Paul Nothaft 12a9d963f5 chore(security): bump frontend nginx to r4 — close 4 HTTP/2 & module CVEs ...

Trivy flagged nginx 1.28.3-r1 in the frontend image (alerts #371-374):
- CVE-2026-42055 (HIGH) HTTP/2 heap overflow
- CVE-2026-49975 (HIGH) HTTP/2 DoS
- CVE-2026-9256  (HIGH) rewrite_module code exec / DoS
- CVE-2026-48142 (MED)  charset_module memory disclosure

All fixed in nginx 1.28.3-r4. The Dockerfile already ran 'apk upgrade
--no-cache', but the pushed image predated the fixed package and the layer
was cached on r1. Add an explicit nginx upgrade to force the layer to rebuild
against the current Alpine repos (which now carry r4).

2026-07-02 17:14:29 +02:00

..

public

fix(csp): external bootstrap script to survive strict reverse-proxy CSP (#564)

2026-05-31 22:35:00 +02:00

scripts

feat(localization): add i18next extraction helper & refactor backup configuration component to tsx

2026-05-09 18:23:12 +02:00

src

feat(setup): validate setup token at step 1 before advancing

2026-07-02 15:18:22 +02:00

.dockerignore

…

.env.example

fix(brand-title): runtime substitution so GHCR-image users can override (#521 follow-up)

2026-05-21 10:00:21 +02:00

.env.production.example

fix(brand-title): runtime substitution so GHCR-image users can override (#521 follow-up)

2026-05-21 10:00:21 +02:00

.gitignore

…

audit-frontend.json

…

docker-entrypoint.sh

fix(brand-title): runtime substitution so GHCR-image users can override (#521 follow-up)

2026-05-21 10:00:21 +02:00

Dockerfile

chore(security): bump frontend nginx to r4 — close 4 HTTP/2 & module CVEs

2026-07-02 17:14:29 +02:00

Dockerfile.dev

fix(security): scan triage cleanup — drop dead deps, harden Docker/nginx/postMessage

2026-05-07 22:31:51 +02:00

Dockerfile.prod

fix(security): resolve Docker image CVEs for code scanning alerts

2026-03-02 23:06:15 +01:00

eslint.config.js

Fix mobile overlay and deps per #43

2025-10-29 12:19:43 +01:00

i18next.config.ts

feat(localization): add i18next extraction helper & refactor backup configuration component to tsx

2026-05-09 18:23:12 +02:00

index.html

fix(branding): point HTML favicon link at /favicon.ico (the real Safari fix)

2026-06-03 19:01:55 +02:00

nginx.conf

fix(branding): serve favicon via backend route so Safari picks it up

2026-06-03 17:35:32 +02:00

nginx.dev.conf

fix(nginx): honour outer X-Forwarded-Proto when behind a reverse proxy (#547)

2026-05-22 13:32:01 +02:00

package-lock.json

chore(security): close 27 code-scanning alerts via dep + base-image bumps

2026-06-29 23:26:32 +02:00

package.json

chore(main): release 3.79.0-beta.0 (#726)

2026-07-02 15:12:45 +00:00

postcss.config.js

…

tailwind.config.js

feat(theme): expand color settings to 8-token CI palette + alt button

2026-05-05 16:04:43 +02:00

tsconfig.app.json

feat: overhaul public landing page and backup tooling

2025-09-19 16:39:18 +02:00

tsconfig.json

…

tsconfig.node.json

…

vite.config.ts

feat(crm): frontend code — pages + services + components

2026-05-26 18:19:32 +02:00

vitest.setup.ts

Fix admin reference mode regressions

2025-10-02 23:39:17 +02:00