules ahead of monorepo migration
- Initial commit
- Add initial backend implementation (health + version endpoints)
- Add professional project README
- Add docker stats engine, system API and dashboard metrics
- Connect WebApp to Core and add Unbound settings ([#12](https://github.com/foxly-it/rootguard/pull/12))
- Add AdGuard bootstrap interface ([#13](https://github.com/foxly-it/rootguard/pull/13))
- Add Unbound preview rollback and diagnostics UI ([#14](https://github.com/foxly-it/rootguard/pull/14))
- Add Unbound advisor and preset interface ([#15](https://github.com/foxly-it/rootguard/pull/15))
- Add Unbound expert configuration editor ([#16](https://github.com/foxly-it/rootguard/pull/16))
- Add secure AIO management interface ([#17](https://github.com/foxly-it/rootguard/pull/17))
- Enforce frontend dependency security audit ([#18](https://github.com/foxly-it/rootguard/pull/18))
- Add guided conditional forwarding interface ([#19](https://github.com/foxly-it/rootguard/pull/19))
- Guide unsigned private forward zones ([#20](https://github.com/foxly-it/rootguard/pull/20))
- Guide private answers for forward zones ([#21](https://github.com/foxly-it/rootguard/pull/21))
- Clarify forwarding authority checks ([#22](https://github.com/foxly-it/rootguard/pull/22))
- Fix alpha dependency security audit ([#23](https://github.com/foxly-it/rootguard/pull/23))
- Add secure local password recovery ([#24](https://github.com/foxly-it/rootguard/pull/24))
- Improve GitHub project discoverability ([#25](https://github.com/foxly-it/rootguard/pull/25))
- Explain service runtime state in Stack Center ([#27](https://github.com/foxly-it/rootguard/pull/27))
- Add on-demand service diagnostics ([#28](https://github.com/foxly-it/rootguard/pull/28))
- Show update and cleanup history ([#29](https://github.com/foxly-it/rootguard/pull/29))
- Show actionable installation diagnostics ([#30](https://github.com/foxly-it/rootguard/pull/30))
- Add guided private DNS controls ([#31](https://github.com/foxly-it/rootguard/pull/31))
- Add guided resolver protocol modes ([#32](https://github.com/foxly-it/rootguard/pull/32))
- Explain containers without healthchecks ([#33](https://github.com/foxly-it/rootguard/pull/33))
- Polish Unbound fields and runtime badge ([#34](https://github.com/foxly-it/rootguard/pull/34))
- Polish management UI ([#35](https://github.com/foxly-it/rootguard/pull/35))
- Add Unbound resource profile controls ([#36](https://github.com/foxly-it/rootguard/pull/36))
- Preserve Unbound resource profiles in proxy ([#37](https://github.com/foxly-it/rootguard/pull/37))
- Add serve-expired controls to Webapp ([#38](https://github.com/foxly-it/rootguard/pull/38))
- Add DNSSEC cache controls ([#39](https://github.com/foxly-it/rootguard/pull/39))
- Expose EDNS buffer size control ([#40](https://github.com/foxly-it/rootguard/pull/40))
- Expose temporary diagnostic logging ([#41](https://github.com/foxly-it/rootguard/pull/41))
- Add collapsible navigation sidebar ([#42](https://github.com/foxly-it/rootguard/pull/42))
- Show AdGuard filter diagnostics ([#43](https://github.com/foxly-it/rootguard/pull/43))
- Unify actions and focus AdGuard diagnostics
- Show trusted stack release metadata ([#45](https://github.com/foxly-it/rootguard/pull/45))
- Keep sidebar navigation and collapse control visible while long pages scroll ([#70](https://github.com/foxly-it/rootguard/pull/70))
- Make box-shadow color/intensity theme-aware to fix washed-out light mode ([#72](https://github.com/foxly-it/rootguard/pull/72))
- Add fullscreen mode and inline base-config reference to expert editor ([#74](https://github.com/foxly-it/rootguard/pull/74))
- Initial project structure
- Add Apache 2.0 license
- Add NOTICE
- Build secure RootGuard control plane ([#1](https://github.com/foxly-it/rootguard/pull/1))
- Add secure AdGuard bootstrap control ([#2](https://github.com/foxly-it/rootguard/pull/2))
- Add versioned Unbound configuration lifecycle ([#4](https://github.com/foxly-it/rootguard/pull/4))
- Add Unbound presets and advisor ([#5](https://github.com/foxly-it/rootguard/pull/5))
- Add safe Unbound custom configuration ([#6](https://github.com/foxly-it/rootguard/pull/6))
- Build AIO control plane and safe updates ([#7](https://github.com/foxly-it/rootguard/pull/7))
- Add guided conditional forwarding ([#8](https://github.com/foxly-it/rootguard/pull/8))
- Support unsigned private forward zones ([#9](https://github.com/foxly-it/rootguard/pull/9))
- Allow private answers per forward zone ([#10](https://github.com/foxly-it/rootguard/pull/10))
- Require authoritative forwarding probes ([#11](https://github.com/foxly-it/rootguard/pull/11))
- Stabilize forwarding probe errors ([#12](https://github.com/foxly-it/rootguard/pull/12))
- Improve GitHub project discoverability ([#13](https://github.com/foxly-it/rootguard/pull/13))
