# Changelog

All notable changes to InboxIntel are documented here. Format follows
[Keep a Changelog](https://keepachangelog.com/); versions follow
[Semantic Versioning](https://semver.org/). See [docs/WORKFLOW.md](docs/WORKFLOW.md).

## [Unreleased]
### Security
- Patched all High/Moderate NuGet advisories the new dependency gate surfaced:
  `System.Text.Json` 8.0.0→8.0.6, `Microsoft.Extensions.Caching.Memory` 8.0.0→8.0.1
  (+ `DependencyInjection.Abstractions`→8.0.2), `System.Security.Cryptography.Xml`
  8.0.1→8.0.3 (transitive pins), and `MailKit`/`MimeKit` 4.13.0→4.17.0.

### Added
- CI/CD pipeline (`.gitea/workflows/`): `security` (gitleaks secret scan + NuGet/npm
  vulnerability gate), `deploy-staging` (auto-redeploy local staging on `develop`,
  with a post-deploy health gate), `deploy-prod` (tag-gated production promotion,
  inactive until the server exists). Verified end-to-end on the self-hosted runner.
- Formal Git workflow & environment strategy (`docs/WORKFLOW.md`).
- Staging environment overlay (`docker-compose.staging.yml`) — production-shaped
  Linux containers on Windows, isolated ports/volumes.
- Version-controlled Git hooks (`scripts/git-hooks/`) + installer
  (`scripts/install-hooks.ps1`): pre-commit secret/format checks, pre-push
  build+test gate.
- `VERSION` file as the single source of truth for the release number.

## [0.1.0] — scaffold
### Added
- .NET 8 Clean Architecture backend (Domain/Application/Infrastructure/Api) + React/Vite SPA.
- Docker Compose stack (Postgres 16, API, frontend, optional nginx proxy).
- Gitea Actions CI (backend build+test, frontend build) on `main`/`develop` + PRs.
- Security hardening: encrypted OAuth tokens, EF global query filters (IDOR),
  loopback binds, non-root containers, SSRF egress guard.
- One-command deploy scripts (`deploy/up.ps1`, `deploy/up.sh`).

[Unreleased]: https://your-gitea-host/InboxIntel/compare/v0.1.0...HEAD