Skip to content

v1.10.2: security catch-up + audit chain and pick FK integrity fixes

Choose a tag to compare

View all tags
@mhightower932 mhightower932 released this 12 Jun 18:08
v1.10.2
f1de118
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Patch release. Security catch-up across all three dependency trees plus two data-integrity fixes from production: the audit-log hash chain now survives multi-line memo content, and line-level pick bookkeeping moves to ON DELETE SET NULL so line deletion cannot strand historical pick records.

Mobile. mobile/package-lock.json picks up in-range security bumps only; zero mobile source diffs. v1.9.0 APK (versionCode 6) remains the working baseline; no new APK build for v1.10.2.

Fixed

  • Audit hash chain handles multi-line payloads (#340): the chain trigger built its hash input via payload::bytea, which rejects the backslash-n sequence JSONB::text emits for multi-line strings -- a multi-line SO memo save rolled back as a generic 500. Both the trigger and verify_audit_log_chain() now use convert_to(payload, 'UTF8'); historical row_hash values continue to verify.
  • Line-level pick FKs no longer block line deletion (#341): pick_tasks.{so_line_id, to_line_id} and wave_pick_breakdown.so_line_id move from default ON DELETE NO ACTION to SET NULL; pick rows survive line deletion as free-standing audit records.

Security

  • flask-cors 6.0.0 -> 6.0.2, pyjwt 2.12.0 -> 2.13.0, with documented pip-audit deferrals for PYSEC-2024-271 and PYSEC-2025-183 (#339).
  • react-router / react-router-dom -> 7.17.0, clearing two HIGH admin-tree advisories (#339).
  • Mobile shell-quote critical (GHSA-w7jw-789q-3m8p) cleared via lockfile-only npm audit fix (#339).

Migrations

  • 057 (#340) -- audit_log chain hash UTF-8 conversion (function replacement; touches no rows).
  • 058 (#341) -- pick_tasks line FKs -> ON DELETE SET NULL.
  • 059 (#341) -- wave_pick_breakdown.so_line_id FK -> ON DELETE SET NULL.

See CHANGELOG.md for the full notes.

Assets 2
Loading