What's new in AmpNexus

Bug Fixes

• local-access: ask chargers whose boot was missed for their password state (892b380)
• auth: customer End Users reach only the chargers they hold (07dca07)
• auth: keep households' live streams open, and survive a tenant-api outage (5383194)
• factory-qa: only the factory programmer's service token records QA results (b452986)
• security: never store or log credentials pushed to chargers (fd0a1f0)
• ingest: EVSE 2's connector 1 no longer overwrites EVSE 1's (6e19b64)
• ingest: a StatusNotification no longer clears a connector's type and power (444d595)
• deps: aws-sdk-s3 1.144 for lru 0.18 (24e00cb)
• deps: clear the October RustSec advisories (2780467)

Features

• local-access: tenant admins and platform support see the password, audited (461006b)
• amqp: read device credentials from device.credentials.upsert (1f8a7ad)
• devices: store and show the device portal's certificate fingerprint (07b27d9)
• devices: manage chargers' local access passwords - push, rotation and owner endpoints (f196280)
• devices: answer the remote wipe with the app's error codes (72120b1)
• devices: remove a charger's personal data remotely (69251f5)
• devices: enrol device keys over OCPP (GetDeviceKey) (38aaaff)
• devices: open a setup recovery window for a charger (db1ac75)
• devices: store setup recovery windows and build their device-api event (0be0b02)

Bug Fixes

• ocpp21: refuse inbound GetCertificateChainStatus; the station sends it (c5dced7)
• ocpp21: the station opens and closes its own periodic event streams (a659b7a)
• ocpp: accept SetMonitoringBase HardWiredOnly, the schema's spelling (0746e7f)
• ble: GET_HANDOVER_CODE needs the cloud grant, and the BLE report hides the code without one (3a7fe61)
• ethernet: never set a NULL default interface when Ethernet loses its address (f065cef)
• ethernet: never set a NULL default interface when Ethernet loses its address (a6a501c)
• log: a seventh LogWorker aux job fails the build, not the job (48f611c)
• network: DNS servers per interface, so a Wi-Fi lease keeps static Ethernet DNS (888b070)
• network: log the default interface and DNS servers in use when they change (eee613c)
• portal: keep the portal's headers C++17 - CI builds components/portal as C++17 (826a2a8)
• setup: never log the setup response body; keep retrying setup after ten minutes (f907b95)

Features

• ocpp: GetDeviceKey, the CSMS's enrolment of the device key (684068a)
• portal: certificates view (device portal phase 5) (f26f699), closes hi#water
• portal: Ethernet static IP, applied as a trial (device portal phase 3) (da61194)
• portal: firmware page hardening (device portal phase 6) (e46f546)
• portal: HTTPS, always on, and a status page (device portal phase 1) (5349a4f)
• portal: the OCPP connection page, approved servers only (device portal phase 4) (14cfc7f)
• privacy: remote wipe keeps network credentials; factory reset keeps hardware data (96840cf)
• privacy: remove personal data - one routine for BLE, factory reset and CustomerInformation (17459d6)
• security: after an NVS wipe, the eFuse serial is the identity (b72d750)
• security: the device key's pure core (fa87941)
• security: the local access password - hotspot, portal login, cloud push and BLE restore (f6c737d)
• security: the per-device eFuse key in BLOCK_KEY5 (1caed6f)
• setup: setup v2 for a unit that holds a device key (65018b7)

Performance Improvements

• ram: build SQLite without its JSON functions (64de4ec)
• ram: drop the octal MXIC flash driver - 2.1 KB of internal RAM back (238c547)
• ram: keep the ADC sample window in PSRAM - 8.8 KB of internal RAM back (e19492b)
• ram: log DateTime parse failures with ESP_LOGW, not std::cerr (1d478cb)
• ram: move SQLite and mDNS static buffers to PSRAM - 2.3 KB back (e6c9087)

Bug Fixes

• shared: Open/ClosePeriodicEventStream are station-initiated, not commands (6cb4d01)
• security: never store or log credentials pushed to chargers (443f6fc)
• ocpp21: send and read the vendored 2.1 messages as the schema has them (2676070)
• ocpp21: send UpdateFirmware in the schema's casing (2209173)
• deps: clear the October RustSec advisories (033d973), closes cargo#10801
• deps: replace the unmaintained backoff crate with a shared retry helper (6c8abac)

Features

• ocpp: CustomerInformation and NotifyCustomerInformation for the personal-data wipe (ea616cf)

