Improvements to Error classification and Security upgrades

Release Notes — v1.9.2

✨ Improvements

• dediregistry error classification — registry lookup failures now return a *model.CodedErr whose code and HTTP status reflect the actual cause. Previously every failure was a bare error that NACKed as a generic 500. Closes #866 (#928).
  • Timeouts → NET_TIMEOUT (504).
  • DeDi unreachable, or 5xx/429 after retries → NET_DOWNSTREAM_UNAVAILABLE (503).
  • Unusable or oversized response → NET_DOWNSTREAM_INVALID_RESPONSE (502).
  • Subscriber not found → AUT_SUBSCRIBER_NOT_FOUND (401).
  • Missing signing key → AUT_KEY_NOT_FOUND (401).
  • Malformed keyId → AUT_SIGNATURE_INVALID (401).
  • Network not allowed → AUT_NETWORK_NOT_ALLOWED (401).
  • LookupNode, LookupRegistry and QueryByNetwork return NET_ENTITY_NOT_FOUND (404), CTX_MISSING_FIELD (400) or CTX_INVALID_FIELD (400) as appropriate.
  • Core is unchanged. Its existing NACK builder reports the registry's classification.

🔒 Security

• OpenTelemetry — bumped go.opentelemetry.io/otel and related packages to v1.46.0 (otlplog and sdk/log to v0.22.0, contrib runtime to v0.71.0), closing 4 Dependabot alerts (#930):
  • GHSA-8wmf-6v46-5gfg / CVE-2026-81870 — exporter config logging could leak endpoint URLs (alerts #22, #23, #24).
  • GHSA-w34q-cm8f-9c5x / CVE-2026-81871 — the log gRPC exporter ignored env TLS certs, bypassing mTLS and cert pinning (alert #21).
  • The otel log API changed between v0.19 and v0.22, so audit log emission call sites were updated to match.
• grpc-go — pinned to v1.83.2 to close GHSA-2v4p-qf9q-27wj / CVE-2026-84445 (High, alert #25) (#931).
  • The xDS DoS came in transitively as v1.84.0 via #930. A request missing :authority/Host could panic the xDS routing interceptor.
  • ONIX does not use xds.NewGRPCServer, so it was not exploitable.
  • go.mod now carries a "security floor" comment so a future broad bump doesn't reintroduce it before v1.85.0 stable.

📦 Dependencies

• Routine bumps pulled in alongside #930, including golang.org/x/crypto v0.57.0, x/net v0.59.0, x/sys v0.48.0, x/sync v0.23.0, prometheus/client_golang v1.24.1 and testify v1.12.1.

---

What's Changed

• feat(dediregistry): classify lookup failures onto error codes by cause (#866) by @nirmay in #928
• fix(deps): bump go.opentelemetry.io/otel to close 4 Dependabot alerts by @nirmay in #930
• fix(deps): pin grpc-go to v1.83.2 to close xDS DoS alert (High) by @nirmay in #931

Full Changelog: v1.9.1...v1.9.2

Refactor of reqmapper plugin, Security and other fixes.

Release Notes — v1.9.1

✨ New Features

• JSONata-based request mapper translator — introduced a new jsonatatranslator plugin, wired into the request mapper via an injected translator interface, and bundled into reqmapper builds ([#923](#923)).
• JSONata expression caching — compiled JSONata expressions are now cached, avoiding recompilation on every request.

🐛 Bug Fixes

• Catalog crawler: fixed an issue where a single bad network ID lookup would abort the entire poll tick; the crawler now skips the failing ID and continues ([#922](#922)).
• Dependencies: bumped grpc-go to v1.83.2 and amqp091-go to a patched version, addressing Dependabot alerts ([#926](#926), [#927](#927)).

🔧 Refactors

• Refactored the default translator and the reqmapper/translator interface for cleaner extensibility (part of #923).

---

What's Changed

• fix(catalogcrawler): don't abort entire poll tick on one bad network ID by @nirmay in #922
• fix(deps): bump amqp091-go and grpc-go to patched versions by @nirmay in #926
• fix(deps): bump grpc-go to v1.83.2 by @nirmay in #927
• refactor(reqmapper): migrate to translator plugin interface by @areebahmeddd in #923

Full Changelog: v1.9.0...v1.9.1

v1.9.0 Decentralised Catalog tooling

beckn-onix v1.9.0 (draft)

Milestone 1.9.0 - Aug 2026 — due 2026-08-31, 8/8 issues closed.
Range: v1.8.2..HEAD (91 commits, ~24 merged PRs).

