# Changelog All notable changes to BootUI are documented here. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). ## [Unreleased] ## [1.13.1] - 2026-08-07 Patch release that restores accurate scanner scores with customized Jackson mappers and removes Quarkus split-package warnings during application augmentation. ### Fixed - **Overview scanner scores no longer show a false `100 / Good` result when a Spring host application enables Jackson polymorphic typing.** BootUI API responses now use a path-scoped clean Jackson 3 serializer on both Spring MVC and WebFlux without changing host endpoint serialization, while malformed severity summaries surface as scanner errors instead of silently receiving a perfect score (#724). - **Quarkus applications no longer report split-package warnings for BootUI runtime packages.** Same-package white-box tests now live in the Quarkus runtime module instead of an integration-test application archive, keeping augmentation output clean without changing runtime behavior (#719). ## [1.13.0] - 2026-08-06 Feature release headlined by a **dependency graph mode for the Beans panel** on both Spring and Quarkus, alongside the Spring WebFlux security/REST Client/messaging work, configurable BootUI mounts, and another accessibility hardening pass. ### Added - **Beans panel dependency graph.** The panel now opens on an interactive SVG neighbourhood graph — bounded, cycle-safe breadth-first traversal (depth 3, 60 nodes) with role-colour-coded nodes, keyboard navigation, zoom controls, and classification filters — defaulting to the application bean with the most direct dependencies/dependents. A header toggle switches to the existing server-paged list, which now links back into the graph. Ships on both Spring and Quarkus, with Quarkus reporting reduced-fidelity dependency data (#656). - **RabbitMQ and JMS messaging diagnostics.** RabbitMQ publish/consume metadata now appears in a dedicated panel and Live Activity on Spring MVC, Spring WebFlux, and Quarkus, without retaining message payloads or arbitrary headers. A matching JMS panel and Live Activity source cover Spring-managed producers and listeners on Spring MVC and WebFlux; JMS remains unavailable on Quarkus and in GraalVM native images (#655, #660). - **Spring WebFlux security coverage.** A dedicated 25-rule reactive Security advisor now evaluates `SecurityWebFilterChain` configuration across authorization, CSRF, CORS, headers, Actuator exposure, OAuth2/JWT, configuration, and session policy. The raw Spring Security panel also maps reactive chains, filters, endpoint authorization, and best-effort request explanations; both panels exclude BootUI's own permit-all chain (#654, #657). - **REST Client diagnostics on Spring WebFlux and Quarkus.** The standalone panel now streams calls captured from instrumented WebFlux `WebClient` builders, while Quarkus captures metadata-only calls from `@RegisterRestClient` REST Client Reactive proxies. Both feed the shared panel and Live Activity, fail open if capture itself fails, and preserve the existing clear/recording controls; Quarkus intentionally never captures payloads or arbitrary headers (#658, #663). ### Changed - **Custom UI and API mounts now work end to end on Spring MVC, Spring WebFlux, and Quarkus.** `bootui.path` moves the shell, assets, APIs, streams, downloads, authentication cookies, and access guards together, while `bootui.api-path` can override the derived `/api` mount. Both compose once with the host framework's application root, invalid or reserved paths fail startup clearly, and the legacy `/bootui` surface is not left exposed after a move (#662). - **SSE-backed panels now report connection health and recover more predictably.** Live Activity, Exceptions, SQL Trace, Security Logs, and REST Client show calm reconnecting/unavailable states with an explicit retry action, avoid duplicate `EventSource` instances and refresh storms, and reconnect correctly after visibility or network changes (#661). - **State-changing UI actions now consistently require confirmation.** Thread-dump downloads, unsafe HTTP Probe methods, and configuration override creates, updates, and deletes use the branded confirmation flow, default focus to Cancel, and block duplicate submissions while a decision is pending (#692). - Renamed the AI Usage panel to AI Framework and placed it directly after REST Client in the Services group. The existing `ai` route, `/bootui/api/ai/**` contract, and `bootui.ai.*` / `bootui.panels.ai.*` property keys remain stable (#691). - **All Quarkus modules now align on Quarkus 3.33.3.1 LTS** through the shared, published `bootui-quarkus-parent`, preventing runtime/deployment/sample-app BOM drift and keeping the Quarkus LangChain4j BOM on its compatible platform line (#701). - **Dependencies and build tooling updated**, including Vue 3.5.40, Vite 8.2.0, the Quarkus LangChain4j BOM 1.12.1, GraalVM Native Build Tools 1.1.6, and frontend-maven-plugin 2.0.2. - **Copilot app Maven scripts now isolate parallel worktrees** by preserving existing `MAVEN_OPTS` while setting `maven.repo.local=.m2` for setup and subsequent Maven-backed server invocations, preventing same-version local artifacts from colliding through the shared `~/.m2` repository (#702). ### Fixed - **Accessibility defects across the shared UI** are corrected: native form controls now have programmatic labels; the mobile navigation and command palette contain and restore focus with complete dialog/combobox semantics; pointer-driven rows, cards, and sort controls are keyboard-operable; and muted/placeholder text meets WCAG 2.1 AA contrast in both themes (#694–#698). - **Rapid filtering, refreshes, pagination, and navigation no longer let stale frontend requests overwrite newer data.** Paged views now cancel superseded work, guard against fetch implementations that ignore abort signals, and keep loading ownership with the current request (#659). - **A slow or disconnected Log Tail browser can no longer block Spring MVC application logging threads.** SSE delivery now uses ordered, bounded per-subscriber queues and capped daemon workers; overload disconnects only the affected subscriber (#693). - **Custom mounts now link back to the real host application root** instead of always navigating to `/`, including when Spring context paths, WebFlux base paths, or Quarkus root paths are configured (#699). - **The UI no longer fails when browser storage is unavailable or denied.** Theme, sidebar, expanded navigation groups, recent panels, and Live Activity filters use a safe adapter with an in-memory fallback and recover from malformed stored values (#700). - **Native and container sample builds are reliable again.** GraalVM native-image builds work with Maven 3.9.16, and the standalone Quarkus sample image starts without requiring the Docker-backed Observability Dev Service while retaining BootUI's in-process trace capture (#641, #688). - **Documentation heading links remain visible below the fixed navbar** instead of scrolling their target underneath it (#690). ### Security - **MCP tool-call failures no longer leak internal exception details.** An unexpected server-side error during a `tools/call` now returns the standard, detail-free JSON-RPC internal error to the caller, while the original exception and stack trace are still logged server-side for diagnostics (#705). - **Patched vulnerable documentation and frontend build/test dependencies** by updating `immutable` to 5.1.9, `linkify-it` to 5.0.2, `fast-uri` to 3.1.5, and every affected `brace-expansion` line: the documentation toolchain to 1.1.18 and the frontend line through the 2.1.4 backport to its final 5.0.9 release. These packages are not part of BootUI's shipped Java or browser runtime (#625–#627, #676, #678–#679, 4c895203). ## [1.12.0] - 2026-07-12 Security and hardening release that adds authenticated remote API access, brings the MCP Server to Spring WebFlux, enforces bounded outbound HTTP responses, and completes another accuracy pass across every advisor. ### Added - **Authenticated non-loopback API access on all three adapters.** Every non-loopback `/bootui/api/**` request now requires a bearer token, while loopback use remains frictionless. BootUI generates and logs a 256-bit token once when remote access is enabled without a configured `bootui.authentication.token`; callers can send it in the `Authorization` header, and the browser can exchange it for an HttpOnly, `SameSite=Strict` cookie scoped to the BootUI API (#608). - **MCP Server support on Spring WebFlux**, with a reactive tool catalog over the reactive Live Activity, Exceptions, Security Logs, SQL Trace, and Log Tail controllers. The shared MCP core now validates protocol versions and JSON-RPC envelopes, handles notifications and lifecycle methods correctly, bounds payload size and concurrent calls, and is covered by the same conformance suite on Spring MVC, Spring WebFlux, and Quarkus. WebFlux advertises every applicable tool except `security_scan`, whose backing advisor is not yet ported (#611, #612). - **A distributable BootUI agent skill** for GitHub Copilot and other skill-aware coding agents, covering installation, runtime inspection, advisor scans, verification, and MCP setup (#611). - **Shared security-header policy** across Spring MVC, Spring WebFlux, and Quarkus, including CSP, `X-Content-Type-Options`, `X-Frame-Options`, and HSTS where applicable (#582). - **Focused JDK 21 and 25 compatibility CI**, alongside the existing Java 17 build/release baseline (#579). ### Changed - **All outbound HTTP integrations now enforce response-size budgets.** HTTP Probe returns a clear truncation signal; pentesting probes, GraalVM metadata, OSV/EPSS, and GitHub clients reject oversized responses rather than buffering unbounded remote content (#568). - **The shared API conformance suite now covers nested and action endpoints**, canonical access-denied responses, pagination/filtering, scanner lifecycles, trace operations, and MCP behavior on every adapter. Backend panel metadata is centralized in one validated catalog and checked against UI routes, manifests, guarded API prefixes, and `docs/FEATURES.md` (#581, #583). - **Another full advisor accuracy pass** corrected false positives, stale platform assumptions, severity/rationale gaps, and runtime heuristics across Architecture, Spring/Quarkus application, Hibernate, Memory, Security, REST API, Pentesting, Vulnerabilities, GraalVM, and CRaC. New coverage includes REST response-contract checks, proxy-aware architecture rules, current JVM/container memory heuristics, additional security configuration evidence, stricter version comparison and OSV result handling, and expanded GraalVM/CRaC runtime checks (#597–#606). - **Release verification now smoke-tests all published distributions from Maven Central** — Spring MVC, Spring WebFlux, and Quarkus — before committing and tagging a prepared release (#576). - **Dependencies updated**, including Quarkus 3.37.2, Spring Kafka 4.1.0, the Quarkus LangChain4j BOM, Vite, Prettier, vue-tsc, Playwright, VuePress, Sharp, and the patched `js-yaml` 3.15.0 transitive dependency. ### Fixed - **REST Client panel now reports unavailable until a client is actually instrumented (Spring MVC).** The panel's `/bootui/api/panels` availability previously only checked that the internal `RestClientTraceRecorder` bean existed — but that bean is registered unconditionally (it also backs Live Activity), so the check was always true and the panel showed up in the sidebar even for applications with no `RestClient`, `RestTemplate`, or `WebClient` ever built. Availability now mirrors the recorder's own "has anything been instrumented yet" signal, the same pattern Kafka/Email/Cache already use (#560). - **CRaC Docker publish smoke tests** now grant the capabilities CRIU needs to restore a checkpointed process and use the corrected generated-image startup path (#607). - **WebFlux MCP availability and conformance expectations** now match the implemented reactive server, and nested endpoint conformance checks no longer misclassify valid endpoint families (#612). - **Release pushes retry safely after a non-fast-forward update**, rebasing the release-only version commit before recreating the tag instead of leaving a successfully published version untagged (#559). ## [1.11.0] - 2026-07-09 Feature release headlined by three new dev-loop panels — **Email**, **REST Client Trace**, and **Kafka** — and **Live Activity growing from 4 to 9 merged signal types**. Also ships a ~2.4x faster Maven build. ### Added - **Email panel** — captures outgoing application email (recipients, subject, HTML/text body, attachments) for local inspection, mirroring Laravel Telescope's mail watcher. Ships on both Spring and Quarkus; content is revealed by default, with an opt-in `bootui.email.mask-content` flag for teams routing real PII through a shared dev environment (#538). - **REST Client Trace panel** — captures outbound `RestClient`/`RestTemplate`/`WebClient` calls (method, host, path, status, duration), with slow-call and "chatty" (repeated-call) detection. Spring servlet adapter only for now (#544). - **Kafka panel** — a dedicated, filterable view over producer/consumer activity: direction, topic, partition, offset, key hash, duration, and success/failure, with the message value/payload never captured. Ships on both Spring and Quarkus (#550). - **Live Activity grows from 4 to 9 merged signal types**, adding cache accesses, scheduled-task runs, Kafka producer/consumer activity, outbound REST client calls, and captured email to the existing request/SQL/exception/ security feed — each