What's new in AmpNexus

2.18.4 (2026-11-10)

Bug Fixes

• commands: ignore internal audit results (fa8be73)

2.32.5 (2026-11-10)

Bug Fixes

• ocpp: identify runtime audit commands (84962f3)

2.32.5 (2026-11-10)

Bug Fixes

• ocpp: identify runtime audit commands (84962f3)

2.32.5 (2026-11-10)

Bug Fixes

• ocpp: identify runtime audit commands (84962f3)

1.11.7 (2026-11-10)

Bug Fixes

• sync: skip empty tariff snapshots (191ced0)

1.22.2 (2026-11-04)

Bug Fixes

• deps: patch OCPP Rust security advisories (c4d1229)
• ocpp: recover exhausted channels without broker alarm storms (6e54f35)

2.32.4 (2026-11-04)

Bug Fixes

• deps: patch OCPP Rust security advisories (c4d1229)
• ocpp: recover exhausted channels without broker alarm storms (6e54f35)

2.27.2 (2026-11-04)

Bug Fixes

• deps: patch OCPP Rust security advisories (c4d1229)
• ocpp: recover exhausted channels without broker alarm storms (6e54f35)

2.32.4 (2026-11-04)

Bug Fixes

• deps: patch OCPP Rust security advisories (c4d1229)
• ocpp: recover exhausted channels without broker alarm storms (6e54f35)

2.32.4 (2026-11-04)

Bug Fixes

• deps: patch OCPP Rust security advisories (c4d1229)
• ocpp: recover exhausted channels without broker alarm storms (6e54f35)

1.6.4 (2026-10-26)

Bug Fixes

• auth: honour PLATFORM_ADMIN as every scope only in platform mode (1127ab1)
• billing: an overlapping monthly run skips what the other run wrote (4fb4a2d)
• billing: marks never undo an invoiced event or invoice an unclaimed one (b702ef7)
• billing: never bill £0 for a subscription without a usable price [SIGN-OFF] (c07e3a9)
• billing: no monthly advance for the month billing starts or earlier [SIGN-OFF] (bb229b2)
• billing: read a numeric monthly price as the decimal written [SIGN-OFF] (981b0a7)
• billing: refuse a monthly run whose period does not start on the 1st [SIGN-OFF] (b111983)
• billing: two concurrent claims never take the same billable event (ba20a0f)
• config: read boolean settings strictly and fail closed [SIGN-OFF] (cdd7f22)
• config: treat an empty DATABASE_URL as unset (060ce79)
• config: trim INTERNAL_AUTH_TOKEN like the orchestrator tokens (f8399e7)
• error: answer a 500 with a generic message and keep the detail in the log (ff1ed51)
• events: give up on an AMQP handshake the broker never finishes (eec8a97)
• events: stop requeueing deliveries that can never succeed [SIGN-OFF] (f03aa67)
• pagination: refuse a list offset past i64 with a 400 instead of panicking (8b1eea2)
• plans: refuse a billing cycle other than monthly [SIGN-OFF] (0aa3809), closes #3
• plans: store a missing provisioning mode as the provider's [SIGN-OFF] (a01e30a), closes #20
• plans: validate activation_copy on plans without a provider_config too (8e20b1a)
• sims: a sync no longer rewrites the status or plan of a SIM in service (b627cf4)
• sims: a sync takes Soracom's own SIM status into account [SIGN-OFF] (cad4755)
• sims: deactivating an already deactivated SIM changes nothing (799ab44)
• sims: let PATCH {"service_plan_id": null} unlink a SIM's plan (413cd57)
• sims: PATCH no longer records a SIM deactivated or active [SIGN-OFF] (c7fc8c8), closes #10 #10
• sims: refuse to revive a deactivated SIM row another tenant now holds (a5839b2)
• soracom: give up on a Soracom call that never answers (7dc655a)
• soracom: send the SIM id as one escaped path segment (a5ed1bf)
• subscriptions: look for the buyer on every page of billing-api's accounts [SIGN-OFF] (78d739e)
• subscriptions: record the SIM's claim before Soracom activates it [SIGN-OFF] (2beaa62), closes #6
• subscriptions: refuse to retry a deactivated or active subscription [SIGN-OFF] (3e0233f), closes #5 #5 #4
• subscriptions: start billing a blocked dry-run order when it activates [SIGN-OFF] (c141d0b)