- Expose trustworthy service runtime metadata ([#15](https://github.com/foxly-it/rootguard/pull/15))
- Add bounded redacted service diagnostics ([#16](https://github.com/foxly-it/rootguard/pull/16))
- Add safe update cleanup history ([#17](https://github.com/foxly-it/rootguard/pull/17))
- Add typed installation diagnostics ([#18](https://github.com/foxly-it/rootguard/pull/18))
- Add guided private DNS settings ([#19](https://github.com/foxly-it/rootguard/pull/19))
- Add capability-checked resolver modes ([#20](https://github.com/foxly-it/rootguard/pull/20))
- Distinguish missing container healthchecks ([#21](https://github.com/foxly-it/rootguard/pull/21))
- Add live dashboard metrics ([#22](https://github.com/foxly-it/rootguard/pull/22))
- Add bounded Unbound resource profiles ([#23](https://github.com/foxly-it/rootguard/pull/23))
- Add guided serve-expired controls ([#24](https://github.com/foxly-it/rootguard/pull/24))
- Add DNSSEC cache controls ([#25](https://github.com/foxly-it/rootguard/pull/25))
- Add EDNS buffer size control ([#26](https://github.com/foxly-it/rootguard/pull/26))
- Add privacy-safe diagnostic logging ([#27](https://github.com/foxly-it/rootguard/pull/27))
- Migrate service volume ownership during updates ([#28](https://github.com/foxly-it/rootguard/pull/28))
- Add AdGuard filter diagnostics and DNS defaults ([#29](https://github.com/foxly-it/rootguard/pull/29))
- Fix AdGuard DNS baseline status ([#30](https://github.com/foxly-it/rootguard/pull/30))
- Expose stack release metadata ([#31](https://github.com/foxly-it/rootguard/pull/31))
- Initial rootguard-unbound engine (Debian based) + GH Actions
- Fix Dockerfile: remove entrypoint and stabilize build
- Use system user instead of fixed UID
- Use packaged unbound system user
- Add MIT license and README
- Enterprise versioning: automatic Debian Unbound tagging
- Fix Docker tag: sanitize Debian version (+ → -)
- Update README.md
- Finalize recursive DNSSEC configuration with persistent trust anchor
- Finalize Debian-based recursive DNSSEC configuration (enterprise commented)
- Run container as root (Debian compliant), let unbound drop privileges internally
- Install dns-root-data package to provide Debian root.key
- Container-optimized recursive DNSSEC configuration with documentation
- Finalize enterprise container-optimized Unbound configuration
- Finalize container-optimized Unbound configuration (no pidfile, no syslog)
- Move DNSSEC trust anchor to /var/lib/unbound (writable runtime path)
- Add runtime entrypoint to fix volume ownership and drop privileges correctly
- Finalize runtime bootstrap: proper trust anchor handling without su
- Enterprise runtime model: root PID1 + internal privilege drop
- Enterprise entrypoint: state init + ownership fix + DNSSEC bootstrap
- Replace unbound-anchor bootstrap with Debian trust anchor copy
- Remove unbound-anchor, use Debian dns-root-data trust anchor
- Finalize immutable runtime model with documented unbound.conf
- Finalize immutable runtime model with documented unbound.conf
- Remove legacy entrypoint.sh, keep docker-entrypoint.sh
- Production-ready rootguard unbound base image
- Production-ready rootguard unbound image without anchor hard-fail
- Debian 13 compliant rootguard unbound image using dns-root-data trust anchor
- Debian 13 compliant writable trust anchor under /var/lib/unbound
- Docker-compatible access-control with bridge network support
- Rootguard-ready modular unbound base (unbound.d includes)
- Update README.md
- Harden Unbound for RootGuard runtime ([#1](https://github.com/foxly-it/rootguard/pull/1))
- Adopt AGPL-3.0-or-later ([#2](https://github.com/foxly-it/rootguard/pull/2))
- Allow versioned RootGuard image tags ([#3](https://github.com/foxly-it/rootguard/pull/3))
- Improve GitHub project discoverability ([#4](https://github.com/foxly-it/rootguard/pull/4))
- Upgrade Unbound security baseline to 1.25.2 ([#6](https://github.com/foxly-it/rootguard/pull/6))
- Enable loopback-only runtime control ([#7](https://github.com/foxly-it/rootguard/pull/7))
- Keep Unbound volume identity stable ([#8](https://github.com/foxly-it/rootguard/pull/8))
- Build Unbound reproducibly from verified source ([#9](https://github.com/foxly-it/rootguard/pull/9))
- Prepare RootGuard alpha foundation and documentation ([#5](https://github.com/foxly-it/rootguard/pull/5))
- Add safe update lifecycle history ([#34](https://github.com/foxly-it/rootguard/pull/34))
- Prepare standalone updater component ([#1](https://github.com/foxly-it/rootguard/pull/1))
- Test real paired update and rollback ([#3](https://github.com/foxly-it/rootguard/pull/3))
- Bump the actions group across 1 directory with 6 updates ([#2](https://github.com/foxly-it/rootguard/pull/2))
- Rebuild CI, docs, and workflow tooling for the monorepo

