[kushaldas]

Version

• Bump to 0.5.0 in Cargo.toml, both pyproject.toml files, docs/conf.py and the production compose image tags. Mark 0.5.0 (2026-10-22) in CHANGELOG.

Security

• Take certifi 2026.10.19 in both projects (root CA incident: removes emSign ECC Root CA - G3, matching Debian ca-certificates 20250419+deb13u1), as a documented exception to the cooling window.
• Build actix-web without the http2 feature to drop h2 0.3 (RUSTSEC-2026-0258, no 0.3 fix). The TA listener serves HTTP/1.1.
• Add .cargo/audit.toml recording the known rustls-pemfile unmaintained advisory (RUSTSEC-2025-0134).

Rust

• cargo update, holding back crates published after 2026-10-19 UTC to their previous release.
• Bump actix-web-lab 0.29, base64 0.23, redis 1.7, reqwest 0.13 (kept on native-tls, form feature), sha2 0.11, tera 2.4 (glob_fs) and toml 1.1.
• Add sha256_hex() since sha2 0.11 digests no longer format as hex; output is unchanged. Port template macros to Tera 2 components.
• Add tests: sha256 known vectors, index template and component rendering.

Python

• Move exclude-newer to 2026-10-19 UTC in both projects and relock; drop the obsolete pygamlastan-specific cutoff.
• Fix a ty error in apikeys admin get_readonly_fields.
• Pin the root Ruff rule set to E4, E7, E9, F like the Admin.

[Copilot]

🔵 Needs a closer look

The major dependency and TLS/template changes need successful CI and human validation, and the documented audit configuration remains missing.

1 open issue

• Add the missing .cargo/audit.toml configuration · New

What changed in this PR

Prepares Inmor 0.5.0 with dependency and security updates across the Rust trust anchor and Python projects, plus compatibility changes for upgraded libraries.

Changes:

• Updates release versions, production image tags, and release notes.
• Refreshes dependencies, disables server-side HTTP/2, and documents certificate trust updates.
• Migrates templates to Tera 2 components, adds hash and rendering tests, and fixes API-key admin readonly-field handling.

File	Description
templates/​macros.html	Converts macros to Tera 2 components.
templates/​index.html	Updates component calls and removes the macro import.
src/​tree.rs	Updates the Redis error variant used in tests.
src/​lib.rs	Adds SHA-256 hex encoding and known-vector tests.
src/​bin/​inmor/​main.rs	Updates template loading and adds rendering tests.
pyproject.toml	Bumps the version, updates dependency cutoffs, and pins Ruff rules.
docs/​conf.py	Sets the documentation release to 0.5.0.
dev/​docker-compose.prod.yml	Updates production image tags to 0.5.0.
CHANGELOG.md	Documents the release and security changes.
Cargo.toml	Updates Rust dependencies and HTTP/TLS features.
Cargo.lock	Records the refreshed Rust dependency graph.
admin/​pyproject.toml	Bumps the version and updates dependency cutoffs.
admin/​apikeys/​admin.py	Uses sequence unpacking for readonly fields.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The broad dependency and TLS/template migrations need human review and build/integration validation, with a confirmed deployment compatibility issue still unresolved.

1 open issue

• Update root compose TA image for Tera 2 template compatibility · New

1 resolved since last review

• Add the missing .cargo/audit.toml configuration

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The new lint prerequisite invokes a missing version-check script, blocking the CI lint job.

1 open issue

• Add missing version-check script required by lint and CI · New

1 resolved since last review

• Update root compose TA image for Tera 2 template compatibility

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The major dependency upgrades and TLS behavior changes need build and integration validation before final human approval.

1 open issue

• Add missing docs/releasing.rst release guide · New

1 resolved since last review

• Add missing version-check script required by lint and CI

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The release-version gate accepts mismatched image tags, and the documented clean build omits the frontend image.

1 open issue

• Enable frontend profile to build all release images · New

1 previously missed issue

In code that hasn't changed since last review

Capture complete image tags for release-version validation

scripts/​check_version.py:29

The regex skips tags such as v0.4.0 and latest, so those image references never reach the mismatch check. It also reads 0.5.0_old as 0.5.0 because underscores are excluded. With the release set to 0.5.0, these mismatches therefore pass the new release-version gate. Capture nonnumeric tags and underscores so the full tag is compared against the expected version.

1 resolved since last review

• Add missing docs/releasing.rst release guide

_{Review effort: Balanced}