From 47fb65fdd224994b2f3dfa0a42de90b7a305f0d6 Mon Sep 17 00:00:00 2001 From: Cam Proudlock Date: Mon, 17 Aug 2026 08:37:57 -0400 Subject: [PATCH] Release 0.10.0 --- CHANGELOG.md | 13 +++++++++++++ README.md | 22 ++++++++++++++++++---- frontend/package.json | 2 +- shopdb/__init__.py | 2 +- tests/test_docs_versions.py | 14 +++++++++++++- 5 files changed, 46 insertions(+), 7 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ae4ccab6..1dc03eae 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,6 +10,19 @@ ADR-007 and ADR-002. ## [Unreleased] +## [0.10.0] - 2026-08-17 + +A security release. The Windows installer left the directories it creates +writable by every logged-on user, which made two of the files it puts there a +local privilege escalation; that is fixed and verified on Windows. Alongside it, +the work that makes this product genuinely adoptable by a second site: one +site's hostnames, share paths and networks are out of the product code and out +of the published documentation, and the rule that keeps them out now fails the +build rather than printing a warning nobody read. + +The plugin contract moved to 0.19.0, which is a BREAKING change - see the +Changed section and CONTRACT-STABILITY.md before upgrading a plugin you wrote. + ### Added - Applications accept an uploaded image and an uploaded installer, rather than diff --git a/README.md b/README.md index 3663d2c0..38c26ef7 100644 --- a/README.md +++ b/README.md @@ -108,8 +108,10 @@ SQLite). Do not run dev or production against SQLite. ### Distribution -The application is distributed through the internal GE Aerospace git server. Clone -it from there; there is no public package or image registry. +Source lives here. The Windows installer ships as a release asset rather than a +file in the repository - it is around 240 MB, well past what a repository takes +and well inside what a release asset does. There is no package or image +registry; a site installs from that `.exe` or builds from source. ### Fast path (Docker) @@ -172,7 +174,8 @@ project wiki. To import a site's legacy data, use the HTTP import surface: an admin API token plus the IMPORT-API page in the project wiki drive the whole migration through documented endpoints (`X-Import-Mode` preserves original timestamps). -`scripts/site_imports/wjf/` is the West Jefferson reference loader. +`scripts/site_imports/wjf/` is the reference site's loader, kept as a worked +example of the whole sequence. ### Which deployment route @@ -220,12 +223,22 @@ Query parameters for list endpoints: - `search` - Search term - `assettype` - Filter by asset type (computer, printer, machine, networkdevice, measuringtool) +## Where to start + +the START-HERE page in the project wiki routes by what you are here to do - +standing up a site, deploying the shop-floor tools, writing a plugin, +integrating with the API, or diagnosing something. On the published mirror the +same page is the wiki's front door. + ## Plugin System ShopDB supports plugins for extending functionality. See `CONTRIBUTING.md` for plugin development guidelines. -The image bundles thirteen plugins; only the ones a site installs are loaded: +The image bundles these plugins; only the ones a site installs are loaded. The +current count and each plugin's version and migration head are in +the PROJECT-MAP page in the project wiki, which is generated: +- **backups** - Machine configuration backups (NTLARS/DNC, CMM, part marker, UDC) with revision history and diffs - **computers** - Shopfloor PCs and workstations, collector fleet ingest - **employees** - Employee directory - **geenforce** - GE-Enforce imaging/software manifests and fleet compliance @@ -237,6 +250,7 @@ The image bundles thirteen plugins; only the ones a site installs are loaded: - **printedparts** - 3D-printed part catalogue, kiosk issue tracking and stock alerts - **printers** - Extended printer management with Zabbix integration - **slides** - TV/kiosk slideshows +- **tools** - Tech Tools: barcode and QR generation laid out for real label stock - **usb** - CMMC USB check-in/out tracking - **warranty** - Warranty records with Dell lookups diff --git a/frontend/package.json b/frontend/package.json index 7cfad9c9..5547c034 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -1,6 +1,6 @@ { "name": "shopdb-frontend", - "version": "0.9.0", + "version": "0.10.0", "private": true, "type": "module", "scripts": { diff --git a/shopdb/__init__.py b/shopdb/__init__.py index d3db59a6..10636fe2 100644 --- a/shopdb/__init__.py +++ b/shopdb/__init__.py @@ -63,7 +63,7 @@ __contract_version__ = '0.19.0' # plugin-contract version above are distinct series with independent # bump rules. Not part of the shopdb.api contract surface, so it is # not re-exported there. -__version__ = '0.9.0' +__version__ = '0.10.0' def create_app(config_name: str = None) -> Flask: diff --git a/tests/test_docs_versions.py b/tests/test_docs_versions.py index c4ea061b..8b43d858 100644 --- a/tests/test_docs_versions.py +++ b/tests/test_docs_versions.py @@ -40,7 +40,19 @@ PLUGIN_COUNT = re.compile(r'\b(\d+)\s+bundled plugins\b', re.I) def documentation_files(): - return sorted(p for p in DOCS.rglob('*.md') if p.name not in EXEMPT) + """Everything published that a reader treats as documentation. + + README.md and CONTRIBUTING.md are included deliberately: README is the first + page anyone sees on the mirror, and it was claiming thirteen bundled plugins + when there were fifteen. A rule that covers only docs/ leaves the most-read + file in the repository outside it. + """ + files = [p for p in DOCS.rglob('*.md') if p.name not in EXEMPT] + for name in ('README.md', 'CONTRIBUTING.md'): + top = REPO / name + if top.is_file(): + files.append(top) + return sorted(files) def current_versions():