v0.54.5

[0.54.5] - 2026-09-05

Security

• Cleared 2 new Dependabot alerts (closes #174, #27, #28): browserslist
  4.28.6 → 4.28.7 (uncaught crash/prototype write via untrusted
  browserslist-stats.json, and unbounded memory growth leading to OOM),
  reached via @serwist/next, @serwist/cli, and
  eslint-config-next's Babel toolchain. browserslist is a build-time
  -only tool (target-resolution for autoprefixer/Babel, not shipped in
  the runtime bundle) — confirmed via a clean production build after the
  bump. Via package.json overrides, same mechanism as #150/#169/#172.
  Build and full test suite pass unchanged. npm audit now shows a single
  remaining finding (brace-expansion 1.x under eslint's own
  minimatch@3.1.5, a different advisory than the 5.x one fixed in #172),
  not yet ticketed.

tag: v0.54.5

v0.54.4

[0.54.4] - 2026-09-05

Security

• Cleared the remaining 6 of #150's 18 Dependabot alerts (closes #172,
  sub-issues #6, #11, #15, #20, #21, #24): mysql2 (3.15.3 → 3.23.1, direct
  prisma dep), js-yaml (4.3.0 → 4.3.1, under eslint), deepmerge-ts
  (7.1.5 → 8.0.0, under prisma's config), valibot (1.2.0 → 1.4.2, under
  prisma's bundled dev server), and brace-expansion (5.0.7/5.0.8 →
  5.0.9, under @serwist/cli/eslint-config-next's minimatch@10.2.5) —
  via package.json overrides, same mechanism as #169. brace-expansion
  needed a scoped override keyed to minimatch@10.2.5 specifically, since
  an older non-vulnerable 1.x line of brace-expansion also exists in the
  tree (under eslint's own minimatch@3.1.5) and must not be
  force-upgraded. All five are dev/build-tooling-only transitive deps, not
  runtime-reachable. Build and full test suite pass unchanged. Parent #150
  is now fully closed — all 18 originally-tracked alerts resolved.
• npm audit separately flags 3 unrelated high-severity issues not part of
  #150's original 18 (a newer brace-expansion 1.x advisory under
  eslint's minimatch@3.1.5, and browserslist/@serwist/next) —
  deferred as a new follow-up, not bundled into this fix.

tag: v0.54.4

v0.54.3

[0.54.3] - 2026-09-05

Fixed

• The E2E (Preview) CI gate had been broken for an unknown stretch of time:
  the dedicated Preview/Development Supabase project from #52
  (icmqcqmqvuqyzrjwxfcb) had died entirely — not just paused, its
  Supavisor pooler tenant no longer recognized at all — despite the daily
  keepalive cron, and nothing had replaced it. Every Preview deployment's
  Auth, DB access, and Storage were silently broken, not just CI (closes
  #170). Fixed by provisioning a fresh dedicated Supabase project
  (nthrnjoweetndevqtqng / "supabase-preview-umoja-voices") scoped to
  Preview+Development only, reapplying all migrations, storage buckets, and
  seed data, and updating SKILL.md's environment-isolation section
  accordingly — no application code changes. See the issue for the full
  incident writeup, including a since-corrected mistake where a manual
  prisma/seed.ts run briefly wrote two demo/test accounts into the live
  Production database (caught and cleaned up same-session).

tag: v0.54.3

v0.54.2

[0.54.2] - 2026-09-05

Security

• Cleared 12 of the 18 Dependabot alerts tracked under #150: fast-uri
  (6 alerts, #4/#13/#22/#23/#25/#26), hono (4 alerts,
  #14/#16/#17/#18), and @hono/node-server (2 alerts, #1/#19) — closes
  sub-issues #151, #152, #155-#164 — via package.json overrides,
  pinning fast-uri to 3.1.6, hono to 4.12.34, and
  @hono/node-server to 1.19.15. All three are nested under
  prisma's bundled @prisma/dev dev-server tooling (used only by the
  prisma dev CLI subcommand, which this project's scripts never invoke)
  — not runtime-reachable, and prisma itself has no newer 7.x release
  to bump to, so overrides forces the patched versions without waiting
  on upstream. Build and full test suite pass unchanged. The remaining
  6 alerts under #150 (mysql2, brace-expansion, deepmerge-ts,
  js-yaml, valibot), also dev-tooling-only transitive deps, are
  deferred as separate follow-ups.