Bug Fixes

• ocppcore: answer a 2.1 TransactionEvent as 2.0.1 does, not with {} (6f5723a)
• ocppcore: audit and reconcile 2.1 stations, on 2.1 (34969c9)
• ocppcore: drop the three v201 queues bound to actions 2.0.1 does not have (72df676)
• ocppcore: floor a station's audit generation at the current time (69bdec4)
• ocppcore: refuse a station CALL under a CSMS action, on every version (192c18a)
• ocppcore: stop translating Open/ClosePeriodicEventStream as commands (1831da7)
• shared: Open/ClosePeriodicEventStream are station-initiated, not commands (6cb4d01)
• ocpp-core: bound quorum delivery recovery (852763a)
• ocpp: preserve station command delivery (f2ae2be)
• ocpp: recover deliveries hidden before dispatch (603f865)
• ocpp: recover stalled broker connections (cebf6bf)
• ocpp: recover unacked command responses (a44f0f9)
• ocpp: recover unacked request deliveries (d06dc4c)
• ocpp: restart stalled delivery consumers (da190f6)
• ocpp: use supported delivery recovery mode (5649eb0)
• security: never store or log credentials pushed to chargers (443f6fc)
• core: bound station publish confirmations (94b0297)
• core: park a deferred message without the gateway's user_id (7818521)
• firmware: dispatch and track firmware jobs for 1.6 and 2.1 stations (ba42141)
• ocpp21: send and read the vendored 2.1 messages as the schema has them (2676070)
• ocpp21: send UpdateFirmware in the schema's casing (2209173)
• deps: clear the October RustSec advisories (033d973), closes cargo#10801
• deps: replace the unmaintained backoff crate with a shared retry helper (6c8abac)
• firmware: a device moved to another tenant no longer gets the old tenant's queued update (5b35db0)

Features

• ocpp: CustomerInformation and NotifyCustomerInformation for the personal-data wipe (ea616cf)
• core: stamp the AMQP user_id on the core's platform events (1414e0d)
• firmware: carry the station's own firmware status on fw.device.status (1046d3b)

Bug Fixes

• ocppcore: answer a 2.1 TransactionEvent as 2.0.1 does, not with {} (6f5723a)
• ocppcore: audit and reconcile 2.1 stations, on 2.1 (34969c9)
• ocppcore: drop the three v201 queues bound to actions 2.0.1 does not have (72df676)
• ocppcore: floor a station's audit generation at the current time (69bdec4)
• ocppcore: refuse a station CALL under a CSMS action, on every version (192c18a)
• ocppcore: stop translating Open/ClosePeriodicEventStream as commands (1831da7)
• shared: Open/ClosePeriodicEventStream are station-initiated, not commands (6cb4d01)
• ocpp-core: bound quorum delivery recovery (852763a)
• ocpp: preserve station command delivery (f2ae2be)
• ocpp: recover deliveries hidden before dispatch (603f865)
• ocpp: recover stalled broker connections (cebf6bf)
• ocpp: recover unacked command responses (a44f0f9)
• ocpp: recover unacked request deliveries (d06dc4c)
• ocpp: restart stalled delivery consumers (da190f6)
• ocpp: use supported delivery recovery mode (5649eb0)
• security: never store or log credentials pushed to chargers (443f6fc)
• core: bound station publish confirmations (94b0297)
• core: park a deferred message without the gateway's user_id (7818521)
• firmware: dispatch and track firmware jobs for 1.6 and 2.1 stations (ba42141)
• ocpp21: send and read the vendored 2.1 messages as the schema has them (2676070)
• ocpp21: send UpdateFirmware in the schema's casing (2209173)
• deps: clear the October RustSec advisories (033d973), closes cargo#10801
• deps: replace the unmaintained backoff crate with a shared retry helper (6c8abac)
• firmware: a device moved to another tenant no longer gets the old tenant's queued update (5b35db0)

Features

• ocpp: CustomerInformation and NotifyCustomerInformation for the personal-data wipe (ea616cf)
• core: stamp the AMQP user_id on the core's platform events (1414e0d)
• firmware: carry the station's own firmware status on fw.device.status (1046d3b)

