Release 1.0.8

• Disables UserDetailsServiceAutoConfiguration (#594)
• Add random key padding (#609 & #612)

Release 1.0.7

• Adjusting logger statement to prevent log forging (#583)

Release 1.0.6

• Update log level for invalid TAN syntax check (#553)
• Fix fake delay updates (#570)
• Final adjustments for risk score configuration params based on RKI (#576)

This is the release version used for the Go-Live.

Release Candidate - Patch 5

• Updated timestamp format in log entries (#566)
• Fix connection pool size configuration (#561)
• Fix batch counter concurrency issue (#551)
• Restrict allowed actuator routes (#540)
• Enabling roles also for local development & docker setup (#552)

Release Candidate - Patch 4

• Readjust version config for android app

Release Candidate - Patch 3

• Add TLS Ciphers compliant to BSI-TR-02102-2
• Readjust version config for android app

Release Candidate - Patch 2

• Add CSP header
• Remove use of ForkJoinPool in SubmissionController
• Fix http client connection pool size
• Adjust version config for android app
• Add hostname verification by setting the "ssl-client-verification-verify-hostname" profile

Release Candidate - Patch 1

• Prometheus endpoints adhere to micrometer naming conventions
• Mitigate CVE-2020-13692

Release Candidate

• SSL certificate validation for postgres connection
• Adding mutual SSL between submission and verification
• 16MB threshold for exposure key files
• Higher S3 resilience - distribution fails after 5 unsuccessful operations
• Fixing OpenAPI specification
• Adding application logic monitoring to the prometheus endpoints.
• Switch from e-Tag to CWA-Hash
• Tolerate gaps in submission payload
• Squashing migrations

Beta Patch 10

• Removes the android package identifiers from the signature info as a workaround due to a bug on Android (once a patch arrives this will be reverted)