officialsuyogdixit · Nov 2, 2026 · Nov 2, 2026
diff --git a/docs/plans/guided-docker-install.md b/docs/plans/guided-docker-install.md
@@ -1,6 +1,6 @@
 # Plan: one-command Docker Hub quickstart
 
-Status: complete; 0.3.2 candidate verified for stable-channel promotion. Date: 2026-10-22.
+Status: complete; 0.3.3 candidate verified for stable-channel promotion. Date: 2026-11-02.
 
 ## Outcome and scope
 
@@ -63,3 +63,9 @@ One successful fresh 0.3.2 candidate installation passed all twelve checks with
 Only the exact stable-metadata request used the candidate; the installer downloaded the pinned Compose over HTTPS and pulled its images normally. Owner bootstrap, authentication/CSRF/origin, non-root/read-only execution, loopback binding, private credentials, exact screenshot readback and anonymous denial passed. Recreating only the new installation's two containers retained both named volume identities, owner login, project, thread and exact screenshot bytes. An earlier Docker Hub timeout created no containers or volumes; its partial files and receipts were preserved before connectivity diagnosis and one controlled retry. Both prior 0.3.0 and 0.3.1 installations remained ready with unchanged container, image and volume identities. All three usable installations and their data remain available.
 
 The reviewed stable-channel update selects this tested candidate. Its later promotion commit, exact-main CI, public-site deployment and public metadata/installer/Compose byte equality are verified separately through the [promotion procedure](../releasing.md#promote-the-local-quickstart). Existing installations retain their saved digests. Local-volume acceptance remains separate from production HTTPS/S3/recovery and real provider-account consent; credentials and raw operational evidence stay outside source.
+
+## 0.3.3 security update and stable-channel promotion
+
+Application source: `82b425d4bdd216b9fd155da8aed628a7eca95377`; [exact-main CI](https://github.com/Softinator-TechLabs/feedbacks-oss/actions/runs/41387707616) passed all six jobs. The public [0.3.3 release](https://github.com/Softinator-TechLabs/feedbacks-oss/releases/tag/v0.3.3) downloads and seven checksums were verified against the immutable source, including all 1,137 exported source-file hashes. The extension ZIP remains byte-identical to 0.1.64. [Image publication](https://github.com/Softinator-TechLabs/feedbacks-oss/actions/runs/41389175972) passed native AMD64/ARM64 checks; public manifests, exact source/version labels, parsed SBOM/provenance and actual anonymous pulls passed.
+
+A fresh 0.3.3 candidate installation passed all twelve checks with the unchanged installer. Its owner, project, thread and exact private screenshot bytes survived recreation of only its own containers with the same named volumes. The candidate pins `softinator/feedbacks@sha256:730d6b05e44bedb97b3e39bd2bf9d2e0e2fc0017fa6be6552e5664ae6ced5bf0`. Installer SHA-256 remains `666641f2d440b496e6892dcdbe14595d1eb4abdf2e3e350f7d7305d5f03800bb`; Compose remains pinned to `28b1c714c115388c4a983b670d0a71443eaa3da1`, checksum `2c078743924d3c0d5128fa79ad354083944acfe904024a5b12a269eceeeecc12`. Existing installations retain their saved image pin. Candidate acceptance, required CI and website deployment remain separate evidence. Operational receipts stay private.
diff --git a/site-docs/guide/self-host.md b/site-docs/guide/self-host.md
@@ -93,12 +93,12 @@ The [public Docker Hub image](https://hub.docker.com/r/softinator/feedbacks) sup
 
 ### 1. Download Compose
 
-In a new installation directory, download the [0.3.2 release Compose](https://github.com/Softinator-TechLabs/feedbacks-oss/blob/v0.3.2/compose.registry.yaml) as `compose.yaml`:
+In a new installation directory, download the [0.3.3 release Compose](https://github.com/Softinator-TechLabs/feedbacks-oss/blob/v0.3.3/compose.registry.yaml) as `compose.yaml`:
 
 ```sh
 mkdir feedbacks-server
 cd feedbacks-server
-curl -fL https://raw.githubusercontent.com/Softinator-TechLabs/feedbacks-oss/v0.3.2/compose.registry.yaml -o compose.yaml
+curl -fL https://raw.githubusercontent.com/Softinator-TechLabs/feedbacks-oss/v0.3.3/compose.registry.yaml -o compose.yaml
 umask 077
 touch .env
 chmod 600 .env
@@ -109,7 +109,7 @@ chmod 600 .env
 Paste these fields into `.env`, then fill every empty value. Use your HTTPS origin, private bucket and scoped application key from the [storage guide](/guide/storage). Generate a database password with `openssl rand -hex 32` and a unique organization UUID with `uuidgen`; preserve both for this installation. `TRUST_PROXY_HOPS=1` assumes one trusted reverse proxy; match your actual ingress path.
 
 ```dotenv
-FEEDBACKS_IMAGE=softinator/feedbacks:0.3.2
+FEEDBACKS_IMAGE=softinator/feedbacks:0.3.3
 APP_ORIGIN=
 POSTGRES_PASSWORD=
 ORGANIZATION_ID=
@@ -135,7 +135,7 @@ docker compose ps
 For production, pin the pulled image before the first `up` (or before an upgrade):
 
 ```sh
-docker image inspect softinator/feedbacks:0.3.2 --format '{{index .RepoDigests 0}}'
+docker image inspect softinator/feedbacks:0.3.3 --format '{{index .RepoDigests 0}}'
 ```
 
 Copy that full `softinator/feedbacks@sha256:…` result into `FEEDBACKS_IMAGE` in your private `.env`, then run `docker compose up -d --wait`. Keep the previous digest for recovery. The publication workflow creates versioned tags once; it does not move them or `latest`.

diff --git a/site/public/quickstart-stable.txt b/site/public/quickstart-stable.txt
@@ -1,4 +1,4 @@
-version=0.3.2
-image=softinator/feedbacks@sha256:cfd1284fc9d84e10e4ba9afba11397d472ce851d992ec45ed16fb5f4895d8911
+version=0.3.3
+image=softinator/feedbacks@sha256:730d6b05e44bedb97b3e39bd2bf9d2e0e2fc0017fa6be6552e5664ae6ced5bf0
 compose_sha256=2c078743924d3c0d5128fa79ad354083944acfe904024a5b12a269eceeeecc12
 compose_revision=28b1c714c115388c4a983b670d0a71443eaa3da1