Headline: Decentralized Catalog Publishing

The bulk of this release is a new catalog subsystem (pkg/catalog/*, plugins catalogpublisher and catalogcrawler) enabling DeDi-based decentralized catalog distribution:

• catalogpublisher — new plugin that diffs, signs, and versions a provider's catalog, writes a DeDi-published catalog index (with "latest" pointer, compaction/trim, gzip), and now verifies post-write that published files are actually fetchable and signature-valid (#916).
• catalogcrawler — new plugin that discovers providers via dediregistry, crawls manifest → index → catalog, with parked/abandoned-catalog revival, first-sync visibility, and a signed /crawl/status endpoint (#889, #900, #902, #912, #914).
• catalogstore — shared CatalogBlobStore plugin with a local-disk backend, consumed by both publisher and crawler.
• Handler layer generalized: the old catalogPublish-specific handler became a reusable EndpointHandler (#907), now also backing /crawl and /crawl/status.
• Added referential/business validation for incoming catalogs, beyond what schemav2validator covers (#905).
• Extracted a fetch-verify-decode package and a pure catalog domain package for reuse across crawler/publisher (#902).

Closes: #889, #890, #900, #902, #905, #907, plus follow-on work #912, #914, #916.

Fixes

• schemavalidator: fixed a crash on empty request body for GET/DELETE requests (#736).
• reqmapper: JSONata transform failures are now surfaced and classified as SCH_/BIZ_ error codes instead of opaque failures (#880).
• log: stopped dropping error attributes on slog Warn/Info/Debug records.
• dediregistry: tolerate double-encoded catalog_index_urls in metadata parsing.
• Several catalog-crawler hardening fixes: off-by-one and falsy-zero bugs in park/abandon budget accounting, dropped stale file-lineage version from /crawl/status.

Dependencies

• Bumped catalog-core module to v0.2.0 (pinned from an initial pseudo-version through v0.1.0).

Suggested tag

v1.9.0, tagging current main at f75f6f1.

Patch release with a validation fix and an internal error-model cleanup.

Fixes

• Reject Data Integrity proofs missing verificationMethod in the VC validator ([#895](#895)) — closes a gap where malformed/incomplete proofs could pass validation.

Internal / Refactors

• Collapsed the various coded error types into a single unified CodedErr ([#896](#896)) — continues the error-taxonomy consolidation work, simplifying error construction across the codebase.

New Contributors

• @skdas20 made their first contribution in [#895](#895) 🎉

Full Changelog: v1.8.1...v1.8.2

---

Note: [#896](#896) looks like the follow-up tracked in your #888 coded-error type collapse memory — worth confirming that ticket can be closed now.

What's Changed

• fix(vcvalidator): reject Data Integrity proof with no verificationMethod by @skdas20 in #895
• refactor(model): collapse coded error types into a single CodedErr by @areebahmeddd in #896

New Contributors

• @skdas20 made their first contribution in #895

Full Changelog: v1.8.1...v1.8.2

Beckn v2.0.0 Error Alignment & Build Traceability

Release Notes

✨ Features

• Align NACK error responses with Beckn v2.0.0 ErrorCode taxonomy (#887) — Reshapes model.Error to match the v2.0.0 spec: replaces the flat Error.Paths string with a structured Details{Path, Cause} object. Cause is included for forward compatibility (no call site populates it yet).
• Log adapter version at startup and expose it at runtime (#873, closes #808) — Adds a pkg/version package populated via -ldflags -X at build time (wired into install/setup.sh, both Dockerfiles, and CI). Version is now surfaced in three places: a startup log line, a build object on /health, and onix.build.* OTel resource attributes. Helps identify stale, mismatched, or locally-patched deployments.

🔒 Security Fixes

• Bump golang.org/x/crypto to v0.54.0 (#875, fixes #874) — Clears 13 Dependabot SSH-package CVEs (auth bypass, key-constraint bypass, deadlocks, DoS).
• Bump kin-openapi and grpc-go to patched versions (#892, fixes #891) — kin-openapi v0.137.0→v0.144.0 (critical auth-bypass in ValidationHandler.Load), grpc-go v1.80.0→v1.82.1 (xDS RBAC fail-open, HTTP/2 Rapid Reset DoS).

