Bug Fixes

• deps: replace the unmaintained backoff crate (8cdf639)
• deps: clear the October RustSec advisories (82a6d51), closes cargo#10801

1.20.5 (2026-10-05)

Bug Fixes

• deps: clear the October RustSec advisories (a9016ba)
• deps: drop the unused jsonwebtoken dependency, which compiled rsa (50e0c44)

Bug Fixes

• api-keys: keys get only scopes their creator may grant, on the creator's tenant (ab898c4)
• verify: refuse a credentialed request on a tenant-less path with 403, not 400 (f5326e4)

Features

• verify: let a charger's firmware download through the edge (90feaea)

Bug Fixes

• roles: no customer role produces firmware, and a role sync takes it back (9883ff3)

Features

• roles: let operators, technicians and dashboard viewers read locations (97fe615)

Bug Fixes

• api: clamp paging and never panic on non-object metadata (9252803)
• auth: accept a signed identity dated up to 30 s ahead of this clock (b7d7c74)
• auth: give each internal caller its own token, scopes and tenants (394f65b)
• auth: reads need a person or a release scope; roadmap writes need a person (d5cdab9)
• auth: trust unverified identity headers only when asked for, locally (b58def9)
• consolidation: stop clearing and polluting release notes; settle each week once (1ee7e31)
• db: set statement_timeout as a role default; PgBouncer refuses startup options (671a6dd)
• idempotency: commit the key, the write and its stored response together (55f3633)
• logging: log only verified identity, quiet the probe, keep panics in the JSON log (972e204)
• releases: merge metadata on PATCH and drop the forgeable promotion-readiness gate (7f3e7d7)
• releases: require RELEASE_DELETE to deprecate or restore through PATCH (4db9791)
• releases: serve the highest version as latest, and validate what is published (534674c)
• roadmap: hold the pending-idea cap under concurrent submissions (d1c40ee)
• runtime: stop gracefully on SIGTERM and bound request, auth-api and SQL time (8917997)
• auth: stop forwarding caller-set IP headers to auth-api /verify (5ca089d)

Features

• auth: add RELEASE_PERF_WRITE, and stop API keys moderating the roadmap (42e4fd5)

Performance Improvements

• api: bound the performance, overview, roadmap and mirror reads (9b44339)

Bug Fixes

• auth: apply the API rate limit; it never applied to anything (7a2d6b1)
• auth: compare the internal routes' service token in constant time (f36a33e)
• auth: only the platform produces firmware, reviewed by someone else (f6d875f)
• firmware: a best-effort notification no longer holds up the response (ee35784)
• firmware: a device that changes tenant takes none of its old owner's updates (3410b25)
• firmware: a report ending the previous tenant's job closes that tenant's attempt (ac019db)
• firmware: an eligibility intent whose write fails is not acknowledged (1145067)
• firmware: approve the declared bytes, and serve what was approved (6e59df0)
• firmware: fw.rollout.updated never undoes the operator's own pause or resume (fa5edf7)
• firmware: no download for a removed device or a withdrawn version (0e067ee)
• firmware: offer Retry and Remove only where the rollout still allows them (624a3ed)
• firmware: order ocpp-core's reports; a late one never moves an attempt back (c4fe598)
• firmware: page=0 no longer breaks the rollout and version lists (e3181db)
• firmware: published announcements keep no download credential (8651b29)
• firmware: tell the orchestrator when an allow request is dropped (08a9f7b)
• firmware: refuse to restart a finished rollout or act before approval (7547001)
• firmware: stop losing rollout intents and retry allow requests (11d419c)
• firmware: stop sending the update to a device in a finished rollout (94d8b2c)
• firmware: check, record and announce an allow request in one locked transaction (68b45c4)
• firmware: keep a late status report from moving a finished or paused rollout (36b0049)
• firmware: never lose a rollout or version approval announcement (6bb3e43)
• firmware: retry or park a message the consumer fails to handle, never delete it (8f3329f)
• firmware: serialise a device removal with allows and retries of its rollout (809dd93)
• firmware: store a direct update and its announcement together (a389f5a)
• firmware: give charge points a download URL that lasts until they are reached (6886a9b)
• firmware: let a firmware download under way finish when the pod stops (d86a346)
• firmware: make a re-approval an idempotent repeat that announces nothing (a1077a3)
• firmware: park update-attempt telemetry missing a field at once (d074ebc)
• firmware: SignatureVerified is not the end of an update (1e7a4b6)
• firmware: stop gracefully on SIGTERM without adding delivery counts (36fa6fa)
• firmware: stop the edge probe's own request logging two warnings (b0477a9)
• firmware: record the station's OCPP events as evidence, not status (ad9f98c)

Features

• firmware: show the station's install and reboot phase again (6650ad9)
• firmware: announce device removals through a transactional outbox (2181120)
• firmware: give each outbox announcement a stable AMQP message_id (7bdf5b1)
• firmware: per-job download links that live and die with the update (46835e8)
• firmware: drop the firmware_rollout.webhook column (6688425)