Bug Fixes

• gateway: answer each OCPP version with its own CALLERROR codes (2585e55)
• gateway: check every station reply against its OCPP response schema (2ee7c3f)
• shared: Open/ClosePeriodicEventStream are station-initiated, not commands (6cb4d01)
• gateway: a certificate-api outage no longer refuses Basic-auth chargers (d6a0887)
• gateway: bound core message publishing (aeebc0a)
• gateway: bound platform event publishing (cdab94c)
• gateway: bound station queue setup (9033892)
• ocpp: preserve station command delivery (f2ae2be)
• security: never store or log credentials pushed to chargers (443f6fc)
• ocpp21: send and read the vendored 2.1 messages as the schema has them (2676070)
• ocpp21: send UpdateFirmware in the schema's casing (2209173)
• deps: clear the October RustSec advisories (033d973), closes cargo#10801
• deps: replace the unmaintained backoff crate with a shared retry helper (6c8abac)

Features

• gateway: provision charge points from device.credentials.upsert (0dd9985)
• ocpp: CustomerInformation and NotifyCustomerInformation for the personal-data wipe (ea616cf)
• gateway: stamp the AMQP user_id on everything the gateway publishes (80b4b7e)

Bug Fixes

• ocppcore: answer a 2.1 TransactionEvent as 2.0.1 does, not with {} (6f5723a)
• ocppcore: audit and reconcile 2.1 stations, on 2.1 (34969c9)
• ocppcore: drop the three v201 queues bound to actions 2.0.1 does not have (72df676)
• ocppcore: floor a station's audit generation at the current time (69bdec4)
• ocppcore: refuse a station CALL under a CSMS action, on every version (192c18a)
• ocppcore: stop translating Open/ClosePeriodicEventStream as commands (1831da7)
• shared: Open/ClosePeriodicEventStream are station-initiated, not commands (6cb4d01)
• ocpp-core: bound quorum delivery recovery (852763a)
• ocpp: preserve station command delivery (f2ae2be)
• ocpp: recover deliveries hidden before dispatch (603f865)
• ocpp: recover stalled broker connections (cebf6bf)
• ocpp: recover unacked command responses (a44f0f9)
• ocpp: recover unacked request deliveries (d06dc4c)
• ocpp: restart stalled delivery consumers (da190f6)
• ocpp: use supported delivery recovery mode (5649eb0)
• security: never store or log credentials pushed to chargers (443f6fc)
• core: bound station publish confirmations (94b0297)
• core: park a deferred message without the gateway's user_id (7818521)
• firmware: dispatch and track firmware jobs for 1.6 and 2.1 stations (ba42141)
• ocpp21: send and read the vendored 2.1 messages as the schema has them (2676070)
• ocpp21: send UpdateFirmware in the schema's casing (2209173)
• deps: clear the October RustSec advisories (033d973), closes cargo#10801
• deps: replace the unmaintained backoff crate with a shared retry helper (6c8abac)
• firmware: a device moved to another tenant no longer gets the old tenant's queued update (5b35db0)
• firmware: retry a firmware event that fails, instead of dropping it (e6f412b), closes HI#2

Features

• ocpp: CustomerInformation and NotifyCustomerInformation for the personal-data wipe (ea616cf)
• core: stamp the AMQP user_id on the core's platform events (1414e0d)
• firmware: carry the station's own firmware status on fw.device.status (1046d3b)

Bug Fixes

• security-events: store chargers' SecurityEventNotification events (c08e6d8)
• auth: customer End Users drive only the chargers they hold (5ccd953)
• security: never store or log credentials pushed to chargers (8b8a780)
• deps: replace backoff with a local retry helper (369a7e6)
• deps: clear the October RustSec advisories (0a50d1b)

Features

• commands: refuse CustomerInformation for a 1.6 charger as unsupported (dc06e30)

Bug Fixes

• certificates: retry a failed certificate with a backoff and park it, so it never stalls the rest (f21b867)
• courses: a draft with a final assessment stays saveable and publishable (3e8501e)
• events: record an event as processed only after its effects; retry a failed one (28d139d)
• deps: clear the October RustSec advisories (b5d5917)
• deps: move aws-sdk-s3 to 1.144.0 for lru 0.18 (a1956f4)
• deps: move to sea-orm 2.0 and sqlx 0.9, which takes rsa out of the lockfile (7189307)
• evidence: check the enrolment, then the image header, before decoding; decode with limits (34e9f55)
• release: release from staging (rc) and develop (beta), as the other services do (9235cb2)

Bug Fixes

• telemetry: refuse the normalized fixture outside test and local runs (ae2ad5a)
• tesla: bind the OAuth callback to the user who started the link; refresh, rotate and stop telemetry on disconnect (4c2ade0)
• deps: move sqlx to 0.9, which takes rsa out of the lockfile (03ed88f)
• deps: clear the October RustSec advisories (65890ce), closes cargo#10801

