chore(release): change log for version 20.0.0

[GMishx]

Changelog in preparation for Release 20.0.0 of backend.

This PR is in preparation for the release 20.0.0
This PR also serves as an intimation of merge freeze and a request for testing for finding new bugs.

If until 27/03/2026, there are no comments on this PR, will proceed with the release.

Thank you everyone involved for their hard work and make this release possible!

[KoukiHama]

LGTM

[Aman-Cool]

Hey @GMishx @KoukiHama, did a quick pass through the codebase looking for regressions before this ships.

The one blocker I found; mergeReleases silently leaving ghost releases when packages were linked, is already fixed in 29af0f8, so nothing blocking here.

Two things worth noting though: anyone who ran release merges on rc-2 with packages attached probably has dirty data in CouchDB and should reconcile before upgrading. And the INHERIT_ATTACHMENT_USAGES feature has a duplicate accumulation bug + incorrectly promotes non-license-info usages; it's off by default so low blast radius, but maybe worth a known-issues note in the announcement.

Good work everyone, nice to see the security patches land 🙌

[GMishx]

Nice observation Aman. However, no one has updated their SW360 since the last 18 release, so can be safe in assuming no harm.

[Shivamrut]

Hey @GMishx! I don’t have full clarity on the intended design here, so please treat the below as a guess. If I’m off base, I’d appreciate a correction. I’m mainly trying to get this straight.

One thing stood out:

GET /api/reports/download is permitAll in ResourceServerConfiguration, while the token query param is passed straight through to ExcelExporter.downloadExcelSheet() as a filesystem path. So the endpoint doesn’t behave like an opaque download id. It’s effectively “read this path if it exists,” with no JWT/READ check. The user query param is resolved via getUserByEmail, which fabricates a stub User when lookup fails, so it isn’t a reliable gate either.

Why it might matters: anyone who can hit that URL (for example an internet-facing deployment, mis-routed traffic, a compromised client on the VPN, or another issue that exposes the link) might be able to pull files the JVM can read, such as configs or secrets.

Please check if this is of any real concern. Thanks!