View source for TracCloud: Release Notes for 2026-07

Release Notes — Nicolas Corder

Cycle: post-1.3.37 → 1.4.x (TracCloud) · Trac Engine develop · June–July 2026

==TracCloud (application layer)==

====Event & Observability Platform (headline work)====

* Built out a first-class telemetry system so every meaningful action in the app emits a structured, auditable event.
* New app-namespaced event-source taxonomy and a fleshed-out event() API, adopted across the app procs, helpers, and the src/App domain layer.
* Audit telemetry now covers logins and sensitive user actions end to end.
* Delivery upgraded to the latest AWS EventBridge features, with the ability to buffer events through SQS / Beanstalk for throughput and reliability under load.
* Navigate360 (EAB) integration: new Navigate360 API client, wired to the eab_visit_export cron for automated visit export.

====Security & Compliance====

* Credential redaction across traces/telemetry via PHP #[\SensitiveParameter] — secrets no longer leak into logs or error reporting.
* Resolved third-party licensing issues (password-strength manager) and fixed the license-scan CI job cloning an incomplete project.

====Performance — Caching====

* Asset-serving endpoints now send proper Cache-Control (the proc_cache_headers work) so QR codes, campus logos, resource images, photos, and reference PDFs are cacheable at appropriate public/private TTLs.
* More aggressive file caching for reusable static content.

====Platform — PHP 8.5 Upgrade====

* Moved deployments to PHP 8.5; cleared deprecation-driven build failures (case-statement semicolons, $http_response_header, nullable types, tracLoadForm false/array handling). Docs updated to match.

====Documentation====

* Introduced LLM-assisted documentation generation and synced the doc corpus, including a consolidated security-findings summary.

==Trac Engine (core framework — submodule)==

====Logging & Telemetry Infrastructure====

* New buffered Valkey log driver: pipelined XADD, shared TLS connection with token-refresh on AUTH failure, MAXLEN ~500k trimming, and drop-on-failure safety so logging never blocks a request.
* App logs buffered and flushed in a single XADD after fastcgi_finish_request (zero added request latency).
* Non-blocking CloudWatch event logging via async putLogEvents with a shutdown settle; EventBus/EventBridge client reused per request on the direct path.
* Repaired CloudWatch stream recovery and added request-log redaction.

====Event System Core====

* Completed the engine-side event system: expanded event taxonomy with new domain enums, actor() helper, Event::toEnvelope(), and a RedisBuffer enqueue path (with surfaced connect/read-timeout failures).
* EventBridge client + event functions, cron events, campus-code enrichment, and environment-scoped EventBridge source names.

====Rate Limiting====

* New Rate Limiter module with an EventBridge event on the rate-limit handler.

====Microsoft Graph Integration====

* Delegated /me email + calendar sending via a SwiftMailer transport (feature-toggle gated).

====Security====

* Path-traversal fix in emailTemp asset serving.
* Credential redaction via SensitiveParameter; security library updates.

====Reliability & Compatibility====

* Event buffering to Beanstalk/SQS for throughput.
* URL versioning toggle for pushResource (cache-busting control); PHP nullable-deprecation cleanups.

__NOTOC__