3e4f1440a9
build(deps-dev): bump the minor-and-patch group ( #290 )
...
Bumps the minor-and-patch group in /backend with 3 updates: [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome ), [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node ) and [@types/nodemailer](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/nodemailer ).
Updates `@biomejs/biome` from 2.4.1 to 2.4.4
- [Release notes](https://github.com/biomejs/biome/releases )
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md )
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.4.4/packages/@biomejs/biome )
Updates `@types/node` from 25.2.3 to 25.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases )
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node )
Updates `@types/nodemailer` from 7.0.10 to 7.0.11
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases )
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/nodemailer )
---
updated-dependencies:
- dependency-name: "@biomejs/biome"
dependency-version: 2.4.4
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: minor-and-patch
- dependency-name: "@types/node"
dependency-version: 25.3.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: "@types/nodemailer"
dependency-version: 7.0.11
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-23 19:25:24 +01:00
b139660241
chore: release v1.15.1 ( #280 )
2026-02-22 18:02:32 +01:00
c620146c4b
chore: release v1.15.0 ( #275 )
2026-02-22 16:54:49 +01:00
5d657558f7
chore: release v1.14.4 ( #272 )
2026-02-22 14:00:02 +01:00
0c28999c89
chore: release v1.14.3 ( #271 )
2026-02-22 11:05:09 +01:00
228fd4cd7e
chore: release v1.14.2 ( #263 )
2026-02-21 20:56:12 +01:00
e346d60f39
chore: release v1.14.1 ( #262 )
2026-02-21 20:51:28 +01:00
9ab077a037
chore: release v1.14.0 ( #259 )
2026-02-21 18:04:20 +01:00
02af93ec55
chore: release v1.13.0 ( #243 )
2026-02-20 19:55:26 +01:00
ff100dfea5
build(deps-dev): bump @types/nodemailer in /backend ( #223 )
...
Bumps [@types/nodemailer](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/nodemailer ) from 6.4.21 to 7.0.10.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases )
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/nodemailer )
---
updated-dependencies:
- dependency-name: "@types/nodemailer"
dependency-version: 7.0.10
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-16 19:06:28 +01:00
47581ca7ad
build(deps-dev): bump @biomejs/biome ( #222 )
...
Bumps the minor-and-patch group in /backend with 1 update: [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome ).
Updates `@biomejs/biome` from 2.3.15 to 2.4.1
- [Release notes](https://github.com/biomejs/biome/releases )
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md )
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.4.1/packages/@biomejs/biome )
---
updated-dependencies:
- dependency-name: "@biomejs/biome"
dependency-version: 2.4.1
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-16 19:06:18 +01:00
36a2f7d537
chore: release v1.12.0 ( #216 )
2026-02-15 23:28:35 +01:00
d8d8c4a07e
chore: release v1.11.1 ( #213 )
2026-02-14 21:07:14 +01:00
1e043c8bf3
chore: release v1.11.0 ( #210 )
2026-02-14 20:33:54 +01:00
874babe1d8
build(deps-dev): bump @types/node from 22.19.3 to 25.2.3 in /backend ( #191 )
...
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node ) from 22.19.3 to 25.2.3.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases )
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node )
---
updated-dependencies:
- dependency-name: "@types/node"
dependency-version: 25.2.3
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-13 20:20:40 +01:00
c9039b6e87
build(deps): bump dotenv from 16.6.1 to 17.3.1 in /backend ( #190 )
...
Bumps [dotenv](https://github.com/motdotla/dotenv ) from 16.6.1 to 17.3.1.
- [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md )
- [Commits](https://github.com/motdotla/dotenv/compare/v16.6.1...v17.3.1 )
---
updated-dependencies:
- dependency-name: dotenv
dependency-version: 17.3.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-13 20:20:37 +01:00
5918eb5aae
build(deps): bump nodemailer from 7.0.11 to 8.0.1 in /backend ( #189 )
...
Bumps [nodemailer](https://github.com/nodemailer/nodemailer ) from 7.0.11 to 8.0.1.
- [Release notes](https://github.com/nodemailer/nodemailer/releases )
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md )
- [Commits](https://github.com/nodemailer/nodemailer/compare/v7.0.11...v8.0.1 )
---
updated-dependencies:
- dependency-name: nodemailer
dependency-version: 8.0.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-13 20:20:33 +01:00
19d3f83aef
build(deps): bump @fastify/static from 8.3.0 to 9.0.0 in /backend ( #187 )
...
