Skip to content

Web Console 1.6.191

Choose a tag to compare

View all tags
@chen21019 chen21019 released this 20 Oct 02:07
· 4 commits to main since this release
Immutable release. Only release title and notes can be modified.
1.6.191
This tag was signed with the committer’s verified signature.
chen21019 Cheng-Chen, Chen
SSH Key Fingerprint: nF0fDZ8EQGL+GjPXONcQ9qd4VseNYmcscqwvax867AE
Verified
Learn about vigilant mode.
1452148
This commit was signed with the committer’s verified signature.
chen21019 Cheng-Chen, Chen
SSH Key Fingerprint: nF0fDZ8EQGL+GjPXONcQ9qd4VseNYmcscqwvax867AE
Verified
Learn about vigilant mode.

Official security updates: Handlebars 4.7.10 (CVE-2026-106444/106445/106446) and fast-uri 3.1.8 (CVE-2026-86472). No role, API, session, OIDC or MFA code changes.

Signed producer: 1452148. Protected PR #213 merge: 2405dfe, identical tested tree c2b98b05f8da5cf4a8acaa2e630150ec92acd2ad. CI https://github.com/PastureStack/web-console/actions/runs/39356413277 passed 36 focused Node tests, 4 native Chrome template tests, exact raw audit gate, actual browser-module boundary, and two byte-identical production archives. Required CodeQL checks passed independently. This asset is the original CI output, not a rebuild.

Archive SHA-256: f9b28c25ae27057ae39e55fb29400b8ac459e07632a441eea011591f305950ab; 3037180 bytes. The archive retains all 13 locales. The raw source/build npm audit still reports 29 Moderate and 7 High findings (0 Critical); the 7 High nodes are the exact reviewed build-only braces closure with no official fix, review expiry 2026-10-27 00:00 UTC. New findings, graph/runtime reachability drift and expiry remain fail-closed; actual Webpack and concat inventories passed. Unpatched sprintf-js remains tracked. This is not zero-CVE, a global runtime exemption, or full historical matrix acceptance. Server packaging and QA deployment are separate evidence.

Assets 5
Loading