v1.7.0 - Redesigned integration pages and a better-auth security fix

A minor release: the Data Sources, Data API and Notifications pages are redesigned, the whole app reads better on phones and for low vision, and better-auth is patched.

Upgrading

Nothing to do. There is no migration, and environment variables, port and image base are unchanged.

Security

• better-auth 1.7.14. Closes GHSA-965c-763c-88jm (critical), GHSA-r4xp-prcw-77qf (high) and GHSA-44jh-23m7-hpcf (low), all fixed from 1.7.7. The passkey and SSO plugins move to 1.7.14 with it (#92).

Pages

• Data Sources. A catalog with search, filters and one tile per directory type (Entra ID, Google Workspace, LDAP / Active Directory, AWS, Okta, SCIM) showing its logo and status. A tile opens a side panel with its connections, a Connect button that opens the form for that type, and the setup guide. Automated remediation, the SIEM pull feed and SIEM push delivery are now tabs that explain what each does.
• Data API. The stat tiles are gone; search, filters and the side panel are shared with Data Sources.
• Notifications. Two tabs, Real-time alerts and Scheduled reports, each with a table (Test, Pause, Delete with a confirmation) and an add form where every field has a label. A test shows Delivered or Failed in words.

Readability and phones

• Severity colors used as text reach a 4.5:1 contrast, and muted text is darker.
• Alerts say "Medium severity" and "High confidence", and every action has a text label.
• On phones, alert rows wrap, the dashboard stacks its widgets in one column, and pages use a 16px margin.

Fixes

• Incident Timeline shows monthly bars instead of a smoothed curve that suggested detections before they happened.
• The dashboard's data type shares are computed over every type, so they match the reports.
• The company score is labelled Company risk, to tell it apart from an employee's own level.
• The exposure register groups its data types into Identity, Financial, Contact and account, and Health and HR.

v1.6.4 - Build-time CSS parser patched

A dependency patch: the CSS parser used at build time moves to a fixed version.

Upgrading

Nothing to do. There is no migration, and environment variables, port and the Alpine image base are unchanged.

Security

• postcss-selector-parser 6.1.4 to 6.1.5. This closes GHSA-rj75-hqrm-r3gf (medium), a quadratic parse of flat selectors that could exhaust a CPU. The advisory now has a fix on the 6.x line that tailwindcss 3 accepts.
• The package only compiles Gardik's own CSS at build time and is not part of the production image, so a running instance was not exposed.

v1.6.3 - The image Trivy scans is the image you pull

A hardening release for the CI and the published image. The application itself is unchanged.

Upgrading

Nothing to do. There is no migration, and environment variables, port and the Alpine image base are unchanged. If you deployed from the Docker Hub quick start, consider the new loopback port binding described below.

Security

• The published image is the scanned image. Trivy kept its database inside the build context, so the push step rebuilt next build after the scan and published layers the scan never saw. The database now lives outside the context, and the workflow fails if the pushed layers differ from the scanned ones. The 1.6.2 image was rescanned by hand after its release: 0 findings.
• SBOM. Release images now carry an SBOM attestation next to the build provenance: docker buildx imagetools inspect whitemuush/gardik:1.6.3 --format '{{ json .SBOM }}'.
• Daily image scan. The latest image is rescanned every day; findings land in the repository's Security tab.
• Pinned actions. Every GitHub Action is pinned to a commit SHA, and the repository refuses unpinned ones.
• Quick start. The Docker Hub example now publishes 127.0.0.1:3000:3000 instead of 3000:3000, which listened on every interface in plain HTTP and bypassed host firewalls such as ufw. It also drops every Linux capability and sets no-new-privileges.

CI

• The required ci gate now fails whenever one of its jobs fails, instead of being skipped.
• The Next.js build cache is kept between runs (build step from about 37 s to 8 s).

v1.6.2 - Next.js advisories closed

A security patch: Next.js, zod and the test tooling move to fixed versions, and the image is rebuilt on a patched Alpine base.

Upgrading

Nothing to do. There is no migration, and environment variables, port and the Alpine image base are unchanged.