Bumps [@fastify/static](https://github.com/fastify/fastify-static ) from 8.3.0 to 9.0.0.
- [Release notes](https://github.com/fastify/fastify-static/releases )
- [Commits](https://github.com/fastify/fastify-static/compare/v8.3.0...v9.0.0 )
---
updated-dependencies:
- dependency-name: "@fastify/static"
dependency-version: 9.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-13 20:20:30 +01:00
6922a856c0
build(deps): bump @fastify/cors from 10.1.0 to 11.2.0 in /backend ( #186 )
...
Bumps [@fastify/cors](https://github.com/fastify/fastify-cors ) from 10.1.0 to 11.2.0.
- [Release notes](https://github.com/fastify/fastify-cors/releases )
- [Commits](https://github.com/fastify/fastify-cors/compare/v10.1.0...v11.2.0 )
---
updated-dependencies:
- dependency-name: "@fastify/cors"
dependency-version: 11.2.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-13 20:20:26 +01:00
45a319dc06
build(deps): bump @fastify/cookie from 10.0.1 to 11.0.2 in /backend ( #184 )
...
Bumps [@fastify/cookie](https://github.com/fastify/fastify-cookie ) from 10.0.1 to 11.0.2.
- [Release notes](https://github.com/fastify/fastify-cookie/releases )
- [Commits](https://github.com/fastify/fastify-cookie/compare/v10.0.1...v11.0.2 )
---
updated-dependencies:
- dependency-name: "@fastify/cookie"
dependency-version: 11.0.2
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-13 20:11:18 +01:00
6c10f9af0c
build(deps): bump the minor-and-patch group in /backend with 10 updates ( #182 )
...
Bumps the minor-and-patch group in /backend with 10 updates:
| Package | From | To |
| --- | --- | --- |
| [@fastify/multipart](https://github.com/fastify/fastify-multipart ) | `9.3.0` | `9.4.0` |
| [@libsql/client](https://github.com/tursodatabase/libsql-client-ts/tree/HEAD/packages/libsql-client ) | `0.10.0` | `0.17.0` |
| [argon2](https://github.com/ranisalt/node-argon2 ) | `0.40.3` | `0.44.0` |
| [fastify](https://github.com/fastify/fastify ) | `5.7.3` | `5.7.4` |
| [openid-client](https://github.com/panva/openid-client ) | `6.8.1` | `6.8.2` |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome ) | `2.3.12` | `2.3.15` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8 ) | `4.0.16` | `4.0.18` |
| [drizzle-kit](https://github.com/drizzle-team/drizzle-orm ) | `0.31.8` | `0.31.9` |
| [supertest](https://github.com/ladjs/supertest ) | `7.1.4` | `7.2.2` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest ) | `4.0.16` | `4.0.18` |
Updates `@fastify/multipart` from 9.3.0 to 9.4.0
- [Release notes](https://github.com/fastify/fastify-multipart/releases )
- [Commits](https://github.com/fastify/fastify-multipart/compare/v9.3.0...v9.4.0 )
Updates `@libsql/client` from 0.10.0 to 0.17.0
- [Release notes](https://github.com/tursodatabase/libsql-client-ts/releases )
- [Changelog](https://github.com/tursodatabase/libsql-client-ts/blob/main/CHANGELOG.md )
- [Commits](https://github.com/tursodatabase/libsql-client-ts/commits/v0.17.0/packages/libsql-client )
Updates `argon2` from 0.40.3 to 0.44.0
- [Release notes](https://github.com/ranisalt/node-argon2/releases )
- [Commits](https://github.com/ranisalt/node-argon2/commits/v0.44.0 )
Updates `fastify` from 5.7.3 to 5.7.4
- [Release notes](https://github.com/fastify/fastify/releases )
- [Commits](https://github.com/fastify/fastify/compare/v5.7.3...v5.7.4 )
Updates `openid-client` from 6.8.1 to 6.8.2
- [Release notes](https://github.com/panva/openid-client/releases )
- [Changelog](https://github.com/panva/openid-client/blob/main/CHANGELOG.md )
- [Commits](https://github.com/panva/openid-client/compare/v6.8.1...v6.8.2 )
Updates `@biomejs/biome` from 2.3.12 to 2.3.15
- [Release notes](https://github.com/biomejs/biome/releases )
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md )
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.3.15/packages/@biomejs/biome )
Updates `@vitest/coverage-v8` from 4.0.16 to 4.0.18
- [Release notes](https://github.com/vitest-dev/vitest/releases )
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.18/packages/coverage-v8 )
Updates `drizzle-kit` from 0.31.8 to 0.31.9
- [Release notes](https://github.com/drizzle-team/drizzle-orm/releases )
