bec36fc99f
security: pin axios to 1.14.0 to prevent supply chain attack
...
Axios versions 1.14.1 and 0.30.4 were compromised on March 31, 2026
with a RAT dropper (plain-crypto-js) attributed to North Korean threat
actor UNC1069/Sapphire Sleet. The malicious versions have been removed
from npm but our ^1.12.2 range could have pulled 1.14.1 on next install.
Pin to exact version 1.14.0 (latest safe release) in both frontend and
backend package.json and lock files to prevent any future resolution to
compromised versions.
References:
- https://github.com/axios/axios/issues/10604
- https://snyk.io/blog/axios-npm-package-compromised-supply-chain-attack-delivers-cross-platform/
2026-04-05 18:40:24 +02:00
4272618b3f
fix(security): resolve all npm audit vulnerabilities
...
Frontend (6 → 0 vulnerabilities):
- axios: update to fix DoS via __proto__ key in mergeConfig (CVE-2026-25639)
- swiper: update to fix prototype pollution (critical)
- rollup: update to fix arbitrary file write via path traversal
- minimatch: update to fix multiple ReDoS vulnerabilities
- ajv: update to fix ReDoS with $data option
- markdown-it: update to fix ReDoS
Backend (32 → 0 vulnerabilities):
- multer: update to fix DoS via incomplete cleanup and resource exhaustion
- minimatch: update to fix multiple ReDoS vulnerabilities
- Add npm overrides for transitive dependencies:
- fast-xml-parser >=5.3.8 (fixes XSS, DoS, stack overflow via AWS SDK)
- qs >=6.14.2 (fixes arrayLimit bypass DoS via Express)
- tar >=7.5.8 (fixes path traversal and hardlink attacks via sqlite3)
Docker:
- Pin nginx base image to 1.27-alpine in Dockerfile.prod
- Update security comments in backend Dockerfile
- Existing apk upgrade --no-cache ensures OpenSSL/libexpat CVEs are
patched at build time (OpenSSL 3.5.5, Alpine 3.23.3)
2026-03-02 10:36:47 +01:00
6491184402
chore: add dependencies for Gallery Premium/Story layouts
...
Add missing npm packages required for new gallery layouts:
- yet-another-react-lightbox: lightbox component
- framer-motion: animations
- photoswipe: photo gallery
- swiper: carousel/slider
2026-02-06 21:43:09 +01:00
608bbd50e7
feat: add justified layout modes and aspect-ratio-aware mosaic ( #146 )
...
- Add Flickr justified-layout and react-photo-album as masonry mode options
- Implement aspect-ratio-aware mosaic layout that dynamically selects
patterns based on photo orientations to minimize cropping
- Add 9 mosaic pattern types optimized for different orientation combinations
- Add theme customizer options for masonry mode selection (columns/rows/flickr/justified)
- Add i18n translations for new layout options
2026-01-28 22:31:34 +01:00
8097a0cb53
fix: update packages to fix security vulnerabilities
...
- react-router-dom 6.30.2 → 6.30.3 (XSS via Open Redirects)
- react-router 6.30.2 → 6.30.3
- @remix-run/router 1.23.1 → 1.23.2
- lodash 4.17.21 → 4.17.23 (Prototype Pollution)
2026-01-27 11:40:18 +01:00
892e47d017
feat: add multi-administrator support with RBAC and fix backup/restore for S3
...
## Multi-Administrator System
- Add role-based access control (RBAC) with predefined roles (Super Admin, Admin, Editor, Viewer)
- Add granular permissions system for all admin operations
- Add admin user management page with invite functionality
- Add email invitation system for new administrators
- Add permission middleware protecting all admin routes
- Add PermissionGate component for frontend permission checks
- Track event creator (created_by) for audit purposes
## Backup & Restore Fixes
- Fix S3 backup: endpoint URL handling, manifest loading, field name compatibility
- Fix S3 restore: add list-backups endpoint, transform S3 config from frontend format
- Fix PostgreSQL compatibility: add .returning('id') for insert operations
- Fix disk space check: use df command, handle unknown space gracefully
- Fix dry-run validation to not block on warnings
- Fix req.user → req.admin in restore routes
## Database Migrations
- 054: Add roles table with predefined roles
- 055: Add permissions table
- 056: Add role_permissions junction table
- 057: Add role_id to admin_users
- 058: Add admin_invitations table
- 059: Add admin email templates
- 060: Add created_by to events table
## Other Improvements
- Update .gitignore to exclude planning docs and local backup directory
- Remove SQLite database file from tracking
- Add i18n translations for user management (EN/DE)
2026-01-07 17:10:46 +01:00
3424bd22ee
refactor: Phase 1 code consolidation and service layer setup
...
