AuraBoot
Start free
English简体中文

AuraBoot releases

Generated from the commit history of the product repository, AuraBootTeam/auraboot. There is no stable semver contract before 1.0 — treat 0.x as a moving target, and pin to a commit if you need reproducibility.

Read "Breaking changes" before you upgrade. It carries every feat!: commit and everything with a BREAKING CHANGE trailer.

Unreleased

2026-05-14 – 2026-09-27 · 1991 commits

Features

  • 8629ba46c retain application definitions by lock identity (#2042)
  • 338073cd8 add application definition shadow resolver (#2040)
  • b6b7b6021 test — add Allure Gradle and Playwright adapters (#2035)
  • d4b6c94e0 add application-scoped tenant preference (#2034)
  • 947c8dec2 plugin — add tenant-bound projection reader (#2033)
  • 74be00c2f web — redesign classroom growth display and bee selection (#2026)
  • a7fc521d1 rbac — expose tenant-bound role assignment to trusted plugins (#2023)
  • b25d869d9 edu — update Fengyun bee and class tree assets (#2017)
  • 01e358fe8 web — scope child space for homeroom management (#2015)
  • e7465a19c edu — ship bee growth artwork and motion (#2009)
  • 91d4f3376 edu — add school activation workflow (#2007)
  • 67933409b add branded school onboarding flow (#2006)
  • e18f6c761 web-admin — class tree banner on the class display (#2001)
  • 3a1d74371 meta — self-anchored named query sources for member-level analytics (#1999)
  • ecfe1987d open-platform — add versioned facade and Linux release gate (#1929)
  • 708a81866 auth — anchor login brand in the story panel + wechat-only QR polish (#1978)
  • bc5eabcf5 auth — two-step pure-wechat login backend (stage 2b rev, SOT 05)
  • f5f432d3b release — stage showcase plugin config for product compositions
  • 41e1b91d2 release — stage core-decisionops config for product compositions
  • 1544ce95c decision — pull product-owned usage sources during usage-index rebuild (#1971)
  • 2c6b47f61 decision — pull product-owned usage sources during usage-index rebuild
  • 7a8f7a188 gate — self-contained hifi golden gate for the analytics designers (#1967)
  • ac42179ed auth — embedded WeChat QR on the wechat-only login panel (FR-079)
  • d452ec501 auth — pure-wechat school join endpoint + wechat-only login mode (stage 2b)
  • 6f80ea3a2 auth — deployment login-story branding + v4 hi-fi auth palette; fix branding BFF self-call
  • 81116204c auth — PC WeChat QR login (wechat_web) — same account across devices
  • 35827e24c meta-rendering — semantic status pills and actionable table empty state
  • 1fccffd72 web — bee-tree childlike accents on the class display
  • ca9873331 auth — WeChat mini-program login channel (wechat_mini)
  • 49f2c6d4c web — show deduction records on the class display (P5)
  • d5e159d23 tenant-template — seed xy_school profile permissions (#1952)
  • 9c822d4f4 tenant — bind deployment-declared creator roles on tenant creation (#1951)
  • 269fc000d plugin — seed deployment-declared product plugins into new tenants (#1950)
  • ae523a4d8 web — push class display updates over data-sync SSE (FR-036) (#1949)
  • 9c15e8d49 web — record-scoped quote collaboration + collaborate-only sharing golden (#1947)
  • ef9cbb3e8 permissions — enable record-scoped quote collaboration
  • 88384bda0 composition — host-owned routes win over duplicate plugin mappings
  • 3d8dcc101 plugin — forward host CommandCompletedEvent into plugin module contexts (#1940)
  • 7c1c9d0e3 web-admin — i18n review operations + status chips
  • 181eccee7 db — support extra Flyway locations via AURA_FLYWAY_EXTRA_LOCATIONS

…and 538 more — see the full diff on GitHub.

