Pulp Engine v0.87.0

v0.87.0 delivers the 84 implementation waves from the feature audit: richer report design and output, tenant governance, automation, Office-authored templates and deterministic legacy-report migration. The individual wave reports in docs/spikes/ record their tests and remaining external checks.

Upgrade from v0.86.0

Back up the database, template and asset stores, encrypted-secret configuration and private source/document blobs before upgrading. This release includes database migrations; apply them using the new image before starting API replicas. Follow the PostgreSQL or SQL Server procedure in the release checklist and the deployment guide. File storage does not need a SQL migration.

Use ghcr.io/troycoderboy/pulp-engine:v0.87.0, with matching worker/controller images where those render modes are used. API, editor, TypeScript/Python SDKs, CLI and embed packages follow version 0.87.0. Plugin API/testing packages retain their independent 0.5.0 version line.

Review these compatibility changes before upgrading:

• Data-source connections use /data/connections; /connections now manages delivery connections. Update integrations using the former data-source path.
• New template node types and options still use template formatVersion: 1; older servers can reject those new types. Upgrade render workers together with the API before adopting them.
• Native editable charts are now the PowerPoint default. Use the image fallback option when a target viewer needs it.
• The default Docker font pack is full Noto. Images are larger; standard/minimal font-pack rebuilds are available. Explicit document fonts and pagination fixes can change output appearance. Recheck important documents after upgrading.
• Keep encryption keys and private Office source blobs in backups. Source cleanup on permanent template purge retains blobs referenced by other versions or drafts; unreferenced sources are removed.
• Optional identity, portal, AI, SQL data, delivery and Office PDF-conversion features require their documented configuration and services. Review .env.example and the deployment guide before enabling them. Existing production hardening requirements continue to apply.

Report engine and output

• Correct DOCX images, rich text, pagination, metadata and outlines; decimal-safe calculations, locale/time-zone formatting, expression helpers, global values and custom fonts. ISO date-offset tokens consistently emit Z for UTC across ICU versions.
• Grouped and pivot reports, conditional formatting, richer charts and icons, reusable components/layouts, themes, datasets, contracts and template testing.
• Advanced paper and section setup, watermarks/stationery/inserts, running headers, notes, hyphenation, flow columns, positioned blocks and native Office layout improvements.
• PDF assembly, forms, retained downloads, optimisation, signing and e-invoice attachments, with dedicated conformance tooling.
• Native editable PowerPoint charts with embedded workbook data, continuation slides and improved font fidelity.

Editor and authoring

• Styled canvas authoring, scope-aware field binding, multi-selection, richer inspectors, navigation, search, diagnostics and preview controls. Header icon controls retain their accessible target sizes in crowded layouts. Save notices from other browser tabs survive presence heartbeats. Paged PDF proofs retain canvas navigation with PDF.js 6 destination maps.
• Reusable assets and templates, organisation, drafts, conflict recovery, presence, approval workflows and contextual review threads.
• Host/embed controls, guided forms and the report portal; typed German, French and Arabic Beta interface catalogues with RTL controls.
• Office source upload, schema/tag linting and source/version management. Deterministic legacy-report import includes a fidelity review and navigable source issues before saving.

API, operations and integrations

• Unified asynchronous jobs, idempotency, retries, archives, webhooks, logs, delivery connections, bursting, schedules and calendars.
• Bounded reuse of compiled response serializers reduces repeated server-startup work; request validation retains the native compiler.
• Schedule URL sources retain their selected fields during validation; partial updates preserve saved time zones, and orphaned schedules can still be disabled. Background jobs share component/layout resolution across items.
• Tenant purge includes promotion requests, review comments and label history. Native spreadsheets preserve formatted fallback values for blank cells. AI tool schemas share repeated shapes and keep recursive references valid inside the generation wrapper.
• Runtime API keys, role permissions, tenant lifecycle/policies/quotas, usage analytics, a template catalogue, SCIM/SAML identity and governed AI providers.
• Helm deployment and native amd64/arm64 image publication with PDF parity, SBOM/scanning/signing steps and signed OCI chart distribution.
• MCP and n8n packages plus Power Automate, Zapier and Make integration sources. Expanded named OpenAPI contracts and TypeScript/Python clients; generated .NET, Java, Go and PHP clients have verification and packaging workflows.