What's Changed

• fix: bump golang.org/x/crypto to v0.54.0, clear 13 Dependabot SSH CVEs by @nirmay in #875
• feat: log adapter version at startup and expose it at runtime (#808) by @nirmay in #873
• Align NACK error responses with Beckn v2.0.0 ErrorCode taxonomy by @nirmay in #887
• fix(deps): bump kin-openapi and grpc-go to patched versions by @nirmay in #892

Full Changelog: v1.8.0...v1.8.1

Version Mediation and VC Validation

v1.8.0 — Version Mediation and VC Validation

This release lands two new plugins — Schema version mediation and Verifiable Credential validation — plus a batch of correctness, security, and performance fixes across the routing and registry layers.

🆕 New Plugins

schemaversionmediator — network participants can now evolve their domain schemas independently, without coordinating a synchronized upgrade across the network. When a Consumer node and Provider node declare different schema versions in their node manifests, the mediator fetches JSONata translation artifacts from the network's artifact registry and rewrites the payload in-flight, so each side always receives data in the version it expects. Includes direction-aware manifest resolution (local for receivers, DeDi lookup for callers), single-pass composed translation, artifact caching, and data-loss detection on translated payloads. Ships as a mediateSchema step, paired with validateSchema in the handler pipeline. (#825, closing epics [#769](https://github.com/beckn/beckn-onix/issues/769)/[[#770](https://github.com/beckn/beckn-onix/issues/770)](https://github.com/beckn/beckn-onix/issues/770))

vcvalidator — verifies W3C Verifiable Credentials embedded in a request body before routing, rejecting non-conformant requests with a signed NACK. Supports did:key, did:jwk, and did:web issuer resolution, issuer/signer binding checks (with alg-confusion protection), validity-window checks, and revocation via StatusList2021/BitstringStatusList/DEDI. Previously ran as an out-of-tree plugin bundled into the DEG adapter image; this release upstreams it to build and ship like any other beckn-onix plugin. (#831)

🐛 Bug Fixes

• Registry / routing: Network-agnostic subscribers (e.g. catalog services) no longer fail spurious network-membership checks (#860); context.network_id is now validated against the caller's actual network memberships (#839).
• Schema validation: Extended schema validation no longer incorrectly skips core-schema checks (#854).
• Security: Bumped golang.org/x/net to v0.55.0 to close a DoS vulnerability (#856).
• Performance: ReverseProxy copy buffers are now pooled, cutting allocation churn on the hot request path (#853).

Quality and Security

• Added SECURITY.md with the project's vulnerability disclosure process (#847).
• Overall repository test coverage is now 80.0% of statements (aggregate across all tested packages) with over 800 testcases.
• Expanded unit test coverage across cache, otelsetup, signer, artifactverifier, and plugin/manager (#849, #850, #852, #857, #858).

---

What's Changed

• fix: validate context.network_id against caller network memberships by @nirmalnr in #839
• test: improve unit test coverage for pkg/beckndefaults by @areebahmeddd in #838
• fix(benchmarks): record core count, fix benchstat/report bugs, add v1.7.2 report by @nirmay in #842
• docs: add SECURITY.md by @nirmay in #847
• feat(plugin): add vcvalidator Verifiable Credential step by @ameetdesh in #831
• test(cache): increase unit test coverage by @areebahmeddd in #852
• fix(handler): pool ReverseProxy copy buffers to cut allocation churn by @nirmay in #853
• fix(deps): bump golang.org/x/net to v0.55.0 to fix DoS vulnerability by @nirmay in #856
• fix(schemav2validator): remove core-schema skip in extended schema validation by @nirmay in #854
• test(otelsetup): increase unit test coverage by @areebahmeddd in #850
• test(signer): increase unit test coverage by @areebahmeddd in #849
• test(artifactverifier): increase unit test coverage by @areebahmeddd in #857
• feat: schema version mediation — Epics #769 + #770 [preview] by @nirmay in #825
• test(plugin/manager): increase unit test coverage by @areebahmeddd in #858
• fix(dediregistry): exempt network-agnostic subscribers (e.g. catalog) from network membership checks by @nirmalnr in #860

New Contributors

• @areebahmeddd made their first contribution in #838

Full Changelog: v1.7.2...v1.8.0

Observability enhancements, Improved Clock skew tolerance

Release Notes

• fix(signvalidator): Clock-skew tolerance on the created field is now configurable, replacing the previous hardcoded threshold.
• feat(observability): Beckn signature headers (X-Gateway-Authorization, Authorization) are now captured in audit log records.
• feat(observability): ACK/NACK response bodies are emitted as a second audit log record, giving full request/response visibility per transaction.

