All notable changes are recorded here. The project follows semantic versioning for source releases; the Apify Actor uses the matching major/minor version.
- Treat every currently open PR as a candidate even when it predates the lookback window.
- Keep request timeout enforcement active until the complete response body is read.
- Bound cumulative successful API response data to 50 MiB per run.
- Enforce a 4-minute total run deadline beneath the Task's 5-minute platform timeout.
- Discard raw PR text page by page and bound pre-deduplication key associations.
- Enforce PR row limits before returning a partially filled final page or appending cross-repository rows.
- Attribute a stale Jira aggregate only to historical/current aliases whose own PR evidence is fully closed.
- Restrict Jira tenants and credentials to expected safe forms, and reject every GitHub credential type except a dedicated
github_pat_ fine-grained token.
- Enforce Jira Cloud's 2+ character uppercase-alphanumeric project-key format while recognizing valid keys beside common underscore branch separators.
- Bound extracted Jira project keys to 64 characters and issue counters to 20 digits before they can enter URLs, evidence, or output.
- Discard accepted Jira 403/404 response bodies without parsing; only the status enters issue classification.
- Enforce GitHub's 100-character repository-name limit and bound upstream PR URLs, numbers, timestamps, and repository-count arithmetic.
- Make redaction setup resilient to accessor/Proxy input so direct-library misuse still returns a controlled uncharged failure.
- Make release verification fail if Apify/Docker context allowlists diverge or pinned-base, non-root, memory/header, lifecycle-script, and private-storage image invariants drift.
- Fail closed when duplicate PRs appear within a stream or one PR changes between overlapping recent/open reads; never treat empty evidence as all closed.
- Provide reason-specific recovery instructions for PR or organisation changes observed during completeness checks.
- Re-prove the complete organisation repository scope after PR reads and reject duplicate Jira cursor rows that could hide another match.
- Handle Actor initialization and input-storage failures through a fixed secret-free machine contract before normal orchestration begins.
- Replace generic primitive diagnostics with per-error-code field allowlists, stable identifier constraints, and accessor-free inspection.
- Preflight PPE pricing/capacity, reject synthetic Dataset-item billing, and distinguish non-PPE, normal, final-allowed, and rejected-charge states using the pinned SDK contract.
- Automate package/lockfile/Actor/Docker/Changelog version consistency and reject repository symbolic links during release verification.
- Harden internal regression CLIs with exact tenant/PR URL rules, bounded text/evidence, duplicate/pagination rejection, credential validation, and temporary-secret cleanup.
- Document canonical uppercase Jira Cloud key handling and require a separate OS/base-image CVE scan because npm auditing does not cover Alpine packages.
- Discover every organisation repository automatically by default, bracket the scan with deterministic list proofs, and retain the optional explicit list only as a strict change-control pin.
- Refuse to classify or charge an empty organisation as a healthy zero-evidence scan.
- Replace the impossible out-of-scope remediation that suggested partial repository selection with an action consistent with exhaustive discovery.
- Remove build-only npm/npx/yarn from the final image and start directly with Node, eliminating vulnerable unused package-manager dependencies reported by the image scan.
- Remove Alpine
apk, BusyBox/wget, /bin/sh, and the inherited shell entrypoint from the final image; run Node directly as numeric uid/gid 100:101.
- Reject oversized, repeated, or out-of-order GitHub pages and dot-segment repository names.
- Prevent Jira keys moved into a non-allowlisted project from entering JQL.
- Prevent non-critical logger failures from changing a persisted completed result into a failure.
- Collapse unknown internal error codes to
INTERNAL_ERROR and bound public diagnostic details to schema-safe primitive values.
- Disable dependency lifecycle scripts during production installation.
- Add a Docker-context allowlist matching the Apify upload boundary so direct builds cannot copy tests, research files, local storage, credentials, or host dependencies.
- Override the base image's multi-gigabyte Node heap default with a 160 MiB old-space and 32 KiB header ceiling for the 256 MiB Task.
- Keep runtime code and dependencies root-owned/read-only while granting the non-root process a dedicated mode-700 local storage directory.
- State the Jira issue-aggregate limitation for individual missing PRs.
- Clarify that custom PPE must not be combined with the synthetic Dataset-item event.
- Mark the Store release as public and free, with safe copyable input and readable result examples.
- Expanded the suite to 35 tests with 93.52% line, 85.11% branch, and 91.29% function coverage; the pinned numeric-non-root shellless production image is rebuilt and scanned from the exact release source.
- Verified all 185 installed production package signatures, 29 provenance attestations, permissive dependency licenses, zero known production dependency vulnerabilities, and no Grype findings in the final image at the Medium release gate.
- Field-level Input-page prefills, safe examples, help text, sections, and validation messages.
- Result-field descriptions and examples for completed, exception, incomplete, and failed outcomes.
- SSRF-resistant Jira tenant allowlisting, redirect rejection, bounded response bodies, and rate-limit precedence.
- PR text, timestamp, URL, run-volume, evidence-volume, and cursor validation.
- Recursive redaction of direct, encoded, Base64, auth-header, query, nested, and object-key secret forms.
SECURITY.md, OPERATIONS.md, automated repository verification, and expanded failure-mode tests.
- Persist
OUTPUT before requesting the billable completed-check Dataset event.
- Resolve Jira keys with bounded concurrency and pin the Node 24 container image by digest.
- Expanded automated coverage from 9 to 15 tests and documented the zero-human-delivery boundary.
- Unknown fields and implicit type/whitespace coercion now fail closed.
- Upstream error bodies are never parsed into public failures, and arbitrary successful responses are capped at 10 MiB.
- Jira API credentials can be sent only to first-party Jira Cloud origins.
- Private build 0.2.2 passed valid and fake-auth cloud runs, encrypted-input and exact-secret log checks, Dataset/
OUTPUT consistency, private-Actor/source-manifest checks, and enabled-schedule verification.
- Initial private Actor with exhaustive GitHub repository proof, GitHub/Jira pagination, missing/stale/renamed/access/scope classification, encrypted secret inputs, deterministic errors, PPE billing boundary, and unattended Task/schedule proof.