nested under its correlated request. Kafka and scheduled-task capture are also new on Quarkus, and cache capture is also new on Spring WebFlux (#538, #541, #542, #543, #544). ### Changed - **Email and REST Client Trace moved into the Services group** in the sidebar, alongside Scheduled Tasks and Cache. - **~2.4x faster full Maven build** (5:09 → ~2:10 min on a 10-core machine) by enabling reactor (`-T 1C`) and Surefire test parallelism, after fixing two latent Quarkus concurrency races that made parallel builds flaky (#545). ### Fixed - **Hardened Kafka and Scheduled Tasks activity capture to fail open on errors**, so a capture-side bug can no longer disrupt a real Kafka send/consume or scheduled-task run. ## [1.10.0] - 2026-07-07 Feature release headlined by **Spring WebFlux support**, a third first-class BootUI adapter alongside Spring MVC and Quarkus, and **OpenTelemetry span enrichment** that keeps cross-service traces readable when the Traces panel aggregates spans from multiple BootUI-instrumented instances. The rest of the release is a second, deeper round of the multi-model advisor audit that started in 1.9.0 — this pass covers the remaining eight rule sets (on top of the Security and Hibernate audits below), fixing real bugs and growing most of them. Also corrects a stale claim about loopback enforcement on the Quarkus adapter. ### Added - **Spring WebFlux (reactive) support** — BootUI now runs on Netty/`DispatcherHandler` Spring Boot 4 applications, not just servlet ones. A new drop-in `bootui-spring-boot-starter-reactive` starter and `BootUiReactiveAutoConfiguration` serve the same shared engine, the same Vue UI, and the same `/bootui/api/**` contract as the servlet adapter, gated by the same activation rule plus `@ConditionalOnWebApplication(REACTIVE)`. The same framework-neutral `LocalhostGuard`/`BootUiPanels` safety floor is ported to a `WebFilter` binding (`ReactiveLocalhostOnlyFilter`, `ReactivePanelAccessFilter`), and Live Activity and HTTP Exchanges get dedicated reactive capture layers reusing the unchanged engine stores underneath, with trace-id correlation stamped at every capture point (HTTP exchange, SQL, exception, security) from the active OpenTelemetry span — requiring `spring.reactor.context-propagation=auto` (now a BootUI-contributed overridable default, since Reactor does not otherwise restore that span across WebFlux's scheduler hops) — matching the Quarkus adapter's correlation fidelity. 43 of the 47 panels are available today, and **every action-capable panel that is available behaves identically to the servlet adapter**. Only HTTP Sessions (no reactive analog), the Security advisor and the raw Spring Security panel (a `ServerHttpSecurity`/`SecurityWebFilterChain` ruleset is planned as follow-up), and MCP Server stay unavailable, each with a clear reason surfaced through the panel manifest. Ships with a new reference `bootui-spring-webflux-sample-app` (port 8081) and a matching `Dockerfile-webflux` image. See [docs/WEBFLUX-SUPPORT.md](docs/WEBFLUX-SUPPORT.md) (#523, #526, #536). - **OpenTelemetry span enrichment**, so cross-service traces stay readable once BootUI aggregates spans from more than one instance (for example a Spring app calling a Quarkus app). A new `BootUiIdentitySpanProcessor` stamps `bootui.service`/`bootui.instance` identity attributes on every span at start, and an `OtelSpanEnricher` adds `bootui.sql.queries`/`bootui.exception` depth attributes to the active span from the existing SQL Trace and Exceptions capture hooks — both behind a framework-neutral `SpanEnricher` engine seam (a no-op default) and a new `bootui.telemetry.enrich` toggle, wired on both Spring and Quarkus. The Traces panel's request drawer now surfaces the enrichment with an indicator, and the Spring sample app gained a demo button that calls the Quarkus sample app so the resulting merged, cross-service trace can be seen live. See [docs/SPECIFICATION.md](docs/SPECIFICATION.md) §5.14.3 (#525). - **Two new Spring Security advisor rules**, from the same follow-up audit described under Changed below: `SEC-AUTH-009` (Spring Boot's auto-generated default user/password must not be relied on in production — the fully-default case where no `UserDetailsService`/`AuthenticationProvider` bean and no `spring.security.user.*` property exist at all, distinct from `SEC-AUTH-004`'s explicitly-configured static user, HIGH) and `SEC-SESSION-009` (a custom `server.servlet.session.cookie.name` should use the `__Host-`/`__Secure-` cookie-name prefix so the browser enforces Secure/no-Domain/Path=/, hardening against cookie-tossing from a sibling or subdomain — the unmodified default `JSESSIONID` is not flagged, LOW). The Security advisor now has 59 rules, up from 57 (#522). - **Three new Hibernate advisor rules**, from a second, deeper audit pass dedicated to the Hibernate advisor alone: `HIB-ID-007` (composite identifier classes — `@EmbeddedId`/`@IdClass` — must be `Serializable`, expose a public no-arg constructor, and override both `equals` and `hashCode`, HIGH), `HIB-CONFIG-018` (bind-parameter logging should not be left on in production — `org.hibernate.orm.jdbc.bind`/the legacy SQL binder logger at `TRACE`, or `quarkus.hibernate-orm.log.bind-parameters=true`, HIGH), and `HIB-ENTITY-009` (a unique business-key column with no `@NaturalId`-annotated attribute is a missed lookup-performance opportunity, INFO). The Hibernate advisor now has 69 rules, up from 66 (#511). ### Changed - **Extended the multi-model advisor audit** (5 independent AI models — Claude Opus 4.8, GPT-5.5, Gemini 3.1 Pro, GPT-5.3-Codex, Claude Sonnet 5 — each re-verified against primary sources before implementation) to the remaining eight rule sets, fixing real bugs and adding coverage: - **Architecture** (38 → 39 rules): removed a rule that double-counted violations two other rules already caught, fixed CDI/`@Inject` logger and `System.exit` false positives, extended the test-framework allowlist to Quarkus, and added checks for unmanaged `new Thread(...)` construction and message-less assertions (#509). - **Memory** (32 → 35 rules): corrected stale G1/thread-stack/Serial-GC rationale and thresholds against current OpenJDK ergonomics and cgroup documentation, and added 3 new leak-detection checks — a GC pause latency outlier, buffer-pool growth-without-release, and old-generation trending-upward rule (#510). - **REST API** (47 → 51 rules): recognizes Mutiny `Uni`/`Multi` and JAX-RS `ExceptionMapper`s at parity with Spring's reactive/exception handling, fixes several PATCH/catch-all/pagination false positives, and adds `Idempotency-Key`, `@Deprecated`+OpenAPI, and `Retry-After` checks (#512). - **Pentesting** (70 → 78 rules): fixed a false positive where BootUI's own Actuator convenience defaults were flagged as a misconfiguration, stopped a false "PASS" on Quarkus for checks that can only ever run against Spring metadata (now correctly reported `NOT_APPLICABLE`), and added 6 new header/cookie hardening checks (#513). - **Vulnerabilities** (no static rule catalogue): corrected OSV package-level severity precedence, added full `next_page_token` pagination (previously silently truncated), added FIRST.org EPSS exploit-probability enrichment, and an explicit `fixAvailable` signal (#514). - **Spring Application advisor** (37 rules, unchanged): corrected a stale `RemovedOrRenamedPropertyRule` claim, expanded its legacy-property table from 5 to 41 verified entries, and fixed an async-executor rule that almost never fired against Spring Boot's real default configuration (#515). - **GraalVM** (21 → 23 rules): fixed 11 stale documentation links and a fat-jar/uber-jar blind spot in the dependency scanner, and added checks for `Unsafe.allocateInstance` and dynamic/model MBeans (#516). - **CRaC** (11 → 14 rules, Spring-only): fixed a self-defeating gap where a resource's own `beforeCheckpoint`/`afterRestore` callbacks re-triggered the very leak they were meant to fix, broadened the random/secret scans to instance fields (not just static ones), and added scheduling, HTTP-client, and CRaC-runtime-inventory checks (#518). - **Spring Security** (52 → 57 rules, before the follow-up pass below): removed a rule for a class deleted in Spring Security 6, fixed four Actuator-exposure rules to honor `.exclude`, a CSP wildcard/omission bug, and Spring Security 7's `PathPatternRequestMatcher` format change, and added 6 new rules including matcher-shadowing detection (#519). - **Collapsed duplicate self-traffic classification logic** on both adapters: capture (span export, OTLP receiver) and transform (Traces, Metrics, Cache, and other monitoring panels) each built their own `SelfTelemetryClassifier`, and capture always hardcoded the default `/bootui` path while transform correctly read the operator-configured `bootui.path` — so customizing that property made the two silently disagree on what counts as BootUI's own traffic. Both now share one instance per adapter (#508). - **Each sample app, and its Docker image, now runs on its own dedicated port** — 8080 for the classic Spring Boot app (servlet, AOT, native, CRaC), 8081 for WebFlux, 8082 for Quarkus — so all three can run side by side, locally or in Docker, without a port clash. - **Sample-app integration tests now run Docker-free on H2** instead of requiring a PostgreSQL Testcontainer (#506). - **Bumped dependencies:** Quarkus platform to 3.37.1 (#530), the PostgreSQL JDBC driver to 42.7.13 (#533), and the frontend toolchain — Vite to 8.1.3, Vitest to 4.1.10, vue-tsc to 3.3.6, and Prettier to 3.9.4 (#528, #529, #531, #532). - **Follow-up Spring Security advisor audit pass**, cross-validated by 5 independent AI models (Claude Opus 4.8, GPT-5.5, Gemini 3.1 Pro, GPT-5.3-Codex, Claude Sonnet 5) re-auditing the ruleset shortly after #519, catching two remaining false-positive/stale-doc gaps that audit had not covered: `SEC-OAUTH-001` fired a false HIGH violation on legitimate opaque-token resource servers (`.oauth2ResourceServer(oauth2 -> oauth2.opaqueToken(...))`) because `BearerTokenAuthenticationFilter` is installed identically for both JWT and opaque-token resource servers, but the rule only ever checked JWT-specific config — it now also accepts `spring.security.oauth2.resourceserver.opaquetoken.introspection-uri` or a custom `OpaqueTokenIntrospector` bean as valid proof the resource server validates tokens; and `SEC-ACT-004`'s description/recommendation claimed Spring Boot's `management.endpoint.health.show-details` default is `when-authorized`, which was true before Spring Boot 3.0 but the real current default is `never` — corrected the text and also added detection for `management.endpoint.health.show-components=always`, which leaks the same infrastructure/component names as `show-details=always` but was previously unchecked (#522). - **Second Hibernate advisor audit pass**, cross-validated by 5 independent AI models (Claude Opus 4.8, GPT-5.5, Gemini 3.1 Pro, GPT-5.3-Codex, Claude Sonnet 5) auditing the ruleset against official Hibernate ORM/Quarkus/Spring Data docs and Hibernate's own GitHub source: expanded the Quarkus adapter's `QuarkusHibernatePropertyLookup` with 7 more confirmed Hibernate-property aliases that were previously unreadable on Quarkus and so guaranteed false positives for operators who had actually configured them correctly — `default_batch_fetch_size`, `jdbc.time_zone`, `generate_statistics`, `query.fail_on_pagination_over_collection_fetch`, `query.in_clause_parameter_padding`, `cache.use_query_cache`, and `cache.use_second_level_cache` (the last two both map to Quarkus' single unified `second-level-caching-enabled` toggle) — plus a generic `quarkus.hibernate-orm.unsupported-properties."..."` fallback for keys with no first-class Quarkus option (e.g. `hibernate.order_inserts`/`order_updates`), confirmed end-to-end by a live-boot test asserting Hibernate's own `SessionFactoryOptions` picks the values up. Also fixed: `HIB-ID-004` double-reported every UUID-typed identifier alongside `HIB-ID-005` and asserted an AUTO-strategy rationale that's wrong for UUID ids (now correctly deferred to `HIB-ID-005`); `HIB-ID-005`'s UUID remediation recommended `@UuidGenerator(style = TIME)` as "index-friendly," but `TIME` is an RFC 4122 v1 style with the same index fragmentation problem as random UUIDs — the truly index-friendly `VERSION_6`/`VERSION_7` styles only exist on Hibernate 7.0+, so the remediation is now version-gated to the running Hibernate version; `HIB-ENTITY-005` false positived on every property-access (getter-mapped) entity because its field-vs-method heuristic only worked for the reflection-based scan path, not the real `EntityManagerFactory`-metamodel path — it now keys off an explicit field-access flag; `HIB-MAP-010` incorrectly treated `@OrderBy` as an equally valid alternative to `@OrderColumn` for avoiding delete-and-reinsert list updates, when only `@OrderColumn` actually persists an index (this was already inconsistent with the sibling `HIB-MAP-004` rule's own bag-detection logic); and `HIB-FETCH-004` was downgraded from MEDIUM to INFO after review showed it fired on any entity merely declaring 2+ lazy bag collections, a common and safe pattern — the actual failure mode (`MultipleBagFetchException`) is already covered by `HIB-QUERY-007`, which fires only when bags are actually join-fetched together (#511). - **Fixed a completely non-functional Quarkus application advisor rule (`QA-SCH-001`) and corrected five other rules' severity or rationale**, following a second, independent 5-model research audit, re-verified against live Quarkus 3.33 source before implementation. `QA-SCH-001` (scheduled tasks without a clustered scheduler) never fired in practice because the build-time processor never emitted the `bootui.internal.app.scheduled` config key its own provider reads — fixed by wiring the existing `@Scheduled` Jandex scan into the same build step. Also fixed: `QA-WEB-003`'s rationale incorrectly claimed Quarkus REST clients have no default timeout (they default to a 15s connect-timeout / 30s read-timeout, per `RestClientsConfig`) — the rule now only fires when a timeout is explicitly disabled (`0`) or excessive (over 5 minutes), rather than merely absent; `QA-RX-001` (a reactive endpoint blocking the event loop on JDBC) raised from INFO to HIGH to reflect how severe and common this footgun is in production, and now treats `@Transactional` as a guard alongside `@Blocking` (Quarkus REST dispatches both to a worker thread) and recognizes `CompletionStage`/`CompletableFuture`/`Publisher` return types in addition to `Uni`/`Multi`; `QA-PROD-001` (a Dev Services override in `%prod`) lowered from HIGH to LOW after confirming Dev Services never runs in a packaged `LaunchMode.NORMAL` build regardless of this property's value; `QA-PROD-002` (a destructive Hibernate schema strategy in `%prod`) now also flags `update` (previously only `drop-and-create`/`create`/`drop`), with severity split CRITICAL for the outright-destructive strategies (matching the sibling Hibernate advisor's `HIB-CONFIG-002`) vs. HIGH for `update`; `QA-CDI-002` (a public mutable field on a JAX-RS resource) no longer false-positives on `@RequestScoped` resources, which get a fresh instance per request and carry no shared-state risk; `QA-PERF-001`/`QA-PERF-002` (virtual-thread adoption/pinning) now also count class-level `@RunOnVirtualThread`, not just method-level; and `QA-PROF-001` is rebased on the absence of `%prod.