gustavosantos/MIKROTIK-RMM
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
116 Commits 2 Branches 0 Tags
b3ba2b98dc51d4096f7167e67faccbb3453a92ba
Commit Graph
21 Commits
Author SHA1 Message Date
2GT-RichandClaude Opus 4.8 b3ba2b98dc chore(security): resolve CodeQL findings — unbiased voucher RNG, linear email check, rate-limit query filter (v0.17.2-beta) 
Address the open CodeQL code-scanning alerts:
- guestWifi voucher codes now use rejection sampling so the character
  distribution is uniform (fixes js/biased-cryptographic-random).
- Scheduled-report recipient validation replaced the backtracking email regex
  with a linear split-based check (fixes js/polynomial-redos).
- Add .github/codeql/codeql-config.yml excluding js/missing-rate-limiting:
  rate limiting is applied globally via app.use('/api', rateLimitRedis) plus
  per-route limiters, which CodeQL can't attribute to individual handlers, so
  that rule fired ~38 false positives.

Remaining alerts are dismissed as accepted/false-positive (RouterOS MD5 API
login and self-signed cert acceptance are protocol-mandated; log sites already
strip CRLF).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-07-18 09:56:18 -07:00
2GT-RichandClaude Opus 4.8 3fe8341b71 chore(deps): batch Dependabot bumps + ES2022 tsconfig (v0.17.1-beta) 
Apply the open Dependabot updates as one validated batch (build + test + lint +
local Docker smoke test all green) rather than 11 separate merges.

Backend:
- @types/node 20.19.43 -> 26.1.1 (aligns types with the Node 26 runtime)
- typescript-eslint 8.58.2 -> 8.64.0
- eslint 10.5.0 -> 10.7.0
- eslint-plugin-security 4.0.0 -> 4.0.1
- nodemailer 9.0.1 -> 9.0.3
- tsconfig target/lib ES2020 -> ES2022 so Array.prototype.at() (devices.ts)
  type-checks under the new @types/node — this is what unblocked #72.

Frontend:
- axios 1.18.0 -> 1.18.1
- react-router-dom 7.18.0 -> 7.18.1
- lucide-react 1.21.0 -> 1.23.0
- @xyflow/react 12.10.2 -> 12.11.1
- @vitejs/plugin-react 6.0.2 -> 6.0.3

CI:
- docker/setup-qemu-action v3 -> v4

Closes #58
Closes #60
Closes #62
Closes #65
Closes #66
Closes #67
Closes #68
Closes #69
Closes #70
Closes #71
Closes #72

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-07-18 09:33:26 -07:00
2GT-RichandClaude Fable 5 6f0fbdb74f chore(deps): dependency upgrades — react-router 7, eslint 10, TS 6, plugin-react 6; drop unused zod (v0.16.5-beta) 
Applies the open dependabot PRs in one validated pass:

- react-router-dom 6.30 -> 7.18 (drop-in for our API surface; verified
  in-browser: login, sidebar routing, ?type= deep-links, legacy redirects)
- react + react-dom -> 19.2.7, axios -> 1.18.0, lucide-react -> 1.21.0
- actions/checkout v6 -> v7 across all workflows
- backend: eslint 10 + @eslint/js 10 (fix 5 new no-useless-assignment
  findings), typescript 6.0.3 (explicit types: ["node","jest"] in
  tsconfig — TS 6 no longer auto-includes @types), remove zod (unused)
- frontend: @vitejs/plugin-react 6

Not taken: ioredis 5.11.1 (#55) — bullmq pins ioredis to exactly 5.10.1
(including latest bullmq 5.79), so the bump nests a second ioredis and
breaks BullMQ connection types.