Bug Fixes

• bus: move a charger's meter history with a customer tenant migration, and drop stale upserts (cf4a6f5)
• aggregates: report the energy ingest records, from the canonical daily aggregates (063d001)
• auth: customers read meter data only for chargers assigned to them (079d5f7)
• bus: apply tenant changes in order, and merge replica rows in two tenants (0cf54d3)
• sse: release a stream's channel when it closes, and bound the hub (a9fea80)
• deps: clear the October RustSec advisories (0d3ba90)
• deps: replace backoff with a local retry helper (849a9e4)

Bug Fixes

• orders: a party email is one plain mailbox, and order text is bounded (6c28b1d)
• orders: an order names only a seller that sells to the buyer (bbdc4a0)
• http: never send raw database errors to clients (1e94ae5)
• inventory: reconcile checks the unit's current owner too (c8d86b3)
• scanner: print a Product Label only for the caller's own stock (30be5cf)
• deps: clear the October RustSec advisories (aa7e0ae), closes rust-lang/cargo#10801
• deps: take aws-sdk-s3 1.144 for lru 0.18 (df090ff)

Bug Fixes

• auth: accept only identity headers signed by auth-api (a0c3e11)
• auth: honour PLATFORM_ADMIN and SENTINEL_ADMIN only in platform mode (70fbb1a)
• device-health: a failed incident e-mail no longer loses the incident or the event (e2015f2)
• deps: move to sea-orm 2.0 and sqlx 0.9, which takes rsa out of the lockfile (23e0765)
• deps: move lapin to 4.12 to drop the unmaintained instant crate (34618f2)
• deps: clear the October RustSec advisories (4bb88e9), closes rust-lang/cargo#10801

Bug Fixes

• print: send device-api's print-service token with the serial label (ffe7d77)
• security: publish device credentials on device.credentials.upsert (e8e7a9f)
• setup: print the box card's portal address as http:// (5436b7c)
• catalog: the tethered PlugStream models have one connector (138b7b2)
• deps: move to sea-orm 2.0 and sqlx 0.9, which takes rsa out of the lockfile (81ff58a)
• setup: known-MAC credential re-fetch only inside a recovery window (4d6a661)
• test: build the tethered-connector migration test on sea-orm 2 (159a1b8)
• test: build the tethered-connector migration test on sea-orm 2 (e307581)
• deps: aws-sdk-s3 1.144 for lru 0.18 (e1307c9)
• deps: clear the October RustSec advisories (0680119)
• devices: keep a held charger's hardware on a model change, and publish the change (b2a4daa)
• devices: stop exposing claim codes and MACs to tenant reads and the device topic (38a58b9)
• hardening: CORS only for configured origins, and bounded image work off the runtime (2f1cc74)
• health: quiet the first broker connect, and make health checks able to fail (b8c9aae)
• idempotency: release a key its request abandoned, and never store a credential (418b267)
• outbound: bound every outbound call, cache organisation expansion, and warn on its fallback (bc9cbfb)
• outbox: enqueue with the write, confirm every publish, one ordered publisher, and prune (b394e6f)
• paging: serve device lists and sync pages in a total order, and page sync by position (a99d5f3)
• pending: trust only the gateway's requests, never their credential, and review as a platform admin (911a097)
• setup: normalise MACs, and bound the devices unauthenticated setup can create (722cfff)
• shutdown: drain requests and background work on SIGTERM (e2e718d)
• setup: serve the recovery-window route under /global/ and allow listed service callers (0c20713)

Features

• setup: print the adoption code on the box card (7fcdfa3)
• setup: mint a local access password and print it on a box card (221133b)
• setup: setup v2 - a signed challenge for chargers that hold a device key (985fed4)
• setup: open a recovery window by MAC for the factory and support (206b3c3)
• setup: open recovery windows from chargepoint-api's event (8e18a11)

Bug Fixes

• auth: refuse dot-segment paths on the admin API (71e5da1)
• outbound: guard every partner fetch against SSRF (bc86259)
• deps: move sqlx to 0.9, which takes rsa out of the lockfile (495f5d4)
• deps: clear the October RustSec advisories (5ee654a)

Bug Fixes

• deliveries: outside platform mode, a caller reads only its own tenant's deliveries (fd6b621)
• metrics: serve the service's own metrics on /metrics, so its alerts can fire (21eeea3)
• reports: fetch the expense-report PDF with the token reporting-api accepts (3fa2bbc)
• templates: a tenant template can no longer crash the service; cap template size (a6806c0)
• templates: tenant-written email HTML is sanitised; one plain recipient per order email (d8ef5f1)
• deps: move to sea-orm 2.0 and sqlx 0.9, which takes rsa out of the lockfile (42021dc)
• deps: clear the October RustSec advisories (9babc2c), closes PKCS#8
• deps: replace backoff with a local retry helper (09003f6)