Security

• next 16.3.8 to 16.4.3. This closes GHSA-2464-fhr4-w9xw and GHSA-673q-mjm6-r5xr (critical) and CVE-2026-94482 (high), found by Trivy in the 1.6.1 image. None of them was reachable in Gardik: image optimization is disabled, the image runs on musl rather than glibc, and the app uses neither use cache nor Server Actions.
• zod 4.6.5 to 4.6.7 closes GHSA-mrhx-c7xc-m3w5 (high), a memory exhaustion when validating oversized constrained collections. zod runs in production through better-auth.
• fast-uri 3.1.8 to 3.1.9 (override) closes four moderate URI parsing advisories.
• vitest and @vitest/coverage-v8 5.0.1 to 5.0.5, with vite 8.3.5, close GHSA-qxg6-89mg-rqv8 and GHSA-xp26-3454-mjgp. These only run in development and tests.
• musl 1.2.6-r2 to 1.2.6-r3 (CVE-2026-107891) through the rebuilt node:26-alpine base.

Licenses

• THIRD-PARTY-NOTICES.md now lists 539 runtime packages instead of 542, following the dependency changes.

v1.6.1 - vite advisories closed

A security patch: the vite version used by the test suite no longer ships a vulnerable launch-editor.

Upgrading

Nothing to do. There is no migration, and environment variables, port and the Alpine image base are unchanged.

Security

• vite 8.3.0 to 8.3.4, with rolldown 1.2.14 and @oxc-project/types 0.154.0. This closes three advisories on the launch-editor bundled with vite: GHSA-587h-7wmj-h5pm (high), GHSA-698v-4r3x-3vcv and GHSA-r825-w8mm-5pxw (medium).
• vite comes in through vitest and only runs in development and tests. None of these packages is part of the production image, so a running Gardik instance was not exposed.

Licenses

• THIRD-PARTY-NOTICES.md now lists 542 packages instead of 477. better-auth declares vitest as an optional peer, so npm no longer flags part of the test tooling as development only, and the notice lists it too. The production image is unaffected.

v1.6.0 - HIBP severity fixed and stricter gates

HIBP breaches now get the severity they deserve, the dashboard widgets show every breach, and the codebase runs behind much stricter gates.

Upgrading

One migration runs on start: 20261014120000_canonical_hibp_data_classes renames the plural HIBP labels already stored (passwords, credit_cards, bank_account_numbers, social_security_numbers) to the names the severity rules expect, and raises the alerts those labels kept too low. It never lowers a severity and can run twice safely. Rolling back to 1.5.0 still works. Nothing to do by hand.

Coming from the 1.4.0 image: the 1.5.0 image was never published on Docker Hub, so this release also brings the 1.5.0 changes and its migration. Read the 1.5.0 notes first.

Environment variables, port and the Alpine image base are unchanged.

Fixes

• HIBP severity: HIBP names its data classes in the plural, so passwords, credit cards, bank accounts and social security numbers were not seen as critical and their alerts stayed at MEDIUM. They are now mapped, and the migration corrects the existing data.
• Dashboard widgets: the seven breach widgets left out breaches added by hand and breaches from a source that is no longer connected, so they disagreed with the counters above them. They now count every breach, and a widget set to one source still narrows to it.
• Failed dashboard saves: a refused layout or view change looked saved and was lost on reload. A bar now says the change was not saved, with a Retry button.
• Okta: a user without an email was stored with its login as the address. It is now kept only when it is a valid email.
• Directory type check: a connection type such as toString was accepted as valid. Only the real types are accepted now.

Local development

• make up and make db-up can run side by side, and make image builds and runs the production image on port 3001 to test it.
• A public fictional demo dataset is seeded with make seed-dev.
• The dev container runs as a non-root user (set APP_UID and APP_GID if yours is not 1000).
• The dev app and database ports are bound to 127.0.0.1, so they are no longer reachable from the network. An existing local database container keeps its old binding until it is recreated.

Quality

• make check now runs before every push: npm run check, the integration tests, a schema drift check against the migrations, and the production build.
• npm run check adds gitleaks on the whole history, shellcheck, Trivy on the Dockerfiles, and a check of the commits on the branch. CI runs the same gates.
• TypeScript noUncheckedIndexedAccess is on, and ESLint now rejects floating promises, misused promises and non-exhaustive switches.
• Every code file is at most 200 lines, tests included, and every code comment is a single sentence.

v1.5.0 - Truthful scans and a source catalog

Scans now tell the truth about what they checked, breach data can no longer
inject content into alerts, and the data sources page becomes a catalog that
helps choose which sources to pay for.

Upgrading

One migration runs on start: 20261012124727_track_scan_checks adds a
ScanCheck table and a nullable ApiCredential.rateLimitPerMinute column.
It only adds, so rolling back to 1.4.0 still works. Nothing to do by hand.

