## Read this before upgrading

Upgrade steps, behaviour changes and known issues for each release:
**https://docs.gen0sec.com/docs/cerebellum/reference/changelog**

That page is published separately from this tag, so the entry for `v0.2.0`
may appear a short while after these artifacts do.

**Do not apply this release until that entry is published.** Until it is,
any behaviour change or required upgrade action for this version is
undocumented, and nothing here tells you whether there is one.

---

## What's Changed
* fix(ingress): make --set entrypointHost actually work (CBL-67)
* fix(ingress): make --set externalScheme actually work
* chore(rules-validator): wirefilter 0.7.5, accept regex_replace in waf rules
* chore(rules-validator): restore the documented emit_scheme command
* chore(rules-validator): regenerate the waf scheme for http.request.raw_path
* feat: sync hosted UI to cerebellum
* Deploy the dashboard UI to Kubernetes in SaaS mode
* fix(telemetry-api): fill block-event geo from the event's own fields
* feat: invite role selection CBL-60
* feat: tables for plan limits
* Remove datadog from the UI
* fix(fleet-ban-publisher): publish fleet-bans as JSONL in the agent's wire schema
* Raise the L1 cache TTL to 30s and make it configurable
* update next.js version to the latest
* fix(ui): enforce the pnpm-workspace security overrides and clear pnpm audit
* release: v0.1.2, fix better-auth security risk
* Create SECURITY.md for security policy
* fix(go): update dependencies with known vulnerabilities
* ci: run every job on Ubicloud runners
* Update better-auth to 1.7.7, fix security risk
* chore(deps): bump the npm_and_yarn group across 3 directories with 6 updates[bot]
* ci: don't fail a build when its layer-cache export fails
* fix(migrations): make the passkey, issuer and audit-log grant migrations SaaS-safe
* fix(telemetry-api): accept fleet_ban as a block event source
* fix(schema): join waf_rules_switcher on its own foreign-key column
* fix(telemetry-api): store a kernel drop as an access-rules drop
* fix(ui): stop new orgs landing on /<id>/undefined/onboarding (404)
* fix(charts): derive BETTER_AUTH_URL from entrypointHost, refuse to render without a host