- Fix QuickStartWizard error matching (services wrap errors in new Error(),
losing err.response; now checks err.message as fallback)
- Add shellEscape() to all remaining unescaped CLI commands (removeUser,
enableUser, disableUser, deletePolicy, attachPolicy, createPolicy)
- Fix inconsistent cookie secure flag in logout endpoint
- Add HTML escaping in email report templates to prevent XSS
- Add IP validation on token refresh to enforce IP binding
- Harden email recipient validation against header injection
- Add CSV injection prevention in report export
- Add JWT_SECRET minimum length validation (32 chars) in production
- Update bcrypt 5.x→6.x, nodemailer 6.x→8.x, fix all backend npm vulns
- Redesign UI: new theme (IBM Plex Sans, MinIO-inspired palette), improved
login page, dashboard with skeleton loaders, refined sidebar navigation
- Add missing i18n keys for login and user menu (DE + EN)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Replace deprecated docker-compose with docker compose
- Add package-lock.json files for backend and frontend
- Fix npm ci deployment errors
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
paul
Paul Nothaft