Fixes

  • f13d5cf50 platform — accept pinned bootstrap data (#2047)
  • ffeaac630 platform — keep definition registry queries global (#2046)
  • 8f742de6a platform — restore application definition quickstart startup (#2041)
  • b68117ac2 review batch 2 — purge internal artifacts and confidential identity leaks (#2044)
  • 66529035f review batch 1 — quick fixes across docs, compose, and release pipeline (#2043)
  • f38dd31c2 test — preserve Playwright reporter tuple types (#2036)
  • 0d004ba4e auth — preserve school binding compatibility (#2032)
  • 9401cd093 gate — provide the Open Platform protocol signing key to product containers
  • 24265705f web — translate bare string command rejection contexts
  • 995bf12a0 meta — preserve physical mappings and scoped platform exports (#2029)
  • 9b387fb43 web — stabilize classroom display and child space loading (#2031)
  • e77c3a303 application — tolerate image-less release receipts in deploy and gate scripts
  • e63f65f46 release — register core-decisionops and showcase configs in the staging catalog
  • f897fbd68 auth — store teacher join name as nonunique display name (#2027)
  • 77b34f3ca async — audit nested command handlers and preserve follow-up bridge (#2022)
  • eb6e61ac6 auth — self-provision PC WeChat school creators (#2021)
  • a6db19b2d setup — force multi-school mode for school onboarding (#2020)
  • 8620b52fb web — clarify school onboarding and localized edu cards (#2019)
  • bca5f1fe2 web — keep teacher code action out of backend proxy (#2016)
  • 6fce72897 meta — resolve optional money SPI safely (#2008)
  • 309b01423 quote — close residual BOM gate gaps (#2005)
  • c0372c1c1 web-admin — pass session permission codes into page runtime context (#2002)
  • 6f6516eaf meta — protect function-wrapped masked projections instead of denying (#2000)
  • 98eb8b27c observability — provision the open-platform protocol signing key in the acceptance stack (#1997)
  • 6a693ae99 migration — guard price-evidence backfill for non-quote slot databases (#1998)
  • 45bace722 meta — backfill price evidence quote anchors + seed anchors in e2e helpers (#1994)
  • 7a4669630 meta — treat ab_tenant_member as a platform reference source (#1993)
  • 7827c09f9 meta — accept full ISO-8601 instants in datetime range filters (#1995)
  • 335f9a6c8 plugin — defer reference validation in product-plugin seeding; pass signing/encryption key env (#1996)
  • f68128d9e auth — opaque session token lookup + align four drifted oss-backend-unit gate test clusters (#1992)
  • 7911b258a meta — record-scoped collaborators pass named query source checks (#1990)
  • 663473633 meta — jsqlparser 5.3 pin + record-scoped collaborators pass NQ source checks (#1989)
  • db3665d21 meta — drop the null row entries MyBatis returns for all-NULL rows (#1988)
  • c27db5d23 tenant — the bootstrap template must not default the admin role (P0) (#1987)
  • f1b332ec4 security — the tenant admin role must never be the default role (P0) (#1986)
  • f520daa71 web-admin — ship the missing class-logo-default.svg static asset (#1985)
  • 36f4a82c9 auth — backfill unionid on wechat identities once the claim arrives (#1983)
  • 6519fefdc deps-frontend — regenerate pnpm-lock.yaml to record root overrides (#1982)
  • 7086b8a8a auth — resolve bind-school user by JWT subject (pid), not email (#1981)
  • 149e3af92 auth — accept the platform's actual invite status (active), not PENDING (#1980)

…and 541 more — see the full diff on GitHub.

Performance

  • 3cf880810 decision — memoize dict option loads per fact-catalog build
  • 4e92b38ec meta — route internal dict loads through the proxy and cache getCurrentVersion
  • bce947d18 meta — cache getModelFields on the command hot path (hotspot #2, -50%)
  • ef35c402a meta — cache dict lookups on the command hot path
  • 9e50fd4d0 crm — batch share removal and merge pool-item updates on assign (#1800)
  • d9f9a5e21 crm — bound lead pool command queries (#1631)
  • e26ee8d9d commands — support governed plugin persistence (#1608)
  • bcc45381b permission — cache tenant authorization snapshots (#1403)
  • a8a54ad56 platform — scope metadata and permission reads (#1192)

Plus 538 test, refactor and tooling commits, not listed here.

v0.1.0-beta.3

2026-05-10 – 2026-05-18 · 193 commits

Features

  • 219925fdb plugin — expose ai provider accessor
  • b28dfec52 mobile — add showcase mobile UX profile import support
  • af5a12866 showcase — add mobile ux profile config
  • cdb94f604 im — support mobile AI member management
  • 287492eb0 im — include agent names in handoff events
  • 6bee47421 im — add mobile AI group backend contracts
  • 57153ab6b pipeline — import dev pipeline packets
  • 13c48198b pipeline — expose dev pipeline import endpoint
  • 30fd9aa93 pipeline — import dev pipeline packets
  • 84628c90a ai — close PCBA quality agent runtime (#176)
  • 3e4fe105c ai — close PCBA quality agent runtime
  • ad32028b2 meta — preserve SoD entity pid aliases
  • caa17bcb7 permission — add record share pid aliases
  • e784a9217 marketplace — add paid install workflow