Environment variables, port and the Alpine image base are unchanged.

Security

Breach data is escaped before it reaches an alert. Breach names and fields
come from third-party sources; they were inserted as-is into email HTML,
Slack and Teams messages, CEF headers and syslog structured data. A crafted
value could inject markup or forge log fields. Each channel now escapes them
for its own format.

Fixes

• No more silent "no exposure". A source that failed (rate limit, rejected
  key, outage) used to count as checked. Every check is now recorded per
  employee and source, failures are retried with backoff, each source keeps to
  its rate limit, and the remaining gaps are shown with the steps to fix them.
• LDAP: employees with several mail values were synced with one invalid,
  joined address, so they were never matched. The connection is also closed
  when a search fails.
• AWS Identity Store: a user without an email was stored with its user
  name as the address. It is now kept only when it is a valid email.

Features

• Data sources catalog: each source shows a recommendation level, its
  health, its pricing and its logo, with a drawer to connect it, set its rate
  limit, or fix it.
• Dismissible scan banner: the incomplete-scan banner can be closed, and
  comes back when the situation changes.

Quality

• npm run check runs every gate before each push and in CI: lint, Prettier,
  types, unit tests with a coverage floor (now 56%), knip, a 200-line cap per
  file, version consistency, licenses, production audit.
• The Entra ID, Google Workspace, LDAP and AWS connectors now have unit tests.
• SECURITY.md states which versions receive security fixes.

v1.4.0 - The image moves to Alpine and ships with no known advisory

The published image moves from Debian to Alpine. It drops from 1.19 GB to
540 MB on disk and ships with no known advisory, where the previous image
carried 4 critical and 59 high.

1.3.1 was cut but never tagged nor published as an image. Its changes ship
here, so an operator coming from 1.3.0 also gets the critical next/og fix and
one schema migration, described below.

Upgrading

An operator who extends the image must install packages with apk instead of
apt-get, and anything relying on glibc has to adapt. Environment variables,
port and migrate-on-start are unchanged.

From 1.3.0, one migration runs on start.
20261001090000_drop_account_issuer_requirement makes Account.issuer
nullable and moves the account lookup index back to (providerId, accountId).
The column and its backfilled values stay, so rolling back to 1.3.0 still signs
existing users in. Nothing to do by hand: migrations run on start as before.

Security

A critical remote code execution advisory in next/og is closed, along with
three high fast-uri advisories. next now sits at 16.3.8, which also closes
CVE-2026-94483 (high).

sharp moves to 0.35.5 and source-map-js to 1.2.2, closing the two high
advisories that had a fix.

Image

The Debian base carried its advisories in packages the app never uses. The
runner also shipped /opt/prisma and .next twice, because of a trailing
chown -R. sharp is excluded since next/image is unused, and Prisma Studio
with the embedded Postgres behind prisma dev leave the CLI tree: the runner
only calls migrate deploy, which opens neither.

The runner stage is now rebuilt on every publish, so the package upgrade cannot
be replayed from an old cache layer.

Better Auth 1.7.5

Better Auth 1.7.5 reverts the issuer-keyed account lookup that 1.7.0
introduced, and no longer writes Account.issuer. Left NOT NULL, that column
would have turned every sign-up into a failure, hence the migration above.
Invitations, seeds and test fixtures stop setting it.

CI

braces has a high advisory with no patched release, reachable only through
tailwindcss and the Next ESLint plugin, so the full-tree audit failed every
pull request with nothing to act on. The blocking npm audit now covers
production dependencies, and the full tree is still audited and printed without
blocking.

Development

The seed scripts work again. dotenv 18 ships its own binary, which shadowed
the one from dotenv-cli. Scripts now load .env.local through Node's
--env-file-if-exists, and prisma.config.ts through process.loadEnvFile.
Shell variables still win, and a missing file is still not an error.

eslint-config-next moves to 16 with native flat configs, middleware.ts
becomes proxy.ts as Next 16 expects, and effects no longer call setState
synchronously, as eslint-plugin-react-hooks 7 requires. The unused @dnd-kit
packages are gone.

v1.2.4 - The project is now Gardik, and the published image is clean

Two things ship here. The project changes name, and the published image stops
carrying a vulnerability that v1.2.3 claimed to have fixed.

This release moves the repository and the Docker image. The old locations
receive nothing further.