Bug Fixes

• ocpp: send InstallVerificationFailed with its schema spelling (775342d)
• ocpp16: stop sending Idle mid-update; report the phase when triggered (3e1bec3)
• ota: give every OTA timer one owner and no delete to race (4aada2b)
• ota: honour UpdateFirmware retries and retryInterval (8646284)
• ota: let a new UpdateFirmware replace an update waiting to install (2a6a5c8)

Bug Fixes

• programme: log when the internal programme-orders route refuses a call (8af9136)
• scanner: ConfirmDispatch no longer fails when billing-api is down or refuses (660e3c7)
• auth: compare the internal token in constant time (d3e7616)

Bug Fixes

• auth: compare service tokens in constant time (8987f7f)
• setup: publish nothing on a setup re-run, and never replay connector status (9eb1bbf)
• security: remove the hard-coded performance-test token (4cc8b62)

1.14.1 (2026-09-30)

Bug Fixes

• references: look charge points up at chargepoint-api's internal root (6d72e18)

Bug Fixes

• intents: remember an intent handled before its rollout's approval (edec8bf)
• rollout: a device that will never report no longer holds a slot or its rollout open (342c4dd)
• consumer: requeue prefetched deliveries with a nack, not a channel close (52ebd02)
• consumer: stop dropping repeated intents and losing failed ones (f1ceade)
• mq: wait for a publisher confirm, and publish persistently (0c3b4fb)
• rollout: a cancelled or completed rollout stays that way (2266122)
• intents: drop an intent older than the last one applied to its rollout (7a76ee6)
• mq: reconnect the tick's connection, and report it honestly (b835d9a)
• rollout: remember a device removal that arrives before the device (f726cd3)
• tick: promote each rollout in one transaction, publishing inside it (6abeca5)
• consumer: stop cleanly on SIGTERM, giving back every held delivery with a nack (54379f1)

Features

• dedupe: prune event_dedup claims older than 30 days (3c243f5)
• consumer: park a message that keeps failing on firmware.orchestrator.dead (e3897b5)

Bug Fixes

• auth: fail closed without AUTH_API_VERIFY_URL (7940528)
• auth: verify direct callers as the real request (944d9ed)

Bug Fixes

• scheduled-reports: send each service its own internal token (4e4d75d)
• demo-data: refresh on the station key, write only its own rows, price its sessions (3d51f99)

Bug Fixes

• octopus: an open-ended rate is cheap until the next one starts (e3f4430)
• octopus: find a location's tariff from its agreement code (6904136)
• octopus: read a location tariff's region from the stored key (516a43b)
• tariff-windows: authorise a location's windows against the location (b64960a)
• auth: honour PLATFORM_ADMIN only for a platform identity (ee307b3)
• auth: trust the ingress-signed identity; verify direct callers as the real request (6e0df19)
• events: confirmed, stamped tariff.events with a transactional outbox (2c3ff42)
• external-api: encode outbound path segments; validate Octopus account numbers (7ef9b40)
• idempotency: release a reservation when its request fails or is dropped (23157e1)
• internal: check the internal token against startup config, in constant time (e07943c)
• main: shut down gracefully on SIGTERM, well inside the 30 s grace period (c36113a)
• octopus: authorise location link routes against the location, via tenant-api (3a63364)
• price-estimate: price the window slot by slot, exactly (47cb4da)
• provider-tariffs: bound last_updated and the size of a tariff upsert (ffe0833)
• rates: range queries return the rate in force, and page instead of truncating (8350247)
• sync: keep syncing withdrawn products customers are still on (c12e51e)
• sync: never delete the unit rate in force (6ac9d8c)
• sync: remove the OCPP core rate sync (910d577)
• sync: sync tariffs Octopus lists under varying or prepayment (e421b01)
• tariff-windows: an open-ended rate lasts until the next one starts (a68740c)
• tariffs: find a tariff by any form of its code (bcb9f26)
• performance: serve the performance test on a path auth-api can scope (074a512)
• sync: send chargepoint-api its own internal token for device settings (b138c61)

Features

• sync: one-off backfill of unit-rate history for reporting (c92a5bf)

Bug Fixes

• release: work with semantic-release installed outside the repository (9a33a7d)
• shared: re-run the build script only when the commit changes (fb5935f)

Bug Fixes

• release: work with semantic-release installed outside the repository (9a33a7d)
• shared: re-run the build script only when the commit changes (fb5935f)

Bug Fixes

• release: work with semantic-release installed outside the repository (9a33a7d)
• firmware: refuse an allow for a cancelled rollout (28416e6)
• firmware: apply a repeated firmware allow at most once (3b480cd)
• shared: re-run the build script only when the commit changes (fb5935f)

Performance Improvements

• core: index the retention job's age columns (c348e67)

