6439cf2e42
chore(main): release 3.76.0-beta.0
2026-06-30 15:02:34 +00:00
541b3d32ef
chore(main): release 3.75.1-beta.0
2026-06-30 14:09:58 +00:00
5925bed761
chore(main): release 3.75.0-beta.0
2026-06-30 09:44:00 +00:00
7546f104a3
chore(security): close 27 code-scanning alerts via dep + base-image bumps
...
Single PR closing every open code-scanning alert at
https://github.com/PicPeak/picpeak/security/code-scanning . Both repos go
from 27 open alerts → 0 across direct deps, transitive deps, and build-
time bundled deps.
## Backend (`backend/package.json` + overrides)
Direct dep bumps:
- axios 1.15.2 → 1.16.0 (closes 9 alerts: 7 high + 1 med + 1 low)
- nodemailer 8.0.10 → ^9.0.1 (closes 1 high — SSRF + file-read via raw option)
- multer 2.1.1 → 2.2.0 (closes 2 alerts: 1 high + 1 med)
- form-data 4.0.5 → 4.0.6 (closes 1 high)
- tar ≥7.5.13 → ≥7.5.16 (closes 1 med)
- postcss 8.5.6 → 8.5.10 (closes 1 med)
- i18next-http-backend 3.0.2 → 3.0.5 (closes 1 med — backend lagged frontend)
- js-yaml 4.1.1 → ^4.2.0 (closes 1 med)
- joi 17.13.3 → ^17.13.4 (closes 1 med)
Overrides updated to match deps (npm rejected the install otherwise) +
nodemailer ^9.0.1 added as override so imapflow + mailparser transitive
bundling of older nodemailer is also fixed. Babel devDep auto-bumped via
`npm audit fix` (low-severity arbitrary file read).
Backend npm audit: 0 vulnerabilities.
## Frontend (`frontend/package.json`)
Direct dep bumps:
- axios 1.15.2 → 1.16.0
- postcss 8.5.6 → 8.5.10
- i18next-http-backend 3.0.5 → 3.0.5 (already current — kept for parity)
`npm audit fix` swept up 12 transitive issues at the same time:
- vitest (1 critical — file read on UI server)
- vite (2 high — fs.deny bypass, NTLM hash via launch-editor)
- ws (2 high — uninitialized memory + DoS)
- dompurify (8 mod — multiple IN_PLACE / hook-pollution XSS vectors)
- react-router-dom + react-router (1 mod transitive)
- esbuild (1 mod — dev server file read)
- @babel/core (1 low)
Frontend npm audit: 0 vulnerabilities.
## Frontend Dockerfile
- Build stage: `node:20-alpine` → `node:22-alpine`
Closes the npm-bundled CVE class (picomatch, ip-address, brace-expansion,
@sigstore/core, tar) that came from Node 20's older bundled npm. Matches
the backend Dockerfile base. The nginx serving stage stays at
`nginx:1.28-alpine` — that tag is rolling, so the next build picks up
the fixed 1.28.3-r4 layer that closes the 4 nginx CVEs.
## Verification
- Backend: `npm audit` → 0 vulnerabilities ✅
- Frontend: `npm audit` → 0 vulnerabilities ✅
- Backend Jest (workflow engine, rounding, WhatsApp): 47/47 pass ✅
- Frontend Vitest: 84/84 pass ✅
- `frontend npm run build`: succeeds ✅
- nodemailer 9 sanity check: our usage is `createTransport({host,port,secure,auth})`
+ `sendMail({from,to,subject,html,text})` — we don't touch the `raw`
option that 9.x tightened, so the major bump is API-compatible.