1.11.6 (2026-10-26)

Bug Fixes

• auth: tell auth-api the path the caller requested, prefix included (062dcb4)
• config: let AMQP_URI take precedence over RABBITMQ__URL, as documented (20ebd95)
• config: read SERVER__CORS_ORIGINS from the environment as a list (c0dee48)
• internal: find a tariff's rates by any of its codes on the internal route [SIGN-OFF] (fe078b6)
• octopus: answer 400 when Octopus refuses the customer's key or account (5dc9350)
• octopus: let two simultaneous first links of a location both succeed (e6cb215)
• octopus: link a tariff's standing charges to Octopus's real endpoint (43bcad6)
• octopus: list every product exactly once when paging through tied names (f37e59f)
• octopus: match product search text in any case and literally (71ce253)
• octopus: never link a location to an agreement that has ended [SIGN-OFF] (b5047b0)
• octopus: stop a sync in flight from re-linking a location just unlinked [SIGN-OFF] (316663f)
• octopus: work out each link's tariff again when re-announcing it [SIGN-OFF] (2e89493)
• pagination: answer an empty page for a page number past any offset (3501a94), closes #11
• price-estimates: answer a failed device lookup with its own status (5ee3dc9)
• price-estimates: round a price exactly on a half-penny up, not down [SIGN-OFF] (d3425f2)
• provider-tariffs: answer an offset beyond i64 with an empty page (e18ed14), closes #11
• provider-tariffs: refuse a price too large for its column (f52f422)
• publisher: rebuild the RabbitMQ link after a publish times out (f2ce414)
• sync: keep syncing the products in use when the listing fails (639306c)
• sync: retry Octopus requests that time out or lose the connection (44a2fa4)
• tariff-family: an export tariff is not named Octopus Go (78d6e83)
• tariff-family: Intelligent Octopus Go is left to Octopus's control [SIGN-OFF] (037bc13)
• tariff-windows: refuse a from at the end of time instead of panicking (d34a8d9), closes #11

1.5.6 (2026-10-26)

Bug Fixes

• accounts: a duplicate billing account is a 409, not a 500 (01d96ed)
• config: a blank DATABASE_URL falls back to DATABASE__URL (FINDINGS #34) (e9f46e5)
• config: Debug output never prints Xero, database or broker credentials (FINDINGS #34) (ed894b8)
• config: only an explicit [secure] value turns XERO_DRY_RUN off (FINDINGS #26) (b353f6c)
• errors: a 500 database_error body no longer echoes the driver message (FINDINGS #32) (4ce024a)
• idempotency: a successful operation never runs twice under one key (FINDINGS #25) (0d48d42)
• invoices: an amount too large to store is a 422, not a 500 (932cc71)
• invoices: keep an invoice's lines in the order they were given (e4891f3)
• invoices: write an invoice and its lines at once, and never strand claimed events (7b52265)
• order-sync: keep order-api's address out of the sync-queue warning (11c5fcd)
• order-sync: never raise two customers' orders on one "unknown" account (4ba7ce4)
• runs: a PATCH cannot approve, execute or reopen a billing run (daf2efa), closes #15
• runs: a run whose invoice never reached Xero is failed, not completed (05bbc1b)
• subscriptions: don't complete a run whose events could not be reported (49dd07f)
• subscriptions: one tenant's failure no longer stops the monthly job (0347ce0)
• subscriptions: overlapping monthly jobs draft one run per account (15a5feb)
• subscriptions: report events invoiced once Xero holds their invoice (191b8fa)
• suspension: a hung Sentinel can't lock the operator out of a retry (b7b1600)
• suspension: a suspension or resume Sentinel did not carry out is not done (795ddfc)
• suspension: take a suspension decision only from the status it applies to (e9aa7b9)
• xero: make XERO_TENANT_ID optional, as the README documents (b63d700)
• xero: never raise an invoice in Xero twice or re-email a sent one (d5c7fb1), closes #11 #1
• xero: never send a paid or voided invoice again (c4cbab5), closes #6
• xero: record a failed customer email like any other Xero failure (e66e816)
• xero: record a replayed webhook delivery once (abbda1a)
• xero: stop trusting dry-run placeholder ids once dry run is off (d8abffc)