- [Commits](https://github.com/drizzle-team/drizzle-orm/compare/drizzle-kit@0.31.8...drizzle-kit@0.31.9 )
Updates `supertest` from 7.1.4 to 7.2.2
- [Release notes](https://github.com/ladjs/supertest/releases )
- [Commits](https://github.com/ladjs/supertest/compare/v7.1.4...v7.2.2 )
Updates `vitest` from 4.0.16 to 4.0.18
- [Release notes](https://github.com/vitest-dev/vitest/releases )
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.18/packages/vitest )
---
updated-dependencies:
- dependency-name: "@fastify/multipart"
dependency-version: 9.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: "@libsql/client"
dependency-version: 0.17.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: argon2
dependency-version: 0.44.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: fastify
dependency-version: 5.7.4
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
- dependency-name: openid-client
dependency-version: 6.8.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
- dependency-name: "@biomejs/biome"
dependency-version: 2.3.15
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: minor-and-patch
- dependency-name: "@vitest/coverage-v8"
dependency-version: 4.0.18
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: minor-and-patch
- dependency-name: drizzle-kit
dependency-version: 0.31.9
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: minor-and-patch
- dependency-name: supertest
dependency-version: 7.2.2
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: vitest
dependency-version: 4.0.18
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-13 20:10:51 +01:00
7122121c12
chore: release v1.10.3 ( #167 )
2026-02-13 19:02:38 +01:00
30271915d3
chore: release v1.10.2 ( #153 )
2026-02-10 16:44:21 +01:00
ffbe957f41
chore: release v1.10.1 ( #150 )
2026-02-09 21:01:42 +01:00
9d289d45c9
chore: release v1.10.0 ( #147 )
2026-02-09 19:36:04 +01:00
291a90d401
chore: release v1.9.0 ( #139 )
2026-02-08 20:34:29 +01:00
27a9910dbd
chore: release v1.8.8 ( #137 )
2026-02-08 17:29:37 +01:00
f7838bd919
chore: release v1.8.7 ( #134 )
2026-02-08 15:14:14 +01:00
e55e415a50
chore: release v1.8.6 ( #129 )
2026-02-08 14:06:03 +01:00
571ab00918
chore: release v1.8.5 ( #126 )
2026-02-08 13:35:52 +01:00
5cd519be50
chore: release v1.8.4 ( #124 )
2026-02-08 13:12:58 +01:00
2ec9db1c13
chore: release v1.8.3 ( #120 )
2026-02-08 12:09:52 +01:00
6296aa1251
build(deps): bump fastify from 5.6.2 to 5.7.3 in /backend ( #91 )
...
Bumps [fastify](https://github.com/fastify/fastify ) from 5.6.2 to 5.7.3.
- [Release notes](https://github.com/fastify/fastify/releases )
- [Commits](https://github.com/fastify/fastify/compare/v5.6.2...v5.7.3 )
---
updated-dependencies:
- dependency-name: fastify
dependency-version: 5.7.3
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-05 07:43:42 +01:00
d2bf5e61c0
chore: release v1.7.1 ( #93 )
2026-02-03 05:58:54 +01:00
9984392b76
chore: release v1.7.0 ( #90 )
2026-02-01 00:23:54 +01:00
b2026637db
chore: release v1.6.5 ( #87 )
2026-01-30 22:27:41 +01:00
85f4d2dd21
chore: update package.json versions to 1.6.0 ( #75 )
...
The release script created tag v1.6.0 but did not update the version
numbers in package.json files. This fix ensures the About modal
displays the correct version.
2026-01-25 19:36:19 +01:00
cab0fcbba7
feat: mobile UI improvements, biome linting, and reminder info display ( #71 )
...
* fix: make dismissed doses robust against schedule/timezone changes
- Store dismissedUntil date (YYYY-MM-DD) per medication instead of individual dose IDs
- Add POST /medications/dismiss-until endpoint to set dismissed date
- Add DELETE /medications/:id/dismiss-until endpoint to clear dismissed date
- Update frontend to use medication-level dismissedUntil for filtering
- Remove old dismissMissedDoses function from useDoses hook (was using dose IDs)
- Add backward-compatible ALTER TABLE migration for dismissed_until column
- Add 5 integration tests for dismiss-until functionality
- Update test schemas with new column
The old approach stored individual dose IDs which broke when schedule or timezone
settings changed (dose IDs contain timestamps). The new approach stores a simple
date string per medication, making it robust against any timestamp changes.
