{
  "schema_version": "1.0",
  "latest_version": "v1.0.0-rc.18",
  "latest_url": "https://releases.bmh.ai/qs/v1.0.0-rc.18/qs-v1.0.0-rc.18.tar.gz",
  "latest_sha256": "bfa7c02a39e5757aeab25aa4fa7b8232fbf3142dedd330e862721f8025b341d5",
  "released_at": "2026-05-04T15:43:05Z",
  "released_by": "releases@bmh.ai",
  "minimum_version_supported": "v1.0.0-rc.17",
  "requires_schema_migration": false,
  "migration_phase": "none",
  "required_env_vars_added": [],
  "breaking_changes": false,
  "release_notes_url": "https://releases.bmh.ai/qs/v1.0.0-rc.18/release-notes.html",
  "release_notes_summary": "Block 5 / Phase 5 validation-layer closure release for the hardening environment.\n\nThis release packages the completed Phase 5 validation work after rc.17:\n\n- Compliance attestations and reports validation completed.\n- Communications and examinations validation completed.\n- Regulatory/calendar, engine, and memory validation completed.\n- Final body-validation inventory cleared: 0 direct JSON parsers, 0 MFA readJsonBody routes, 0 form-data routes, 1 approved NextAuth credentials exception.\n- MFA key usage hardened with HKDF-derived subkeys for encryption/HMAC separation.\n\nNo Prisma schema changes are included. Deploy to hardening first and verify before any dev/demo promotion.",
  "estimated_downtime_seconds": 45
}