What's Changed

• fix(signvalidator): apply configurable clock-skew tolerance to created field by @nirmay in #819
• feat(telemetry): capture Beckn signature headers in audit log records by @nirmay in #827
• feat(auditlog): emit ACK/NACK response body as second audit record by @nirmay in #828

Full Changelog: v1.7.1...v1.7.2

Auxiliary spec support, Improved reliability, security & signature hardening

beckn-onix v1.7.1 — Release Summary

Protocol Compliance

• Beckn spec v2 context aliases — senderId/receiverId and senderUri/receiverUri are now accepted as first-class context fields alongside the canonical names, easing migration for spec v2 deployments.
• Auxiliary spec support — the schema validator can now validate non-Beckn verbs and extended-verb deployments against auxiliary OpenAPI specs, making the adapter usable in hybrid and custom network configurations.

Security & Signature Hardening

• Ed25519 enforced — the signature validator now rejects any algorithm other than Ed25519, closing a downgrade path where a weaker algorithm could be substituted.
• Timestamp checks split — expiry and not-yet-valid checks are now distinct, giving clearer rejection reasons and preventing edge cases around clock skew handling.
• Subscriber identity cross-check — the signing subscriber ID is now verified against the request context, preventing a forged-sender attack where a valid signature from a different subscriber was accepted.
• Signed beckn-constants file — adapter configuration constants are now distributed as a cryptographically signed YAML file, preventing tampering with shared network configuration at rest.

Reliability & Performance

• Registry lookup caching — registry results are cached, eliminating redundant network calls on every request and reducing latency under load.
• Schema validator URI cache bypass — TTL-based schema reloads now correctly bypass the global kin-openapi URI cache, fixing stale schema serving after a reload interval.
• Domain allowlist validation strengthened — the schema validator's domain allowlist check is stricter, closing cases where malformed domain strings could slip through.

Housekeeping

• Manifest YAML fields and registry metadata keys migrated to camelCase for consistency.
• README updated to document all current plugins and added a key aspects section.

---

Contributors: @nirmay, @nirmalnr

What's Changed

• feat: support senderId/receiverId and senderUri/receiverUri as Beckn spec v2 context field aliases by @nirmay in #759
• fix(signvalidator): enforce ed25519 algorithm in signature validation by @nirmalnr in #757
• fix: migrate manifest YAML fields and registry metadata keys to camelCase by @nirmalnr in #761
• docs: update README — add missing plugins and key aspects section (#776) by @nirmay in #777
• feat(config): introduce signed beckn-constants file by @nirmay in #762
• fix: regenerate beckn-constants signing keypair after key loss by @nirmay in #781
• fix(ci): pull --rebase before push in sign-beckn-constants workflow by @nirmay in #782
• chore: add header comment to beckn-constants.yaml (workflow smoke test) by @nirmay in #783
• feat(schemav2validator): auxiliary spec support for non-Beckn and extended-verb deployments by @nirmay in #794
• fix(schemav2validator): bypass kin-openapi global URI cache for TTL reloads by @nirmalnr in #799
• fix: cache registry lookup results to prevent repeated network calls by @nirmalnr in #800
• fix(signvalidator): split timestamp check into distinct expiry/not-ye… by @nirmay in #803
• fix(schemav2validator): strengthen domain allowlist validation by @nirmalnr in #802
• fix(signvalidator): cross-check signing subscriber identity against request context by @nirmalnr in #807

Full Changelog: v1.7.0...v1.7.1

Protocol vLTS alignment, Payload Store & Routing Hardening

Overview

v1.7.0 is a significant feature and stability release. It introduces Beckn Protocol v2.0 support (AckSignature, AckNoCallback, ResponseStep interface), a new stateful payload recording plugin, role-specific observability stacks, and local schema support — alongside a focused round of bug fixes across caching, routing, schema validation, and signing.

