## slothflowlabs/duckle — v0.7.2…v0.7.3

_63 commits._

### Features
- **feat(xsd): add audited contract acceptance command (#342)** (5f2749f)
- **feat(sequence): a full snapshot opens a new epoch (#326 AC5)** (3489ebb)
- **feat(connectors): Manticore Search source and sink** (f70b25b)
- **feat(transforms): expand nested objects on Explode and Flatten** (a1292b6)
- **feat(geo): spatial sort on the Geospatial sink, and offer parquet in its file dialog** (b2c0a2c)

### Fixes
- **fix(materialize): rebuild a lost publication event without resurrecting a pruned one** (a37ae74)
- **perf(retention): ask whether an asset declares freshness once, not once per event** (d4fec86)
- **fix(retention): report the ledger prune that happened, not the one planned** (f175786)
- **fix(engine): serialise the delivery ledger, all three writers** (d670314)
- **fix(engine): a cancelled backfill stays cancelled** (bd1234c)
- **fix(engine): serialise accepting an XSD contract, and name the workspace** (b4f5f9b)
- **fix(engine): read the artifact view with the credentials, not without them** (269d265)
- **fix(engine): refuse a DuckDB dot-command before it reaches the CLI** (b527d30)
- **fix(engine): the per-stage executor stops putting credentials in argv** (635e297)
- **fix(retry,retention): a receipt survives what still names it, and its own run** (b9499fd)
- **fix(retention): keep the record that says a publication was already consumed** (273054e)
- **fix(sequence,xsd): the newest ledger decides, and xsd accept takes the paths the store holds** (1135fd6)
- **fix(policy): block extension downloads in restricted runs (#341)** (81d474b)
- **fix(xsd): a schema path with a space stopped fail mode refusing anything** (1610a56)
- **fix(params): a run parameter is a value, in SQL as well as in a shell** (2a8c087)
- **fix(console): the rebinding guard covers reads, not just writes** (0aea186)
- **fix(artifact): the extraction cache is per user, and reuse is checked** (4516c0e)
- **fix(console): claiming an exposed console needs the code it printed** (e3d7b7d)
- **fix(runlock): an artifact run takes the lock a run takes** (e002fcd)
- **fix(runlock): a follower and a manual fire take the lock a run takes** (9b43341)
- **fix(retention): keep the publication a freshness SLA still reads** (0f54d9d)
- **fix(secrets): redact a context secret by where it came from, not where it landed** (42cf797)
- **fix(archive): read a backslash as a path separator in a member name** (f7ad8a2)
- **fix(runlock): a run someone asks for takes the same lock a scheduled run takes** (c928dd6)
- **fix(test): resolve a tested pipeline the way a run resolves it** (470260a)
- **fix(drift): read the real source, not a placeholder** (82dbaa3)
- **fix(backfill): let a slice resolve saved connection references** (630c290)
- **fix(backfill): resolve env and vault placeholders before a slice runs** (a6199f4)
- **fix(mcp): resolve ${workspace} for a run started over MCP** (afe7bb1)
- **fix(retry): refuse to repeat a file operation or a shell command** (69db442)
- **fix(serve): a manual run that panics still reports an outcome** (4119516)
- **fix(map): cast each Visual Mapper output to the type it declares** (2930c16)
- **fix(serve): keep the scheduler tick responsive, and clear its busy marks on a panic** (9485f49)
- **fix(excel): call the quick-xml method that replaced the deprecated one** (afa6248)

### Backend
- **release: v0.7.3** (088dd96)
- **deps: zstd 0.14, suppaftp 11, wasmi 2.0, boa_engine 0.22** (3a5a2a0)
- **deps: argon2 0.6, with the stored hashes proved to survive it** (77f7d77)

### Tests
- **test(alerts): assert the state file is absent, not merely unanswerable** (53d4e2e)
- **test(engine): stop a leaked policy from hanging the suite, and bound every accept** (0c04a36)
- **test(policy): cover batched extension installs (#346)** (a760fff)
- **test(policy): clear the policy env on the way in, not only on the way out** (eadcf4c)
- **test(lance): round-trip a Parquet file through the vortex subcommands** (87eca8b)

### Docs
- **docs(transforms): say which of Explode and Flatten takes a list and which takes a struct** (579bda7)
- **docs(deps): say why arrow, parquet, lancedb and vortex are pinned where they are** (44d9f0d)
- **docs: align the v0.7.2 notes in the README and on the site with the release** (68fbf0f)

### Chore
- **chore(deps): take rustls to 0.23.45 for RUSTSEC-2026-0285** (69244ec)
- **ci: pull MinIO images from Quay after Docker Hub removal (#347)** (6c0ce08)
- **chore(deps): bump lancedb in the cargo-major group across 1 directory (#345)** (0b82e3b)
- **chore(deps): bump the cargo-safe group with 3 updates (#344)** (14b04da)
- **chore(deps): bump the npm-safe group in /frontend with 2 updates (#343)** (59263ca)
- **chore(deps): stop proposing the arrow major and vortex** (21c3cb7)
- **chore(deps): bump the cargo-safe group across 1 directory with 14 updates (#338)** (038b109)
- **chore(deps): bump the npm-safe group across 1 directory with 14 updates (#336)** (273c67a)
- **build(deps): hold lopdf at the version pdf-extract parses with** (cd47d60)
- **ci: check the LanceDB sidecar when its dependencies change** (0615806)
- **chore(deps): bump actions/attest-build-provenance (#334)** (d2e5919)
- **chore(packaging): Arch packages to 0.7.2** (891504f)
- **ci(release): install the ODBC deps the capability registry job needs** (523b62e)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/slothflowlabs/duckle?utm_source=github-action)._