Validation: backend tsc/lint/build + 92 tests green; frontend tsc/lint/
build + 11 tests green; docker stack rebuilt and browser-verified.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-03 20:35:21 -07:00
2GT-RichandClaude Fable 5 662d7852fa ci(publish): build & push multi-arch images (amd64 + arm64) to GHCR 
Add docker/setup-qemu-action and platforms: linux/amd64,linux/arm64 to
both the backend and nginx build-push steps so GHCR images run natively
on arm64 (ARMv8) hosts instead of amd64-only. Refs #56.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-02 22:39:27 -07:00
2GT-Rich 73087a6e40 Merge pull request #21 from 2GT-Media-Group-LLC/dependabot/github_actions/docker/build-push-action-7 
Bump docker/build-push-action from 6 to 7
 2026-05-25 16:03:21 -07:00
2GT-Rich 86f4fbc073 Merge pull request #20 from 2GT-Media-Group-LLC/dependabot/github_actions/actions/checkout-6 
Bump actions/checkout from 4 to 6
 2026-05-25 16:03:18 -07:00
2GT-Rich 039e18131e Merge pull request #19 from 2GT-Media-Group-LLC/dependabot/github_actions/docker/setup-buildx-action-4 
Bump docker/setup-buildx-action from 3 to 4
 2026-05-25 16:03:14 -07:00
2GT-Rich 9f729d93a9 Merge pull request #18 from 2GT-Media-Group-LLC/dependabot/github_actions/docker/login-action-4 
Bump docker/login-action from 3 to 4
 2026-05-25 16:03:11 -07:00
dependabot[bot] 1798406b84 Bump docker/build-push-action from 6 to 7 
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6 to 7.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/v6...v7)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-20 12:46:18 +00:00
dependabot[bot] 2dad8345a3 Bump actions/checkout from 4 to 6 
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v4...v6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-20 12:46:16 +00:00
dependabot[bot] 3f589fd081 Bump docker/setup-buildx-action from 3 to 4 
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3 to 4.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](https://github.com/docker/setup-buildx-action/compare/v3...v4)

---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-20 12:46:12 +00:00
dependabot[bot] a8dd47a4d0 Bump docker/login-action from 3 to 4 
Bumps [docker/login-action](https://github.com/docker/login-action) from 3 to 4.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/v3...v4)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-20 12:46:10 +00:00
dependabot[bot] 640b474326 Bump docker/metadata-action from 5 to 6 
Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5 to 6.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](https://github.com/docker/metadata-action/compare/v5...v6)

---
updated-dependencies:
- dependency-name: docker/metadata-action
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-20 12:46:06 +00:00
2GT-RichandClaude Sonnet 4.6 9b303c8cbc Fix publish workflow: use 'file' instead of 'dockerfile' parameter 
docker/build-push-action@v6 renamed the parameter from 'dockerfile' to
'file'. The backend succeeded by luck (default Dockerfile matched), but
nginx failed because the Dockerfile isn't in the root context directory.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-19 10:27:49 -07:00
2GT-RichandClaude Sonnet 4.6 25ae3854b4 Add GHCR publish workflow and pre-built image deployment 
Adds a GitHub Actions workflow that builds and pushes backend and nginx
images to GitHub Container Registry on every merge to main and on
releases. Adds docker-compose.ghcr.yml for end users who want to deploy
without cloning the repo, and updates the README with Quick Deploy
instructions alongside the existing build-from-source guide.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-19 10:21:21 -07:00
2GT-Rich fe1f7a4001 Merge pull request #4 from 2GT-Media-Group-LLC/dependabot/github_actions/github/codeql-action-4 
Bump github/codeql-action from 3 to 4
 2026-04-19 09:46:42 -07:00
2GT-Rich 241204a40d Merge pull request #2 from 2GT-Media-Group-LLC/dependabot/github_actions/actions/setup-node-6 
Bump actions/setup-node from 4 to 6
 2026-04-19 09:46:31 -07:00
dependabot[bot] ed2d757bf4 Bump github/codeql-action from 3 to 4 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3 to 4.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/v3...v4)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-16 16:56:46 +00:00
dependabot[bot] 3fc6a6f350 Bump actions/setup-node from 4 to 6 
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 6.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/v4...v6)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-16 16:56:42 +00:00
dependabot[bot] 24167879ab Bump actions/checkout from 4 to 6 
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v4...v6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-16 16:56:39 +00:00
2GT-Rich e43b80a9a2 Add security standards and CI infrastructure 
- SECURITY.md with vulnerability disclosure policy and self-hosting guidance
- Dependabot config for weekly dependency updates (npm, Docker, Actions)
- ESLint v9 flat config for frontend and backend, with eslint-plugin-security
- GitHub Actions CI: lint, typecheck, build, and npm audit on every push/PR
- CodeQL workflow for automated security scanning (runs on push and weekly)
 2026-04-16 09:55:53 -07:00