Skip to content

11.31.3: Hub operator cockpit (opt-in) + axios security patch - #573

Merged
kaihaase merged 1 commit into
mainfrom
develop
Jul 20, 2026
Merged

11.31.3: Hub operator cockpit (opt-in) + axios security patch#573
kaihaase merged 1 commit into
mainfrom
develop

Conversation

@kaihaase

Copy link
Copy Markdown
Member

What is this?

A new feature (opt-in) plus a security patch. Non-breaking — nothing changes for existing projects until you opt in.

  • Hub — a build-free, ADMIN-gated operator cockpit served by the framework at /hub (16 panels: dashboard, diagnostics, logs, traces, query profiler, cron, DB, models/ERD, migrations, files, config, auth-migration, routes/permissions, error-codes, email preview, mailbox, AI). Disabled by default, switched on per environment.
  • Security — pins axios to 1.18.1, closing 3 moderate advisories (recursion DoS + prototype pollution) that were transitive via the Brevo and Mailjet mail SDKs.

How do I update?

pnpm update @lenne.tech/nest-server

Do I need to do anything?

No. The Hub is disabled by default and the axios fix is automatic. To enable the Hub in an environment:

// config.env.ts
hub: { collectors: { queries: true }, mailbox: { mode: 'capture' } }, // stays ADMIN-gated

It never turns on implicitly and stays ADMIN-gated. In production it is off unless you add it explicitly (see the migration guide for the safe production recipe).

Under the hood

Self-sufficient login/logout, a public shell that reveals nothing (nav/env/links come from an ADMIN-gated payload), startup guards against a public Hub in reachable environments, and the standalone permissions report now follows the Hub. Full details: migration-guides/11.31.2-to-11.31.3.md.

🤖 Generated with Claude Code

…erate axios advisories

Hub: build-free /hub cockpit (16 panels, 3 runtime collectors, Mailpit-style
mailbox, confirm-guarded admin actions), disabled by default and switched on
per environment, ADMIN-gated. Self-sufficient login + logout, client-built
nav (public shell reveals nothing), Routes/Permissions panel, unavailable
panels greyed out. Startup guards: public-access guard (roles:false forbidden
in reachable envs unless acknowledged) and a warning when no roles guard is
active. Permissions report now follows the Hub (never a standalone reachable
surface).

Security: pin axios to 1.18.1 to close 3 moderate advisories (recursion DoS +
prototype pollution) transitive via the Brevo and Mailjet mail SDKs.

Also: add a typecheck:tests check step (which surfaced and fixed a stale
CoreAiConversationService constructor arity in tests/unit/ai.spec.ts).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@kaihaase
kaihaase merged commit 49a125e into main Jul 20, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant