release: 1.0.0-alpha.3 (formula-sandbox opt-out + CI fix)

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -30,7 +30,7 @@ body:
     id: version
     attributes:
       label: FlowMeter version
-      placeholder: "1.0.0-alpha.2"
+      placeholder: "1.0.0-alpha.3"
     validations:
       required: true
   - type: dropdown

CHANGELOG.md

@@ -5,6 +5,21 @@ All notable changes to FlowMeter are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.0-alpha.3] — 2026-06-22
+
+### Added
+- **Opt-out for the formula sandbox.** A new **Allow unsafe formulas** setting
+  (Settings ▸ Security) lets you disable formula safety so trusted templates with
+  non-whitelisted formulas can be imported, saved, and rendered. It is **off by
+  default**, persisted locally, and mirrored to the backend on startup. When an
+  import is blocked, an **"Enable unsafe formulas & retry"** prompt offers to turn
+  it on and re-run the import. Exposed at runtime via `GET`/`PUT
+  /api/v1/settings/security`, seeded by the `ALLOW_UNSAFE_FORMULAS` setting.
+
+### Fixed
+- **Startup sync no longer crashes the app under test mocks.** The formula-safety
+  preference is read from `localStorage` on startup instead of the store.
+
 ## [1.0.0-alpha.2] — 2026-06-14
 
 ### Fixed
@@ -47,5 +62,6 @@ a FastAPI backend and a React/Vite frontend packaged as a single executable.
   tag-triggered release workflow that builds the Windows and Linux executables.
 - Removed dead legacy plotting code.
 
+[1.0.0-alpha.3]: https://github.com/sommaa/FlowMeter/releases/tag/v1.0.0-alpha.3
 [1.0.0-alpha.2]: https://github.com/sommaa/FlowMeter/releases/tag/v1.0.0-alpha.2
 [1.0.0-alpha]: https://github.com/sommaa/FlowMeter/releases/tag/v1.0.0-alpha

CONTRIBUTING.md

@@ -1,7 +1,7 @@
 # Contributing to FlowMeter
 
 Thanks for your interest in improving FlowMeter! This project is in an early
-(`1.0.0-alpha.2`) public phase, so bug reports, fixes, and focused feature work are all
+(`1.0.0-alpha.3`) public phase, so bug reports, fixes, and focused feature work are all
 genuinely useful.
 
 By participating you agree to abide by our [Code of Conduct](CODE_OF_CONDUCT.md).

README.md

@@ -8,7 +8,7 @@
 
 <br>
 
-[![Version](https://img.shields.io/badge/version-1.0.0--alpha.2-7C3AED?style=for-the-badge&labelColor=1e1e2e)](https://github.com/sommaa/flowmeter/releases)
+[![Version](https://img.shields.io/badge/version-1.0.0--alpha.3-7C3AED?style=for-the-badge&labelColor=1e1e2e)](https://github.com/sommaa/flowmeter/releases)
 [![Python](https://img.shields.io/badge/Python-3.10+-3776AB?style=for-the-badge&logo=python&logoColor=white)](https://python.org)
 [![React](https://img.shields.io/badge/React-19-61DAFB?style=for-the-badge&logo=react&logoColor=black)](https://react.dev)
 [![TypeScript](https://img.shields.io/badge/TypeScript-5.4-3178C6?style=for-the-badge&logo=typescript&logoColor=white)](https://typescriptlang.org)
@@ -931,7 +931,7 @@ cp backend/.env.example backend/.env
 | Variable | Default | Description |
 |:---------|:--------|:------------|
 | `APP_NAME` | `FlowMeter API` | Application display name shown in API docs and logs |
-| `APP_VERSION` | `1.0.0-alpha.2` | Semantic version string |
+| `APP_VERSION` | `1.0.0-alpha.3` | Semantic version string |
 | `DEBUG` | `false` | Enable debug mode — verbose logging, full error tracebacks in API responses |
 | `HOST` | `0.0.0.0` | Server bind address (`0.0.0.0` = all network interfaces) |
 | `PORT` | `8000` | Listening port for the FastAPI/Uvicorn server |

SECURITY.md

@@ -2,7 +2,7 @@
 
 ## Supported versions
 
-FlowMeter is pre-1.0 software (`1.0.0-alpha.2`). Security fixes are applied to the
+FlowMeter is pre-1.0 software (`1.0.0-alpha.3`). Security fixes are applied to the
 latest release on the `main` branch only.
 
 ## Reporting a vulnerability

VERSION

@@ -1 +1 @@
-1.0.0-alpha.2
+1.0.0-alpha.3

backend/.env.example

@@ -2,7 +2,7 @@
 
 # App settings
 APP_NAME=FlowMeter API
-APP_VERSION=1.0.0-alpha.2
+APP_VERSION=1.0.0-alpha.3
 DEBUG=true
 
 # Server settings

backend/app/__init__.py

@@ -1,4 +1,4 @@
 """
 FlowMeter Backend Application
 """
-__version__ = "1.0.0-alpha.2"
+__version__ = "1.0.0-alpha.3"

backend/app/core/config.py

@@ -52,7 +52,7 @@ class Settings(BaseSettings):
 
     # App Info
     app_name: str = "FlowMeter API"
-    app_version: str = "1.0.0-alpha.2"
+    app_version: str = "1.0.0-alpha.3"
     debug: bool = False
 
     # Server

backend/docs/conf.py

@@ -12,7 +12,7 @@
 project = "FlowMeter Backend"
 copyright = "2026, FlowMeter Team"
 author = "FlowMeter Team"
-release = "1.0.0-alpha.2"
+release = "1.0.0-alpha.3"
 
 # -- General configuration ---------------------------------------------------
 extensions = [

frontend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowmeter-frontend",
-  "version": "1.0.0-alpha.2",
+  "version": "1.0.0-alpha.3",
   "private": true,
   "type": "module",
   "scripts": {

frontend/src/App.tsx

@@ -15,6 +15,7 @@ import { OnboardingWizard } from '@/components/onboarding/OnboardingWizard';
 import { StorylineModal } from '@/components/features/Storyline/StorylineModal';
 import { useThemeEffect } from '@/hooks';
 import { settingsApi } from '@/services/api';
+import { ALLOW_UNSAFE_FORMULAS_STORAGE_KEY } from '@/store/slices/uiSlice';
 
 /**
  * Main application component with layout and global state management.
@@ -98,9 +99,12 @@ const App: React.FC = () => {
 
   // Mirror the persisted formula-sandbox preference to the backend on startup,
   // since the backend runtime flag resets to its default on every (re)start.
+  // Read straight from localStorage (the source of truth) so this does not
+  // depend on the store being initialised.
   React.useEffect(() => {
+    const allow = localStorage.getItem(ALLOW_UNSAFE_FORMULAS_STORAGE_KEY) === 'true';
     settingsApi
-      .setSecurity(useStore.getState().allowUnsafeFormulas)
+      .setSecurity(allow)
       .catch((e) => console.warn('Failed to sync formula-safety setting on startup:', e));
   }, []);