VulnForge v4.4.1 Released

[homelabforge]

[4.4.1] - 2026-03-17

Changed

• Decompose scan pipeline _process_scan into 4 discrete stages with documented commit boundaries
• Split monolithic api.ts (1140 lines) into modular type and API client files (21 modules)
• Migrate direct API calls to React Query hooks in About, ContainerDetail, ApiKeysCard, DatabaseBackupSection
• Add TTL cache, typed batch getters, and declarative validation to SettingsManager
• Add provider caching, circuit breaker, and exponential backoff to notification dispatcher
• Document repository transaction convention (flush vs commit) across all repositories

Removed

• Dead header-based auth system (19 settings keys, routes/auth.py, frontend schemas)
• Legacy ntfy-only notifier (notifier.py) — replaced by multi-service dispatcher
• Legacy notification settings (notify_on_scan_complete, notify_on_critical, thresholds)
• Dead frontend code: authApi, userAuth:401 listener, auth Zod validators

Fixed

• Auth middleware now respects user_auth_mode=none, allowing open access on fresh installs without requiring setup first (fixes Enable Local Auth - not working #28)
• Missing theme entry in DEFAULT_CATEGORIES (was falling back to 'general' instead of 'ui')
• Deprecated send_to_ntfy field in notification rule schemas (API contract preserved)
• Marked ScanResultRepository as deprecated (test-only, no production consumers)

Added

• Frontend test infrastructure: test-utils.tsx, test-factories.ts
• Tests for SettingsContext, useVulnForge hooks, Dashboard page (110 -> 134 tests)

Dev Dependencies

• @typescript-eslint/eslint-plugin: 8.56.1 → 8.57.0
• @typescript-eslint/parser: 8.56.1 → 8.57.0
• @vitejs/plugin-react-swc: 4.2.3 → 4.3.0
• @vitest/coverage-v8: 4.0.18 → 4.1.0
• @vitest/ui: 4.0.18 → 4.1.0
• ruff: 0.15.5 → 0.15.6
• typescript-eslint: 8.56.1 → 8.57.0
• vite: 7.3.1 → 8.0.0
• vitest: 4.0.18 → 4.1.0

App Dependencies

• pyjwt: 2.11.0 → 2.12.1