Release v0.5.0: ui develop → main

[0xmanhnv]

Release of everything on develop since v0.4.0. 30 files differ from the v0.4.0 tag (measured by content — see the note on this branch below for why the commit count between tags is not a useful number here).

What this ships

Wire types are generated, not hand-written (#357)

Six API groups now derive their types from the OpenAPI spec. The server won three disagreements the hand-written types had been asserting: tenant_id, critical_groups/high_risk_groups and exposures were declared but never returned; depth, is_direct and parent_component_id were returned but invisible to the UI.

Making the types honest exposed a live bug: (ecosystem as ComponentEcosystem) || active — a Status value copy-pasted into an ecosystem field. TypeScript could not see it because after the cast every operand is a truthy literal, so the fallback is unreachable to the checker and live at runtime.

findings was deliberately left hand-written: ApiFinding is 124 fields against the specs 139 and is read by dozens of components — it deserves its own review rather than a mechanical swap. Worth naming what it is currently blind to: sla_deadline, is_internet_accessible, remediation, and on ApiVulnerability the cisa_kev flag — a KEV indicator the server returns, on a CTEM product.

Compensating controls could not be created at all (#354)

The create form offered Preventive/Detective/Corrective/Compensating. The database accepts segmentation/identity/runtime/detection/other — zero overlap. Every create returned 500. Status offered Pending, which is not a value either. The reduction factor was sent as a percentage into a column constrained to the 0–1 fraction.

Two CI checks that were wrong in a way that read as green (#347, #356, #338)

• The palette-drift gate turned main red after every release, because it diffs against a base that does not apply on a release PR.
• docker-scan was gated on event_name == push, so the weekly scheduled security sweep skipped the image entirely and reported success. It had been green without scanning for weeks.

Six suppressed ESLint errors, two of them real bugs (#348)

Removed rather than re-suppressed. Math.random() during render (hydration mismatch) and a bare require() in an ESM config were genuine defects hiding behind the disable comments.

Navigation honesty (#339–#343)

47 of the 107 unreachable pages are scaffolds — they render dashboard totals under a domain title, so wiring them into the sidebar would mislead rather than help. The four Exposures pages that carry real data were surfaced; the sidebar stopped promising two that are not built. A regression test now fails the build if a scaffold is added to the sidebar, keyed on the exact useDashboardStats import rather than a fuzzy heuristic — the first version of that check flagged 15 working pages.

Supply chain (#349, #350, #353, #352, #344)

The production image shipped npm, which is where its remaining CVEs lived. Removed. postcss and sharp overridden to clear the last two advisories. Dependency groups updated.

About this branch

The tree is develops byte for byte; one merge -s ours commit records main as a parent.

Releases here are squash-merged, which leaves main with a single parent so git cannot see that develop already contains it — the next release then reports dozens of phantom conflicts in files neither side meaningfully changed. That has happened four times. Merging main back into develop is the textbook answer and does not stick, because the following release squashes again.

Verified before merging that 0 files exist in main but not in develop, so -s ours discards nothing, and the resulting tree was checked to be identical to develop directly rather than trusting ancestry.