v0.1.25.20 — from/to ISO-8601 window filter on listReservations (rolls up .19 Tomcat hygiene)

v0.1.25.20 — from / to ISO-8601 window filter on listReservations

Rolls up v0.1.25.19 (Tomcat 10.1.55 CVE hygiene) and v0.1.25.20 (the feature) into a single release, following the precedent set by v0.1.25.15 (which rolled up v0.1.25.14) and v0.1.25.17 (which rolled up v0.1.25.16).

Feature: from / to time-window filter on GET /v1/reservations

Implements cycles-protocol-v0.yaml revision 2026-05-21 and closes #159 via #160.

• Two new optional query parameters: from and to, both string format: date-time (ISO 8601), both inclusive bounds on the reservation's created_at_ms. Either may be supplied alone (open interval) or together (closed window). The filter always binds to created_at_ms regardless of sort_by, so sort_by=expires_at_ms&from=…&to=… returns reservations created in the window, ordered by expiry.
• Implemented in both the legacy SCAN-cursor path and the sorted path.
• FilterHasher.hash(...) folds fromMs/toMs into the sorted-path cursor's canonical hash with gated emission (only when at least one bound is non-null), preserving v0.1.25.18 cursor back-compat byte-exactly when callers don't send the new params. Locked down by FilterHasherTest.preservesPreWindowHashWhenBothBoundsNull (golden hash 2f397ea0e8fb53b7).
• Validation: malformed values → 400 INVALID_REQUEST; from > to → 400 before any repository call; blank strings treated as unset; missing/unparseable created_at rows defensively excluded when either bound is supplied.
• Naming matches the family-wide from/to + format: date-time convention already in use on listAuditLogs, listEvents, listWebhookDeliveries, listTenantEvents, and listTenantWebhookDeliveries.

Security: Tomcat 10.1.55 (rolled up from v0.1.25.19, #161)

Re-pinned <tomcat.version>10.1.55</tomcat.version> to close seven CVEs flagged by Trivy against org.apache.tomcat.embed:tomcat-embed-core 10.1.54 (the version Spring Boot 3.5.14's BOM manages today):

Severity	CVE	Fixed in
CRITICAL	CVE-2026-43512	10.1.55 / 11.0.22
CRITICAL	CVE-2026-43515	10.1.55 / 11.0.22
CRITICAL	CVE-2026-41293	10.1.55 / 11.0.22
HIGH	CVE-2026-43513	10.1.55 / 11.0.22
HIGH	CVE-2026-42498	10.1.55 / 11.0.22
HIGH	CVE-2026-41284	10.1.55 / 11.0.22
LOW	CVE-2026-43514	10.1.55 / 11.0.22

The override is removable once Spring Boot ships a release whose BOM manages 10.1.55+.

Wire compatibility

Purely additive at the wire level. Clients that don't send from / to get exactly the v0.1.25.18 response byte-for-byte (including sorted-path cursors mid-pagination — the gated-emission canonical form preserves the v0.1.25.12 8-field hash byte-exactly when neither bound is supplied). Older runtime clients silently ignore the new params per the additive-parameter guarantee in cycles-protocol-v0.yaml.

Client SDK releases (companion artifacts)

All four reference clients have matching releases landing now:

• runcycles (Python) 0.4.2 — runcycles/cycles-client-python#66
• runcycles (TypeScript) 0.3.2 — runcycles/cycles-client-typescript#103
• runcycles (Rust) 0.2.5 — runcycles/cycles-client-rust#39
• cycles-client-java-spring (Spring Boot starter) 0.2.3 — runcycles/cycles-spring-boot-starter#78

Verification

• 538 protocol-service tests pass (375 data + 163 api), 95% JaCoCo bundle gate met.
• Container scan green against the locally-built v0.1.25.20 image (Trivy HIGH/CRITICAL count: 0 after the 10.1.55 pin).
• End-to-end smoke test against docker compose up v0.1.25.20: all validation paths (malformed → 400, reversed → 400) and all happy-path combinations (from-only, to-only, both, equal-bounds, sort_by=expires_at_ms independence, blank-as-unset, legacy SCAN cursor + active filter) confirmed.

Follow-up

runcycles/cycles-server#162 — feature suggestion for expires_from/expires_to and finalized_from/finalized_to window filters to support cleanup-of-expired-reservations workflows (out of scope for v0.1.25.20).