# ForgeFlow 0.4.0 release notes

## Scrollable change list

The changed-file panel now has an independent bounded vertical scroll area. Large commits no longer make lower files unreachable.

## Commit readiness

The action panel now labels the commit message as required and displays the exact reason why commit actions are disabled. Selected files are staged automatically during commit; manual staging remains available as an optional index-review step.

## ITWorx.tech branding

The supplied ITWorx.tech logo is integrated into the title bar, first-run setup and application icons.

## Built-in source updater

ForgeFlow can check the configured private Gitea repository, defaulting to `Jens/ForgeFlow` on `main`.

The updater:

- reads the remote `package.json` at an exact branch commit;
- compares semantic versions;
- downloads an authenticated exact-SHA archive;
- verifies a SHA-256 checksum;
- closes ForgeFlow;
- backs up the current source;
- installs dependencies;
- runs the complete quality gate;
- restores the previous source when validation fails;
- restarts ForgeFlow.

## SSH / Unraid deployment

A server can be configured once with hostname, SSH port, username, encrypted credentials and `/mnt/user/appdata` as base path.

Deployment profiles support:

- existing Git-backed application folders;
- automatic new folder creation;
- exact commit verification;
- pinned SSH host identity;
- existing or generated Compose configuration;
- host and container ports;
- Unraid Web UI and icon labels;
- server-folder mapping;
- tracked-change blocking;
- nested-Git warnings;
- runtime-data preservation;
- rollback to the previous SHA.

## LumaOps audit

The supplied server and Gitea roots both match commit `d42d4a7f08240c478d07466e3fabec654dc71367`. The root Git checkout and Compose file should remain. A stale nested `source/` Git checkout is documented for controlled cleanup.

## Validation

ForgeFlow 0.4.0 has 59 passing automated tests, including real temporary Git remotes, update exact-SHA checks, SSH path safety, renderer workflow contracts, diagnostics redaction, exact previous-SHA rollback enforcement and deployment controls.