` override keys instead of active-profile emptiness, which rarely fires on a running app. Grew the advisor from 16 to 20 rules with four new checks: `QA-CDI-003` (shared mutable state on a `@Singleton` bean — the same risk `QA-CDI-001` already flags for `@ApplicationScoped`), `QA-CFG-004` (the deprecated `quarkus.hibernate-orm.database.generation` property, in favour of `quarkus.hibernate-orm.schema-management.strategy`), `QA-WEB-004` (graceful shutdown timeout never configured at all, distinct from `QA-WEB-002`'s "explicitly zeroed" case), and `QA-DB-001` (a JDBC datasource with no explicit `quarkus.datasource.jdbc.max-size`, silently relying on Agroal's default pool size of 50). See [docs/QUARKUS-ADVISOR-CHECKS.md](docs/QUARKUS-ADVISOR-CHECKS.md) (#520). ### Fixed - **Corrected a stale, overly pessimistic claim in the Quarkus adapter's `GET /bootui/api/overview` endpoint.** `activation.localhostOnly` was hardcoded to `false`, with a warning claiming loopback-source trust was "not yet fully enforced" on Quarkus reads. This was inaccurate: `BootUiQuarkusSafetyFilter` has enforced the full shared `LocalhostGuard` policy — loopback-source trust, the `Host` allow-list, and cross-site-write rejection — over the *whole* `/bootui` surface, including plain reads, since Quarkus support first shipped; only writes ever needed the extra CSRF-style check. The field now mirrors the Spring adapter's semantics (`true` unless `bootui.allow-non-localhost=true`) and the misleading warning was removed. - **Quarkus Security advisor: removed two dead-property rules, repurposed a third, and fixed several logic bugs**, found via a 5-model research synthesis independently re-verified against live Quarkus/SmallRye 3.33 source (grew from 43 to 45 rules). `QS-AUTH-011` (JDBC bcrypt work-factor) and `QS-CORS-004` (unanchored CORS regex) were retired outright: both checked config properties/behaviors that don't exist in current Quarkus (`BcryptPasswordKeyMapperConfig` has no work-factor field at all, and the CORS regex full-match bypass from quarkus/quarkus#34718 was fixed in Quarkus 3.3.0). `QS-AUTH-006` was repurposed from a dead `allow-unsigned-tokens` check (that property never existed) into a real finding for an unpinned JWT signature algorithm on a remote JWKS. `QS-GRAPHQL-001` was fixed to check the real `quarkus.smallrye-graphql.field-visibility=no-introspection` mechanism instead of a non-existent `introspection-enabled` property. `QS-CORS-001`/`002` no longer treat unset origins as equivalent to a wildcard (Quarkus's `CORSFilter` actually restricts unset origins to same-origin-only, the opposite of the old wording) — the unset case now gets its own correctly-worded `QS-CORS-005` (INFO). `QS-CORS-003`'s credentials-default modeling now mirrors Quarkus's real `.orElse(originMatches)` behavior instead of assuming credentials are off when unset. `QS-CFG-001` no longer blanket-excludes the entire `quarkus.*` namespace from secret scanning (it could never flag `quarkus.datasource.password`, `quarkus.oidc.credentials.secret`, etc.). `QS-TLS-002`/`003` now also scan named TLS registry buckets (`quarkus.tls..*`), not just the default bucket. `QS-MGMT-001` switched from resolved-value to raw-key inspection for `quarkus.management.host`, since BootUI's Quarkus advisor only ever runs under dev/test `LaunchMode`, where the resolved value could never observe Quarkus's real non-loopback prod default. `QS-AUTHZ-002`/ `004` now factor in HTTP-method-scoped permission policies (`quarkus.http.auth.permission.*.methods`) instead of treating every policy as applying to all methods. `QS-MSG-001` now evaluates each messaging channel independently so one channel's secure protocol can't mask another's insecure one. `QS-SESSION-003`'s wording now matches its `>= 8h` trigger. Three new rules were added: `QS-OIDC-003` (public OIDC client without PKCE), `QS-DEV-003` (SmallRye Health UI always-include), and `QS-MGMT-003` (management interface with no explicit prod-scoped host binding, complementing `QS-MGMT-001`). See [docs/QUARKUS-CHECKS.md](docs/QUARKUS-CHECKS.md) for full details on every rule. ## [1.9.0] - 2026-07-03 Feature release headlined by **optional durable JDBC persistence for Live Activity** on both adapters — the feed can now survive an application restart instead of living only in a bounded in-memory buffer — alongside a **Sentry-style triage workflow** for the Exceptions panel, **SQL call-site capture with a list-level N+1 badge** in Live Activity, and a comprehensive audit pass across all nine advisor rule sets that fixed real bugs and grew four of them. Also fixes a CodeQL-flagged XSS vulnerability in the Quarkus adapter and closes the per-panel access-gating parity gap called out as Spring-only in 1.8.0. ### Added - **Optional durable JDBC persistence for Live Activity, on both adapters.** Live Activity has always kept its feed in a bounded in-memory ring buffer that's lost on restart; it can now optionally persist to a JDBC datasource instead. A new `ActivityStore` abstraction backs the feed — `InMemoryActivityStore` (the unchanged default), `JdbcActivityStore`, and a `BufferedActivityStore` write-behind decorator that batches writes without blocking request handling — with rows namespaced per application instance (`instance_id`) so a shared database can safely serve multiple app instances, and a choice of a `shared` (host-provided) or `dedicated` datasource. A runtime "Use the existing datasource" button lets an operator hot-switch from in-memory to persistent capture with no restart, a graceful-shutdown hook flushes the last buffered batch, and every row is masked at capture time (`SecretMasker`) so persisted history is immutable and never needs re-masking on read. A new `BootUiJdbcCaptureGuard` prevents BootUI's own persistence JDBC calls from being captured back into its own Live Activity feed. See [docs/FEATURES.md](docs/FEATURES.md), [docs/QUARKUS-SUPPORT.md](docs/QUARKUS-SUPPORT.md), and [docs/PROPERTIES.md](docs/PROPERTIES.md) for the new `bootui.activity.persistence.*` properties (#504). - **A Sentry-style triage workflow for the Exceptions panel.** Every exception group can now be marked **Open**, **Acknowledged**, or **Resolved** via a new `POST /bootui/api/exceptions/{id}/status` endpoint (identical on both adapters); a **Resolved** group that sees a new occurrence automatically reopens to **Open** and increments a lifetime `regressionCount`, surfaced in the UI as a "Reopened ×N" badge — **Acknowledged** groups deliberately don't auto-transition, since the developer already knows about the failure. A status filter narrows the list alongside the existing text/source filters (#499). - **SQL call-site capture and a list-level N+1 badge in Live Activity.** `SqlTraceRecorder` now walks the capturing thread's stack to resolve the first application-code frame that issued a query, surfaced as `callSite` per execution and `callSites` per statement group in both the SQL Trace panel and the Live Activity per-request drawer (new `bootui.sql-trace.capture-call-site` property, default `true`). Live Activity's main table now also flags a request suspected of an N+1 pattern with a badge directly in the row, instead of requiring the drawer to be opened, using the same shared `SqlTraceGrouping` logic and threshold the drawer already used (#500). - **A dismiss/restore workflow for the Vulnerabilities panel**, bringing it in line with the Architecture panel's existing precedent: a vulnerability can be dismissed — keyed by `::` so the dismissal survives a patch-version bump of the still-vulnerable dependency — and is then excluded from the vulnerable-dependency count and severity rollups while staying visible in the UI, dimmed, with a Restore button (#485). - **Quarkus parity features**, closing gaps against the Spring adapter: security events now correlate into Live Activity the same way Spring's do (#489); Live Activity gained a reduced, trace-id-only per-request profile drill-down — SQL correlation always shows "exact" and security events are badged "principal" rather than the fuller thread-exact match Spring's profiler can show (#496); exceptions resolved by an application's own JAX-RS `ExceptionMapper` are now captured (#501); and per-panel `bootui.panels.*` enable/read-only gating is now enforced on the Quarkus adapter via a new `QuarkusPanelAccessFilter`, at full behavioral parity with Spring's `PanelAccessFilter` — the one gap called out as Spring-only in 1.8.0 (#491). - **Two new MCP tools**, `get_live_activity` and `get_exception_detail`, extending the MCP Server panel's tool catalogue (#502). ### Changed - **Audited all nine advisor rule sets against primary sources** (framework reference docs, specs, and library source), fixing bugs and growing coverage where real gaps were found: the **Architecture** advisor grew from 37 to 38 rules, fixing a Spring-only field-injection rule that false-positived on idiomatic CDI code (adding the framework-neutral `ARCH-CODE-016` counterpart) plus fixes to proxy-visibility and reactive-return-type detection (#486); the **Spring** application advisor grew from 35 to 37 rules, fixing a graceful-shutdown detection gap and a severity-escalation gap, and adding an in-memory-database-in-production check and a public-mutable-field check (#483); the **Security** advisor grew from 48 to 52 rules, adding HTTP-Basic-without-TLS, weak-HSTS, weak-CSP, and hardcoded-credential-property-name checks, and cross-checked the Quarkus Security advisor's 43 rules with no changes needed (#484); the **Pentesting** advisor grew from 69 to 70 rules, fixing a severity bug and (across two follow-up passes) an evidence-truncation bug, and adding a DevTools remote-secret-exposure check (#479, #480); the **Hibernate** advisor's 66 rules got five bug fixes, including a wrong AUTO-strategy claim, a `@Transient`-field false positive, and Panache-specific false positives now correctly suppressed under Quarkus (#487); the **REST API** advisor's 47 rules got JAX-RS void-handler status-detection fixes that were causing both false positives and false negatives on Quarkus (#482); the **Memory** advisor's 32 rules got JVM-tuning calculator fixes for stale JDK-version gates (`-XX:+ZGenerational`, `-XX:+UseStringDeduplication`) (#481); and the **Vulnerabilities** advisor kept its rule count (it has no static rule catalogue) but fixed a CVSS v3 severity-parsing bug that had silently misclassified every real OSV advisory, and added partial-scan-failure resilience and withdrawn-advisory filtering (#485). - **Expanded Playwright e2e coverage**: deep interaction specs for Quarkus's action-capable panels (#490), coverage for the new Quarkus per-panel access gating (#494), and dedicated specs for 17 more Quarkus panels — bringing the Quarkus e2e suite to the same interaction-level depth as Spring's (#498). - **Reduced BootUI's Maven Central publishing footprint** ahead of Sonatype's new monthly publishing quota: stopped publishing the demo/test modules, largely the sample app's fat jar, which accounted for roughly 750MB and 92% of the previously-published footprint (#477); and trimmed checksum fanout to only the md5/sha1 files Sonatype actually mandates, cutting published files per release from 174 to 116 (#493). ### Fixed - **Fixed a high-severity CodeQL-flagged XSS vulnerability (`java/xss`)** in `QuarkusIndexResource`, where the injected `` was built from attacker-influenced request-URI data; it's now derived from the static `quarkus.http.root-path` config instead, matching the Spring adapter's existing pattern. No caller-visible behavior change for legitimate requests (#503). - **The compiled BootUI shell was still reachable in Quarkus production builds**, even though the data-bearing `/bootui/api/**` surface was already dark — Quarkus wires its static-resource handler for `META-INF/resources/**` unconditionally, independent of this extension's launch-mode gating. A new always-on Vert.x route filter (`BootUiProdShellGuardFilter`) now answers 404 for the entire `/bootui` surface whenever `LaunchMode.NORMAL` is active (#497). - **Quarkus Exceptions and Live Activity entries always had a null `method`, `path`, and `handler`.