Repository navigation
Rc/v5.18.2 - #784
Merged
Merged
Rc/v5.18.2#784
Conversation
Rollback paths referenced db without importing it, which failed flake8 F821 and would raise NameError at runtime.
Unblocked test_inline_scripts_carry_a_nonce so the strict CSP policy can stay enforceable.
Route request.referrer and login next= targets through safe_redirect helpers, pass only same-origin relative paths from the unauthorized handler, and sanitize request-derived values written to logs.
Allowlist CSS colors and image paths in the admin HTML builder, keep sandboxed Jinja rendering explicit, and return generic client errors instead of exception text or stack traces.
Build activity timelines, task selects, column toggles, and edit-timer summaries with DOM APIs/textContent instead of interpolating data into innerHTML.
Run apt-get upgrade during image build and install current pip/setuptools before app requirements so Trivy findings against stale image tooling are addressed on rebuild.
Override the electron-builder transitive sprintf-js with a precision-capped build so GHSA-hp3w-g68c-fv3c clears until upstream publishes a fixed release.
Escape calendar API fields before innerHTML, swap filter HTML via DOMParser, and flash generic messages for task bulk-delete failures.
Analyze Python and JavaScript on develop/main so stale GitHub code-scanning alerts can clear on current HEAD.
Add path/redirect/log sanitizer helpers and CodeQL models, harden LDAP/calendar sinks, stop client-facing exception leaks, encrypt desktop store with webSecurity, and exclude tests from analysis.
Switch CodeQL to security-extended, rebuild validated redirects, harden outbound URL/OIDC/SSRF checks, sanitize logs, and drop localStorage secret fallbacks in the desktop app.
Add safe_redirect() sink with validation, stop OIDC metadata IP URL rewrite, tighten support-ui href host allowlist, and suppress accepted token/LDAP alerts.
Rebuild OIDC discovery URLs from validated issuer components, stop assigning support-tier hrefs from config, and keep 5xx API errors generic.
Align setup.py, VERSION, clients, README, and changelog for the 5.18.2 release; also fix a broken API import and strip UTF-8 BOMs from model modules.
Database Migration Validation❌ Migration validation failed! Issues detected:
Please review the migration files and fix the issues before merging. This comment was automatically generated by the Migration Validation workflow. |
❌ CI Test ResultsOverall Status: 2 test suite(s) failed Test Results: 3/9 passed Test Suites:
Commit: e5bf2f4 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Brief description of the change and why it's needed.
Type of change
Checklist
pytest).Related issues
Fixes # (issue number, if applicable)
See CONTRIBUTING.md and CHANGELOG.md for guidelines.