1.19.1 (2026-10-26)

Bug Fixes

• admin: a distribution never resurrects a withdrawn version (FINDINGS #4) (35f2c29)
• catalog: a device-api that never answers no longer hangs the sync (FINDINGS #23) (e435552)
• catalog: an older catalog entry never reverts a model's pin (FINDINGS #17) (083c40c)
• cohort-preview: a charger named by its device id is counted (FINDINGS #20) (5168abc)
• cohort-preview: a member that left the tenant is not counted (FINDINGS #19) (3bdc376)
• cohort-preview: the platform preview counts what a platform rollout enrols (FINDINGS #25) (c806293), closes #19
• cohort-preview: the preview counts only the rollout's product (FINDINGS #21) (d13ae7e)
• compat: latest global reports the newest servable release (FINDINGS #29) (cc33d2a)
• db: the database password never reaches the logs (FINDINGS #38) (2a3c1b3)
• direct-updates: a direct update racing a withdrawal never sends the withdrawn image (FINDINGS #11) (029b98f)
• direct-updates: a dotted hardware revision keeps its minor part (FINDINGS #14) (651894d), closes #22 #7
• direct-updates: a release candidate orders before its release (FINDINGS #22) (9dfb3e7)
• direct-updates: a version for newer hardware is never sent or recommended to a charger known to be older (FINDINGS #7) [needs sign-off] (52349cb), closes #5 #14
• downloads: only an approved or released version is linked (FINDINGS #30) (530c765)
• events: a late OCPP event never moves last-seen back (FINDINGS #24) (b774ca6), closes #17
• events: never send a withdrawn version to a charger (FINDINGS #1) (ea94790), closes #16
• groups: a device's groups show only the asking tenant's groups (FINDINGS #8) (deb7406)
• groups: a duplicate group name is a 409 conflict (FINDINGS #26) (50ba090)
• groups: a group cannot be renamed to an empty name (FINDINGS #27) (a4b82dd)
• groups: a group with members can be deleted (FINDINGS #18) (95e8135)
• groups: a member that left the tenant is not counted (FINDINGS #28) (caf4167)
• manifest: the hardware revision filter compares revisions by number (FINDINGS #13) (02105f9)
• openapi: documented operations resolve to served URLs (FINDINGS #39) (d1bda70)
• rabbit: the logged broker URL masks a password holding : (FINDINGS #37) (dc8027a)
• releases: a release never resurrects a withdrawn version (FINDINGS #3) (6fbe7de)
• rollouts: a device retry reaches only an enrolled charger whose update failed (FINDINGS #9) (122b7dc)
• rollouts: a page of a rollout's devices far past the end is empty, not a panic (FINDINGS #40) (9d889ed), closes #33 #33 #33
• rollouts: a page of rollouts far past the end is empty, not a panic (FINDINGS #33) (e35631e)
• rollouts: a tenant's channel policy is read and enforced (FINDINGS #15) (f4ae00e)
• rollouts: an approval enrols only the hardware, model and tags the rollout asks for (FINDINGS #6) [needs sign-off] (d1b4ad7), closes #5 #5 #5 #5
• rollouts: an approval never enrols hardware known to be older than the image needs (FINDINGS #5) [needs sign-off] (109a005), closes #13 #14
• rollouts: an approval never sends firmware withdrawn since the request (FINDINGS #2) (233ad65)
• storage: head_object reports a missing object as absent (FINDINGS #36) (a2fe708)
• update-attempts: a page far past the end of the attempts listing is an empty page (FINDINGS #31) (f2e8cd2)
• update-attempts: a repeated allow keeps the progress a device shows (FINDINGS #16) (d0cec07)
• update-attempts: a report moves only its own tenant's and charger's direct update (FINDINGS #32) (8ac4108)
• update-attempts: a report or sweep never undoes a close committed meanwhile (FINDINGS #10) (5c227bb)
• versions: minHwRev: null resets the minimum to "0" (FINDINGS #34) (93ce6b9)
• versions: a failed approval removes its approved/ copy (FINDINGS #35) (2919776), closes #12
• versions: a page far past the end of the version list is empty (FINDINGS #33) (92b7592)
• versions: an approval's checked copy survives a concurrent attempt (FINDINGS #12) (1b2ff5e), closes #35

