Paul Nothaft 64e4925fbb chore(security): bump backend npm 10 -> 11 to patch bundled sigstore/tar ...

Closes Trivy alerts #375 (sigstore CVE-2026-48815), #321 (@sigstore/core),
#314 (tar) — npm@10 bundles the vulnerable sigstore 3.1.0; npm 11 ships the
patched 4.x. Safe because this npm is CLI-only in the final image: runtime
deps come from the builder stage's node_modules and the entrypoint runs node,
not npm, so the install-behaviour issues that motivated the 10.x pin never run
here. npm 11 requires Node >=22.9 — satisfied by node:22-alpine.

2026-07-02 17:16:09 +02:00

..

__tests__

feat(setup): validate setup token at step 1 before advancing

2026-07-02 15:18:22 +02:00

assets/fonts

feat(crm): backend code — services + routes + utilities + tests

2026-05-26 18:18:51 +02:00

docs

…

migrations

feat: zero-config first run — in-browser admin bootstrap + auto-generated secrets

2026-07-01 14:49:18 +02:00

scripts

feat: native S3 storage backend (#328) + presigned download follow-up

2026-04-28 10:06:36 +02:00

src

feat(setup): validate setup token at step 1 before advancing

2026-07-02 15:18:22 +02:00

.dockerignore

…

.env.example

fix(auth): default COOKIE_SECURE to 'auto' in production + first-install UX (#427)

2026-05-09 15:55:09 +02:00

.eslintrc.js

…

audit-backend.json

…

dependencies-backend.json

…

Dockerfile

chore(security): bump backend npm 10 -> 11 to patch bundled sigstore/tar

2026-07-02 17:16:09 +02:00

Dockerfile.dev

fix(security): scan triage cleanup — drop dead deps, harden Docker/nginx/postMessage

2026-05-07 22:31:51 +02:00

ecosystem.config.js

…

jest.config.js

…

jest.setup.js

…

knexfile.js

…

package-lock.json

chore(security): close 27 code-scanning alerts via dep + base-image bumps

2026-06-29 23:26:32 +02:00

package.json

chore(main): release 3.79.0-beta.0 (#726)

2026-07-02 15:12:45 +00:00

server.js

feat(setup): validate setup token at step 1 before advancing

2026-07-02 15:18:22 +02:00

test-filter.js

…

wait-for-db.sh

feat: zero-config first run — in-browser admin bootstrap + auto-generated secrets

2026-07-01 14:49:18 +02:00