Skip to content

1.3.0

Choose a tag to compare

View all tags
@tomkat-cr tomkat-cr released this 30 Aug 12:56
· 4 commits to main since this release
1.3.0
72927db
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

[1.3.0] - 2026-08-30

Added

  • AGENTS.md, GEMINI.md, and CLAUDE.md files to provide context and instructions to AI Coding Assistants [GS-303].
  • Add SAST testing [GS-315].
  • Add frontend scripts library [GS-107].

Changed

  • License changed to MIT [FA-244].
  • Rename AWS_S3_BUCKET_NAME to AWS_S3_BUCKET_NAME_FE in the .env file [GS-328].
  • ChatBot conversation code blocks enhancements: replace copy text button by an icon, and enhance design [GS-214].
  • Add "tailwind-build" script to deploy_* and run_* Makefile commands [GS-214].
  • webpack.config.js and config-overrides.js: commented out the Node.js core module resolve.fallback polyfills (os, url, crypto, stream, assert, vm, tty, constants, zlib, https, http, util) since nothing in the codebase needs them and Vite already runs fine without them; added npm install --save-dev ... notes above each so they can be re-enabled if a consumer's own dependency graph needs them [GS-338].
  • Update version to 1.3.0 in package.json, package-lock.json, and version.txt to reflect the latest release [GS-327].

Fixed

  • "Could not resolve dependency: formik@2.4.5" error in ExampleApp, FastApiTemplate and all apps that uses genericsuite-fe-ai as a dependency [GS-254].
  • "installHook.js:1 TypeError: JY.default.includes is not a function" error when certain ChatBot conversations are clicked and the page becomes empty [GS-214].
  • tsconfig.json was missing an exclude for *.test.tsx, so every test file got its own .d.ts stub emitted into dist/esm and dist/cjs during the Rollup build. These 14 stray files were already committed to the repo and shipping in dist/ with every npm publish [GS-338].
  • Removed a bogus "with" entry from the config-overrides.js resolve.fallback config — with is not a Node.js core module, so the fallback never did anything [GS-338].
  • The webpack.config.js fallback referenced require.resolve("assert") for a package that was never declared anywhere in package.json; documented it in the install note instead of leaving a silently-broken reference [GS-338].
  • rollup.config.mjs: removed formik from the external array — it isn't a declared peer dependency and isn't imported anywhere in src/ (leftover from copying genericsuite-fe's Rollup config) [GS-338].
  • "config-overrides.js" updated to fix errors running the app with RUN_BUNDLER="react-scripts" [GS-338], and refactor it to use fileURLToPath for path resolution and clean up unused debug logs [GS-327].
  • "process" dependency installation on "webpack.config.js" file documentation to to fix errors running the app [GS-338].

