From bc581eebf9807f5d61f08475852283c93ee4f1dd Mon Sep 17 00:00:00 2001 From: Bryan Frimin Date: Tue, 30 Jun 2026 19:40:36 +0200 Subject: [PATCH] Release probod/v0.222.0 Signed-off-by: Bryan Frimin --- cmd/probod/CHANGELOG.md | 21 +++++++++++++++++++++ cmd/probod/VERSION | 2 +- 2 files changed, 22 insertions(+), 1 deletion(-) diff --git a/cmd/probod/CHANGELOG.md b/cmd/probod/CHANGELOG.md index aa8bda891..42d755579 100644 --- a/cmd/probod/CHANGELOG.md +++ b/cmd/probod/CHANGELOG.md @@ -4,6 +4,27 @@ All notable changes to `probod` (the server, including the bundled `@probo/conso ## Unreleased +## [0.222.0] - 2026-06-30 + +### Added + +- OAuth2 loopback redirect URIs now match regardless of port, enabling native OAuth clients such as Claude Code that use ephemeral ports at authorization time (RFC 8252 section 7.3) +- Access review campaigns can now be closed when entries are in a failed state + +### Changed + +- Third-party risk assessment vetting notes now persist the full structured breakdown (risk classification, per-category analysis, privacy and data-processing practices, AI governance, contractual clauses, professional standing) instead of a short summary only + +### Fixed + +- Deleting a user still referenced elsewhere (e.g. as an asset owner) now returns a 409 Conflict instead of an internal error +- GraphQL endpoint is now protected against alias-flooding DoS (GHSA-prh2-g8pv-m7p9): parser token limit, field complexity cap, LRU query cache, and field suggestion suppression added to all three GraphQL handlers + +### Removed + +- Access review campaigns no longer expose a framework-controls field +- `pendingEntryCount` field removed from access review campaigns + ## [0.221.0] - 2026-06-30 ### Added diff --git a/cmd/probod/VERSION b/cmd/probod/VERSION index 2cc685759..8fda9d1f0 100644 --- a/cmd/probod/VERSION +++ b/cmd/probod/VERSION @@ -1 +1 @@ -0.221.0 +0.222.0