** The HTTP-context- free log-based capture path always won a dedup race against the richer HTTP-filter capture path. Fixed by resolving the current request's method/path from the CDI-current `CurrentVertxRequest` (#492) and the current resource class/method from RESTEasy Reactive's `CurrentRequestManager` (#495). - **Three bugs found while building deeper Quarkus e2e coverage** (#498): the Beans panel hid any bean whose fully-qualified name merely *started with* BootUI's own package prefix, not just BootUI's own beans; the Mappings panel had the identical bug hiding real JAX-RS resources; and Security Logs badges always rendered the generic color on Quarkus, because the color-matching logic checked only Spring's ALL-CAPS audit-event names against Quarkus's PascalCase CDI security event class names. - **Corrected stale Quarkus panel-availability claims in `docs/QUARKUS-SUPPORT.md`** that still listed Database Connection Pools, Security Logs, and Log Tail as not-yet-implemented after they had already shipped (#488). - **Fixed broken javadoc `@link` references** that were causing CI build warnings (#476). - **Fixed a stale Quarkus version reference in the docs and permanently guarded the release workflow** to fail the release if any stale version reference remains anywhere in the repo or any `pom.xml` wasn't bumped (#478). ## [1.8.0] - 2026-07-01 Feature release headlined by **Quarkus support** — BootUI is now a dual-framework developer console that runs the same Vue UI and `/bootui/api/**` contract on Spring Boot 4 or Quarkus — alongside a hardening pass on the two new Quarkus advisors and the breaking renames that came with the Quarkus port (the `cache` panel id, the `bootui-spring-*` module names, and the `bootui-engine`/`bootui-spi` merge). ### Added - **Quarkus support: BootUI is now a dual-framework developer console.** A new `bootui-quarkus` / `bootui-quarkus-deployment` extension serves the same Vue UI, the same `/bootui/api/**` DTO contract, and the same framework-neutral engine the Spring Boot adapter has always used — add the extension to a Quarkus 3.33 LTS application and the console activates automatically in `quarkus:dev` / `@QuarkusTest`, staying dark (no wired endpoints or beans) in `LaunchMode.NORMAL`. The large majority of the panel surface is live at launch: **always available** — Overview, Architecture, the framework-application advisor (labelled "Quarkus"), Pentesting, Vulnerabilities, Memory, Threads, Heap Dump, Live Memory, JVM Tuning, Metrics, Loggers, Log Tail, Health, HTTP Probe, Beans, Mappings, Configuration (read-only), Traces, AI Usage, HTTP Exchanges, Live Activity, Exceptions, MCP Server, and GitHub; **available when their capability is detected** — Hibernate, Scheduled Tasks, Cache, Flyway, Liquibase, Database Connection Pools, Dev Services, Security Logs, SQL Trace, REST API, and Profile Diff. Every action-capable panel (advisor scans, Heap Dump, Threads download, Loggers, HTTP Probe, Cache clear, Flyway migrate/clean, Liquibase update, Traces clear, MCP Server toggle) is guarded by the same shared engine `LocalhostGuard` write floor Spring uses, so both adapters reject non-local/cross-site requests identically. Only GraalVM, CRaC, Conditions, Startup Timeline, HTTP Sessions, Spring Data, Spring Security, and DevTools stay unavailable on Quarkus, each with a panel-specific "not applicable" reason. See [docs/QUARKUS-SUPPORT.md](docs/QUARKUS-SUPPORT.md) and [docs/FEATURES.md](docs/FEATURES.md) for the full per-panel breakdown (#467). - **A new Quarkus-native Security advisor** (kept under the shared panel id `spring`, labelled "Quarkus Security" on the Quarkus adapter) reviews Elytron/OIDC authentication, `quarkus.http.auth.permission.*` authorization, TLS, CORS, and `@RolesAllowed` usage in place of the Spring-Security-coupled advisor, which has no Quarkus equivalent. See [docs/QUARKUS-CHECKS.md](docs/QUARKUS-CHECKS.md) for the full rule catalogue (#467, #472). - **A framework-neutral HTTP conformance harness (`bootui-conformance`)** pins the shared `/bootui/api/**` contract with one abstract test suite that both adapters run against a booted sample app: the panels manifest must match a golden fixture, every panel reported `available:true` must answer its primary `GET` with JSON, and a cross-site state-changing request must be rejected with 403 — so lighting up a panel on either backend automatically gets black-box coverage (#467). - **A reference `bootui-quarkus-sample-app`** and Docker-free `@QuarkusTest` integration/conformance suites (`bootui-quarkus-integration-tests`) demonstrate and gate the Quarkus adapter, mirroring the existing Spring sample app and Playwright e2e coverage (#467). ### Changed - **Hardened the Quarkus application and Quarkus Security advisors toward Spring parity**, following a first advisor audit. Fixed three bugs: dead CSRF detection in `QS-AUTH-003`, `@DenyAll`-secured endpoints not counted as secured in `QS-AUTHZ-003`/`QS-AUTHZ-004`, and a blocking-JDBC check (`QA-RX-001`) comparing against the global endpoint count instead of the per-endpoint reactive/blocking split. Grew the Quarkus application advisor from 10 to 16 rules (verbose log level in prod, compression/graceful-shutdown/REST-client-timeout hygiene, virtual-thread adoption/pinning) and the Quarkus Security advisor from 25 to 43 rules (JWT hardening, JDBC identity-store checks, CORS regex anchoring, fine-grained security headers, form-auth session hardening, a management-endpoint merge-risk check), including five rules with no Spring equivalent: virtual-thread pinning (JEP 491), `quarkus.http.non-application-root-path` merging health/metrics into the app namespace, gRPC server reflection left on in production, GraphQL schema introspection, and messaging SASL credentials configured without TLS. Since the whole Quarkus advisor surface was still unreleased, rule IDs were renumbered rather than leaving permanent gaps (#472). - **Bumped dependencies:** the Vue dependency group (#469), Spotless Maven plugin to latest (#468), the PostgreSQL JDBC driver to 42.7.12 (#470), and Prettier to 3.9.3 in the frontend (#471). - **Renamed the "Spring Cache" panel to "Cache".** The panel, route, and API are now framework-neutral so the same UI covers Spring Cache and `quarkus-cache`: route `/cache`, API `GET`/`POST /bootui/api/cache[/clear]`, and panel id `cache` (config keys `bootui.panels.cache.enabled` / `.read-only`). The advisor sidebar label now follows the running framework (shows "Quarkus" on Quarkus), matching the panel header. **This is a breaking change for existing integrations:** the browser route `/spring-cache` still redirects to `/cache`, but the old API path `GET /bootui/api/spring-cache` has been removed with no server-side alias (use `/bootui/api/cache`), and the old `bootui.panels.spring-cache.*` config keys are no longer read (rename them to `bootui.panels.cache.*`). - **Renamed the Spring adapter modules to carry a `spring` token**, matching the Quarkus adapter's naming (`bootui-quarkus*`): the auto-configuration module `bootui-autoconfigure` is now `bootui-spring-autoconfigure`, and the reference app `bootui-sample-app` is now `bootui-spring-sample-app`. **The only breaking change is the published Maven Central coordinate `com.julien-dubois.bootui:bootui-autoconfigure` → `…:bootui-spring-autoconfigure`.** Consumers who depend on `bootui-spring-boot-starter` (the recommended path) need no change — the starter pulls in the renamed module transitively. Only projects that declared a direct dependency on `bootui-autoconfigure` must update the artifact id. The `bootui-spring-boot-starter` artifact id is unchanged, Java package names (`io.github.jdubois.bootui.*`) are unchanged, and the published Docker image names (`jdubois/bootui-sample-app*`) are unchanged. - **Merged the `bootui-spi` module into `bootui-engine`.** The framework-neutral service-provider interfaces now live in the `io.github.jdubois.bootui.spi` package inside `bootui-engine` (the boundary is still enforced by `SpiBoundaryArchitectureTests`), reducing the shared modules from four to three (`bootui-core`, `bootui-engine`, `bootui-conformance`). **The only breaking change is that the published Maven Central coordinate `com.julien-dubois.bootui:bootui-spi` no longer exists** — its types ship in `bootui-engine`. Java package names (`io.github.jdubois.bootui.spi.*`) are unchanged, so code that imports these interfaces still compiles; consumers who depend on `bootui-spring-boot-starter` or `bootui-quarkus` (the recommended paths) need no change, since both pull the engine in. Only projects that declared a direct dependency on `bootui-spi` must drop it (the engine already provides those classes). ## [1.7.0] - 2026-06-29 Feature release headlined by **richer Dependabot insight in the GitHub panel** and **filterable readiness concerns on the GraalVM and CRaC advisors**, alongside a console-wide accessibility, motion, and design-token polish and a fix for a trailing-slash redirect loop. ### Added - **Dependabot alert details in the GitHub panel security drawer.** The drawer previously showed only an open-alert count plus a privacy note. It now lists the bounded set of open Dependabot alerts with their package, ecosystem, severity, advisory ID, summary, affected range, and fixed version — non-secret advisory metadata. Code scanning and secret scanning stay count-only and never inline secret values or vulnerable code snippets (#464). - **Concern filtering on the GraalVM and CRaC advisor panels.** Both panels listed every readiness concern with no way to narrow them. A shared filter toolbar (severity chips, category dropdown, free-text search) now appears once a scan finds concerns, with a live count and a no-match empty state, keeping the two advisors uniform (#463). ### Changed - **Console-wide accessibility, motion, and design-token polish.** A design pass verified WCAG 2.1 AA contrast in both light and dark themes (including caution body text), put a visible branded focus ring on every interactive control, calmed elevation and motion (flattened card shadows, hover-lift only on interactive cards, honors `prefers-reduced-motion`), and replaced native `window.confirm()` on one-click mutations with a branded confirmation dialog. `DESIGN.md` and its sidecar are now the documented source of truth for the radius, severity-color, and chart palettes (#459). - **Bumped the toolchain:** build plugins to latest (#462), Testcontainers to 2.0.5 (#461), and Node to 24.18.0 / npm to 11.17.0 (#460). - **Clarified the front-end hot-reload workflow** in the contributor and agent docs so UI iteration uses the Vite dev server (`:5173/bootui/`) rather than the pre-built Maven-served console (#457). ### Fixed - **`/bootui` no longer redirects to `/bootui/`, fixing a "localhost redirected you too many times" (`ERR_TOO_MANY_REDIRECTS`) loop behind a trailing-slash–stripping filter or proxy.** BootUI used to answer `GET /bootui` with a `302` to the canonical `/bootui/` so its relatively-referenced Vue assets and `fetch('api/...')` calls would resolve. Spring Framework 6.1+/Boot 4 dropped trailing-slash URL matching, so a host application that restores it with `UrlHandlerFilter.trailingSlashHandler("/**") .wrapRequest()` (a standard Boot 4 idiom) rewrites `/bootui/` back to `/bootui` ahead of the dispatcher — turning BootUI's redirect into an infinite loop. The same happens behind any proxy or filter that strips trailing slashes. BootUI now serves the SPA shell at **both** `/bootui` and `/bootui/` and injects a runtime `` so assets, API calls, and lazy chunks resolve regardless of the trailing slash, with no redirect to loop on. Host `server.servlet.context-path` support (#332) is preserved because the base href is computed per-request (#456). ## [1.6.0] - 2026-06-25 Feature release headlined by **idle memory reclamation** — BootUI now releases its live diagnostic buffers and pauses recording while the console sits idle — alongside a fix for a YAML activation gotcha that could silently disable BootUI and a restore of the Spring Security panel's collapsible sections. ### Added - **Idle memory reclamation for the live diagnostic buffers.** BootUI fills several bounded in-memory buffers from the host application's own traffic — ingested OTLP traces/spans, the SQL trace, and the request/security correlation windows. In development that traffic keeps flowing even when nobody has the console open, so the buffers sat at their steady-state size for no observable benefit. Once the console has been idle for `bootui.free-on-idle.timeout` (default `5m`), BootUI now releases those buffers' retained data and pauses recording into them, then refills them from live traffic on the next console request. A `ConsoleActivityFilter` registered just after the safety filters marks the console active on any trusted-local `/bootui` request (UI load, API poll, or stream open), so an open console never reclaims while a genuinely unused one does. The Exceptions and Log Tail buffers are deliberately retained so a recent error stays visible when the console is opened, the idle gate is kept separate from any user-facing pause toggle so resuming never overrides an explicit pause, and the whole behavior is dev-only and fully disabled with `bootui.free-on-idle.enabled=false` (#452). - **Ecosystem page on the documentation site** ([`docs/WORKS-WITH.md`](docs/WORKS-WITH.md)) that tells the shared-Java workflow story across BootUI, [Coffilot](https://www.julien-dubois.com/coffilot/), and [Dr JSkill](https://www.julien-dubois.com/dr-jskill/), reachable from a new "Ecosystem" navbar entry (#432). ### Fixed - **`bootui.enabled: ON` / `OFF` in YAML no longer silently disables BootUI.