Cut release 2.15.0

[hokiepokedad2]

develop is 4 commits ahead of main and ready to release. Tracking the cut here.

Contents

Added

• PUBLIC_URL pins the OAuth callback origin for Discord and OIDC instead of deriving it from each request, with startup validation of the value (Sign-in fails with "Invalid OAuth2 redirect_uri" behind an undeclared reverse proxy #689)
• A warning when a callback is about to go out as http:// while an untrusted X-Forwarded-Proto: https is present, naming both fixes

Removed

• Discord:RedirectUri, dead config read by no code path

Fixed

• Dependabot targets develop rather than main, so dependency bumps stop landing straight on released code
• Documentation for PROXY_KNOWN_PROXIES / PROXY_KNOWN_NETWORKS, which existed since PROXY_KNOWN_PROXIES and PROXY_KNOWN_NETWORKS were never bridged, so the documented opt-in did nothing #596 but appeared in no example file, guide or reference — the gap that made Sign-in fails with "Invalid OAuth2 redirect_uri" behind an undeclared reverse proxy #689 undiagnosable

Version 2.15.0: one new opt-in feature, no behaviour change for anyone who does not set PUBLIC_URL. The removed setting did nothing, so it is not a breaking change.

Steps

• Open develop → main and let it through the merge queue
• Publish the GitHub release tagged v2.15.0
• Merge the changelog promotion PR that release-changelog.yml opens, or the next release inherits these entries
• Confirm prod reports 2.15.0 at GET /api/version
• Confirm sign-in still works on prod after the redeploy

Notes

Publishing deploys production. docker-publish.yml pushes :latest on release and watchtower on .178 polls every 60s, so prod moves within about a minute with no further action. Prod's proxy fix lives in its .env and docker-compose.yml on the host, not in the image, so it survives the redeploy; PUBLIC_URL is not set there and is not needed, because proxy trust already resolves the callback.

This is also the merge queue's first end-to-end run — nothing has ever passed through it. A misconfiguration there shows up as silence rather than an error, so watch https://github.com/PGAN-Dev/PoracleWeb.NET/queue/main rather than the PR page.

[hokiepokedad2]

Released as v2.15.0.

• develop → main merged via Release 2.15.0 #699 — the merge queue's first successful end-to-end run, landing as a merge commit (7e93233)
• Release published, :latest built, watchtower deployed prod inside a minute
• Changelog promotion docs: cut changelog for v2.15.0 #700 merged, and chore: sync the v2.15.0 changelog promotion back to develop #703 syncs it back to develop so the next release does not open on a stale [Unreleased]
• Prod reports 2.15.0 at /api/version
• Sign-in verified: GET /api/auth/discord/login returns an https:// redirect_uri

The queue was switched from SQUASH to MERGE before cutting. Every previous release landed on main as a merge commit, and squashing would have left develop's commits out of main's ancestry and produced a CHANGELOG conflict on every future release.