Office templates and migration

DOCX, XLSX and PPTX sources can be filled natively from shared expressions/data and converted to PDF through isolated Gotenberg. Source packages are private and versioned; the editor, SDKs and CLI expose upload and linting workflows.

Offline import accepts RDL/RDLC, JRXML, Crystal XML exports and Handlebars/Liquid/Jinja HTML. Importers produce editable drafts with parameter, asset, expression and fidelity inventories. Unsupported features are reported. See the migration guide.

The plugin API, read-only Office linter and offline importer/HTML mapping subset are MIT-licensed as documented in licensing. Rendering and PDF conversion remain commercial.

Validation

The release security audit also updates the editor to PDF.js 6.2.108, CSV parsing to 7.0.3 and ZIP parsing to fflate 0.8.3. Node-forge 1.4.0 has no published fix for GHSA-86w9-cpqp-85rv; the pinned pnpm patch backports the nested DigestAlgorithm element-count check from upstream PR 1152. CI exercises the installed dependency with valid signatures and malformed inner/outer sequences. The audit exclusion for that advisory covers this patched dependency; the two pre-existing reachability exceptions remain documented in v0.85.1.

CI gate: publication is gated on a successful full CI run for the exact release commit on main. The workflow runs the shared core gate first, uses fail-fast limits for API/file-storage test failures and browser suites, and then enables the additional runners. It includes core build/typecheck/lint/tests and coverage, file storage, SQL Server, editor/auth E2E, Docker smoke, Windows installer and evaluation-bundle validation. See the CI runs for the release commit’s results.

Locally verified: the final audit gates passed 38 build tasks, 68 typecheck tasks, 30 lint tasks, 564 HTML-renderer tests and 190 Python tests, Ruff, strict mypy, encoding/OpenAPI checks and isolated consumer checks for 12 npm tarballs. These were performed on the audited source before the release-only version bump; the final audit report records exact evidence. The final production image passed five legacy-import fixtures and browser review/export checks. Office fixtures passed Open XML/LibreOffice checks, with native Office checks recorded in the relevant wave reports. Generated language SDKs passed local build, unit, packaging and smoke checks during implementation.

The final Linux hyphenation benchmark measured 6.53% pooled HTML-build overhead. One individual trial exceeded the 10% target; variance and the repeatable benchmark are recorded in the final audit report.

Release preparation with fresh dependencies also passed 2,553 editor tests, all 127 TypeScript SDK tests, and the unchanged coverage thresholds for PDF (420 tests), HTML (564), DOCX (134), PPTX (196) and charts (296). All 12 versioned npm tarballs passed isolated consumer checks and publish dry runs. The four generated SDKs passed builds, unit checks, packaging and API smoke tests against v0.87.0. All 54 PostgreSQL migrations applied to disposable databases. Helm/schema and alert-rule validation passed; a local kind install passed migrations, readiness, Helm tests, mixed-script PDF rendering and a 30-second pod-replacement loop with 35 successful renders and no HTTP failures. The production image passed read-only startup and PDF rendering, and its installed node-forge package passed the malformed-signature regression checks.

The editor browser gates passed all 56 default scenarios and all 28 authenticated scenarios, including accessibility, real PDF downloads, PDF-to-canvas navigation and concurrent editing. Focused unit regressions cover PDF.js destination maps and cross-tab save-notice retention.

Fresh Python 3.12 verification passed all 190 SDK tests, Ruff and strict mypy using only the declared development dependencies. SQL Server applied all 52 migrations and passed 181 store, API, tenant-isolation and document-download tests. A disposable PostgreSQL backup/restore rehearsal preserved all 48 tables and 65 fixture rows through dump, database recreation, restore and a no-op migration check.

npm publication: deferred until publishing authentication passes. Packaging and consumer checks have passed; verify published package availability before installing v0.87.0.

Not verified: customer Crystal exports; Litmus/Email on Acid email-client screenshots; vendor automation accounts; PowerPoint Edit Data, Keynote and Google Slides checks; DocuSign sandbox; Entra/Okta SCIM validators; live Bedrock, Vertex and Foundry accounts. These checks remain pending by agreement. First .NET/Java/Go/PHP registry publication and public-resolution checks remain pending registry onboarding; the release workflow verifies and packages them without enabling publication. No customer production deployment is performed by this release.