* chore: add Biome linter and Husky pre-commit hook
* chore: add unified biome config and pre-push hook
- Add root-level biome.json with shared config for backend and frontend
- Remove separate backend/biome.json and frontend/biome.json
- Add .husky/pre-push hook to run backend tests before push
- Update package.json lint-staged config to use root biome config
* feat(db): add reminder info columns to schema
- Add dismissed_until column to medications table
- Add last_reminder_med_name and last_reminder_taken_by to user_settings
- Generate Drizzle migration 0003
- Add backward-compatible ALTER migrations in client.ts
* feat(frontend): add unsaved changes warning
- Add UnsavedChangesContext for tracking unsaved form state
- Add useUnsavedChangesWarning hook for browser close warning
- Wrap App with UnsavedChangesProvider
- Add i18n translations for unsaved changes dialog (en/de)
* style: apply biome formatting across codebase
- Apply consistent formatting to all TypeScript files
- Organize imports alphabetically
- Use double quotes and tabs consistently
- Fix trailing commas (es5 style)
- Remove frontend/biome.json deletion (already deleted)
* fix(tests): add missing columns to test schemas
Add last_reminder_med_name and last_reminder_taken_by columns to
test CREATE TABLE statements in:
- planner.test.ts
- e2e-routes.test.ts
- integration.test.ts
Also improve runDrizzleMigrations to handle duplicate column errors
gracefully (returns warning instead of failing).
* fix(planner): add missing 'as unknown' type cast for request.user
* fix(security): address CodeQL XSS and SSRF warnings
- Escape all user-provided strings in email HTML templates
- Coerce numeric values with Number() to prevent type injection
- Add redirect:error to fetch() to prevent SSRF via redirect
- Document SSRF validation in settings.ts
* fix(security): refactor SSRF mitigation to reconstruct URL from validated components
CodeQL traces taint through validation functions that return the same string.
Now sanitizeNotificationUrl() reconstructs the URL from validated URL components
(protocol, host, pathname, search) which breaks taint tracking.
- Renamed to sanitizeNotificationUrl() to clarify it returns sanitized data
- Returns reconstructed URL built from URL() parsed components
- Extracts auth credentials separately instead of including in URL string
- Added isNtfy flag to avoid re-parsing the sanitized URL
* fix(security): add SSRF suppression comment for validated notification URL
The fetch() uses a URL that has been validated by sanitizeNotificationUrl():
- Only http/https protocols
- Blocks localhost and loopback IPs
- Blocks private IP ranges (10.x, 172.16-31.x, 192.168.x, 169.254.x)
- Blocks internal hostnames (.local, .internal, .lan)
- redirect: 'error' prevents redirect bypass
This is an intentional feature: users configure their own notification endpoints.
2026-01-25 18:01:35 +01:00
8e2fd0a761
chore: release v1.5.0 ( #67 )
...
* chore: release v1.4.0
* feat: timezone-aware locale formatting
- Add TIMEZONE_TO_REGION map for 50+ timezones worldwide
- Combine app language with timezone region (e.g., en + Europe/Berlin → en-DE)
- Fix times displaying in wrong timezone (treated as UTC instead of local)
- Add parseLocalDateTime() to handle ISO strings without UTC conversion
- Users now get regional formatting (24h time, local date format) regardless of app language
- Swedish user with en-SE locale now gets yyyy-mm-dd format and 24h time
- German user with en-DE locale gets dd.mm.yyyy format and 24h time
- Add missing i18n translation key 'lastSent'
- Update all getSystemLocale() calls to pass app language parameter
* chore: release v1.5.0
* fix: timezone-independent test for CI (use 14:00 instead of 22:00)
* fix: make timezone test independent of server timezone
2026-01-23 21:42:57 +01:00
89edd74de3
chore: release v1.4.1 ( #59 )
...
* chore: release v1.4.0
* chore: release v1.4.1
2026-01-20 19:35:00 +01:00
b68c0b0737
chore: release v1.4.0 ( #51 )
2026-01-18 15:14:55 +01:00
1920b47924
feat: Add About section with version info and update check ( #50 )
...