Bug Fixes

• domains: verify by DNS, one tenant per verified host, platform hosts reserved (9d2b215)
• logos: a tenant's logo is a key under its own prefix; check dimensions before decoding (8eafc25)
• tenants: outside platform mode, write only your own tenant and never tenant_global (15bfbd1)
• users: a disabled or suspended user loses their FusionAuth login (9541c98)
• deps: move lapin to 4.12 to drop the unmaintained instant crate (082b447)
• roles: deleting a role template needs ROLE_DELETE; a name clash is a 409 (b083b37)
• deps: move aws-sdk-s3 to 1.144 for lru 0.18 (a35322a)
• deps: replace the unmaintained backoff crate (e095925)
• deps: clear the October RustSec advisories (2c09748), closes cargo#10801

Bug Fixes

• api-keys: a malformed organisation id can no longer take auth-api down (9885c10), closes HI#1
• api-keys: never store a raw API key for idempotent replays (3c6cac8)
• rate-limit: anonymous traffic can no longer lock valid credentials out (46a2eb5), closes HI#2
• verify: let chargers reach the setup challenge without credentials (b56d282)
• deps: move lapin to 4.12 (4919be0)
• deps: move sqlx to 0.9 (92d86fa)
• verify: an API key authenticates only on its tenant_id, never its slug (a869d7f)
• api-keys: a tenant lists and revokes only its own keys (2aedbe3)
• deps: clear the October RustSec advisories (2ff778f)

Features

• scopes: report-first rules for customer platform-only scopes and service tokens (6d1ed5a)

Bug Fixes

• auth: honour PLATFORM_ADMIN across tenants only for platform-mode identities (3fdfd22)
• migration: reset the station OnIdle so the profile-3 move never stops a charge (9457611)
• worker: lease outbox messages so two workers never publish the same command (d28283d)
• deps: move to sea-orm 2.0 and sqlx 0.9, which takes rsa out of the lockfile (a8550ba)
• deps: clear the October RustSec advisories (410310c)

Features

• pki: serve the public CA, chain and CRL from memory for a minute (83db447)

Bug Fixes

• documents: accept and render only https document links (6204ce3)
• tap-events: bound what the public tap page can write (7bedebd)
• deps: move to sea-orm 2.0 and sqlx 0.9, which takes rsa out of the lockfile (ac0914a)
• deps: clear the October RustSec advisories (7c98aea), closes rust-lang/cargo#10801

Bug Fixes

• canary: a batch that ended unsent no longer holds its rollout for good (b0d9ebe)
• status: recognise ocpp-core's dispatched and paused job statuses (0bd194b)
• deps: clear the October RustSec advisories (aba258c)
• canary: wait for a batch's results before the next, and honour canary_percent (b796970)
• dedupe: treat a message id reused by another message as a new event (d448fef)
• intents: check intents and device status against the rollout's tenant (193b656)
• logging: log from INFO when RUST_LOG is unset, and JSON with LOG_FORMAT=json (92a6d4c)
• status: accept firmware-api's refused-allow report, and never let it undo a real one (162f9cc), closes HI#2
• status: apply device status reports in the order ocpp-core recorded them (e96b7eb)
• tick: wake every replica at the start of the same tick interval (fcc30e7)

Features

• metrics: serve /metrics with rollout, slot and tick metrics (d260824)

Bug Fixes

• deps: move to sea-orm 2.0 and sqlx 0.9, which takes rsa out of the lockfile (e1610b8)
• deps: clear the October RustSec advisories (b360d98), closes rust-lang/cargo#10801

Bug Fixes

• deps: move to sea-orm 2.0 and sqlx 0.9, which takes rsa out of the lockfile (37bbc17)
• deps: clear the October RustSec advisories (4d4a046), closes cargo#10801

Features

• versions: name a version's uploader to whoever could approve it (7b3c9ed)

Bug Fixes

• deps: aws-sdk-s3 1.144 and lru 0.18.5 for the lru advisories (f02d3bc)
• deps: clear the October RustSec advisories (43ed68e)

Bug Fixes

• deps: move to sea-orm 2.0 and sqlx 0.9, which takes rsa out of the lockfile (4bae829)
• deps: clear the October RustSec advisories (84dc1d8)