** YAML parses the unquoted `ON` as the boolean `true`, which reached `BootUiActivationCondition` as the string `"true"`, was rejected as an invalid value, and turned BootUI off — so `/bootui` fell through to the static-resource handler and 404'd with `NoResourceFoundException`. The activation condition now normalizes boolean-ish values (`TRUE`/`YES` → `ON`, `FALSE`/`NO` → `OFF`), matching Spring's relaxed enum binding used for BootUI's other `Mode` properties; unknown values still fail closed (#447, #448). - **Restored the collapsible accordion in the Spring Security panel.** Bootstrap's collapse JavaScript was never imported, so clicking the panel's accordion section headers did nothing; BootUI now bundles `bootstrap/js/dist/collapse` and the sections expand and collapse again (#431). - **Corrected the heading-anchor scroll offset on the documentation site** so deep links and in-page anchors no longer land with the target heading hidden behind the fixed navbar (#426). ## [1.5.2] - 2026-06-17 Patch release fixing a startup crash for applications that contribute their own `HttpExchangeRepository`, polishing two panels (Metrics measurement spacing and the Flyway sidebar icon), and adding a guide for driving BootUI from local AI coding agents. ### Added - **AI agents guide** ([`docs/AI-AGENTS.md`](docs/AI-AGENTS.md)) covering how to drive BootUI from local AI coding agents over the Model Context Protocol (MCP): connecting an agent to BootUI's MCP server so it can consult the running application before proposing a fix and verify it afterwards, a worked Hibernate-findings example, and how BootUI pairs with [Coffilot](https://github.com/jdubois/coffilot) to build, run, and scan an app from the GitHub Copilot App's side panel (#423). ### Fixed - **BootUI no longer crashes applications that contribute their own `HttpExchangeRepository`.** BootUI registers a fallback in-memory `HttpExchangeRepository` guarded by `@ConditionalOnMissingBean`, but runs `@AutoConfigureBefore` the standard HTTP-exchange auto-configurations. When the host application supplied its own repository from a configuration ordered after BootUI (for example its own auto-configuration), the condition could not see it yet, so BootUI created its fallback as well — leaving two repositories that broke single-bean injection into BootUI's recording filter and Spring Boot's own `httpExchangesEndpoint`, crashing the context at startup. BootUI now reconciles the repositories in a `BeanFactoryPostProcessor` that runs after every bean definition is registered (regardless of ordering) and before any bean is instantiated, dropping its fallback whenever another `HttpExchangeRepository` is present so exactly one remains — the application's own — which BootUI's filter and HTTP Exchanges panel then use transparently (#422). - **Corrected the Flyway panel icon** in the sidebar and panel header so it no longer reuses an unrelated glyph (#412). - **Restored the spacing between the statistic label and value** in the Metrics panel's per-sample measurements, which had run together without a gap (#410). ## [1.5.1] - 2026-06-15 Patch release with two fixes: BootUI's live panels no longer hold the JVM open until the configured shutdown timeout (a graceful-shutdown regression introduced by 1.5.0's move to Server-Sent Events), and BootUI no longer crashes Spring Cloud Config applications during the bootstrap phase. ### Fixed - **BootUI's live panels no longer delay graceful shutdown.** The Server-Sent Events panels (Live Activity, Exceptions, SQL Trace, Security Logs, Log Tail, Copilot, Claude Code) open an `SseEmitter` with no timeout, which counts as an active request. Their emitter cleanup ran from a bean-destruction (`@PreDestroy`) hook — too late, because Spring Boot 4's default graceful shutdown waits for in-flight requests *before* beans are destroyed, so every JVM stop blocked until the `spring.lifecycle.timeout-per-shutdown-phase` timeout (30s by default). BootUI now completes these streams on `ContextClosedEvent`, which fires before the web server's graceful-shutdown lifecycle, so the application stops promptly again. - **BootUI no longer breaks Spring Cloud bootstrap startup.** When a host application used Spring Cloud Config / the legacy bootstrap context (`spring-cloud-starter-bootstrap`) with BootUI active (for example under the `dev` profile), the application crashed at startup with `MissingWebServerFactoryBeanException: No qualifying bean of type 'ServletWebServerFactory' available`. BootUI's command-line support forces a servlet web type so the console can be served, but it was also applying that to Spring Cloud's transient, non-web **bootstrap** application context, which has no `ServletWebServerFactory`. BootUI now detects the bootstrap context (via Spring Cloud's `"bootstrap"` marker property source) and leaves it untouched, while still forcing the servlet web type on the main application. ## [1.5.0] - 2026-06-15 Feature release headlined by a new **Live Activity** panel — a diagnostics "home base" that merges BootUI's already captured signals into one reverse-chronological stream and adds a Symfony-style per-request profiler — and a move to **Server-Sent Events** for the event-driven panels so they update the moment something happens instead of polling on a timer. It also adds keyboard shortcuts and number-key navigation to the command palette, a fourth Ahead-of-Time sample-app Docker image (Spring AOT + JDK AOT cache), simplifies the Overview panel, upgrades the sample app to Spring AI 2.0.0 GA, and quiets the tracing libraries' DEBUG noise. ### Added - **Live Activity panel** — a new Overview panel that is the diagnostics home base: one reverse-chronological stream of everything the application just did plus a per-request profiler. It adds no new instrumentation, instead reusing the controllers and DTOs that back the HTTP Exchanges, SQL Trace, Exceptions, and Security Logs panels, so every value is already masked, self-filtered, and bounded. The stream merges `REQUEST`, `SQL`, `EXCEPTION`, and `SECURITY` entries with a colour-coded severity, a latency heat scale, a requests-over-time sparkline, a KPI strip (requests/min, error rate, p50/p95 latency, SQL rate, slowest endpoint, active exceptions, health, heap), and client-side filters that persist in the browser. Correlated SQL, exceptions, and security events are nested chronologically under the request that produced them — pinned by trace id, by the request's serving thread, or by method/path — and the per-request profiler correlates one request's signals with a tiered join that degrades gracefully and labels approximate matches rather than fabricating links, flags likely N+1 access patterns, and offers a **Copy profile** action. The merged feed is pushed over **Server-Sent Events** (`GET /bootui/api/activity/stream`) and can be paused and resumed. The panel is read-only and inherits BootUI's full safety model. Configurable under `bootui.activity.*` (#388). - **Server-Sent Events live updates** for the Exceptions, SQL Trace, and Security Logs panels. Each panel subscribes to a per-panel `/stream` endpoint and re-fetches the moment a signal is captured (or the buffer is cleared or paused/resumed) instead of polling on a fixed interval. The push carries no data — masking, truncation, and value-exposure rules still apply through the regular endpoint — bursts are coalesced into a single refresh, the stream is closed when the auto-refresh toggle is off or the tab is hidden, and the panels fall back to their initial load when Server-Sent Events are unavailable (#386). - **Command palette keyboard shortcuts and number-key navigation** — each panel now has a two-letter shortcut that the palette matches and displays, and the unfiltered palette can be navigated with the number keys `1`–`9` (#381). - **AOT-optimized sample-app Docker image** (`Dockerfile-aot`, `docker-compose-aot.yml`, published as `jdubois/bootui-sample-app-aot`) — a fourth startup-optimization option that combines Spring AOT processing with a JDK AOT (Ahead-of-Time) cache on the plain JVM image for significantly faster startup, documented in [`docs/TRY-SAMPLE-APP.md`](docs/TRY-SAMPLE-APP.md) (#383, #387). - Sample-app **action-lab buttons** that exercise more BootUI panels for richer demos and integration coverage (#389). - New `bootui.activity.*` configuration properties, catalogued in [`docs/PROPERTIES.md`](docs/PROPERTIES.md). ### Changed - **Simplified the Overview panel** by removing the live Health and Memory cards. The panel now opens with the hero banner and quick links and leads straight into the on-demand security & health scoring dashboard; the dedicated Health, Live Memory, and Heap Dump panels (also reachable from the Live Activity KPI strip) remain the home for that detail (#396). - **Quieted the tracing libraries' DEBUG noise at full sampling.** Because BootUI raises `management.tracing.sampling.probability` to `1.0` for local development, the OpenTelemetry SDK and Micrometer Tracing span/propagation code runs on every request and floods the console with low-value lines when the host's root logger is at `DEBUG`. BootUI now pins `logging.level.io.opentelemetry` and `logging.level.io.micrometer.tracing` to `INFO` as overridable defaults while the Traces panel is active; set either key yourself to opt back in (#394). - Upgraded the sample app to **Spring AI 2.0.0 GA** (from `2.0.0-RC1`) (#378). - Bumped `esbuild` from `0.28.0` to `0.28.1` (#380). ### Fixed - **`NoSuchMethodError` opening the Configuration or MCP Server panel on older Jackson 3** — `ConfigMetadataCatalog` now binds to the stable `ObjectMapper.treeToValue(TreeNode, Class)` overload instead of `treeToValue(JsonNode, Class)`, which was only added in jackson-databind 3.1. Host applications whose classpath resolves an earlier Jackson 3 (for example 3.0.x dragged in by a transitive dependency) no longer crash `ConfigController` start-up with `java.lang.NoSuchMethodError: 'java.lang.Object tools.jackson.databind.ObjectMapper.treeToValue(...)'` (#384). - **SQL Trace no longer fails under Spring Boot DevTools' class-loader split.** When DevTools loads the application on its restart class loader, the data source's own loader (the base loader, where the driver/pool jar lives) cannot see BootUI's `SqlTracedDataSource` marker, so creating the JDBC tracing proxy threw. BootUI now defines the proxy with its own class loader — a descendant of the data source's that can see both the marker and the JDK's JDBC interfaces — so SQL tracing keeps working during DevTools-powered development (#395). - Updated the Claude Code panel icon (#392). - Fixed the documentation site's home-page `` tag (#382) and a duplicate `@vuepress/plugin-markdown-tab` warning during the docs build (#379). ## [1.4.0] - 2026-06-12 Feature release headlined by three new panels — a **SQL Trace** panel that records executed SQL through a hand-written JDBC proxy and flags slow queries and likely N+1 access patterns, an **Exceptions** diagnostics panel that captures and groups runtime exceptions, and an opt-in, local-only **MCP server** (with a Developer Tools panel) that exposes BootUI's advisors and read-only diagnostics to local AI coding agents. It also sharpens the Traces panel, strengthens the CRaC advisor, fixes two GraalVM native-image issues in the starter, hardens the sample app's JVM and native Docker images to zero OS-package CVEs, shrinks the packaged UI, and polishes the console shell. ### Added - **SQL Trace panel** — a new Database panel showing the SQL statements the application recently executed, captured by a hand-written JDBC tracing proxy built on the JDK's own dynamic-proxy support (no third-party database-proxy library). It transparently wraps each `DataSource` and records SQL text, statement/category, wall-clock duration, affected rows, batch size, connection, thread, and failures into a bounded in-memory ring buffer; groups identical statements; flags likely **N+1** access patterns and slow queries; and offers local-only Pause/Resume and Clear actions. Parameter capture is off by default and masked when enabled, wrapping fails open, and the JDK proxies are registered for GraalVM native images. Configurable under `bootui.sql-trace.*` (#359). - **Exceptions panel** — a new Diagnostics panel that captures, groups, and surfaces exceptions thrown by the host application. Capture uses two observe-only sources (a `HandlerExceptionResolver` for MVC handler exceptions with request context, and a Logback root appender for anything logged with a throwable), deduplicated by `Throwable` identity and grouped by a SHA-256 fingerprint of the class and top stack frames, with bounded recent occurrences and the cause chain. Messages are masked, request paths are captured without query strings, and the clear action honors read-only. Configurable under `bootui.exceptions.