2026-06-29 23:26:32 +02:00
5ba45753c1
chore(main): release 3.74.0-beta.0
2026-06-29 20:39:22 +00:00
578a73f352
chore(beta): release 3.73.0-beta.0
2026-06-29 17:57:55 +00:00
c4ed88b085
chore(beta): release 3.72.0-beta.0
2026-06-28 19:53:32 +00:00
74d53b22b1
chore(beta): release 3.71.3-beta.0
2026-06-27 19:50:21 +00:00
5c04137a6b
chore(beta): release 3.71.2-beta.0
2026-06-27 19:45:27 +00:00
218b0dfd94
chore(beta): release 3.71.1-beta.0
2026-06-26 11:05:06 +00:00
ef5247d013
chore(beta): release 3.71.0-beta.0
2026-06-25 17:17:34 +00:00
15be3b8d32
Merge pull request #667 from Luca-Timo/feat/workflow-engine
...
feat: admin-configurable workflow engine + dunning/Mahngebühr rework (RFC — feedback welcome)
2026-06-25 19:17:03 +02:00
488735d0cc
chore(beta): release 3.70.0-beta.0
2026-06-23 16:42:29 +00:00
9ae43fc991
chore(beta): release 3.69.1-beta.0
2026-06-23 15:44:38 +00:00
79607c597a
feat(workflows): 'Clean up layout' auto-arrange button (dagre)
...
Adds a one-click tidy that re-lays the graph top-to-bottom with dagre
(@dagrejs/dagre) and fits the view — handles the loop-back cycle by breaking
it internally. en + de string.
2026-06-23 12:03:36 +02:00
5c0396d0c1
feat(workflows): React Flow canvas editor + list + approvals UI
...
Adds the admin Workflows surface (top-level nav, gated by the workflows
flag + workflows.view): a list page (enable toggle, delete, new), a
pending-approvals inbox (confirm/deny), and a React Flow (@xyflow/react)
canvas editor — palette to add nodes, drag handle→handle to connect
(branch/gate/loop expose yes-no / confirm-deny / loop-exit handles), a
side-panel JSON config editor, and save (writes a new version). Routes +
sidebar entry + workflows.service. Build + tsc clean.
NOTE: the workflow page strings render via inline English fallbacks; DE
translations for the workflows.* block are still pending native review.
2026-06-23 02:51:40 +02:00
f9690cb568
chore(beta): release 3.69.0-beta.0
2026-06-22 20:51:07 +00:00
0b72751808
chore(beta): release 3.68.1-beta.0
2026-06-22 19:38:43 +00:00
b86d171a2a
chore(beta): release 3.68.0-beta.0
2026-06-21 19:35:28 +00:00
c978d4d0fd
chore(beta): release 3.67.1-beta.0
2026-06-21 19:33:49 +00:00
9fb6d5dbf9
chore(beta): release 3.67.0-beta.0
2026-06-21 19:20:01 +00:00
5fde5be0d4
chore(beta): release 3.66.1-beta.0
2026-06-19 07:57:49 +00:00
0a91f1042f
chore(beta): release 3.66.0-beta.0
2026-06-19 06:47:36 +00:00
c07fb09fe2
chore(beta): release 3.65.1-beta.0
2026-06-18 19:31:14 +00:00
0156dd4296
chore(beta): release 3.65.0-beta.0
2026-06-18 19:24:25 +00:00
f6ad6b71dd
chore(beta): release 3.64.0-beta.0
2026-06-18 05:18:49 +00:00
d49a4d425d
chore(beta): release 3.63.0-beta.0
2026-06-17 21:28:24 +00:00
ccdb5b9823
chore(beta): release 3.62.0-beta.0
2026-06-17 20:18:03 +00:00
bd07fc474d
chore(beta): release 3.61.0-beta.0
2026-06-13 21:47:18 +00:00
3aaddaf210
chore(beta): release 3.60.6-beta.0
2026-06-10 16:38:01 +00:00
a3e5ba4e75
chore(beta): release 3.60.5-beta.0
2026-06-09 16:11:18 +00:00
6ccac348ac
chore(beta): release 3.60.4-beta.0
2026-06-08 20:52:58 +00:00
13b3a4cfa1
chore(beta): release 3.60.3-beta.0
2026-06-04 20:09:37 +00:00
6ee30a357d
chore(beta): release 3.60.2-beta.0
2026-06-04 19:40:36 +00:00
3361a8bb51
chore(beta): release 3.60.1-beta.0
2026-06-02 07:17:10 +00:00
987911a03b
chore(beta): release 3.60.0-beta.0
2026-06-02 07:11:30 +00:00
b646dab493
chore(beta): release 3.59.1-beta.0
2026-05-31 21:10:15 +00:00
714f7647fc
chore(beta): release 3.59.0-beta.0
2026-05-29 20:54:16 +00:00
d50edcc427
chore(beta): release 3.58.0-beta.0
2026-05-29 20:05:46 +00:00
4989c468a8
chore(beta): release 3.57.2-beta.0
2026-05-29 20:04:53 +00:00
7be484eb8e
chore(beta): release 3.57.1-beta.0
2026-05-29 20:03:02 +00:00
463ef4d0fd
chore(beta): release 3.57.0-beta.0
2026-05-29 14:25:27 +00:00
84486c65f1
chore(beta): release 3.56.0-beta.0
2026-05-29 09:27:47 +00:00
5f0fcc225c
Merge pull request #555 from Luca-Timo/feat/crm-pr
...