Fixes

  • 171f093a1 initialize agent runtime gate plugins
  • dac945ef0 split bootstrap from plugin import
  • 67ac63519 expose marketplace upgrade checks
  • 7768ffec3 seed oss docker marketplace catalog
  • 50276c15d avoid wget in ga frontend healthcheck
  • 07ceb0c4e use absolute web-admin path in isolated stack
  • 3430a2c4c use runtime backend image for enterprise reset
  • 3288240f7 harden docker dependency install registry
  • 01fa49b34 stabilize docker pnpm bootstrap behind proxy
  • d42b4484e stabilize oss docker bootstrap auth refresh
  • 57033128a require tenant context for plugin import
  • 6f0faf9f4 stabilize plugin import validation contracts
  • f3c33bc46 harden isolated reset plugin import
  • 8931d7f38 harden GA docker reset bootstrap
  • e5b2e9c2c meta — stabilize page schema mapper queries
  • c0e8287bd forms — render localized button labels
  • ac39bd24b plugins — namespace priority fields for clean imports
  • be8f5e922 meta — serialize structured json values
  • a1e63ae9b preserve plugin pid on command import
  • 971bcfb34 restore CI gate scripts after branch merge
  • 3c6de59a7 remove stale merge markers from aurabot api test
  • a759071a6 ai — require tools for evidence-first openai agents
  • 9bfd33c42 ai — validate llm cloud config secrets
  • 45d112719 ui — render default saved view types
  • cd37651f6 pipeline — serialize import json fields
  • d3d7202d6 resolve CodeQL security findings (#177)
  • 89fb4faa4 pipeline — wire importer service constructor
  • 52e414016 resolve CodeQL security findings
  • 603c77203 security — annotate stateless API CodeQL suppressions
  • 435ac261c security — use CodeQL suppression ids
  • 3a078759a security — document CodeQL-safe stateless API paths
  • 934da9519 security — document CodeQL-safe stateless API paths
  • 14b8233d0 agent — harden replay result contracts and isolated gate (#165)
  • 4801594c5 mobile — hide audit fields from search hits
  • 8d657b442 mobile — add oss mobile search endpoint
  • 307a73904 im — route mobile group chat sends to agents
  • f10803213 mobile — hide audit fields from search hits
  • 1d80d2126 mobile — add oss mobile search endpoint
  • 07617f5e7 agent — harden replay result contracts and isolated gate
  • 045c2976a im — route mobile group chat sends to agents

…and 3 more — see the full diff on GitHub.

Plus 67 test, refactor and tooling commits, not listed here.

v0.1.0-beta.2

2026-05-11 – 2026-05-11 · 30 commits

Features

  • ec625a4e2 agent — unify runtime execution and replay audit

Fixes

  • 8fffa60b1 isolate PF4J plugin directory in Docker quickstart
  • 4a603e747 ci — align isolated env contracts
  • 12c1323f2 bootstrap — align startup and e2e contracts
  • 597a59fdd dashboard — stabilize OSS CRM seed dashboard

Plus 14 test, refactor and tooling commits, not listed here.

v0.1.0-beta.1

2026-03-26 – 2026-05-11 · 1532 commits

⚠️ Breaking changes

Read this before you upgrade.

  • 2ea4b157f PR template + brand assets capture spec
  • 845e0769d conv-turn — DC.4-OSS retire SSE transport, unify on ImMessageBroadcaster WS
  • fb833e56f usp — audit admin list+stats access alongside forget (GDPR paper trail)
  • 6e769b250 usp — extract UserSoulProfileStatus enum + migrate DB values to lowercase
  • b817598c8 remove legacy ApprovalChainExecutor + ab_approval_task
  • 3d8ff46f4 bpm — remove legacy ApprovalChainExecutor + ab_approval_task

