Paul Nothaft 0fe5792a7d fix(deps): bump ip-address, brace-expansion and postcss for open CVEs (stable) (#988) ...

Backport of #987. stable carried the same vulnerable versions.

  brace-expansion  5.0.8  -> 5.0.9   CVE-2026-69152 (high)
  ip-address       10.2.0 -> 10.4.0  CVE-2026-69192 (high), CVE-2026-54272,
                                     CVE-2026-69198 (medium) — SSRF and
                                     trust-boundary bypasses
  postcss          8.5.18 -> 8.5.23  CVE-2026-69153 (medium)

Lockfile holds exactly one entry per package, all at or above the fixed
version; the image installs via npm ci --omit=dev.

2026-08-04 14:36:10 +02:00

..

__tests__

fix(projects): stop the cockpit offering email controls the API rejects (stable) (#977)

2026-08-03 14:49:04 +02:00

assets/fonts

feat(crm): backend code — services + routes + utilities + tests

2026-05-26 18:18:51 +02:00

docs

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

migrations

fix(security): enforce project ownership on project + project-email routes (stable) (#966)

2026-08-02 21:24:41 +02:00

scripts

feat(auth): admin TOTP MFA — enrollment, login challenge, recovery, CLI reset

2026-07-03 11:33:38 +02:00

src

fix(projects): stop the cockpit offering email controls the API rejects (stable) (#977)

2026-08-03 14:49:04 +02:00

.dockerignore

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

.env.example

feat(auth): admin TOTP MFA — enrollment, login challenge, recovery, CLI reset

2026-07-03 11:33:38 +02:00

.eslintrc.js

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

audit-backend.json

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

dependencies-backend.json

Upgrade nodemailer to 7.0.7 (GHSA-mm7p-fcc7-pg87)

2025-10-13 21:11:38 +02:00

Dockerfile

fix(security): close 5 Trivy alerts — postcss/tar bumps + drop npm from the runtime image (stable) (#879)

2026-07-27 09:54:43 +02:00

Dockerfile.dev

fix(security): scan triage cleanup — drop dead deps, harden Docker/nginx/postMessage

2026-05-07 22:31:51 +02:00

ecosystem.config.js

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

jest.config.js

fix(tests): raise jest timeouts to the 120s convention (stable) (#902)

2026-07-29 12:48:50 +02:00

jest.setup.js

feat: overhaul public landing page and backup tooling

2025-09-19 16:39:18 +02:00

knexfile.js

Fix PicPeak regressions and close #22 #24 #25 #26 #27 #28

2025-09-21 22:03:07 +02:00

package-lock.json

fix(deps): bump ip-address, brace-expansion and postcss for open CVEs (stable) (#988)

2026-08-04 14:36:10 +02:00

package.json

fix(deps): bump ip-address, brace-expansion and postcss for open CVEs (stable) (#988)

2026-08-04 14:36:10 +02:00

server.js

fix(security): bound inbound-mail resources, redact secrets from logs (stable) (#965)

2026-08-02 21:18:49 +02:00

test-filter.js

docs: fix deployment/admin routing and CORS guidance; add AGENTS.md; ignore AGENTS.md (refs #18)

2025-09-05 15:01:16 +02:00

wait-for-db.sh

fix(security): close 5 Trivy alerts — postcss/tar bumps + drop npm from the runtime image (stable) (#879)

2026-07-27 09:54:43 +02:00