*` (#358). - **MCP server for AI agents** — BootUI can optionally expose its advisors and read-only diagnostics to local AI coding agents (GitHub Copilot, Claude Code) through an opt-in, local-only [Model Context Protocol](https://modelcontextprotocol.io) server. It is a hand-rolled JSON-RPC 2.0 endpoint at `POST /bootui/api/mcp`, disabled by default (`bootui.mcp.enabled=OFF`), that reuses the existing controllers and DTOs so every tool returns the same masked, bounded shape as the REST API — advisor scans as action tools, plus diagnostics and core-context read tools — and inherits BootUI's full safety model. A new **MCP Server** panel (top of Developer Tools) documents the exposed tools, shows connection details and a copyable client-configuration JSON, and toggles the server on or off at runtime, overriding the configured mode. Configurable under `bootui.mcp.*` (#368, #370). - Three new **CRaC readiness checks** — `CRAC-FILE-001` (direct file-handle opens), `CRAC-CACHE-001` (live `CacheManager` beans), and `CRAC-CONFIG-001` (static initializers capturing env/properties) — plus broadened `CRAC-RES-001`, `CRAC-SECRET-001`, and `CRAC-POOL-001` coverage, all catalogued in [`docs/CRAC-READINESS-CHECKS.md`](docs/CRAC-READINESS-CHECKS.md) (#355). - New `bootui.sql-trace.*`, `bootui.exceptions.*`, and `bootui.mcp.*` configuration properties, all catalogued in [`docs/PROPERTIES.md`](docs/PROPERTIES.md). - A brand favicon for the console UI, the sample app, and the VuePress documentation site (#364). ### Changed - **Traces panel now shows the HTTP request path** a trace served (falling back to the root span name when no path attribute is present) instead of labelling traces with generic root spans, and **fully excludes BootUI's own traffic**: self-span filtering is now trace-level, so once any span identifies a trace as BootUI's own the whole trace — and sibling spans exported in other OTLP batches — is dropped. Applied to both the in-process span exporter and the `/bootui/api/otlp` receiver (#375). - **Polished the console shell** — collapsed-sidebar hover flyouts, a mobile overlay drawer and responsive topbar, a pulsing "live" dot on the auto-refresh toggle, recently visited panels floated to the top of the command palette, and human-readable byte sizes in Health details (#362). - **Shrank the packaged UI JAR** by subsetting the Bootstrap Icons font and CSS to only the icons BootUI uses (#363). - **Hardened the sample app's JVM Docker image** (published as `jdubois/bootui-sample-app`) to carry no known OS-package CVEs. Its runtime stage now uses Google's distroless glibc base (`gcr.io/distroless/base-debian12:nonroot`, the same base `Dockerfile-native` uses) instead of Alpine, which removes the vulnerable `openssl` (`libssl3`/`libcrypto3`) and `busybox` packages a scanner previously flagged. The `jlink` runtime is now assembled on the glibc JDK to match the base; because distroless ships no shell, JVM flags moved from a `sh -c $JAVA_OPTS` entrypoint to `JAVA_TOOL_OPTIONS`, the entrypoint is exec-form, and the Docker `HEALTHCHECK` was dropped (probe `/actuator/health` from your orchestrator instead, as the native image already documents) (#365). - **Hardened the sample app's GraalVM native Docker image** by building a mostly-static binary and switching the runtime stage to `gcr.io/distroless/base-debian12:nonroot`, taking it (and the BootUI-generated `Dockerfile-native`) to zero CVEs; the curl-based `HEALTHCHECK` was dropped (#356). - **Shrank the sample app's JVM Docker image from 739MB to 338MB** by exploding the repackaged Spring Boot jar into layers, assembling a curated `jlink` runtime, and using a minimal Alpine final stage (#361). - Refactored the sample app into clean feature packages for clearer demos and integration tests (#371). ### Fixed - **GraalVM native image: the Mappings panel no longer fails.** `GET /bootui/api/mappings` (the compatibility endpoint that returns Actuator's raw mappings descriptor) threw a `MissingReflectionRegistrationError` in a native image because Jackson reflectively instantiates the array forms of Actuator's nested `MediaTypeExpressionDescription` / `NameValueExpressionDescription` types while serializing them. BootUI's `RuntimeHints` now register those types and their array forms, so consumers of the starter no longer need to declare the hints themselves (#367). - **GraalVM native image: BootUI no longer self-reports as "Disabled" while running.** In a native image the activation condition is frozen at AOT build time, but the `BootUiActivation` bean recomputed it against the live runtime environment (where the build-time `dev` profile / `bootui.enabled=ON` no longer apply), so the Overview panel and the startup log claimed BootUI was disabled even though it was serving. When running AOT-generated artifacts, BootUI now trusts the frozen build-time decision and reports the accurate enabled state (#367). - Exempted the `/bootui/api/mcp` endpoint from Spring Security's SPA CSRF token so non-browser MCP clients (e.g. VS Code) can connect without a token, while `LocalhostOnlyFilter`'s loopback, `Host` allow-list, and cross-site defenses still apply (#370). - Fixed VuePress documentation anchor links landing on the wrong section (#374). ## [1.3.0] - 2026-06-11 Feature release headlined by two new GraalVM/CRaC capabilities — a new **CRaC (Coordinated Restore at Checkpoint) readiness panel** and **GraalVM reachability-metadata** support (repository lookup plus an install-into-source-tree action) — alongside an upgrade to **Spring Boot 4.1.0** and a second wave of advisor improvements (Memory, REST API, GraalVM) authored with Anthropic's new **Claude Fable 5** model, on top of the 1.2.0 hardening pass. It also makes BootUI reachable from inside containers through narrow, fail-closed opt-ins (`bootui.trusted-proxies` and `bootui.trust-container-gateway`), runs the sample app Docker-free by default, and adds a cross-platform CI build matrix. ### Added - **CRaC readiness panel** — a new Runtime panel that reviews the host application's [Coordinated Restore at Checkpoint](https://docs.spring.io/spring-framework/reference/integration/checkpoint-restore.html) readiness. It reports whether the `org.crac` API is on the classpath, whether the running JVM is a CRaC-capable JDK (detected via the real CRaC implementation rather than the no-op shim), whether `spring.context.checkpoint=onRefresh` is set, and any `-XX:CRaCCheckpointTo` / `-XX:CRaCRestoreFrom` JVM arguments. It scans the host application's own classes against a curated set of `CRaC-*` checks (including the `CRAC-POOL-001` connection-pool readiness check) for constructs that complicate checkpoint/restore, and generates ready-to-use container assets — a multi-stage `Dockerfile-crac` plus a `checkpoint-and-run.sh` entrypoint. The full catalogue lives in [`docs/CRAC-READINESS-CHECKS.md`](docs/CRAC-READINESS-CHECKS.md) (#322). - **GraalVM reachability-metadata lookup** — the GraalVM panel queries the reachability-metadata repository for the host's dependencies and adds an _install into source tree_ action that writes the metadata into the project; the "Include dependencies" toggle now defaults to on (#324, #331). - A second wave of advisor rules on top of the 1.2.0 hardening pass: **7 new GraalVM checks** (plus the new `GRAAL-FFM-001` Foreign Function & Memory check, replacing the AWT check), **7 new Memory rules**, and **9 new REST API rules**, all catalogued in the refreshed `docs/*-CHECKS.md`. This wave of advisor work was authored with Anthropic's new Claude Fable 5 model. - **`bootui.trusted-proxies`** — an opt-in list of source IP ranges (CIDR notation, e.g. `172.16.0.0/12`) trusted in addition to loopback by the safety filter. Lets local Docker-bridge callers reach BootUI without the blunt `bootui.allow-non-localhost=true`: it relaxes only the source-address check and keeps the `Host` allow-list (DNS-rebinding) and cross-site write (CSRF) protections in force. Pair it with `bootui.allowed-hosts` for the hostname the browser uses. - **`bootui.trust-container-gateway`** (`OFF` / `AUTO` / `ON`, default `OFF`) — a one-flag opt-in to trust the auto-detected container gateway as a single `/32`, so BootUI can be reached inside a container with a published port without knowing the subnet or setting a broad `bootui.trusted-proxies` CIDR. Detection covers both the Linux Docker Engine bridge gateway (from `/proc/net/route`) and the Docker Desktop gateway (via the `gateway.docker.internal` DNS name). Like `bootui.trusted-proxies`, it relaxes only the source-address check and keeps the `Host` allow-list and CSRF protections in force. - **Cross-platform CI** — a build workflow matrix that runs the full build on Linux, Windows, and macOS. - A "Docker container access" section in [`docs/SETUP.md`](docs/SETUP.md) covering the trusted-proxies and container-gateway options. ### Changed - **Upgraded to Spring Boot 4.1.0** (from 4.0.x), including aligning the Hibernate advisor end-to-end tests with Hibernate 7.4 collection-fetch behavior (#326). - Marked the **JVM Tuning, GraalVM, Architecture, REST API, and CRaC** panels unavailable in GraalVM native images, where their underlying JVM/bytecode analysis cannot run. The startup-timeline buffer is now installed for AOT images even when BootUI is inactive, so timeline data is captured if BootUI is later enabled. - **`bootui-sample-app` now runs Docker-free by default** — the `dev` Spring profile (the default via `spring.profiles.default=dev`) swaps the Docker Compose PostgreSQL, Redis, and Ollama services for an in-memory H2 database, a simple in-memory cache, and disabled Spring AI, so a bare `spring-boot:run` (and the Playwright e2e suite) starts offline with no Docker engine. A new `docker` profile (`-Dspring-boot.run.profiles=docker`) restores the full Docker experience (PostgreSQL, Redis, Ollama, and the `qwen2.5:0.5b` chat model). - **"Try the sample app" now uses the published Docker image** — [`docs/TRY-SAMPLE-APP.md`](docs/TRY-SAMPLE-APP.md) runs `jdubois/bootui-sample-app` (the JVM image), with `docker run` command lines for the CRaC (`jdubois/bootui-sample-app-crac`) and GraalVM native (`jdubois/bootui-sample-app-native`) images too. The `scripts/run-sample.sh` and `scripts/run-sample.ps1` helper scripts, which cloned and built the repository locally, were removed. - The sample app's three Dockerfiles (JVM, CRaC, and native) now default to the `dev` profile with Flyway/Liquibase disabled for fast startup, and the JVM and CRaC images set explicit JVM tuning flags. - Shared a single source-tree writer and build-system detection routine across the GraalVM and CRaC config generators. ### Fixed - BootUI now loads correctly when the host application sets a non-root `server.servlet.context-path` (#332). - Fixed the generated `Dockerfile-native` Maven build for plain Spring Boot applications (#325). - Normalized install display paths to forward slashes on Windows so the setup snippets render correctly. - Removed the ArchUnit gate from CRaC availability — only running in a native image disables the panel. - Fixed broken documentation links and aligned the VuePress navbar logo with the sidebar toggle. ## [1.2.0] - 2026-06-09 Feature release headlined by a **sweeping hardening pass across all eight rule-based advisors** — recalibrated severities, far fewer false positives and negatives, and a wave of new high-signal checks — backed by the new ability to **dismiss and restore advisor findings**. It also makes the console load even when the host disables Spring's static-resource mappings, and fixes scheduled-task and sample-app native-image regressions. ### Added - **New high-signal advisor checks** added across the rule advisors during the hardening pass, including Architecture (`ARCH-SPRING-017`, `ARCH-SPRING-018`, `ARCH-SPRING-019`, `ARCH-SPRING-021`, `ARCH-MOD-001`), REST API (`RAPI-MAP-008`, `RAPI-RESP-008`, `RAPI-VER-005`), and GraalVM (`GRAAL-CLASSGEN-001`, `GRAAL-INIT-002`, `GRAAL-SER-002`, `GRAAL-SCAN-001`, `SPRING-AOT-001`, `SPRING-AOT-002`, plus new class-generation, classpath-scanning, and Spring-AOT categories), with further new Spring, Hibernate, Memory, Security, and Pentesting rules catalogued in the refreshed `docs/*-CHECKS.md`. - Added `CRITICAL` severity to the Architecture, REST API, Spring, Hibernate, Security, Pentesting, and GraalVM advisors; official "learn more" links to the Architecture, Pentesting, and GraalVM panels; and a muted analysis-error channel on the Architecture, Spring, Security, and Memory panels that surfaces rules which throw during evaluation. - **Dismiss / restore advisor findings** — every finding surfaced by the seven Overview-scored rule advisors (Architecture, REST API, Spring, Hibernate, Memory, Security, Pentesting) now carries a _Dismiss_ button. Dismissed rules collapse into a "Dismissed rules" list at the bottom of the panel and are excluded from the panel's finding count, severity bars, the panel's own advisor score, and the weighted Overview score; they can be restored at any time. Dismissals are keyed by the globally unique rule IDs, applied server-side, and persisted under the `dismissedRules` node of a developer-local `.bootui/boot-ui.yml` file (next to the runtime overrides file), so they survive restarts and stay consistent between each panel and the Overview dashboard. - Per-advisor **0–100 score** now shown on each of those advisor panels (100 minus the weighted finding penalty), always matching the value the Overview dashboard computes for that advisor, rendered through a shared `AdvisorScoreCard`. ### Changed - **Hardened every rule-based advisor (Phases 0–8)** — Architecture, REST API, Spring, Hibernate, Memory, Security, Pentesting, and GraalVM — with context- and profile-aware dynamic severity, recalibrated thresholds, canonical Spring Boot 4 property names, and fewer false positives/negatives. The matching `docs/*-CHECKS.md` catalogues