## [0.1.0-alpha.5] - 2026-08-01

### Added

- Add AdGuard release channel setup ([#66](https://github.com/foxly-it/rootguard/pull/66))
- Integrate signed release provenance ([#67](https://github.com/foxly-it/rootguard/pull/67))

### Fixed

- Use exact SLSA v1 attestation predicate ([#68](https://github.com/foxly-it/rootguard/pull/68))
- Preserve Stack Center provenance status ([#69](https://github.com/foxly-it/rootguard/pull/69))

### Other

- Integrate WebApp action audit
- Integrate reproducible Unbound source build ([#63](https://github.com/foxly-it/rootguard/pull/63))
- Complete Unbound amd64 update verification ([#64](https://github.com/foxly-it/rootguard/pull/64))
- Integrate stack release metadata ([#65](https://github.com/foxly-it/rootguard/pull/65))
- Prepare v0.1.0-alpha.5 ([#70](https://github.com/foxly-it/rootguard/pull/70))

## [0.1.0-alpha.4] - 2026-08-01

### Other

- Integrate Unbound resource profiles ([#50](https://github.com/foxly-it/rootguard/pull/50))
- Pin patched Unbound 1.25.2 image ([#51](https://github.com/foxly-it/rootguard/pull/51))
- Integrate serve-expired controls ([#52](https://github.com/foxly-it/rootguard/pull/52))
- Integrate DNSSEC cache controls ([#53](https://github.com/foxly-it/rootguard/pull/53))
- Integrate EDNS buffer size control ([#54](https://github.com/foxly-it/rootguard/pull/54))
- Integrate privacy-safe diagnostic logging ([#55](https://github.com/foxly-it/rootguard/pull/55))
- Integrate sidebar and matching preview icons ([#56](https://github.com/foxly-it/rootguard/pull/56))
- Match preview KPI icons to dashboard ([#57](https://github.com/foxly-it/rootguard/pull/57))
- Integrate safe Unbound volume migration ([#58](https://github.com/foxly-it/rootguard/pull/58))
- Prioritize reproducible Unbound build ([#59](https://github.com/foxly-it/rootguard/pull/59))
- Integrate AdGuard filter diagnostics ([#60](https://github.com/foxly-it/rootguard/pull/60))
- Prepare RootGuard v0.1.0-alpha.4

