release: v0.5.1 - security hardening (DEBT-024)#82

Merged

fvadicamo merged 21 commits into

mainfrom

Jul 12, 2026

Commits on Jul 11, 2026

docs(backlog): add DEBT-024 security sweep from post-release review

fvadicamo
and
claude
committed
docs(backlog): refresh DEBT-024 to 2026-07-11 alert state

fvadicamo
and
claude
committed
chore(deps): re-lock vulnerable transitives for DEBT-024 security sweep

fvadicamo
and
claude
committed
ci(security): add minimal permissions blocks to all workflows

fvadicamo
and
claude
committed
fix(admin): validate token format before setting login cookie

fvadicamo
and
claude
committed
fix(admin): strip token whitespace; assert lookup skipped in login test

fvadicamo
and
claude
committed
fix(app): replace starlette-prometheus with prometheus-fastapi-instrumentator

fvadicamo
and
claude
committed
docs(changelog): log admin login hardening under v0.5.1 security

fvadicamo
and
claude
committed
Merge pull request #80 from vektralabs/chore/v0.5.1-security
fvadicamo
authored

Commits on Jul 12, 2026