Security

  • json5, postcss, and prismjs security vulnerabilities fixed by upgrading their dependent packages [GS-214].
  • Upgrade dependencies to latest version: crypto-browserify@^3.12.1, downshift@^9.4.0, react-icons@^5.7.0, react-markdown@^10.1.0, react-syntax-highlighter@^16.1.1 [GS-219] [GS-214].
  • Upgrade axios@^1.19.0 to fix the security vulnerabilities [GS-219]:
    • Server-side Request Forgery (SSRF) [High Severity][https://security.snyk.io/vuln/SNYK-JS-AXIOS-17111062] in axios@1.15.1
    • Prototype Pollution [High Severity][https://security.snyk.io/vuln/SNYK-JS-AXIOS-17111079] in axios@1.15.1
    • Insertion of Sensitive Information Into Sent Data [High Severity][https://security.snyk.io/vuln/SNYK-JS-AXIOS-17172681] in axios@1.15.1
    • Improperly Controlled Modification of Dynamically-Determined Object Attributes [High Severity][https://security.snyk.io/vuln/SNYK-JS-AXIOS-16299921] in axios@1.15.1
    • Prototype Pollution [High Severity][https://security.snyk.io/vuln/SNYK-JS-AXIOS-17111060] in axios@1.15.1
    • Prototype Pollution [Critical Severity][https://security.snyk.io/vuln/SNYK-JS-AXIOS-16417750] in axios@1.15.1
    • Improper Removal of Sensitive Information Before Storage or Transfer [High Severity][https://security.snyk.io/vuln/SNYK-JS-FOLLOWREDIRECTS-16032162] in follow-redirects@1.15.11
    • Allocation of Resources Without Limits or Throttling in Axios
    • form-data: CRLF injection in form-data via unescaped multipart field names and filenames
    • Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
    • Axios: Header Injection via Prototype Pollution
    • Axios: unbounded recursion in toFormData causes DoS via deeply nested request data
    • follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets
  • Upgrade yup@^1.7.1 to fix the security vulnerabilities [GS-219]:
    • Arbitrary Code Injection [High Severity][https://security.snyk.io/vuln/SNYK-JS-LODASH-15869625] in lodash@4.17.23
      introduced by yup@0.32.11 > lodash@4.17.23
    • Arbitrary Code Injection [High Severity][https://security.snyk.io/vuln/SNYK-JS-LODASHES-15869627] in lodash-es@4.17.23
      introduced by yup@0.32.11 > lodash-es@4.17.23
    • lodash vulnerable to Prototype Pollution via array path bypass in _.unset and _.omit
  • Upgrade react-router-dom@^7.18.2 to fix the security vulnerability [GS-219]:
    • React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response. This is a follow up to CVE-2026-22030 to address related CSRF flows in unstable RSC code paths.
    • React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE
    • React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets
    • React Router vulnerable to DoS via unbounded path expansion in __manifest endpoin
    • React Router vulnerable to Denial of Service via reflected user input in single-fetch #105
  • Upgrade jest to "^30.4.2", jest-environment-jsdom to "^30.4.1", and "babel-jest" to "^30.4.1" to fix the security vulnerabilities [GS-219].
    • @babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input
    • ws: Memory exhaustion DoS from tiny fragments and data chunks
    • brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
    • js-yaml: YAML merge-key chains can force quadratic CPU consumption
    • @babel/core: Arbitrary File Read via sourceMappingURL Comment
  • Upgrade rollup-plugin-typescript2 to "^0.37.0" and typescript to "^5.3.3" to fix the security vulnerabilities [GS-219].
    • Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching
  • Other security vulnerabilities fixed by upgrading their dependent packages [GS-219]:
    • SVGO removeScripts plugin leaves some executable scripts intact
    • serialize-javascript [removed] Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString() CVE-2020-7660
    • serialize-javascript [removed] Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects
    • PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
    • fast-uri [removed] fast-uri vulnerable to path traversal via percent-encoded dot segments
    • fast-uri [removed] fast-uri vulnerable to host confusion via percent-encoded authority delimiters
    • fast-uri [removed] fast-uri vulnerable to host confusion via failed IDN canonicalization
    • path-to-regexp [removed] path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters CVE-2024-45296
    • ip-address [removed] ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass
    • express-rate-limit [removed] express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network
    • qs [removed] qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set
    • body-parser [removed] body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement
    • elliptic [removed] Elliptic Uses a Cryptographic Primitive with a Risky Implementation
  • "react" and "react-dom" have now peer dependencies with "^18.2.0" that does not affect this codebase because it only uses BrowserRouter/Routes/Route/Link/Navigate, no RSC APIs. By the way React/ReactDOM will be upgraded to 19 on next release to fix the mentioned react-router-dom security vulnerability [GS-219].
  • Bump Node.js version in .nvmrc to 26 [GS-339].
  • Upgrade @babel/core to ^7.29.7 to fix the @babel/core: Arbitrary File Read via sourceMappingURL Comment (CVE-2026-49356) [GS-219].

Removed

  • The scripts/ directory were moved to the frontend scripts library [GS-107].
  • Unused peerDependencies: react-icons, web-vitals, fs, json-loader, with, constants-browserify, crypto-browserify, os-browserify, stream-browserify, tty-browserify, url, vm-browserify, browserify-zlib, https-browserify, net, stream-http, util, buffer, downshift, history, rxjs, react-markdown, yup. None are imported anywhere in src/; the CRUD-editor-oriented ones (buffer, downshift, history, rxjs, react-markdown, yup) are already required transitively through the genericsuite peer dependency for anyone who needs them, and the Node.js core module shims were only ever used by the (optional) webpack/react-app-rewired dev-server configs [GS-338].
  • Unused devDependencies: @babel/cli, @babel/preset-stage-0, @rollup/plugin-typescript, file-loader, path, url-loader (same reasoning as genericsuite-fe), and whatwg-fetch (no test needs it here). @testing-library/user-event was kept — unlike genericsuite-fe, it's genuinely used in ChatCodeBlock.test.tsx [GS-338].
  • Unnecessary dependencies (css-loader, postcss-loader, style-loader, and , gh-pages). The user can import them if webpack or github pages are going to be used in their app [GS-338].
  • 'id="copyButton"' attribute from the component [GS-327].
Assets 2
Loading