2.18.3 (2026-10-20)

Bug Fixes

• boost: send the customer boost on three phases [needs product decision] (b39155c)
• charge-now: refuse a remoteStartId no station profile may take (40aa60b)
• charge-now: refuse an evseId below 1, as the boost does (86e9739)
• chargepoint-api: encode a tenant or serial as a path segment, not a form (01c8986)
• chargepoint-api: never ask about a . or .. tenant or serial (73dc22f)
• commands: name a command by its OCPP action before any per-action rule (d4e5a96), closes #1 #10 #18 #10 #18 #1 #10 #18
• config: keep the secrets out of AppConfig's Debug output (25ccb56)
• consumers: bound every ack and nack so a dropped connection cannot wedge a consumer (41e992b)
• hardware-config: a PATCH for a charger not held, or not checkable, saves nothing (18bd378)
• hardware-config: after a failed dispatch, a retry sends every stored change (a98e4e0)
• managed-charging: answer a Go boost over a ChargeFlow plan with a 400 (9490818), closes #25
• managed-charging: count each moment of ChargeFlow's tariff windows once (83e4fa7), closes #19
• managed-charging: encode chargepoint-api and tariff-api path segments (bef9c42), closes #24
• managed-charging: end a Go boost to the status an accepted clear leaves (58d4a4c), closes #23
• managed-charging: plan Octopus Go windows in time order, each moment once (1b0eacf), closes #20
• managed-charging: read a clock-time ready-by as London time [needs product decision] (037567c), closes #15
• managed-charging: refuse a charging rate that is not positive (cdf8705), closes #22
• managed-charging: refuse a past departure for the full-service Go plan (71f982a), closes #16
• managed-charging: refuse non-finite tariff rates and sort rates totally (58c0ae1), closes #21
• managed-charging: track the clear a provider-managed apply withdraws a plan with (866a43b), closes #26
• metrics: serve the service's own metrics at /metrics (8431d97)
• mode: clear a boost on the EVSE it was installed on (44ced3c)
• mode: expire only the profile rows a stack clear removes (4af34e5)
• mode: re-send a plan a mode switch cleared from under a boost (e0ea7a0)
• openapi: stop the server URL at /ocpp so paths resolve once (5f64535)
• portal-requests: a request the broker refuses is an error, not "queued" (94db959)
• profiles: refuse an update while the profile's removal is pending (b11ce93)
• rabbitmq: bound the connect and every publish confirm, and answer health during a reconnect (58375ae)
• rule-events: an undecodable outbox row no longer holds up every rule event (0921876)
• rule-events: renew each event's lease before publishing it, so a stale upsert cannot follow its delete (43fb7a3)
• schedules: key the customer-schedule record by tenant as well as serial (4679243)
• schedules: record a retried workflow step as the command it sent (4a73846)
• security-events: redact BasicAuthPassword and AuthorizationKey in techInfo (2fb4e61)
• session-indicator: a descriptor the reconciler cannot clear goes to the back (b5d60cc)
• session-indicator: the reconciler retries a clear it could not deliver (5981441)
• smart-charging: refuse an optimisation no charger could satisfy (7b476df)
• vehicle-sense: a charger unplug withdraws the vehicle plan while telemetry is stale (9abef75)
• vehicle-sense: a trigger cannot postpone an overdue evaluation (8ec3f13)
• vehicle-sense: announce a degradation once, not on every trigger (e20485f)
• vehicle-sense: requeue a trigger the database could not record (de31105)
• vehicle-sense: run the flag-off rollback, without consuming triggers (b99555c)

1.28.3 (2026-10-19)

