Security
- Next.js 15.1.0 -> 16.2.7 on frontend and landing (CVE-2025-55182, XMRig compromise)
- python-jose 3.3.0 -> PyJWT 2.13.0
- Redis auth enabled via REDIS_PASSWORD
- public registration closed, auth endpoints throttled
- every /api response marked no-store
- dev postgres and redis bound to loopback
- extension requests bound to the configured PingCRM instance
- transitive advisory patches across backend, frontend, docs, whatsapp-sidecar
Fixes
- trust proxy headers so redirects keep the https scheme
- dashboard surfaces fetch failures instead of rendering zeros
- extension pairing surfaces failure and bounds its poll loop
- registration validation errors reach the UI
- contact search strips a leading @ so handle queries match
- suggestions skip archived contacts
- duplicate emails detected on edit and auto-merged across syncs
- alembic loads DATABASE_URL from app settings
Features
- landing SEO/GEO: robots, sitemap, canonical, JSON-LD, FAQ, docs deep links, og.png, live star count
- docs: meta descriptions on all pages, robots.txt with sitemap directive
- LinkedIn: avatar and company enrichment on profile visit, ACo contact repair
Performance
- backend test suite 774s -> 45s