	Before	Now
Repository	WhiteMuush/DataShield	WhiteMuush/Gardik
Image	whitemuush/datashield	whitemuush/gardik
Package	datashield	gardik

Read Upgrading before pulling. The container, volume and database names all
change, so a naive update starts on an empty database.

Security

The published image shipped mysql2@3.15.3, still carrying
GHSA-3f6p-5ww8-9rcr, the auth plugin downgrade to mysql_clear_password that
leaks the connection credentials in plaintext. That is the advisory v1.2.3
announced as fixed. It was fixed in the application, not in the image.

The cause sits in the migrator stage of the Dockerfile, which built its own
npm tree from the empty manifest npm init -y produces. The project overrides
never reached it, and npm audit could not see it either, because it reads the
application lockfile rather than the image. The overrides block is now carried
into that tree, so the two stay in sync without a second list to maintain.

Five more high-severity advisories clear with it: deepmerge-ts at 7.1.5, plus
brace-expansion, tar and ip-address, which came bundled inside npm itself.
npm is now removed from the final image, where nothing used it: the entrypoint
resolves the Prisma bundle with node, the CMD is node server.js, and so is
the healthcheck.

Every image pulled since 2 September is affected. Drop it and pull
whitemuush/gardik instead.

CI

The publish job now builds the image locally, has Trivy scan it, and pushes only
once the scan passes. Scanning after the push would have done nothing but
confirm that a vulnerable image was already public.

Upgrading

The rename reaches the infrastructure names. The volume becomes
gardik-db-data and the database gardik, both new and empty on first start.

To keep existing data, either hold the old names through POSTGRES_DB and an
explicit volumes entry, or pg_dump from the old volume and restore into the
new one before migrations run.

Seed and fixture addresses move from @datashield.local to @gardik.local.

v1.2.3 - Credentials stop leaking through a downgraded MySQL handshake

A security release. Three high-severity advisories are cleared, and the
dependency backlog that was hiding behind them is folded in, Better Auth 1.7
included.

This release carries a schema migration. Run prisma migrate deploy before
the new build serves traffic. Skipping it makes every password sign-in fail with
User not found, because Better Auth 1.7 looks accounts up by a column that
does not exist yet.

Security

mysql2 allowed an auth plugin downgrade to mysql_clear_password, which
leaks the connection's credentials in plaintext. The package sits three levels
down, pinned at 3.15.3 by prisma, so Dependabot could not bump it on its
own and the fix is a package.json override to 3.22.0 or later.

browserslist at 4.28.6 and below carried unbounded cache growth with no
eviction, an eventual out-of-memory (GHSA-c83g-rgw3-j3cx), and an uncaught crash
plus a prototype write reachable through an untrusted browserslist-stats.json
(GHSA-73wf-gq98-2v4g). Also overridden, also transitive.

Both were blocking the dependency audit on every open dependency PR, which is
how a backlog of three had accumulated.

Better Auth 1.7

Account identity is now keyed on the issuer. Lookups use
(issuer, accountId) rather than (providerId, accountId), so an identity
survives a provider being renamed. The Account model gains a required issuer
column. The migration adds it nullable, backfills each row from what it already
states, local:credential for password accounts and the advertised issuer from
the matching SsoProvider row for SSO accounts, then makes it NOT NULL and
indexes the pair.

Every place that writes an account row by hand, invitation acceptance and the
seed scripts included, now stamps the issuer from the library's own helper
rather than from a string typed out here, so a change upstream surfaces as a
type error instead of a silent sign-in failure.

Enrolling a second factor returns a discriminated union. Only the TOTP arm
carries the URI and the backup codes, so the enrollment call asks for TOTP by
name and narrows before reading them.

The three better-auth packages are pinned to 1.7.2 exactly. Dependabot
proposed 1.7.1, which no longer installs: the passkey plugin's caret floats to
1.7.2 and that version requires better-auth@^1.7.2. Pinning the family
together stops a caret from splitting it again.

Dependencies

Prisma and its adapter to 7.10.0, Next.js to 16.3.3, @react-pdf/renderer
to 4.8.1, plus the AWS SDK, pg, lucide-react, @tanstack/react-table and
the type packages. CodeQL moves to 4.37.8 and TruffleHog to 3.97.1.

Verification

The full suite ran against throwaway databases shaped like CI: 250 unit tests,
88 integration tests on a UTC database and again on a Europe/Paris one, and 16
Playwright end-to-end tests, alongside a clean audit, the license gate, the type
check and the build.