Paul Nothaft cee0a380a6 fix(deps): bump nanoid and js-yaml out of two HIGH advisories (stable) (#1014) ...

Backport of #1013 to the curated channel. Both are production dependencies of the backend image (npm ci --omit=dev):

- nanoid 3.3.16 -> 3.3.18 (CVE-2026-67213, infinite loop in customAlphabet)
- js-yaml 4.3.0 -> 4.3.1 (GHSA-5p4m-2wfm-xmqj, quadratic CPU in !!omap resolution)

Stable reported no open alerts only because its last Trivy scan ran on 2026-08-04 with v3.45.14, before either advisory was published — the vulnerable versions were present in the lockfile regardless.

Lockfile-only; the existing ^ ranges already permitted both fixes.

2026-08-10 11:00:03 +02:00

..

__tests__

fix(security): vet the destination project when linking a deal (stable) (#992)

2026-08-04 16:36:28 +02:00

assets/fonts

feat(crm): backend code — services + routes + utilities + tests

2026-05-26 18:18:51 +02:00

docs

…

migrations

fix(security): enforce project ownership on project + project-email routes (stable) (#966)

2026-08-02 21:24:41 +02:00

scripts

feat(auth): admin TOTP MFA — enrollment, login challenge, recovery, CLI reset

2026-07-03 11:33:38 +02:00

src

fix(security): vet the destination project when linking a deal (stable) (#992)

2026-08-04 16:36:28 +02:00

.dockerignore

…

.env.example

feat(auth): admin TOTP MFA — enrollment, login challenge, recovery, CLI reset

2026-07-03 11:33:38 +02:00

.eslintrc.js

…

audit-backend.json

…

dependencies-backend.json

…

Dockerfile

fix(security): close 5 Trivy alerts — postcss/tar bumps + drop npm from the runtime image (stable) (#879)

2026-07-27 09:54:43 +02:00

Dockerfile.dev

…

ecosystem.config.js

…

jest.config.js

fix(tests): raise jest timeouts to the 120s convention (stable) (#902)

2026-07-29 12:48:50 +02:00

jest.setup.js

…

knexfile.js

…

package-lock.json

fix(deps): bump nanoid and js-yaml out of two HIGH advisories (stable) (#1014)

2026-08-10 11:00:03 +02:00

package.json

chore(stable): release 3.45.14 (#990)

2026-08-04 21:26:28 +02:00

server.js

fix(security): bound inbound-mail resources, redact secrets from logs (stable) (#965)

2026-08-02 21:18:49 +02:00

test-filter.js

…

wait-for-db.sh

fix(security): close 5 Trivy alerts — postcss/tar bumps + drop npm from the runtime image (stable) (#879)

2026-07-27 09:54:43 +02:00