BlueTeam.News v1.0.2

BlueTeam.News v1.0.2 adds Node 26 support and another defense-in-depth pass while preserving the same source installation on macOS, Windows, and Linux:

git clone → npm install → npm start

There is no standalone installer or bundled runtime.

Runtime compatibility

• Test Node 22, 24, and 26, including Node 26 on Windows, Linux, Apple Silicon macOS, and Intel macOS.
• Upgrade better-sqlite3 for Node 26 native binaries.
• Bridge legacy and Node 26 fetch-dispatcher handlers, including request bodies, aborts, and backpressure.

Security hardening

• Block loopback DNS rebinding and mismatched browser origins.
• Require configured API secrets to be at least 32 characters and limit unauthenticated health diagnostics.
• Bound untrusted feed and cache input, reject credential-bearing URLs, and strengthen SSRF handling.
• Sanitize terminal-control and secret-bearing log content.
• Harden exported Briefing CSP, local POSIX file permissions, and Express fingerprinting.
• Refresh vulnerable dependency resolutions, explicitly allow reviewed native install scripts, and expand CI audits.

Documentation

• Refine the README and split operations, configuration, architecture, API, and development material into focused guides.
• Clarify the cross-platform source workflow, remote-proxy requirements, and optional outbound data.

Upgrade note

Existing API_SECRET values shorter than 32 characters or resembling placeholders must be replaced before startup. Run npm install on the target machine; do not copy node_modules between operating systems, CPU architectures, or Node versions. npm 11.18+ is recommended so the install-script allowlist is enforced locally.

Verification

• 38 test suites: 771 passed, 2 platform-specific permission assertions skipped locally and exercised in Linux CI.
• Secret, Git-history secret, contrast, placeholder, CTI-scope, asset, and scoring checks passed.
• Dependency tree, native SQLite smoke test, and source-package dry run passed.