Skip to content

v1.4.1 — CodeQL security fixes

Choose a tag to compare

View all tags
@Greigh Greigh released this 26 Jun 23:07
v1.4.1
65d9c53
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

CodeQL security remediations for Android bill reminders and household invite email validation, plus Android housekeeping for the intro screen and encrypted token storage.

Changed

  • Information security policy — documents that CodeQL runs on main pushes, weekly schedule, and manual dispatch (not on every pull request).
  • Android intro icons — ReceiptLong and TrendingUp use auto-mirrored Material icons on the pre-login intro for RTL locales.
  • Android token storage — document intentional use of deprecated EncryptedSharedPreferences until a stable security-crypto successor ships.
  • Android versionCode 6 (same 1.4.1 build for Play re-upload).

Fixed

  • Android PendingIntents — bill-reminder alarm and notification tap intents use explicit ComponentName destinations with FLAG_IMMUTABLE (CodeQL java/android/implicit-pendingintents, alerts #31 and #32).
  • Household invite email validation — reuse shared isValidEmail() with a 254-character cap before regex matching (CodeQL js/polynomial-redos, alert #33).

Full changelog: https://github.com/Greigh/FiHaven/blob/main/CHANGELOG.md#141--2026-06-26

Assets 2
Loading