## [0.1.0-alpha.3] - 2026-07-29

### Other

- Record alpha.2 release status ([#17](https://github.com/foxly-it/rootguard/pull/17))
- Add live project overview to website ([#18](https://github.com/foxly-it/rootguard/pull/18))
- Simplify project website experience ([#19](https://github.com/foxly-it/rootguard/pull/19))
- Improve GitHub project discoverability ([#20](https://github.com/foxly-it/rootguard/pull/20))
- Stabilize manual section navigation ([#22](https://github.com/foxly-it/rootguard/pull/22))
- Update component repository presentation ([#23](https://github.com/foxly-it/rootguard/pull/23))
- Animate hero dashboard preview ([#24](https://github.com/foxly-it/rootguard/pull/24))
- Use production environment terminology ([#25](https://github.com/foxly-it/rootguard/pull/25))
- Add project legal pages and tool navigation ([#26](https://github.com/foxly-it/rootguard/pull/26))
- Group and polish public site navigation ([#27](https://github.com/foxly-it/rootguard/pull/27))
- Correct AdGuard Home Updater naming ([#28](https://github.com/foxly-it/rootguard/pull/28))
- Integrate language switch into navigation ([#29](https://github.com/foxly-it/rootguard/pull/29))
- Unify site header and documentation naming ([#30](https://github.com/foxly-it/rootguard/pull/30))
- Sync roadmap and Stack Center visibility ([#31](https://github.com/foxly-it/rootguard/pull/31))
- Publish bounded Stack Center diagnostics ([#32](https://github.com/foxly-it/rootguard/pull/32))
- Refine AdGuard integration and cleanup roadmap ([#33](https://github.com/foxly-it/rootguard/pull/33))
- Add safe update lifecycle history ([#34](https://github.com/foxly-it/rootguard/pull/34))
- Pin alpha images by digest ([#35](https://github.com/foxly-it/rootguard/pull/35))
- Pin standalone updater component ([#36](https://github.com/foxly-it/rootguard/pull/36))
- Pin real update rollback test ([#37](https://github.com/foxly-it/rootguard/pull/37))
- Publish installation diagnostics milestone ([#38](https://github.com/foxly-it/rootguard/pull/38))
- Add clean install platform matrix ([#40](https://github.com/foxly-it/rootguard/pull/40))
- Add guided private DNS lifecycle ([#42](https://github.com/foxly-it/rootguard/pull/42))
- Add checked resolver protocol modes ([#44](https://github.com/foxly-it/rootguard/pull/44))
- Unify Docs link colors ([#45](https://github.com/foxly-it/rootguard/pull/45))
- Integrate explicit healthcheck states ([#46](https://github.com/foxly-it/rootguard/pull/46))
- Integrate RootGuard UI polish ([#47](https://github.com/foxly-it/rootguard/pull/47))
- Integrate dashboard metrics and UI polish ([#48](https://github.com/foxly-it/rootguard/pull/48))
- Prepare RootGuard v0.1.0-alpha.3 ([#49](https://github.com/foxly-it/rootguard/pull/49))

## [0.1.0-alpha.2] - 2026-07-26

### Other

- Announce public alpha on website ([#14](https://github.com/foxly-it/rootguard/pull/14))
- Integrate local password recovery ([#15](https://github.com/foxly-it/rootguard/pull/15))
- Prepare RootGuard v0.1.0-alpha.2 ([#16](https://github.com/foxly-it/rootguard/pull/16))

## [0.1.0-alpha.1] - 2026-07-26

### Other

- Initialize RootGuard project repository
- Integrate RootGuard stack and project website ([#1](https://github.com/foxly-it/rootguard/pull/1))
- Update GitHub Pages actions ([#2](https://github.com/foxly-it/rootguard/pull/2))
- Integrate Unbound configuration v2 ([#3](https://github.com/foxly-it/rootguard/pull/3))
- Integrate Unbound advisor and project state ([#4](https://github.com/foxly-it/rootguard/pull/4))
- Prepare RootGuard alpha foundation and documentation ([#5](https://github.com/foxly-it/rootguard/pull/5))
- Integrate guided conditional forwarding ([#6](https://github.com/foxly-it/rootguard/pull/6))
- Allow private answers for forward zones ([#7](https://github.com/foxly-it/rootguard/pull/7))
- Require authoritative forwarding checks ([#8](https://github.com/foxly-it/rootguard/pull/8))
- Refresh dashboard website preview ([#9](https://github.com/foxly-it/rootguard/pull/9))
- Prepare public RootGuard alpha Compose release ([#10](https://github.com/foxly-it/rootguard/pull/10))
- Respect component package ownership ([#11](https://github.com/foxly-it/rootguard/pull/11))
- Publish WebApp from its component repository ([#12](https://github.com/foxly-it/rootguard/pull/12))
- Pin published alpha component revisions ([#13](https://github.com/foxly-it/rootguard/pull/13))