dependabot[bot]
ea58aaef5f
Bump helmet from 7.2.0 to 8.1.0 in /backend
...
Bumps [helmet](https://github.com/helmetjs/helmet ) from 7.2.0 to 8.1.0.
- [Changelog](https://github.com/helmetjs/helmet/blob/main/CHANGELOG.md )
- [Commits](https://github.com/helmetjs/helmet/compare/v7.2.0...v8.1.0 )
---
updated-dependencies:
- dependency-name: helmet
dependency-version: 8.1.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-04-20 12:46:29 +00:00
2GT-Rich
5d96503832
Add Jest unit test infrastructure and initial test suite
...
Sets up Jest + ts-jest for the backend and adds 47 tests across 5
suites covering crypto utilities, OUI vendor lookup, auth middleware,
AlertService dispatch/cooldown logic, and DeviceCollector uptime parsing.
2026-04-19 10:21:14 -07:00
2GT-Rich
9511927a05
Merge pull request #14 from 2GT-Media-Group-LLC/dependabot/npm_and_yarn/backend/dotenv-17.4.2
...
Bump dotenv from 16.6.1 to 17.4.2 in /backend
2026-04-19 09:46:50 -07:00
2GT-Rich
bd85f988da
Fix all backend lint errors and security vulnerabilities
...
Backend lint (4 errors fixed):
- auth.ts: suppress @typescript-eslint/no-namespace on Express global
augmentation (legitimate TS pattern for extending Request type)
- clients.ts: remove unnecessary \. escape in regex character class
- devices.ts: remove unnecessary \- escape by moving hyphen to front [-:]
- PollerService.ts: add comment to empty catch block
Security audit (high/critical CVEs fixed):
- frontend: bump axios (critical SSRF), lodash (high injection),
follow-redirects (moderate) via npm audit fix
- backend: bump nodemailer 6.x → 8.0.5 (fixes 4 SMTP injection CVEs)
2026-04-16 11:08:42 -07:00
dependabot[bot]
c1eb857fd0
Bump dotenv from 16.6.1 to 17.4.2 in /backend
...
Bumps [dotenv](https://github.com/motdotla/dotenv ) from 16.6.1 to 17.4.2.
- [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md )
- [Commits](https://github.com/motdotla/dotenv/compare/v16.6.1...v17.4.2 )
---
updated-dependencies:
- dependency-name: dotenv
dependency-version: 17.4.2
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-04-16 16:57:24 +00:00
2GT-Rich
e43b80a9a2
Add security standards and CI infrastructure
...
- SECURITY.md with vulnerability disclosure policy and self-hosting guidance
- Dependabot config for weekly dependency updates (npm, Docker, Actions)
- ESLint v9 flat config for frontend and backend, with eslint-plugin-security
- GitHub Actions CI: lint, typecheck, build, and npm audit on every push/PR
- CodeQL workflow for automated security scanning (runs on push and weekly)
2026-04-16 09:55:53 -07:00
dependabot[bot]
2GT-Rich