gustavosantos/MIKROTIK-RMM
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
28 Commits 2 Branches 0 Tags
6cb2e6844c690c3d3c6145915227b46f881116e3
Commit Graph
4 Commits
Author SHA1 Message Date
2GT-Rich 9511927a05 Merge pull request #14 from 2GT-Media-Group-LLC/dependabot/npm_and_yarn/backend/dotenv-17.4.2 
Bump dotenv from 16.6.1 to 17.4.2 in /backend
 2026-04-19 09:46:50 -07:00
2GT-Rich bd85f988da Fix all backend lint errors and security vulnerabilities 
Backend lint (4 errors fixed):
- auth.ts: suppress @typescript-eslint/no-namespace on Express global
  augmentation (legitimate TS pattern for extending Request type)
- clients.ts: remove unnecessary \. escape in regex character class
- devices.ts: remove unnecessary \- escape by moving hyphen to front [-:]
- PollerService.ts: add comment to empty catch block

Security audit (high/critical CVEs fixed):
- frontend: bump axios (critical SSRF), lodash (high injection),
  follow-redirects (moderate) via npm audit fix
- backend: bump nodemailer 6.x → 8.0.5 (fixes 4 SMTP injection CVEs)
 2026-04-16 11:08:42 -07:00
dependabot[bot] c1eb857fd0 Bump dotenv from 16.6.1 to 17.4.2 in /backend 
Bumps [dotenv](https://github.com/motdotla/dotenv) from 16.6.1 to 17.4.2.
- [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md)
- [Commits](https://github.com/motdotla/dotenv/compare/v16.6.1...v17.4.2)

---
updated-dependencies:
- dependency-name: dotenv
  dependency-version: 17.4.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-16 16:57:24 +00:00
2GT-Rich e43b80a9a2 Add security standards and CI infrastructure 
- SECURITY.md with vulnerability disclosure policy and self-hosting guidance
- Dependabot config for weekly dependency updates (npm, Docker, Actions)
- ESLint v9 flat config for frontend and backend, with eslint-plugin-security
- GitHub Actions CI: lint, typecheck, build, and npm audit on every push/PR
- CodeQL workflow for automated security scanning (runs on push and weekly)
 2026-04-16 09:55:53 -07:00