Features

  • 32158b7f3 platform — 7 generic dashboard extensions (i18n, sanitizer, widget props) (#87)
  • e79da378e demo — DemoModeGuard + container image build pipeline
  • 5341b1ee9 platform — Phase 3 Op6+Op8 — BuiltinPluginImportService 2-profile + script §7.5 trim (#105)
  • 0df30702a platform — bootstrap admin endpoint + 9-invariant contract (Phase 2.4) (#104)
  • dd769ff87 platform — unify startup runners into BootstrapStartupRunner (Phase 2.3 of bootstrap-unified) (#103)
  • ef6dbf79e platform — extract BootstrapRepairService (Phase 2.2 of bootstrap-unified) (#102)
  • 3789e4a61 platform — add IT scaffolding (Phase 2.1 of bootstrap-unified plan) (#100)
  • 1fc34ddec agent — add GET /api/agent/tools/registry, remove no-op /tools/sync (#111)
  • 2ed274ca9 cli — add --dir and --non-interactive flags to aura plugin init (#107)
  • 7c3c51796 tests — env-scripts-testing v3 — Phase 1 + 1.5 + 3-partial (#99)
  • 6c2739429 agent — stub LlmProvider for E2E without real API key (#98)
  • d710453c6 connector-sdk — protocol-agnostic SDK + JDBC reference connector (#97)
  • 47e629fa1 aurabot-skill — SPI surface scaffold (Step 1 of C-2 plan)
  • d48761cc8 aurabot — mount V3 shell in root.tsx — global provider + toggle + panel
  • d446a5e3c aurabot — scaffold V3 shell — provider/panel/toggle + 9 envelopes + SPI client
  • 0e2ea5672 smart-kanban — swap PointerSensor → MouseSensor when AURA_E2E_MODE flag is set
  • 430649de6 smart-view — thread pageKey to kanban + preserve dashboard widget shorthand
  • 68f5db1f3 view — expose groupByDictCode and terminalStages on kanban ViewConfig
  • 91550aa2b smart-table-chart — consume widget config columns + i18n labels
  • a4c92f3b4 smart-kanban — derive columns from dict enum for full stage visibility
  • 60e855ea5 meta-cmd — add default_value autoSet strategy that yields to payload
  • c191dd21c auth — JwtAuthenticationFilter populates MetaContext role ids (M-090 CFG-001)
  • 9fa753be1 rbac — RoleMapper.findPrioritiesByIds batch lookup (M-090 CFG-001)
  • 8f1757fc6 meta-context — getCurrentRoleIds + 5-arg setContext overload (M-090 CFG-001)
  • 76dc328f2 mobile-config — subject_type+subject_id scope columns + CHECK + index (M-090 CFG-001)
  • 228708038 crm-starter — add lightweight CRM overview dashboard
  • 307ddcfe9 crm-starter — add Pipeline Board + Lead Board kanban saved views
  • 0efd268b0 mobile-log — composite index on (category, client_timestamp DESC) (M-090 OPS-002)
  • b0944bf55 ui/meta — fieldConfigSchemas with schema-driven definition
  • 56443fed7 shared/designer — handle 'dict-select' PropertyType in PropertyFieldRenderer
  • 5f5c9cdeb shared/designer — handle 'array' PropertyType in PropertyFieldRenderer
  • d7a65baf4 shared/designer — ArrayItemEditor for the new 'array' PropertyType
  • 217f26cc4 shared/designer — extend PropertySchema with array, dict-select, and TLabel group
  • 3c55c8193 smart-kanban — visual treatment for won/lost terminal cards
  • 99b531d0e perm-validator — add --oss=<path> and --enterprise=<path> flags
  • a5d6f812e smart-kanban — add currency/avatar/progress/date-relative card field renderers
  • fe91ddd71 p1demo — ai-fill-banner DSL block + DslFormFillContext (P1' Stage C)
  • 194e91921 smart-kanban — inject dict color/terminal into column header
  • 765ce0191 perm — rename Java constants + bootstrap registrations + strict-mode CI (Phase 2/3/6)
  • 268e7dbbc p1demo — wd_leave_request AI fill + safety check + annotation read (P1' Stage B)

…and 356 more — see the full diff on GitHub.

