Release notes

v0.87.0 delivers the 84 implementation waves from the feature audit: richer report design and output, tenant governance, automation, Office-authored templates and deterministic legacy-report migration. The individual wav…

The visual template editor gets a full design and usability pass, plus fixes

Production dependencies built up 1 critical and 69 high advisories in the

Audit remediation release 2 of 2, closing the five high-value findings the

Pure release-tooling patch. The product is identical to v0.84.0 — see

> Publication note: v0.84.0 was tagged but never published — the

This release works through the adverse findings of the second post-hardening quality audit. It

This release closes the highest-leverage cluster from the post-hardening quality audit: an

The post-hardening audit's finding F4 noted that the named-user editor registry was

This release closes the highest-leverage findings from the post-hardening quality audit of

Tag: v0.79.0

Tag: v0.78.4

Tag: v0.78.3

Tag: v0.78.2

Tag: v0.78.1

Tag: v0.78.0

Tag: v0.77.1

Tag: v0.77.0

Tag: v0.76.1

Tag: v0.75.8

Tag: v0.75.7

Tag: v0.75.6

Tag: v0.75.5

Tag: v0.75.4

Tag: v0.75.3

Tag: v0.75.2

Tag: v0.75.1

Tag: v0.75.0

Tag: v0.74.0

Tag: v0.73.0

Tag: v0.72.0

Tag: v0.71.0

Patch release. Closes four blocker/high/medium issues surfaced in the v0.67.0 review. No schema changes, no new migrations, no new features — v0.67.1 exists solely to make the v0.67.0 feature flag behave the way the v0.6…

Phase C.0 Stage 2 — Multi-tenant mode.

Phase C.0 Stage 1 — Tenant primitive (foundation refactor).

Dev Team Blockers — Phase A (observability & reliability) + Phase B (template lifecycle & quality), end-to-end.

Commercial Distribution.

SDK coverage initiative — Stage 2: the Go SDK ships.

SDK coverage initiative — Stage 1: the .NET SDK ships.

v0.61.0 closes the Developer Blockers initiative — the four stages identified as the biggest friction points between "Pulp Engine API is running" and "external team is productive against it." Shipping them together in on…

- Audit purge endpoint — DELETE /audit-events?before=<ISO 8601> removes

Patch release fixing CI failures from v0.56.0 (v0.56.0–v0.56.2 tags

Patch release fixing CI failures from v0.56.0 (v0.56.0 and v0.56.1 tags

Patch release fixing CI failures from v0.56.0: missing Prisma migration for

Closes all 5 audit items from the documentation and code quality review.

Patch release fixing CI failures from v0.55.0: sub-package versions synced to

Editor store decomposition and paginated template picker.

Patch release fixing CI failures from v0.54.0: version consistency (sub-package

Paginated collection responses, request correlation, and stricter hardened-production enforcement.

Remote resource egress control, storage instrumentation, and observability improvements.

Production-grade defaults, editor architecture decomposition, and canvas render performance.

Dev toolchain major version upgrades: ESLint 10 and TypeScript 6.

Security headers, starter pack library, and exhaustive documentation sweep.

Editor authoring release: six new capabilities for template authors, plus the

Patch release that fixes the Docker build failure that blocked v0.48.0 publication,

> Superseded by v0.48.1. The v0.48.0 Docker images were never published to

The bundled editor deployment path is now first-class. The Docker image now includes the

Patch release. No functional changes.

This release introduces a three-phase render isolation architecture that progressively removes

This release hardens the hostile-content trust boundary across four renderer layers: IPv6

Patch release. Fixes a Prisma query-engine binary mismatch that caused Postgres mode to

Patch release. Fixes a post-destroy ENOENT unhandled exception in the onSend SVG-block hook

This release hardens the security posture across three layers: legacy SVG assets are now actively

This release adds bounded capability freshness to the preview panel. Long-lived editor sessions can

This release sharpens the editor's preview and publish-gate failure handling. fetchPreviewStatus() now returns distinct typed reasons for each failure mode instead of collapsing them, the preview panel fail-closes with s…

This release completes render error classification for the public API routes and sharpens the /render/validate contract, making all three render endpoints operationally honest and machine-readable.

This release adds preview capability negotiation and render execution error codes for the editor preview routes, giving the editor clear, machine-readable reason codes when a render attempt fails, and a stable capability…

This release makes hardened production the endorsed and clearly signposted default path across every operator-facing surface: the README quick-start, the Dockerfile container defaults, .env.example, the deployment guide,…

This release improves editor resilience by adding error containment at critical React boundaries, so render crashes and lazy chunk-load failures degrade gracefully instead of collapsing into a white screen. It also remov…

This release tightens release discipline, improves production operator guidance, and removes several invisible lazy-loading gaps in the editor. It adds a mojibake regression guard, consolidates hardened-production startu…

This release fixes the version-history lazy boundary in the editor: the modal now

Patch release. No functional changes.

This release closes two production-trust gaps: asset-binary store health is now

This release consolidates all work since v0.27.0. Eight distinct improvements are shipped

This release ships two independent security improvements: hardened production-mode

v0.25.1 CI was blocked by bugs in the new auth E2E test suite. Three issues were fixed across two iterations:

v0.25.0 was retracted immediately after tagging — the pnpm-lock.yaml was not updated when vitest@^4.0.0 was added to packages/template-model/package.json, which would have caused pnpm install --frozen-lockfile to fail in…

This release adds five opt-in configuration controls that reduce reliance on "operator must deploy this perfectly" for key security surfaces.

This release is a stability and consistency pass with no new end-user features. It hardens

Two major capabilities land in this release:

Asset binaries (uploaded images) can now be stored in an S3-compatible bucket instead of the local filesystem. This is configured independently of the template/metadata storage backend (STORAGE_MODE) via a new ASSET_BINA…

Patch release following v0.21.0. No breaking changes. No schema migrations. No production code changes.

Affected: Any integrator that parses the body of 422 Validation Failed responses

v0.20.0 closes the last major commercial-readiness gap in Pulp Engine's operator trust model: editor sessions are now attributable, and all write operations produce structured audit log events.

v0.19.0 extends the editor authentication model introduced in v0.15.0 with three independent but complementary operator controls, plus a file-to-database migration script, a full OpenAPI schema layer, and a suite of new …

Prior to this release, Pulp Engine had no immutable production artifact. Operators were required to clone the repository at a git tag, install all dependencies (including build toolchain), generate the Prisma client, and…

Prior to this release, Pulp Engine had no application-level metrics and almost no targeted structured logging. Auth failures, render failures, version conflicts, and preview-vs-production traffic were invisible to operat…

Prior to this release, all template mutation endpoints (PUT, DELETE, and version restore) used last-write-wins semantics. Two concurrent editors could each load the same template, modify their copies, and both save succe…

---

Adds a narrower editor scope (API_KEY_EDITOR) so the visual editor no longer needs an admin-scoped credential in the browser. Set VITE_API_KEY to API_KEY_EDITOR instead of API_KEY_ADMIN. The browser retains full editor f…

Replaces the single shared API_KEY with three named credential scopes. Production integrations can now hold a render-only key; template management uses a separate admin key; preview routes can be restricted to a dedicate…

Release date: 2026-03-22

Release date: 2026-03-22

Release date: 2026-03-19

Release date: 2026-03-19

Release date: 2026-03-19

Release date: 2026-03-19