Bug Fixes

• catalog: answer a duplicate slug with 409, not 500 (bf29969)
• catalog: answer a model PATCH with the model's images (50d7c08)
• catalog: keep a model on its own product line's firmware stream [needs product decision] (a8e7211)
• catalog: publish the model event when the firmware-policy tool clears a pin (7809ea1)
• catalog: refuse an unknown parent on a pre-hierarchy stream with 400 (b10e31e)
• config: let a plain-name variable beat its section form and config files (bb42fd5)
• consumers: bound every ack, nack and reject, and reconnect when one hangs (e5bd76f)
• consumers: compare a delivery's user_id exactly as the broker stamped it (dfe3c35)
• consumers: refuse a serial Postgres cannot store instead of retrying it (e315067)
• devices: answer an offset past i64::MAX instead of panicking (dc1a799)
• devices: keep a tenant's own devices in its organisation expansion (0b67d7b)
• devices: let a stock device take any catalog model [needs product decision] (e42b074)
• docs: send the docs page's script tag with ordinary quotes (169e7f4)
• events: leave name out of a held device's device.upsert, not null (53758b7)
• images: count alt-text characters, not bytes (b161cca)
• images: keep the S3 error code, request id and key in storage errors (23f4c3f)
• images: store a focal point only once its renditions are rendered (b2ac6b8)
• images: write re-uploads to new keys and clean up failed uploads (2ffc6a2), closes #19 #20
• outbox: cut a failure reason on a character boundary (3f4f681)
• pending: answer a review-list offset past i64::MAX instead of panicking (52c31f6), closes #14
• rabbitmq: mask the whole userinfo in the logged broker URL (10a3bb5)
• reconcile: strip a byte order mark from the manifest (98e61df)
• security: keep the database password out of connection errors (3c63933)
• security: keep the database password out of the CLIs' connection errors (cd87aa3)
• setup: approve a pending charge point once under overlapping requests (42746a7)
• sync: answer a page past i64::MAX rows instead of panicking (d617e61)
• tenant-changes: require the checked holder in the guarded write (930ecaf)

1.8.7 (2026-10-19)

Bug Fixes

• aggregation: read only JSON numbers a double can hold from stored samples (FINDINGS #27) (2576dc8)
• alias-repair: keep buckets whose baseline retention deleted (FINDINGS #7) (330096d)
• alias-repair: rebuild the next energy reading's bucket (FINDINGS #6) (6395733)
• canonical: a sampled value without a measurand is the energy register (FINDINGS #4) (79681cd)
• canonical: drop a canonical value whose unit or multiplier doesn't parse (FINDINGS #28) (7c8dd1e)
• canonical: the phase-less value wins over per-phase readings (FINDINGS #1) (a7103da)
• config: refuse deprecated bindings that would unbind a live route (FINDINGS #23) (53968b7)
• connectors: replace a renumbered connector's old row (FINDINGS #15) (f9c2f3a)
• ingest: book a replayed reading against when it was received (FINDINGS #19) (9c35b67)
• legacy-repair: count readings two global aliases disagree on as conflicts (FINDINGS #11) (7680913)
• legacy-repair: report one connector under two global aliases as a conflict (FINDINGS #22) (9218df3)
• legacy-repair: treat ampnexus as a global alias, as ingest does (FINDINGS #12) (d10c4dd)
• metrics: label requests no route matched as "unmatched" (FINDINGS #17) (d7ed7d2)
• openapi: document the paths that are served, with unique operationIds (FINDINGS #25) (dc4841a)
• provisioning: never let a blank or padded tenant hold a charger (FINDINGS #13) (ab451c1)
• provisioning: reject deliveries that can never apply instead of requeueing (FINDINGS #18) (f39c91f)
• publisher: bound the AMQP connect and the publisher-confirm wait (FINDINGS #16) (6e0183e)
• publisher: retry a nacked or returned publish without reconnecting (FINDINGS #30) (b2d8708), closes #16 #16
• retention: keep the baseline of the earliest rebuildable day (FINDINGS #8) (059f237)
• series: a rollup for no tenant is empty, not a SQL error (FINDINGS #29) (73df8c5)
• series: refuse a page whose row offset cannot be queried (FINDINGS #24) (0f7e769)
• series: roll up each connector on its own, then add them up (FINDINGS #10) (90e5fb0)
• tenant-history: seam from the new tenant's last bucket before the floor (FINDINGS #9) (eee7550)
• timestamp-repair,alias-repair: take ingest's connector lock first (FINDINGS #21) (92d4f16)
• timestamp-repair: rebuild the energy neighbours of both positions (FINDINGS #2, #3) (6911010)
• timestamp-repair: salt aggregate event ids with the repair run (FINDINGS #20) (a890e41)