Phase 1.1: Shared parsers utility
- Create backend/src/utils/parsers.js with parseBooleanInput, parseStringInput, etc.
- Create frontend/src/utils/parsers.ts with TypeScript equivalents
- Update routes to import from shared parsers
Phase 1.2: Auth routes consolidation
- Merge auth.js, auth-enhanced.js, auth-enhanced-v2.js into single auth.js
- Add password change and password strength endpoints
- Consolidate middleware (auth.js with token revocation support)
- Update all imports across 14+ route files
Phase 1.3: CreateEvent page consolidation
- Remove duplicate CreateEventPage.tsx (basic version)
- Rename CreateEventPageEnhanced.tsx to CreateEventPage.tsx
- Update exports and imports
Phase 1.4: CMS page consolidation
- Remove duplicate CMSPage.tsx (basic version)
- Rename CMSPageEnhanced.tsx to CMSPage.tsx
- Update exports and imports
Phase 1.5: Multer config factory
- Create backend/src/config/multerConfig.js
- Centralized upload configuration with presets for photos, logos, favicons
- Reusable helpers: createDiskStorage, createFileFilter, uploadTimeoutMiddleware
Phase 2.1: Event service layer
- Create backend/src/services/eventService.js
- Move event business logic out of routes
- Functions: createEvent, getAllEvents, updateEvent, deleteEvent, extendExpiration
2026-01-02 10:12:24 +01:00
paul
7c7498385f
Regenerate frontend package-lock to match package.json
Build and Push Docker Images / build-backend (push) Failing after 2m44s
Build and Push Docker Images / build-frontend (push) Failing after 11s
Build and Push Docker Images / summary (push) Successful in 3s
2025-11-28 18:44:38 +01:00
5f1affafd8
Update frontend package-lock.json for npm compatibility
...
Regenerate lock file to include missing esbuild platform dependencies
required by newer npm versions.
2025-11-28 17:54:56 +01:00
paul
9a75f1c929
Add video support, media filters, and translations
Build and Push Docker Images / build-backend (push) Failing after 14m2s
Build and Push Docker Images / build-frontend (push) Failing after 44m43s
Build and Push Docker Images / summary (push) Successful in 3s
2025-11-28 13:29:44 +01:00
paul
bce5f749b1
Merge remote-tracking branch 'upstream/main'
Build and Push Docker Images / build-backend (push) Failing after 13m5s
Build and Push Docker Images / build-frontend (push) Failing after 2m55s
Build and Push Docker Images / summary (push) Successful in 3s
2025-11-25 22:43:48 +02:00
f327f4cbcd
Update package-lock.json files to sync with security overrides
2025-11-25 20:40:29 +00:00
paul
a971eee7b9
Merge remote-tracking branch 'origin/main'
Build and Push Docker Images / build-frontend (push) Has been cancelled
Build and Push Docker Images / summary (push) Has been cancelled
Build and Push Docker Images / build-backend (push) Has started running
2025-11-25 22:03:02 +02:00
paul
8e8dd358bf
Merge remote-tracking branch 'upstream/main'
2025-11-25 22:02:23 +02:00
f29e9db99d
chore: bump version to 1.1.15 (backend + frontend)
continuous-integration/drone/push Build is passing
continuous-integration/drone/tag Build is passing
2025-10-29 11:30:46 +00:00
paul
69538b86ea
Fix mobile overlay and deps per #43
Test and Lint / backend-test (pull_request) Successful in 1m24s
Test and Lint / frontend-test (pull_request) Successful in 1m59s
continuous-integration/drone/pr Build is passing
2025-10-29 12:19:43 +01:00
paul
f6f1c31369
Fix mobile overlay and deps per #43
continuous-integration/drone/pr Build is failing
Test and Lint / backend-test (pull_request) Successful in 2m10s
