Milestones

List view

• Audit follow-ups (post-1.6)

  Findings from the Jul 2026 full product audit that are not already tracked under v1.7–v1.12 Must/Should items. Ship alongside or ahead of those milestones when severity warrants.

  Due by September 29, 2026

  •1/23 issues closed
  4% complete22 open1 closed

• v1.12.0

  Finding provenance, signed releases/reports, and sustainable OSS delivery. Focus: C25–C30 plus community/support docs (#379–#381). Issues: #342 #343 #368 #369 #370 #371 #372 #373 #379 #380 #381

  Due by March 30, 2027

  •0/11 issues closed
  0% complete11 open0 closed

• v1.11.0

  Actionable history/diffs plus source-plugin contract and tenant-safe search. Focus: C20–C24. Issues: #340 #341 #363 #364 #365 #366 #367

  Due by January 30, 2027

  •0/7 issues closed
  0% complete7 open0 closed

• v1.10.0

  Supply-chain depth: SPDX, VEX/CSAF, and conservative reachability. Focus: C17–C19. Issues: #339 #360 #361 #362

  Due by December 30, 2026

  •0/4 issues closed
  0% complete4 open0 closed

• v1.9.0

  Scan correctness/performance and truthful SBOM platform. Focus: C13–C14 (bounded NVD, stackVersions matching), C15–C16 (SBOM capabilities + CycloneDX hardening). Issues: #337 #356 #357 #338 #358 #359

  Due by November 29, 2026

  •0/6 issues closed
  0% complete6 open0 closed

• v1.8.0

  Web UI/UX correctness wave 2 (remaining items under epic #385). IA, scan UX, a11y, i18n/RTL, Watch/Export clarity. Complements v1.6.0 Must UI bugs (#386–#389). Issues: #390–#409 (except any closed earlier)

  Due by October 30, 2026

  •5/24 issues closed
  20% complete19 open5 closed

• v1.7.0

  Reliable multi-tenant jobs and multi-replica foundations after v1.6.0. Focus: C05–C06 (job leasing/idempotency + tenant-scoped job APIs/Redis), production queue E2E, shared-state adapters (C09–C10). Issues: #333 #348 #349 #376 #335 #352 #353 #378 #396

  Due by September 29, 2026

  •0/9 issues closed
  0% complete9 open0 closed