feat: CRM module — quotes, contracts, invoices, hours, calendar, tax
2026-05-29 11:27:23 +02:00
fd8ee5d52c
chore(beta): release 3.55.0-beta.0
2026-05-27 13:53:11 +00:00
54b185db47
chore(beta): release 3.54.7-beta.0
2026-05-26 20:54:29 +00:00
a7e16e7bf6
feat(crm): frontend code — pages + services + components
...
Brings in the full frontend CRM stack: admin authoring pages,
customer-portal surfaces, public response flows, typed services,
and the supporting component library. i18n locale JSON is the next
commit (kept separate so reviewers can read it as data).
Pages
- Quotes: list / editor / detail / public accept-decline
- Invoices: list / editor / detail / public payment-check
- Contracts: list / editor / detail / block library / public sign
- Calendar (FullCalendar — admin-only v1)
- Tax report (period picker + CSV/PDF export)
- Hours (logged time entries, per-customer)
- Deals lineage (DocumentLineageCard surfaces)
- CRM Development (admin dev tools, gated by crmDevelopment flag)
- Customer-portal pages for quotes / invoices / contracts
- Settings reorg: CRM-Settings group + dedicated tabs for Business
Profile, CRM behaviour, Contracts block library, Reminder emails
- BrandingPage typography (PDF font picker)
- EventDetailsPage / CustomerDetailPage / CreateEventPage extensions
(event-time fields, hours toggle, per-event reminder override)
Services (typed)
- quotes.service, bills.service, contracts.service
- customerAdmin.service, deals.service, calendar.service,
taxReport.service, contracts-blocks.service
- businessProfile.service (timezone, font picker, bank accounts)
- useInstallmentDefaults hook, useLocalizedDate dateInputLang extension
Components (admin)
- CustomerPicker (shared across quote/invoice/contract editors)
- LineItemsTable (hierarchy + details_text, memoised pricing)
- InstallmentsPanel (simple + advanced toggle, fixed-date vs trigger)
- DocumentLineageCard (deal_uuid grouped view)
- EditInstallmentPlanModal (atomic post-spawn plan reshape)
- EventReminderOverrideCard, EmailTemplateEditor (tiptap),
PdfFontPicker, IntegrityCheckCard
- Feature-flag context + RequireFeature wrapper + AdminSidebar
featureFlagsAny derivation + UI-hiding sweep
Build infra
- vite.config: fullcalendar chunk carved off (~200 KB lazy-loaded)
- frontend/package.json: tiptap, fullcalendar, signature_pad,
react-international-phone, et al.
- tailwind + prose styles updated for editor surfaces
3-way merge note: 1 conflict (CustomerDetailPage.tsx) hand-resolved
to keep upstream's SUPPORTED_LANGUAGES.map() data-driven pattern
over feat/crm's hardcoded option list; feat/crm's DecimalInput
import preserved alongside.
2026-05-26 18:19:32 +02:00
08fa2e9b63
chore(beta): release 3.54.6-beta.0
2026-05-25 20:19:09 +00:00
793aa1247e
chore(beta): release 3.54.5-beta.0
2026-05-22 12:41:21 +00:00
27e9b0535e
Merge pull request #545 from the-luap/chore/clawpatch-review-fixes
...
chore: address clawpatch review findings
2026-05-21 19:07:17 +02:00
github-actions[bot]