tag: v0.54.2
v0.54.2 - Force fast-uri/hono/@hono-node-server to patched versions via overrides (#169)

Clears 12 of the 18 Dependabot alerts tracked under #150 (closes #151, #152,
#155, #156, #157, #158, #159, #160, #161, #162, #163, #164). All three
packages are nested under prisma's bundled @prisma/dev tooling, not
runtime-reachable, and prisma has no newer 7.x release to bump to — so
package.json overrides forces the patched versions directly. Build and
full test suite pass unchanged.

v0.54.1

What's Changed

Security

• Bumped next (and matching eslint-config-next) from 16.2.11 to 16.3.0 to clear the postcss/sharp advisories from a cross-repo npm audit cluster (closes #148) — a routine minor version bump, no functional changes. npm audit dropped from 11 advisories (6 high, 5 moderate) to 8 (3 high, 5 moderate). The remaining 8 are dev/build-tooling-only transitive dependencies (brace-expansion, fast-uri, js-yaml, hono/@hono/node-server, valibot) with no runtime-reachable path; clearing them would require forcing a prisma/eslint version bump outside their declared ranges, deferred as a separate call.

Full Changelog: v0.54.0...v0.54.1

v0.54.0

Security

• Fixed an authentication bypass found in a cross-repo security audit (closes #144): src/proxy.ts's middleware matcher exempts requests carrying a next-router-prefetch/purpose: prefetch header (needed so Next's own Link prefetching doesn't regenerate a CSP nonce per prefetch) — but that same middleware was also the only place the Supabase auth/role check ran, so a request with either header skipped auth entirely. Added independent requireSessionOrRedirect()/requireAdminOrRedirect() guards (src/lib/get-session.ts) at the layout level for /admin, /songs, /logistics, and /profile, matching the pattern every Server Action already uses correctly — authorization for these routes no longer depends on middleware alone.

v0.53.0

What's Changed

Added

• Added e2e/test_rls_security.py, a regression test for the prior Supabase
  RLS incident: asserts the anon/publishable key — the exact credential a
  misconfigured or accidentally-disabled RLS policy would expose — cannot
  read real seeded data (Song, User) or insert a row through the
  auto-generated PostgREST REST API. This app's own code never queries
  through that path (Prisma, over a privileged direct connection, is the
  sole access path), so no existing test — including the app-level route
  gating in test_auth.py — would catch a regression at this layer. Talks
  to Supabase's REST API directly via requests, no browser needed; reads
  Supabase credentials from the environment or .env.local. (closes #142)

Full Changelog: v0.52.0...v0.53.0

v0.52.0

Added

• Added a Vitest unit-test layer, colocated as *.test.ts next to each module: pure lib/ logic (validation, pagination, EAT formatting, upload-error classification, lyrics parsing, constants helpers, rate-limit's client-IP resolution, media bucket-URL routing) and, via a mocked prisma/getSession, the invite/role-gating RBAC guard (last-active-admin and self-demotion checks) factored out of member-actions.ts into a new member-guards.ts module. Wired npm run test into a new unit.yml required check, and fixed a pre-existing gap where e2e wasn't actually enforced as a required status check on main. (closes #139)

v0.51.1

Fixed

• Standardised remaining American spellings to British spelling (colour, behaviour, neighbour, recognised, grey, etc.) across the changelog, e2e docstrings, a Prisma schema comment, and several src/ comments. (closes #137)

v0.51.0

What's Changed

Added

• Added @vercel/analytics and @vercel/speed-insights to the root layout, feeding the cross-project vercel-metrics data pipeline. (closes #134)

Full Changelog: v0.50.1...v0.51.0