npm audit --audit-level=high war im prepush nach dem Baseline-Rollout rot.
npm audit fix ohne --force, package.json unverändert. Geändert:
- body-parser 2.3.0->2.4.0
- iconv-lite 0.7.2->0.7.3
- zod 4.4.1->4.6.7
Moderat offen (Fix nur per --force bzw. Major): esbuild uuid
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- make quick/check/mutation from cj/security-baseline (Makefile unchanged,
settings in baseline.mk), pre-commit, gitleaks, Semgrep rules, ESLint
security rules, Forgejo workflow
- tests/security: generic baseline tests plus app config and role tests
against createApp() with an in-memory database
- extract createApp() from src/server/index.ts; LB_DATABASE_PATH for tests
- fix gaps found by the tests: reject unknown fields on project create,
answer malformed JSON with 400 instead of 500, set nosniff on the API
- npm audit fix (next 16.4.1 and others, no high/critical left)
- clear ESLint errors, safeFileName without control-character regex
- per-project ownership stays an open, documented gap (idorGap -> TODO)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Node 22 leaves active LTS at the end of October. Move the Docker base
image and the documented local requirement to Node 24.
Pull @types/node from ^25 down to ^24 so the type definitions no longer
describe a newer runtime than the one in use. Types ahead of the runtime
let TypeScript accept APIs that are not there at execution time; the
opposite direction is harmless.
Add an engines field to record the supported version. No .nvmrc, since
the project is not used with a Node version manager.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