were refreshed. - Reworked Memory heap-pressure detection to measure pressure from a post-GC dual snapshot and to track GC-overhead trend across scans rather than within a single forced GC. - Extracted shared UI building blocks (`FlashBanner`, `SpinnerButton`, `ReadOnlyNotice`, `AdvisorScoreCard`) and a shared `AgentSessionController` base for the Copilot and Claude Code panels. - Changed the Spring panel icon from a lightbulb to a leaf. - Restructured the documentation site: install the starter via a dedicated dev Maven/Gradle profile, render the Maven/Gradle setup as VuePress tabs, reordered the setup sections, and removed the README badges. ### Fixed - Serve the BootUI console assets even when the host sets `spring.web.resources.add-mappings=false`: a dedicated `WebMvcConfigurer` maps `/bootui/**` to the bundled SPA without re-exposing the host's own static resources, and disabled static-resource mappings are now logged at `WARN` with a troubleshooting note (#291). - Scheduled Tasks panel no longer returns HTTP 500 when the host application registers its own `ScheduledTaskHolder` bean; tasks are aggregated across every holder so programmatically registered timers appear alongside `@Scheduled` tasks (#288). - Fixed the sample app's native-image smoke test for its new `@Inheritance(TABLE_PER_CLASS)` and `UUID` `@Id` demo entities by registering reflection hints for the `UnionSubclassEntityPersister` constructor and the `UUID[]` multi-id loader array in the sample app's native-hints configuration. - Fixed a Liquibase connection leak and a brittle cache type check flagged by static analysis, and stabilized the Hibernate advisor end-to-end tests against cached scan state and duplicated paged collection-fetch detail rendering. ## [1.1.0] - 2026-06-07 Feature release that introduces a dedicated **Advisors** workspace with three new rule-based panels (Spring, REST API, Memory), expands every existing advisor catalogue, lets the console run from non-web applications, and reorganizes the runtime memory panels — while hardening the safety filter and correcting the Actuator-defaults precedence. ### Added - **Spring panel** — new advisor that inspects the running application for Spring and Spring Boot 4 best-practice issues, shipping 31 curated rules documented in `docs/SPRING-CHECKS.md`. - **REST API panel** — new advisor that audits controller/handler mappings against 36 curated REST design rules, documented in `docs/REST-API-CHECKS.md`. - **Memory panel** — new advisor with 22 heap, native, GC, and finalizer checks documented in `docs/MEMORY-CHECKS.md`. - **Live Memory** runtime panel showing live JVM memory-pool usage, split out from the previous runtime Memory panel. - Support for serving the BootUI console from **non-web (command-line) Spring Boot applications**, not just servlet web apps. - GitHub panel **open-issues drawer** that lists open repository issues with bounded refreshes. - Five new Spring Security checks — BCrypt work-factor floor (`SEC-AUTH-006`), Referrer-Policy and Permissions-Policy headers (`SEC-HEAD-005`/`SEC-HEAD-006`), concurrent session control (`SEC-SESSION-007`), and HTTPS enforcement in production (`SEC-CONFIG-006`), documented in `docs/SECURITY-CHECKS.md`. - Expanded advisor coverage across the board: GraalVM readiness grows from 5 to 12 checks, plus new Architecture, Hibernate, and Memory rules, all reflected in their `docs/*-CHECKS.md` catalogues. ### Changed - Grouped the rule-based panels under a dedicated **Advisors** navigation group (Architecture, REST API, Spring, Hibernate, Memory, Security) alongside Pentesting and Vulnerabilities, and wired the new advisors into the Overview security & health scoring dashboard. - Renamed panels for clearer URLs and class names: dropped the "Advisor" suffix from the rule-based panels, renamed Tuning Advisor to **JVM Tuning** and Dependencies to **Vulnerabilities**, and split the runtime Memory panel into **Live Memory** and **JVM Tuning**. Legacy routes (`/security-advisor`, `/hibernate-advisor`, `/tuning-advisor`, `/pentest`, `/dependencies`, `/rest-advisor`, `/spring-advisor`, `/memory-advisor`, `/profiles`) redirect to the new paths. - Aligned endpoint, controller, and DTO naming for Log Tail, HTTP Probe, Database Connection Pools, and Profile Diff, and fixed the Database Connection Pools component pluralization. - Standardized the empty/unavailable panel state behind a shared `UnavailableState` component and consolidated shared time/number formatting helpers across views. - Renamed the advisor catalogue docs from `*-ADVISOR-CHECKS.md` to `*-CHECKS.md`, closed rule-ID numbering gaps so every sequence is continuous, corrected drifted Hibernate doc entries (`HIB-CONFIG-016`, `HIB-CONFIG-017`, `HIB-MAP-018`, `HIB-MAP-019`), and rewrote `docs/REST-API-CHECKS.md` in the shared `### ID - Title` format. Renumbered rule IDs: `MEM-GC-002` → `MEM-GC-001`, `MEM-GC-003` → `MEM-GC-002`, `RAPI-VALID-003` → `RAPI-VALID-002`, `RAPI-VALID-004` → `RAPI-VALID-003`, and `HIB-FETCH-007` → `HIB-FETCH-006`. - Gave AI Usage, Copilot, and Claude Code their own documentation sections and synced `docs/FEATURES.md`, `docs/PROPERTIES.md`, the README feature table, and the screenshots with the Advisors regrouping. - Scoped the Maven Central release secrets to a protected `maven-central` GitHub environment. ### Fixed - BootUI's Actuator defaults are now contributed as true lowest-priority defaults so a host application's `EnvironmentPostProcessor` settings always win (#246). - Hardened the localhost-only safety filter and added value-based secret masking for browser-visible property values. - Fixed dark-mode contrast on Bootstrap contextual utilities and on the GitHub quota metric cards. - Made the developer tooling more robust: `run-sample.sh` no longer fails on macOS Bash 3.2, the getting-started scripts can target `main` or one of the last five tags, the Maven offline setup primes `spring-boot-maven-plugin`, and the Copilot dev server self-heals on a cold worktree `.m2`. - Fixed documentation-site build failures (GitHub Pages Node 24 configuration, backticked angle-bracket type fragments, and the Hibernate advisor image) and pinned the Ollama Docker Compose port to stabilize the e2e startup. ## [1.0.0] - 2026-06-05 First stable BootUI release, focused on promoting the current local developer-console surface to `1.0.0`, adding the Spring Security Advisor, and publishing the redesigned documentation site. ### Added - Security Advisor panel with explicit Spring Security hardening checks for authentication, authorization, CSRF, sessions, headers, CORS, method security, actuator exposure, OAuth2 resource-server validation, and security configuration hygiene, plus the `docs/SECURITY-ADVISOR-CHECKS.md` rule catalogue. - Overview security & health scoring dashboard that can run the available Architecture, Hibernate Advisor, Security Advisor, Vulnerabilities, Pentesting, and GitHub scanners individually or together. - VuePress documentation site, GitHub Pages workflow, repository documentation, and setup/sample-app pages for the public docs at `julien-dubois.com/boot-ui`. ### Changed - Copilot and Claude Code dashboards now emphasize input/output token usage charts while retaining event and failure views for sanitized local agent activity. - Refreshed release-facing screenshots for the 1.0 surface, including Overview, Security Advisor, Copilot, and Claude Code, and verified the screenshot set against the routed panel list. - Updated the implementation roadmap so completed 1.0 work is separated from the next workstream for trace/log/request correlation, bean graph visualization, and an e-mail viewer. ### Fixed - Detected proxied Hikari data sources in the Database Connection Pools panel. - Corrected Spring Modulith Flyway migration reporting so module-specific history tables remain visible and read-only. - Fixed VuePress markdown links, homepage setup navigation, GitHub Pages Node 24 configuration, and sample quick-start script UI bundling. ## [0.5.1] - 2026-06-04 Patch release focused on preserving BootUI startup in applications that do not include Spring Security Core while keeping Security Logs support available when Spring Security authentication events are present. ### Fixed - Guarded BootUI's auto-configured Spring Security audit event repository behind Spring Security authentication event classes so applications without `spring-security-core` no longer fail at startup. ## [0.5.0] - 2026-06-04 Fifth BootUI release, focused on repository context, servlet session inspection, database migration/advisor tooling, and release-facing documentation for the expanded 0.5.0 panel surface. ### Added - GitHub dashboard panel under Overview, with local repository detection, bounded refreshes for pull requests, issues, latest GitHub Actions executions, dynamic rate-limit/quota drawers, security signals, and Copilot usage report metadata. - HTTP Sessions panel backed by embedded Tomcat session metadata, with masked session identifiers and attributes by default plus confirmation-gated clear/destroy actions. - Database navigation group with read-mostly Flyway and Liquibase panels, including migration/change-set inventory and confirmation-gated `migrate`, `clean`, and `update` actions. - Hibernate Advisor panel with explicit Hibernate/JPA mapping, configuration, caching, and repository-query checks, plus the `docs/HIBERNATE-CHECKS.md` rule catalogue. - Auto-configured an in-memory Spring Boot `AuditEventRepository` for Security Logs when BootUI is active, audit events are enabled, and the host app has not provided its own repository. - Sample-app quick-start scripts for macOS/Linux and Windows PowerShell. ### Changed - Standardized panel auto-refresh controls and visibility-aware refresh behaviour across live panels. - Updated the GitHub Actions drawer to show latest execution details and count only the latest run per workflow when reporting workflow failures. - Expanded the sample app with Flyway/Liquibase schemas, richer Hibernate/JPA sample mappings, HTTP session data, security events, and release screenshots for the current sidebar surface. - Reworked the implementation roadmap so already-shipped database/security/runtime panels moved out of the plan and the next workstream focuses on trace/log/request correlation, bean graph visualization, and an e-mail viewer. ### Fixed - Corrected AI Usage telemetry KPIs and summary calculations. - Matched the exact BootUI root paths in BootUI's highest-priority Spring Security chain so host SPA fallback filters do not intercept `/bootui` before BootUI can redirect to its console. - Tightened security diagnostics, value exposure handling, panel availability wiring, and release documentation for the 0.5.0 panel surface. ## [0.4.0] - 2026-06-03 Fourth BootUI release, focused on new local runtime/security diagnostics, native-image readiness tooling, and the current grouped sidebar surface. ### Added - GraalVM native-image readiness panel with on-demand host-application checks for reflection, dynamic proxies, resources, serialization, native access, dependency reachability metadata, and a reviewable `reachability-metadata.json` scaffold. - Threads panel backed by in-process `ThreadMXBean` snapshots, with state counts, deadlock detection, virtual-thread context, server-side filtering/paging, stack expansion, and confirmation-gated raw dump download. - HTTP Exchanges panel for recent inbound application requests, including bounded recording, server-side filtering, masked headers/query data, trace identifiers, and drawer-style request/response details. - Security Logs panel and Security navigation group for recent Spring Boot audit events, bounded retention, masking, filters, and visibility-aware auto-refresh. - Weekly GraalVM native-image build workflow and native-image sample-app Docker assets/readiness documentation. ### Changed - Renamed the Cache surface to Spring Cache across the route metadata, docs, and release-facing screenshots. - Updated HTTP Exchanges and Security Logs to use standard visibility-aware auto-refresh instead of manual refresh buttons. - Updated the next-feature roadmap so already-shipped panels moved out of the plan and the next workstream is focused on migrations, trace/log/request correlation, and bean graph visualization. - Bumped build and dependency plumbing, including Spring AI 2.0.0-M8, the GraalVM native build tools plugin, Sonatype Central publishing plugin, Maven plugins, `actions/checkout`, and the frontend/API error-handling utilities. ### Fixed - Added Spring AOT runtime hints and sample native-image wiring so BootUI resources, DTOs, heap-dump/security reflective calls, and Maven metadata survive native-image builds. - Updated feature documentation, sample-app walkthroughs, security policy, Playwright docs, and screenshots for the current sidebar grouping and full 0.4.0 panel surface. - Completed Java/frontend audit follow-ups around nullability, shared helpers, frontend API normalization, and duplicate utility removal. ## [0.3.0] - 2026-06-02 Third BootUI release, focused on the new JVM Tuning Advisor, Java 17 baseline, stronger AI telemetry guidance, and release-facing documentation/screenshots for the updated menu surface. ### Added - Tuning Advisor panel split out from Memory, with fixed bare-metal JVM options, percentage-based Kubernetes `JAVA_TOOL_OPTIONS`, optional Burstable request sizing, Actuator probe YAML, and virtual-thread sizing guidance based on the running JVM context. - LangChain4j support in the AI Usage panel. BootUI now detects Spring AI and/or LangChain4j, shows the selected framework with