Bug Fixes

• release: work with semantic-release installed outside the repository (9a33a7d)
• firmware: refuse an allow for a cancelled rollout (28416e6)
• firmware: apply a repeated firmware allow at most once (3b480cd)
• shared: re-run the build script only when the commit changes (fb5935f)

Performance Improvements

• core: index the retention job's age columns (c348e67)

Bug Fixes

• release: work with semantic-release installed outside the repository (9a33a7d)
• firmware: refuse an allow for a cancelled rollout (28416e6)
• firmware: apply a repeated firmware allow at most once (3b480cd)
• shared: re-run the build script only when the commit changes (fb5935f)

Performance Improvements

• core: index the retention job's age columns (c348e67)

1.0.0 (2026-09-29)

Features

• add API request correlation context (53e03ae)
• add tenant-isolated OCPI partner service (62e41c4)
• events: enrich location projection with EVSE detail (fdee073)
• events: make location projection merge-safe for two producers (dcbbc92)
• performance: add internal load-test endpoint (d68b863)
• public: add website read endpoints for locations & tariffs (d8fbf27)
• support outbound OCPI partner registration (dec147c)

1.6.1 (2026-09-29)

Bug Fixes

• migration: build the migration CLI only with its cli feature (f902171)

1.1.2 (2026-09-29)

Bug Fixes

• stop publishing lifecycle events as ocpp commands (233d2dd)

1.6.1 (2026-09-28)

Bug Fixes

• sims: keep the platform's Soracom account out of tenants' reach (f49ac89)

1.5.3 (2026-09-29)

Bug Fixes

• auth: verify signed identities; Xero and suspension routes are platform-only (85d6111)
• migration: give the idempotency migration its own name so it runs (4fa88e1)

Features

• firmware: report superseded rollout jobs; retire a removed device's job (809d6ee)
• authorize: decide idTokens in the backend, in shadow until enforced (46036b2)
• shared: carry the owning tenant on a PortalRequest (429e16a)
• firmware: hold a paused rollout's jobs; expire a job unsent after 7 days (b06d42f)

Bug Fixes

• ocppcore: retire the legacy smart-charging consumer (a807a79)
• ci: promote the image built from the promoted commit (e687b02)
• ci: run the ocpp-core v16, v21 and mock-db tests, and test feature branches (5229a21)
• firmware: fail a job the station goes silent on, and publish it (f1c582e)
• firmware: map every firmware status explicitly so failed installs fail the job (a0bed94)
• ocpp16: find a transaction by station and id, not by tenant (e7d8a79)
• ocpp16: the Ended event carries the stop register, and the session energy beside it (f22417c)
• ocpp201: bind NotifyEVChargingNeeds under the action name the gateway publishes (c134818)
• ocpp21: answer every station message with a schema-valid reply (497d3dd)
• ocpp21: carry the station's reply on 2.1 command results (f1a1c75)
• ocpp21: record 2.1 station state through the 2.0.1 persistence (3a40d1c)
• ocpp: check for a live gateway consumer with a passive declare (8d637af)
• ocppcore: a failed last_seen lookup no longer panics the consumer (9445188)
• ocppcore: a panic no longer stops an OCPP queue for good (2b4d9d6)
• ocppcore: always answer a station's CALL, and keep replies off request handlers (d17f701)
• ocppcore: answer a repeated 1.6 StartTransaction with the transaction it already opened (b9bfff2)
• ocppcore: bound the platform command action map (3dc0eed)
• ocppcore: carry TransactionEvent offline and seqNo into the platform event (41cc0ce)
• ocppcore: compile what the 2.1 core now shares with 2.0.1 (3892daf)
• ocppcore: defer a station's messages until its tenant is known (c10f3ba)
• ocppcore: deliver platform command results at least once (d21072b)
• ocppcore: give every platform command an expiry; never dispatch an expired one (be701d7)
• ocppcore: keep the 2.1 firmware status mapping as a test-only guard (1e30855)
• ocppcore: make sea-orm's mock an opt-in feature, not a dev-dependency (92c7975)
• ocppcore: never cache a failed tenant lookup; serve the last known tenant (e172998)
• ocppcore: prune published outbox rows, the OCPP audit log and meter values (597c486)
• ocppcore: report a platform command that cannot be sent, before dropping it (c1ccc53)
• ocppcore: stop labelling metrics by charge point (8638235)
• ocpp: judge presence on the persisted last_seen and drop the online triggers nothing sent (2f33393)
• ocpp: meter_kwh is the Outlet energy register, whatever order and unit it comes in (f93c3f4)
• reconcile: outages no longer park stations, and one sweep runs at a time (f47e208)
• site-control: judge the site master stale on receive time and its real cadence (d5bacd2)
• site-control: send a changed cap on the recalculation that computes it (d048039)
• ocppcore: SmartCharging with no managed plan yet is not runtime drift (ed3cd4b)
• readiness: carry configuredMaxAmps and every undeclared key through to the platform (f4777f5)