---

New Features

Beckn Protocol v2.0 Support

• AckSignature (NFH-004) — Adapter now countersigns Ack responses per the proto-v2 spec, gated behind ProtocolVersion config. ([#685](#685))
• HTTP 202 AckNoCallback — Non-final-hop (NFH) responses now return 202 Accepted with an unsigned Ack body instead of a callback, replacing the earlier incorrect 409. ([#726](#726), [#738](#738))
• ResponseStep interface — New ResponseStep / ResponseStepContext abstraction decouples the response pipeline from raw *http.Response, enabling cleaner composability. ([#685](#685), [#729](#729))

Payload Store Plugin

• New payloadstore plugin records request/response payloads for audit, replay, and debugging. Documented in CONFIG.md. ([#716](#716), [#720](#720))

Local Schema Support

• Schema validator can now resolve schemas from a local path, removing the hard dependency on remote schema registries during development and offline deployments. ([#704](#704))

Observability — Response Pipeline Telemetry

• InstrumentedResponseStep wraps the response pipeline with OpenTelemetry spans, making callback latency and errors visible in traces. ([#730](#730))

DeDi Registry — Retry Config

• dediregistry now parses and applies retry configuration from the adapter YAML, improving resilience against transient registry failures. ([#686](#686))

---

Refactors & Improvements

• Network Observability stacks split — The monolithic docker-compose for network observability is split into role-specific stacks (BAP/BPP), reducing noise and making per-role deployment practical. ([#715](#715))
• reqMapper promoted to a dedicated step — Request mapping is no longer a plugin side-effect; it is a first-class pipeline step, making execution order explicit and testable. ([#731](#731))
• dediregistry config cleanup — registryName config key removed; wildcard lookup is now hardcoded as a constant. ([#725](#725))
• opapolicychecker cleanup — Removed redundant networkID return from selectedPolicy; dropped the actions allowlist and extractActionFromPath logic; snake_case enforcer test added. ([#708](#708), [#754](#754))
• Policy checker README reformatted for readability. ([#710](#710))

---

Migration Notes

• simplekeymanager config — Rename networkParticipant → subscriberId in your adapter YAML before upgrading.
• dediregistry config — Remove any registryName key; it is no longer read.
• reqMapper — If you were relying on reqMapper as a plugin in the plugin pipeline, update your config to use it as a step instead. See [#731](#731) for the new config shape.
• Proto-v2 gating — AckSignature and AckNoCallback are activated by setting protocolVersion: v2 in your adapter config. Existing v1 deployments are unaffected.

---

New Contributors

Welcome to the project!

• @abhey-WIL — local schema support ([#704](#704)) and reqMapper step promotion ([#731](#731))
• @riteshkparouha-cyber — policy checker documentation ([#710](#710))

---

What's Changed

• fix(config): update registry URL and key manager configuration for example configs by @nirmalnr in #703
• fix(simplekeymanager): rename networkParticipant config key to subscriberId by @nirmay in #705
• Feat/local schema support by @abhey-WIL in #704
• Parse DeDi registry retry config by @Tomeshwari-02 in #686
• refactor(opapolicychecker): drop redundant networkID return from selectedPolicy, add snake_case enforcer test, clarify no-camelCase comments by @nirmalnr in #708
• refactor(network-observability): split monolithic compose into role-specific stacks by @nirmay in #715
• feat(payloadstore): add stateful payload recording plugin by @nirmalnr in #716
• refactor: updated readme for policy checker for better formatting by @riteshkparouha-cyber in #710
• docs(config): add payloadstore plugin to CONFIG.md and fix plugin numbering by @nirmalnr in #720
• feat(proto-v2): AckSignature (NFH-004), ResponseStep interface, ProtocolVersion gating by @nirmay in #685
• fix(cache): cache.Get returns ("", nil) on miss instead of leaking redis.Nil by @nirmalnr in #723
• fix(tests): resolve flaky/failing unit tests across cache, router, and otelsetup packages by @nirmalnr in #721
• refactor(dediregistry): remove registryName config and hardcode wildcard constant by @nirmalnr in #725
• refactor(definition): replace *http.Response in ResponseStep with ResponseStepContext by @nirmay in #729
• feat(proto-v2): HTTP 409 AckNoCallback response type (#680) by @nirmay in #726
• feat(observability): add InstrumentedResponseStep for response pipeline telemetry by @nirmay in #730
• fix(manifestloader): resolve cache-miss log noise and Redis fault tolerance by @nirmalnr in #732
• feat: made reqMapper a dedicated step instead of a plugin by @abhey-WIL in #731
• fix(proto-v2): change AckNoCallback HTTP status from 409 to 202 by @nirmay in #738
• fix(schemav2validator): support GET/DELETE bodyless requests by @nirmay in #739
• fix(router): support compound action paths and bodyless requests by @nirmay in #743
• fix(reqpreprocessor): pass through bodyless GET/DELETE requests without 400 by @nirmay in #746
• fix: strip module base path in step layer before plugin URL lookup by @nirmay in #747
• fix(schemav2validator): reject empty-body POST before schema validation by @nirmay in #750
• fix(opapolicychecker): remove actions allowlist and extractActionFromPath by @nirmalnr in #754
• fix(handler): use 4-line signing string for solicited callbacks (#752) by @nirmay in #756