Fixes

  • b17b67f8f web-admin — widen workspace admin pages
  • bec085007 meta — canonicalize page DSL contracts
  • d43976634 entitlement — add core probe API
  • dca515ea6 avoid i18n cache hydration mismatch
  • 6c2ee3068 harden bootstrap auth and page layout
  • d18cb54d4 quickstart — correct smoke endpoints — /api/menu and /api/permissions roots return 500/403 (#138)
  • 54816276e bff — hand non-API routes to react-router SSR — replace placeholder SPA fallback
  • d9caec6f5 deps — pin react-router family back to 7.5.0 — 7.15 drops unstable_createContext
  • 17336dead plugin — builtin import — reorder core profile + register meta.changelog.read
  • 5ea2e664b tests — dedupe BASE_URL in member-* specs — unblock smoke collection
  • 6d49c7a99 deps — bump react-router suite to 7.15.0 lockstep + migrate unstable_* APIs
  • 19a86643f deps — regenerate pnpm-lock.yaml — sync with 6 dependabot package.json bumps
  • 55675e147 docker — set SESSION_SECRET in compose frontend service — unblock BFF startup
  • a3850455a docker — platform Dockerfile JDK 25 → 21 — match toolchain + Gradle 8.13
  • cfaf28baf docs — pass-7 follow-through — credentials + actual profile usage
  • 2ebda00bf launch — review-pass 7 — README terminology + sync rule order + 1.0 honesty
  • 0b43149c4 cla — trivial-fix exemption — drop char-count threshold
  • 72595a777 ci — codeql manual build for platform/ + gitee mirror plain --force
  • 8b1faeb80 launch — review-pass 4 — DemoModeGuard real paths + CodeQL + SECURITY honesty
  • 1f42e7fde oss-e2e — unblock OSS docker E2E baseline — 240→<35 fail across 24 commits (#114)
  • 3431055fe launch — review-pass 3 — NOTICE accuracy + prereq alignment + issue-template URLs
  • 022ba09c5 launch — review-pass 2 — self-audit follow-through
  • e8b31e3ba launch — review-pass 1 — license terminology, factual accuracy, broken gates
  • d60b1b71b web — map HttpMessageNotReadableException to HTTP 400 instead of 500 (#110)
  • 1105dcc58 aurabot — correctly hold back partial <think> open tag in OpenAI stream filter (#108)
  • 0720bc1ce e2e — showcase + marketplace cluster — tab ARIA + seed transitions (~29 specs) (#109)
  • 6cb164a99 meta — tag auto-created stub pages so plugin import overwrites them (#106)
  • a57a07d5b e2e — saved-view + finance cluster — unblock ~50 specs (#101)
  • 0fdbb9500 e2e — mcp-cursor-demo spec — install missing SDK dep + ESM __dirname compat (#96)
  • e4d931d4f saved-view+dsl-registry — add data-testid sidebar + register ai-fill-banner block
  • ce38b45ff aurabot-skill — controller + chat executor use ObjectProvider for redis stores (4/4)
  • a9c3c0cd5 aurabot-skill — SkillRequestValidator uses ObjectProvider for stores (3/4)
  • 81de3edd3 aurabot-skill — make SkillIdempotencyStore conditional on redis (2/4)
  • 95e645559 aurabot-skill — make PreviewTokenStore conditional on redis (1/4)
  • 06fb6b923 test — re-add redis config (file got reverted)
  • 59b414dbf p1 — replace error: '&lt;Chinese&gt;' with English in user-facing responses (#93)
  • 2fe1c2e5a p0 — batch fixes from 2026-05-08 deep review (#89)
  • 572ae6a05 p1 — low-risk cleanup batch from 2026-05-08 deep review (#90)
  • e2632fd9c p1 — validator scans rolePermissionBindings + plugin roles.json (#91)
  • bbf20f035 acp — register default-bootstrap.json to bind tenant_admin to ACP perms (F-1 P1)

…and 334 more — see the full diff on GitHub.

Performance

  • d6b0cf5ff notification — @Async NotificationRouter event handlers
  • ff7dcfaf6 agent — pgvector-indexed cluster shortlist + dedup batch + dim validation + content normalisation (PR-74)
  • ff8ecc517 D5 — add PostgreSQL tuning config for development
  • 150ee05c7 B7 — add keyset (cursor-based) pagination for dynamic list API
  • 4a366bd22 phase3 — cache warmup, HikariCP tuning, async audit log
  • 586e3653d n+1 — batch-load BindingRules and add Caffeine caches for command metadata
  • c17b770b9 db — add composite indexes for ab_binding_rule and ab_role
  • cad367cc7 merge phase2a - HTTP compression
  • 60a348fa0 backend — enable HTTP response compression for JSON/HTML/CSS/JS

Plus 462 test, refactor and tooling commits, not listed here.