1.2.2 (2026-10-19)

Bug Fixes

• publish station CRLs immediately after revocation (4c3b100)

1.73.2 (2026-10-19)

Bug Fixes

• adoption: refuse approving a transfer of a deleted charger (6c2d284)
• amqp: ack redelivered hardware telemetry and thermal frames (37abc29)
• amqp: apply a connector event timed to the nanosecond (d913a45)
• amqp: keep stored capabilities on a SKU-only catalog update (b4232d7)
• amqp: never measure a session's energy from a reset meter register (61a2283)
• amqp: take a transaction's cost from its newest event only (a3f04bb)
• amqp: time out an AMQP connect whose handshake never completes (64fbcdb)
• api: keep retired EVSEs, deleted chargers and unknown devices out of reads (4212d55)
• device-logs: one log pull per charger, and a refused restore is not restored (716bf39)
• device-logs: the trace shows the log lines inside its window (129ac36)
• devices: charger searches no longer answer 500 on Postgres (fa0bdb1)
• devices: deleted chargers take no settings, assignments or log pulls (6190f5a)
• devices: parse the SuspendedEVSE device status (9566356)
• emobility: every EVSE at a location carries its OCPI identity (1fbe5aa)
• installer: a revocation reason is measured in characters (dfbeee3)
• installer: diagnostics commands reach the charger again (a249b05)
• installer: let an installer correct its own commission until taken up (ccf1957)
• installer: only platform support redeems a handover link for a customer (06d87e3)
• installer: refuse commissioning a charger into a deleted location (13c45de)
• logs: GET /logs reads the log_entry table the migration creates (902735f)
• network-onboarding: a duplicate provider connection name is a 409 (1b63c71)
• network-onboarding: a module's latest reconciliation supersedes its earlier ones (8e66a40)
• network-onboarding: a reconciliation without differences no longer blocks acceptance (1f8ae66)
• network-onboarding: load projects by uuid and survive unmatched chargers (50359b1)
• ocpp: a tenant or serial is always one path segment of an ocpp-api URL (280a9f6)
• ownership: a keyed retry replays the completed write (6fdd9ca)
• schedule: a charging window's HH:mm takes digits only (feb085c)

Performance Improvements

• database: index recent transaction lookups (2a0065b)

Features

• devices: the presence sweep logs each charger it marks offline, by serial (597bc1a)
• devices: store Offline for chargers silent 10 minutes, and judge presence on 10 everywhere (e2249ee)

Bug Fixes

• devices: a charger's own users see it offline once it goes silent (9a92587)

Bug Fixes

• websocket: keep the link tasks off the journal's flash work (5da4392)
• wifi: join the strongest access point, not the first one heard (0c42ccb)
• network: forgetting Wi-Fi under a running hotspot brings the hotspot back (172fe2e)
• portal: say what the charger does - install now, forget the network, where the password comes from (7efb2de)
• tools: the preview's built-in route table has the personal data page (ef94321)

Features

• portal: personal data page - remove personal data from the device portal (a3432e5)
• tools: a local preview of the device portal for screenshots (e5e6d28)
• tools: capture.py takes the whole portal screenshot set in one run (864c58d)
• tools: mock the personal data page in the portal preview (f3d2606)

1.2.1 (2026-10-16)

Bug Fixes

• worker: retry transient database outages (f10c925)

1.2.4 (2026-10-16)

Bug Fixes

• worker: retry transient database outages (8cee092)

1.20.6 (2026-10-16)

Performance Improvements

• short-circuit performance health queries (1326a01)

Features

• attachments: export the malware-scan backlog and scan outcomes (157d203)

Bug Fixes

• auth: service tokens get only the tenant routes their subject is listed for (887a6a6)
• retention: purge deleted attachments, expired idempotency rows and old outbox/inbox rows (cbd6709)
• attachments: completion streams the upload through SHA-256; one per upload, four per pod (039675a)
• deps: move to sea-orm 2.0 and sqlx 0.9, which takes rsa out of the lockfile (0016815)
• references: call release-api with service-api's own token (3fa06de)
• deps: clear the October RustSec advisories (27d9161), closes cargo#10801