New Contributors

• @abhey-WIL made their first contribution in #704
• @riteshkparouha-cyber made their first contribution in #710

Full Changelog: v1.6.0...v1.7.0

Trusted Policy validation, Network Observability & Benchmarking

Executive Release Notes Summary

Beckn-ONIX v1.6.0 delivers significant advances in decentralized trust infrastructure, network observability, and policy enforcement — making it substantially easier to operate, monitor, and govern Beckn networks at scale.

Decentralized Identity (DeDi) Manifest Integration
Network policy manifests can now be loaded directly from the DeDi registry, with built-in caching and cryptographic artifact verification. OPA network policies are backed by these manifests, closing the loop between network governance and runtime policy enforcement — no manual policy distribution required.

Network-Scoped Policy Enforcement
The OPA policy checker now supports per-network policy configurations, allowing operators to define and enforce distinct rules for each network alongside a global baseline. Artifact verification (detached signatures) is supported for both single-file and manifest-backed policies.

DeDi Registry: Network ID Allowlisting
The DeDi registry plugin now enforces a configurable allowlist of permitted network IDs, strengthening network membership validation and preventing unauthorized network participation.

Unified Audit & Observability Pipeline
A new single-pass audit log pipeline provides PII masking and configurable field selection, with Loki OTLP ingestion for structured log aggregation. Plugin-level observability is expanded: the onix_plugin_info gauge now reports loaded plugins per module, and the network observability dashboard includes a Node Plugin Manifest view.

Schema Validation: OpenAPI 3.1 Support
The schema validator correctly reads the native const field in OpenAPI 3.1 schemas, improving compatibility for networks using the latest specification.

Security
Critical and high-severity CVEs in adapter image dependencies have been resolved.

Benchmarking Infrastructure
A new automated benchmarking suite generates performance reports with interpreted recommendations, supporting ongoing performance regression tracking.

Notable Bug Fixes
Eliminated sync.Once race conditions across metrics and audit log providers; standardised observability attribute naming; corrected schema location to the LTS-tagged URL.

What's Changed

• Add network ID allowlist support to DeDi registry plugin by @nirmalnr in #641
• fix(schemav2validator): conditionally strip @context/type based on s… by @nirmay in #646
• [Benchmark] End-to-end performance benchmark suite for the beckn-onix adapter by @nirmay in #650
• fix(schemav2validator): update schema location to LTS tagged URL by @nirmay in #654
• fix(#659): remove benchstat tool dep, restore go 1.24.6-compatible x/… by @nirmay in #660
• fix: remove sync.Once race and fix nil guard on log provider by @nirmay in #656
• feat(#604): unified audit pipeline with PII masking and field selection by @nirmay in #662
• feat(#652): emit onix_plugin_info gauge for loaded plugins per module by @nirmay in #665
• docs: update config.MD guidance to explain allowed network IDs by @nirmalnr in #668
• fix(#657): standardise parent_id attribute name and clarify network collector comment by @nirmay in #669
• OPA policy checker: add network policy config and signature verification by @nirmalnr in #661
• fix(observability): use Beckn context.action for request metric label by @SurbhiAgarwal1 in #670
• test(observability): remove unused expectedAction field from ServeHTTP test by @nirmay in #693
• docs(observability): add OBSERVABILITY.md and update SETUP.md by @nirmay in #695
• Remove dead legacy registry client by @Tomeshwari-02 in #674
• fix(security): resolve critical/high CVEs in adapter image dependencies by @nirmay in #698
• fix(schemav2validator): read native Const field for OpenAPI 3.1 action extraction by @ameetdesh in #700
• fix(observability): downgrade disabled-audit log from WARN to DEBUG by @nirmay in #699
• Add DeDi-backed manifest loading and manifest-backed OPA network policies by @nirmalnr in #688

New Contributors

• @SurbhiAgarwal1 made their first contribution in #670
• @Tomeshwari-02 made their first contribution in #674
• @ameetdesh made their first contribution in #700

Full Changelog: v1.5.0...v1.6.0