header badges, and offers side-by-side Spring AI and LangChain4j telemetry setup guides explaining the dependency and configuration each needs to emit GenAI spans (including optional prompt/completion content capture). - Health panel setup guidance: a disabled state with guidance when no Actuator `HealthEndpoint` is available, and guidance (without changing reported statuses) when a health tree contains only Spring Boot's default indicators. - Frontend test coverage for the shared auto-refresh and refresh-state utilities, the Health view, and the panel header component. ### Changed - ArchUnit is now bundled transitively through `bootui-spring-boot-starter`, so the Architecture panel works out of the box without an extra application dependency; the sample app's redundant direct dependency was removed. - Architecture checks were expanded with additional coding-practice and Spring proxy/stereotype heuristics. - Pentesting checks now align their local-only hygiene catalogue with OWASP Top 10 2025. - Release preparation (Maven module versions, README install snippet, release commit, and tag) and Maven Central publishing are unified into a single `Release` workflow, replacing the separate `Prepare Release` workflow. - Lowered the build baseline from Java 25 to Java 17, updating the Maven compiler release, the CI build matrix, and CodeQL analysis. - The Data menu item is now Spring Data, and the database pool view is consistently named Database Connection Pools. - AI Usage content-capture guidance and documentation now cover LangChain4j alongside Spring AI. - Copilot and Claude Code agent panels now share the standard panel refresh behavior. ### Fixed - Removed auto-refresh flicker by showing panel skeletons only on first load and sharing refresh state across panels. - Normalized frontend errors when the backend is offline or unavailable. - Removed duplicated `formatDuration`/`formatTime` helpers in the Traces panel in favor of the shared format utilities. - Updated the footer GitHub link, release docs, and regenerated feature screenshots for the current sidebar menu. ## [0.2.0] - 2026-06-01 Second BootUI release, focused on local security diagnostics, three new local-only diagnostics panels — Architecture (ArchUnit), Heap Dump (value-free class histogram), and Database Connection Pools — and safer defaults around host-application security, plus release/documentation hardening for the full visible panel surface. ### Added - Architecture panel that runs a curated, zero-config ArchUnit ruleset against the host application's own classes for package-cycle, coding-practice, and Spring-stereotype hygiene, with an on-demand scan and the latest report. - Heap Dump panel that captures local JVM heap dumps on demand and analyzes a value-free class histogram, including a `max-classes` memory cap plus big-objects and collection-bloat smart filters. Raw `.hprof` download stays disabled by default because dumps contain plaintext secrets. - Database Connection Pools panel that surfaces read-only database pool sizing, masked JDBC metadata, and a live active/idle/total/pending saturation chart, failing closed when pool support is unavailable. - Pentesting panel with explicit, local-only OWASP-aligned hygiene checks for security headers, CORS behavior, cookie flags, verbose errors, Spring Security wiring, actuator exposure, DevTools, H2 console, and risky configuration values. - BootUI Spring Security integration that keeps `/bootui/**` and `/bootui/api/**` reachable in local applications using Spring Security while preserving the localhost-only safety filter. - Automatic local application trace capture so Traces and AI Usage can populate from the host app without requiring a separate local OTLP exporter setup. - CI test report publishing for Maven/JUnit and Playwright runs. - Playwright end-to-end coverage for the Pentesting panel. ### Changed - Monitoring panels now hide BootUI's own beans, mappings, loggers, metrics, traces, and related runtime data by default through `bootui.monitoring.exclude-self=true`. - Request-driven BootUI controllers and agent session stores are lazy-loaded, and agent session parsing is bounded to avoid unnecessary startup work. - Vulnerability findings are sorted by severity/importance first, with stable ordering inside each severity group. - The app shell, panel headers, skeleton states, auto-refresh controls, and command palette/navigation were polished for a faster and more consistent UI. - Architecture, Pentesting, and Vulnerabilities now share clearer scan status messaging. - Startup Timeline configuration, panel read-only controls, application property reference docs, pentest catalogue docs, feature docs, screenshots, and E2E documentation were reconciled with the implemented `0.2.0` behavior. - Refreshed and reorganized `SECURITY.md`. - Regenerated feature screenshots and extended the docs screenshot script to cover the Architecture, Heap Dump, and Database Connection Pools panels. ### Fixed - Fixed sample-app and BootUI security audit findings, including enabling CSRF protection in the sample app. - Fixed hidden-BootUI-internals assumptions in Beans E2E coverage after self-data filtering became the default. - Removed duplicated panel headings and restored Overview/Metrics heading behavior. - Fixed BootUI navigation controls, including theme persistence and command palette shortcut behavior. - Fixed the Claude Code sidebar icon. - Added registry-level coverage so global read-only mode is checked for every action-capable panel. ## [0.1.0] - 2026-05-29 First final BootUI release. This promotes the alpha line to the final `0.1.x` coordinate while keeping the local-only, developer-console safety model and the full visible panel surface. ### Added - Copilot and Claude Code panels for sanitized local activity dashboards, including session summaries, activity trends, tool and model usage, failures, and bounded live refresh behavior. - Vitest, Vue Test Utils, and jsdom coverage for reusable frontend behavior, wired into the Maven test phase. ### Changed - README, feature documentation, the release plan, and generated feature screenshots are aligned with the final `0.1.0` panel surface and install coordinates. - Beans, Conditions, Mappings, Configuration, and Loggers use bounded server-side filtering and pagination for high-cardinality applications. - The full visible route set is promoted from the supported alpha surface to the supported `0.1.0` release surface. ### Fixed - Dev Services discovery and controls handle prototype-scoped Testcontainers beans, stopped containers, null log output, restart failures, metadata-only connection detail masking, and abstract bean definitions more defensively. ## [0.1.0-alpha.5] - 2026-05-27 Latest tagged alpha with the expanded panel surface, telemetry features, and release hardening. ### Added - Backend test coverage for `BootUiProperties` binding, additional activation rules (devtools activation, custom disabled profiles, invalid `bootui.enabled` failing closed), controller mappings and DTO serialization for every `/bootui/api/**` endpoint, Config controller HTTP CRUD with masking modes and restart warnings, logger level mutation/clear, broader secret masking coverage, and panel edge cases (Data, Scheduled, HTTP Probe, Log Tail, Profile Diff, Security, Metrics, DevTools, Dev Services, Memory). - `CHANGELOG.md` and a sample-app walkthrough at `bootui-sample-app/README.md`. - Spring Cache panel for cache managers, known caches, safe local sizes, Micrometer cache metrics, cache annotations, and confirmation-gated clear actions. - Embedded OTLP/HTTP trace receiver at `/bootui/api/otlp/v1/traces`, plus Traces and AI Usage panels for local trace waterfalls, Spring AI observations, token usage, tool calls, and bounded in-memory telemetry. - Optional panel availability metadata so the sidebar can dim panels whose backing classpath, Actuator endpoint, or local infrastructure is unavailable. - GitHub project links in the UI and sample-app AI prompt helpers for exercising telemetry locally. ### Changed - Documentation reconciled with the implemented `AUTO|ON|OFF` activation model, persisted runtime overrides, plain-JavaScript Vue 3 frontend, and the full visible panel set as supported alpha functionality. - Dev Services, Vulnerabilities, Traces, and AI Usage now have stronger empty/disabled states, bounded data handling, and focused Playwright coverage. - Vulnerability scan results are retained in memory after an explicit scan so the panel can keep showing the latest local results. - Sample app PostgreSQL JDBC driver updated to 42.7.11. - Repository formatting checks and release documentation now cover the alpha release workflow, README version synchronization, and Maven Central signing constraints. ### Fixed - Corrected the sample Redis service port mapping used by the Cache panel tests. - Fixed GitHub code scanning workflow permissions and an incomplete string escaping/encoding finding. ### Security - Enabled CSRF protection in the sample app. ## [0.1.0-alpha.4] - 2026 First successful Maven Central publication of the alpha line. ### Fixed - Source-less modules (`bootui-ui`, `bootui-spring-boot-starter`) now attach an empty `javadoc.jar` at the `package` phase so the release-profile `gpg-sign` binding (running at `verify`) signs it. Without this, Sonatype Central rejected the deployment. ## [0.1.0-alpha.3] - 2026 Release attempt blocked by missing javadoc signatures (see alpha.4 fix). ## [0.1.0-alpha.2] - 2026 Initial public alpha attempt. Sonatype Central deployment failed; subsequent attempts re-used the GAV coordinate and required version bumps because Sonatype consumes a coordinate even on failure. ## [0.1.0-alpha.1] - 2026 First tagged BootUI alpha. Highlights of the harden-all-visible-panels scope: ### Added - Spring Boot 4 starter (`bootui-spring-boot-starter`) and auto-configuration (`bootui-autoconfigure`) packaged with a Vue 3 / Vite UI shell served from `/bootui` and `/bootui/api/**`. - `bootui.enabled=AUTO|ON|OFF` activation model with profile-based enablement (`dev`, `local`) and disablement (`prod`, `production`); fail-closed on invalid values; auto-activation when Spring Boot DevTools is on the classpath. - Localhost-only safety filter with explicit `bootui.allow-non-localhost` opt-out. - Secret-masking for browser-visible property names and values, with three exposure modes: `MASKED` (default), `METADATA_ONLY`, and `FULL`. - Runtime configuration overrides persisted to `.bootui/application-bootui.properties` and applied at high precedence on the next start; restart/rebind caveats surfaced for every override mutation. - Internal Actuator bridge that returns stable BootUI DTOs even when the underlying Actuator endpoint or Spring module is absent. - Panels: Overview, Beans, Conditions, Configuration, Mappings, Health, Loggers, Startup Timeline, JVM Memory (with suggested options), Spring Data, Scheduled Tasks, HTTP Probe (loopback-only), Log Tail, Profile Diff, Spring Security, Micrometer Metrics, Dependency inventory + OSV vulnerability scan, Spring Boot DevTools reload/restart, and Dev Services for Docker Compose, Testcontainers beans, and service connection metadata. - Sample application (`bootui-sample-app`) and a Playwright end-to-end suite exercising every visible browser route. ### Notes - Spring Boot 3.x support, Gradle plugin, CLI, extension SPI, hosted features, request history, distributed tracing, multi-service orchestration, and live Docker Compose lifecycle control are intentionally out of scope for the alpha. [Unreleased]: https://github.com/jdubois/boot-ui/compare/v1.13.1...HEAD [1.13.1]: https://github.com/jdubois/boot-ui/compare/v1.13.0...v1.13.1 [1.13.0]: https://github.com/jdubois/boot-ui/compare/v1.12.0...v1.13.0 [1.12.0]: https://github.com/jdubois/boot-ui/compare/v1.11.0...v1.12.0 [1.11.0]: https://github.com/jdubois/boot-ui/compare/v1.10.0...v1.11.0 [1.10.0]: https://github.com/jdubois/boot-ui/compare/v1.9.0...v1.10.0 [1.9.0]: https://github.com/jdubois/boot-ui/compare/v1.8.0...v1.9.0 [1.8.0]: https://github.com/jdubois/boot-ui/compare/v1.7.0...v1.8.0 [1.7.0]: https://github.com/jdubois/boot-ui/compare/v1.6.0...v1.7.0 [1.6.0]: https://github.com/jdubois/boot-ui/compare/v1.5.2...v1.6.0 [1.5.2]: https://github.com/jdubois/boot-ui/compare/v1.5.1...v1.5.2 [1.5.1]: https://github.com/jdubois/boot-ui/compare/v1.5.0...v1.5.1 [1.5.0]: https://github.com/jdubois/boot-ui/compare/v1.4.0...v1.5.0 [1.4.0]: https://github.com/jdubois/boot-ui/compare/v1.3.0...v1.4.0 [1.3.0]: https://github.com/jdubois/boot-ui/compare/v1.2.0...v1.3.0 [1.2.0]: https://github.com/jdubois/boot-ui/compare/v1.1.0...v1.2.0 [1.1.0]: https://github.com/jdubois/boot-ui/compare/v1.0.0...v1.1.0 [1.0.0]: https://github.com/jdubois/boot-ui/compare/v0.5.1...v1.0.0 [0.5.1]: https://github.com/jdubois/boot-ui/compare/v0.5.0...v0.5.1 [0.5.0]: https://github.com/jdubois/boot-ui/compare/v0.4.0...v0.5.0 [0.4.0]: https://github.com/jdubois/boot-ui/compare/v0.3.0...v0.4.0 [0.3.0]: https://github.com/jdubois/boot-ui/compare/v0.2.0...v0.3.0 [0.2.0]: https://github.com/jdubois/boot-ui/compare/v0.1.0...v0.2.0 [0.1.0]: https://github.com/jdubois/boot-ui/compare/v0.1.0-alpha.5...v0.1.0 [0.1.0-alpha.5]: https://github.com/jdubois/boot-ui/releases/tag/v0.1.0-alpha.5 [0.1.0-alpha.4]: https://github.com/jdubois/boot-ui/releases/tag/v0.1.0-alpha.4 [0.1.0-alpha.3]: https://github.com/jdubois/boot-ui/releases/tag/v0.1.0-alpha.3 [0.1.0-alpha.2]: https://github.com/jdubois/boot-ui/releases/tag/v0.1.0-alpha.2 [0.1.0-alpha.1]: https://github.com/jdubois/boot-ui/commit/6ad9e3371c1c92d82597400ffa9063b7746bafe7