Skip to content

v2.18.1

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 03 Oct 11:06
v2.18.1
d319777
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release Summary: v2.18.1

This patch release addresses a high-severity dependency vulnerability affecting file uploads, updates dependencies for security and compatibility, and refines the CI trailer-check behavior.

Security Fix

File Upload Vulnerability (GHSA-xjh9-v7x6-24jw)

Severity: High

Upgraded @fastify/busboy from 3.2.0 to 3.2.2 to remediate a vulnerability in multipart form parsing. This affects the photo upload endpoint and any other file-upload features. If you use the diary photo feature, upgrade immediately.

Maintenance Updates

  • ical-generator: 11.1.1 → 11.1.2 -- patch update
  • Development dependencies:
    • @eslint-react/eslint-plugin 5.20.8 → 5.23.0
    • typescript-eslint 8.70.1 → 8.71.0
    • @types/node 26.6.2 → 26.6.3
    • testcontainers 12.1.0 → 12.2.0
  • GitHub Actions: codeql-action/upload-sarif bumped for security analysis reliability

Deployment

docker pull steilerdev/cornerstone:latest

Restart your container. No database migrations or configuration changes required.

Behind the Scenes

  • CI refinement: The trailer-check job now correctly ignores files changed by commits without Claude agent trailers (human edits and aggregated Dependabot commits in promotion PRs), preventing false failures in beta → main promotion workflows.
  • Dependency policy: The zero-vulnerability requirement now applies to the runtime image only (npm audit --omit=dev). nanoid is now declared as a client dependency (it is bundled by the photo annotator).

Docker Images

  • Stable release (main): steilerdev/cornerstone:latest, steilerdev/cornerstone:2.18.1
  • Beta preview (beta): steilerdev/cornerstone:beta

📚 Full Documentation | 💬 GitHub Issues

2.18.1 (2026-10-03)

Bug Fixes

Documentation

  • policy: scope zero-vulnerability rule to the runtime image (0fc4b31)
  • refocus README on highlights, drop roadmap, add Behind the Scenes section (#2175) (91c79c0)
  • update documentation for release (6c21efa)

Chores

  • deps-dev: bump the dev-dependencies group with 4 updates (ffcf00f)
  • deps: bump github/codeql-action/upload-sarif from 4.38.1 to 4.38.2 in the github-actions group (40f07ff)
  • deps: bump ical-generator from 11.1.1 to 11.1.2 in the prod-dependencies group (190b0ff)
  • update implementation checklist with lessons learned (d81476a), closes #2180

Tests

  • e2e: make open-items global tile assertion immune to concurrent data (35f0596)
Assets 2
Loading