Test and Lint / frontend-test (pull_request) Successful in 2m0s
2025-10-29 11:11:53 +01:00
b76e45cb54
chore: bump version to 1.1.14 (backend + frontend)
continuous-integration/drone/push Build is passing
continuous-integration/drone/tag Build is passing
2025-10-20 12:41:34 +00:00
07759a0e40
chore: bump version to 1.1.13 (backend + frontend)
continuous-integration/drone/push Build is passing
continuous-integration/drone/tag Build is passing
2025-10-15 05:29:19 +00:00
8c690155bf
chore: bump frontend version to 1.1.12
2025-10-13 18:19:57 +00:00
f20472ca26
chore: bump version to 1.1.11 (backend + frontend)
2025-10-12 19:23:19 +00:00
87f4526220
chore: bump version to 1.1.10 (backend + frontend)
2025-10-12 19:18:37 +00:00
d42a11680f
chore: bump version to 1.1.9 (backend + frontend)
2025-10-06 13:18:43 +00:00
38dd74b893
chore: bump version to 1.1.8 (backend + frontend)
2025-10-03 05:19:52 +00:00
paul
775e417e55
Fix admin reference mode regressions
2025-10-02 23:39:17 +02:00
45e835a51a
chore: bump frontend version to 1.1.7
2025-09-27 06:14:25 +00:00
afc00090cf
chore: bump frontend version to 1.1.6
2025-09-27 06:11:45 +00:00
fb739f221d
chore: bump version to 1.1.4 (backend + frontend)
2025-09-24 15:39:34 +00:00
9d2726b3d3
chore: bump frontend version to 1.1.1
2025-09-22 12:41:16 +00:00
paul
39d2244e1e
chore: switch versioning workflows to manual triggers
2025-09-19 22:31:55 +02:00
eb626be22c
chore: bump version to 1.0.130 (backend + frontend)
2025-09-19 14:47:37 +00:00
e51347d0a1
chore: bump version to 1.0.128 (backend + frontend)
2025-09-18 14:05:43 +00:00
paul
71e7179145
Harden auth cookies and fix native schema for event creation
Mirror to GitHub / mirror (push) Successful in 45s
Test and Lint / backend-test (push) Successful in 1m37s
Test and Lint / frontend-test (push) Successful in 2m8s
Version and Release / version-bump (push) Successful in 1m0s
Version and Release / trigger-drone (push) Successful in 3s
2025-09-18 15:59:26 +02:00
1d8be3d840
chore: bump frontend version to 1.0.127
2025-09-17 21:40:18 +00:00
ed2a278da2
chore: bump frontend version to 1.0.126
2025-09-17 21:22:44 +00:00
eb3751cb52
chore: bump frontend version to 1.0.125
2025-09-14 15:08:14 +00:00
0d77a3a0a8
chore: bump version to 1.0.124 (backend + frontend)
2025-09-14 14:25:37 +00:00
aa9b3a0227
chore: bump version to 1.0.123 (backend + frontend)
2025-09-14 13:53:37 +00:00
05ebaaeedb
chore: bump version to 1.0.122 (backend + frontend)
2025-09-09 18:54:09 +00:00
6a4b549d9f
chore: bump version to 1.0.121 (backend + frontend)
2025-09-09 18:45:28 +00:00
8404125ff0
chore: bump version to 1.0.117 (backend + frontend)
2025-09-09 17:10:38 +00:00
9fd6b44487
chore: bump version to 1.0.116 (backend + frontend)
2025-09-09 15:47:41 +00:00
f2abb40987
chore: bump version to 1.0.115 (backend + frontend)
2025-09-09 15:32:47 +00:00
4aa0ff705f
chore: bump version to 1.0.114 (backend + frontend)
2025-09-09 15:25:05 +00:00
448882cfef
chore: bump version to 1.0.113 (backend + frontend)
2025-09-09 13:31:10 +00:00
798f6211e0
chore: bump version to 1.0.112 (backend + frontend)
2025-09-09 09:46:52 +00:00
afeb35a446
chore: bump version to 1.0.111 (backend + frontend)
2025-09-06 07:22:38 +00:00
78ab0ad2e9
chore: bump version to 1.0.110 (backend + frontend)
2025-09-05 22:06:43 +00:00
1d826accdc
chore: bump version to 1.0.109 (backend + frontend)
2025-09-05 13:07:58 +00:00
f7a8765f58
chore: bump version to 1.0.108 (backend + frontend)
2025-09-02 15:46:57 +00:00
Paul Nothaft
paul