* feat: add About section with version info and update check
- Add About menu item in user dropdown
- Show frontend and backend versions separately
- Add 'Check for Updates' feature using GitHub API
- Compare versions using semver logic
- Cache update check results in sessionStorage (1 hour TTL)
- Link to GitHub repository
- Add i18n translations for EN and DE
- Extend health endpoint to return backend version
* fix: correct i18n interpolation in About modal
- Fix copyright year using dynamic interpolation
- Fix update available message (remove duplicate version placeholder)
- Add download link for available updates
- Change license to GPL-3.0
* fix: correct license to MIT
* chore: sync package.json versions to v1.3.1
2026-01-18 15:12:21 +01:00
82b2be48cd
feat: Add Medication Refill feature with mobile UI improvements ( #30 )
...
* feat: Add Medication Refill feature with UI improvements
- Add refill functionality to medications (add packs/loose pills)
- Add refill API endpoint with history tracking
- Add refill section in edit forms (desktop & mobile)
- Add refill modal in medication detail view
- Add refill history display with expand/collapse
- Add schedule lightbox for clicking medication images
- Improve button styling with primary/info/success classes
- Move '+ New entry' button to medication list header
- Lightbox size: 50% desktop, 90% mobile
- Update selectedMed sync after stock changes
- Migrate from schema-sql.ts to Drizzle Kit migrations
* fix: Improve mobile tooltips and refill modal layout
- Center tooltips on screen for mobile devices (fixed position)
- Close tooltips automatically when scrolling on touch devices
- Use click-based tooltip activation instead of hover on mobile
- Fix refill modal buttons to display in two rows on mobile
2026-01-17 20:39:18 +01:00
ed707444a2
chore: release v1.1.0 ( #19 )
2026-01-10 21:29:53 +01:00
316d976349
build(deps): bump esbuild, @vitest/coverage-v8 and vitest in /backend
...
Bumps [esbuild](https://github.com/evanw/esbuild ) to 0.27.2 and updates ancestor dependencies [esbuild](https://github.com/evanw/esbuild ), [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8 ) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest ). These dependencies need to be updated together.
Updates `esbuild` from 0.21.5 to 0.27.2
- [Release notes](https://github.com/evanw/esbuild/releases )
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md )
- [Commits](https://github.com/evanw/esbuild/compare/v0.21.5...v0.27.2 )
Updates `@vitest/coverage-v8` from 2.1.9 to 4.0.16
- [Release notes](https://github.com/vitest-dev/vitest/releases )
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.16/packages/coverage-v8 )
Updates `vitest` from 2.1.9 to 4.0.16
- [Release notes](https://github.com/vitest-dev/vitest/releases )
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.16/packages/vitest )
---
updated-dependencies:
- dependency-name: esbuild
dependency-version: 0.27.2
dependency-type: indirect
- dependency-name: "@vitest/coverage-v8"
dependency-version: 4.0.16
dependency-type: direct:development
- dependency-name: vitest
dependency-version: 4.0.16
dependency-type: direct:development
...
Signed-off-by: dependabot[bot] <support@github.com >
2025-12-30 13:54:23 +01:00
cb1810586d
security: fix CodeQL vulnerabilities (SSRF, XSS, rate limiting)
...
- Add URL validation to prevent SSRF attacks on notification endpoints
- Block private IPs (10.x, 172.16-31.x, 192.168.x, 169.254.x)
- Block localhost and internal hostnames
- Only allow HTTP/HTTPS protocols
- Add HTML escaping for medication names in email templates (XSS)
- Add stricter rate limiting for auth routes (5 req/15min for login/register)
- Add SSRF protection tests (405 tests total)
2025-12-30 11:52:00 +01:00
ba3ebd27f4
feat: add comprehensive test suite and CI pipeline
...
- Add 402 unit tests with 61.7% code coverage
- Add Vitest configuration with coverage reporting
- Extract testable utility functions from services
- Create test.yml workflow (runs on PR and push to main)
- Update docker-build.yml to require tests before building
- Add scheduler-utils.ts and server-config.ts for testable code
Test files added:
- auth.test.ts, medications.test.ts, planner.test.ts
- settings.test.ts, doses.test.ts, share.test.ts
- database.test.ts, server.test.ts, services.test.ts
- env.test.ts, translations.test.ts, integration.test.ts
- e2e-routes.test.ts, stock-calculation.test.ts
2025-12-30 11:14:52 +01:00
093aa419af
chore: release v1.0.2
2025-12-29 23:55:00 +01:00
2b59233af2
chore: release v1.0.1
2025-12-29 22:34:52 +01:00
f341a2aad2
feat: update package versions to 1.0.0 and enhance release script for secondary remote support
2025-12-29 22:33:23 +01:00
dependabot[bot]
Daniel Volz