[strukturpiloten-release-plz]

🤖 New release

• boxferry-model: 0.9.0 -> 0.10.0 (✓ API compatible changes)
• boxferry-engine: 0.9.0 -> 0.10.0 (✓ API compatible changes)
• boxferry-compose: 0.9.0 -> 0.10.0 (✓ API compatible changes)
• boxferry-podman: 0.9.0 -> 0.10.0 (✓ API compatible changes)
• boxferry-quadlet: 0.9.0 -> 0.10.0 (✓ API compatible changes)
• boxferry: 0.9.0 -> 0.10.0 (✓ API compatible changes)

Changelog

boxferry

0.10.0 - 2026-10-25

Changed

• Preserve sensitivity on interpolated Compose container names so protected identities remain
  guarded during target planning and reporting.

• Preserve explicit public Podman volume runtime names consistently in declarations and named
  mounts, retaining external ownership and refusing protected names, collisions, and undeclared
  logical references under every loss policy
  (#467).

• [breaking] Require Rust 1.98.1 across BoxFerry and the Lens repositories, replacing the
  Rust 1.85 minimum. Update diagnostic-bundle ZIP generation to the advisory-fixed 9.0.3 line,
  without enabling extraction or changing archive privacy and size limits
  (#455).

• Preserve explicit runtime network names during Compose export without assigning the
  observed-name fallback twice; retain protected-name refusal and ownership diagnostics
  (#436).

• Reconcile Supabase and Observability live reimport contracts with protected
  service-alias refusal: retain every route and runtime probe, and record the
  affected Quadlet-to-Compose cells as known migration gaps rather than successes.

• Clarify Compose unsupported-output remediation: protected service aliases block
  every loss policy; partial omission applies only when a candidate exists.

• Extend the default Quadlet target range through 6.1.2, matching QuadletLens evidence while
  retaining the separate 6.1.0 Podman deployment target (#335).

• Consume ComposeLens 0.3.4, PodmanLens 0.2.5, and QuadletLens 0.2.4; preserve generated
  Compose strings containing YAML separation characters and service/environment associations in
  application definitions such as Appwrite. Refresh active upstream Podman test lanes to 5.8.7 and
  6.1.2 in both root modes, while retaining historical captures and the separate
  exact Podman rendering boundary (#340).

• Infer the neutral application name from one Quadlet unit filename on convert and validate;
  require --application-name for multiple units while retaining explicit overrides (#338).

• Discover a sole conventional Compose document from the current directory on convert and
  validate when no input selector is supplied; reject collisions and unsafe candidates, and
  report the selected document without reading .env (#337).

• [breaking] Reconstruct reviewed portable Podman application settings and named-resource
  relationships by default at the CLI, with --podman-import-policy conservative for evidence-only
  import. Keep exact loss policy and separate privacy authorization; report source reconstruction
  separately from target conversion loss (#332).

• [breaking] Select one unambiguous local Podman application without a selector, offer bounded
  terminal choices for ambiguous inventories, and show the chosen connection and graph before
  output. Compose-label groups require explicit consent; label values no longer determine the
  default output name, so use --application-name when that name matters
  (#333).

• [breaking] Withhold literal environment values from generated artifacts by default, require explicit --environment-values include for Compose and Quadlet output, and separate Podman value acquisition from effective-setting promotion. Protected inline Podman output remains blocked until PodmanLens provides a safe renderer (#334).

• Add bounded Immich 3.1.0 CPU-only migration acceptance with deterministic PNG upload,
  metadata and derivative processing, persistence, privacy, resource-budget evidence, and an
  independently reviewed sanitizer-v3 native acquisition replay
  (#136).

• Add bounded Paperless-ngx live migration acceptance with real PDF, DOCX, and ODT processing,
  search, converter, persistence, privacy, and resource-budget evidence (#135).

Fixed

• Preserve explicit public Podman container runtime names in create/start artifacts, pod membership,
  and dependency ordering while retaining logical service identities. Refuse protected or invalid
  names, target collisions, and undeclared logical references under every loss policy
  (#474).

• Accept bare relative --report-file paths in the current directory while retaining
  existing-parent validation and create-new, non-overwriting report writes
  (#472).

• Preserve Compose service-network aliases' native per-scalar sensitivity: retain public aliases
  without taint from protected siblings, keep sensitive substitutions protected, and fail closed when
  native metadata cannot be corroborated. Refuse the entire Compose candidate for protected aliases
  in service network attachments under every loss policy instead of losing confidentiality after
  fresh text reload; successful protected-service-alias Compose export is no longer supported.
  Group-network aliases remain unrendered under the existing unsupported/partial-loss contract
  (#432).

• Preserve explicitly promoted typed Podman network aliases through every exporter and require
  Supabase Realtime tenant DNS plus acknowledged PostgreSQL subscriptions before accepting live
  readiness (#231).

---

This PR was generated with release-plz.