1.28.3 (2026-10-19)

Bug Fixes

• catalog: answer a duplicate slug with 409, not 500 (bf29969)
• catalog: answer a model PATCH with the model's images (50d7c08)
• catalog: keep a model on its own product line's firmware stream [needs product decision] (a8e7211)
• catalog: publish the model event when the firmware-policy tool clears a pin (7809ea1)
• catalog: refuse an unknown parent on a pre-hierarchy stream with 400 (b10e31e)
• config: let a plain-name variable beat its section form and config files (bb42fd5)
• consumers: bound every ack, nack and reject, and reconnect when one hangs (e5bd76f)
• consumers: compare a delivery's user_id exactly as the broker stamped it (dfe3c35)
• consumers: refuse a serial Postgres cannot store instead of retrying it (e315067)
• devices: answer an offset past i64::MAX instead of panicking (dc1a799)
• devices: keep a tenant's own devices in its organisation expansion (0b67d7b)
• devices: let a stock device take any catalog model [needs product decision] (e42b074)
• docs: send the docs page's script tag with ordinary quotes (169e7f4)
• events: leave name out of a held device's device.upsert, not null (53758b7)
• images: count alt-text characters, not bytes (b161cca)
• images: keep the S3 error code, request id and key in storage errors (23f4c3f)
• images: store a focal point only once its renditions are rendered (b2ac6b8)
• images: write re-uploads to new keys and clean up failed uploads (2ffc6a2), closes #19 #20
• outbox: cut a failure reason on a character boundary (3f4f681)
• pending: answer a review-list offset past i64::MAX instead of panicking (52c31f6), closes #14
• rabbitmq: mask the whole userinfo in the logged broker URL (10a3bb5)
• reconcile: strip a byte order mark from the manifest (98e61df)
• security: keep the database password out of connection errors (3c63933)
• security: keep the database password out of the CLIs' connection errors (cd87aa3)
• setup: approve a pending charge point once under overlapping requests (42746a7)
• sync: answer a page past i64::MAX rows instead of panicking (d617e61)
• tenant-changes: require the checked holder in the guarded write (930ecaf)