Release shelf@2.1.4 · Shelf-nu/shelf.nu

Security release

This release contains two security fixes.

GHSA-j83g-fjxm-w7m7 — Cross-organization
IDOR. Audit note content could be read and overwritten across workspace
boundaries: AuditNote has no organization column of its own, and one code
path looked notes up by id alone. Any member holding audit:update in any
workspace could rewrite an audit note belonging to another. Severity:
High (CVSS 7.1).
GHSA-433r-fpjf-cc4h — Audit image evidence was
readable and deletable by workspace members not assigned to the audit. The
deletion removes the storage objects, so it is not recoverable. Confined to a
single workspace. Severity: Medium (CVSS 5.4). Reported responsibly by an
external researcher — thank you.

The first crosses an organization boundary; the second does not. Neither
escalates a member to Owner.

Kit detail pages no longer send last-scan data — the scanner's name and
email, GPS coordinates and device user-agent — to members without
scan:read. It was previously hidden by a client-side check while still
present in the page payload (#2906).

Affected versions: all versions up to and including 2.1.3.

All self-hosted operators should upgrade.

docker pull ghcr.io/shelf-nu/shelf.nu:2.1.4
# or, if you track :latest
docker pull ghcr.io/shelf-nu/shelf.nu:latest

Then restart your container. No database migration is required.

fix(bookings): validate booking dates in the resolved preference timezone by @DonKoko in #2896
fix(dialogs): stop bulk dialogs from clipping their own footer by @DonKoko in #2901
fix(audits): require assignment, and bind evidence to the audit that owns it by @DonKoko in #2900
fix(bookings): compute booking date defaults in the preference zone by @DonKoko in #2905
fix(kits): gate last-scan PII server-side on the kit detail loader by @DonKoko in #2906

chore(assets): remove the now-unused Prisma-OR search builders by @DonKoko in #2897

Full Changelog: https://github.com/Shelf-nu/shelf.nu/compare/shelf@2.1.3...shelf@2.1.4