diegosouzapw 8ce81a067c fix(security): pin GCM authTagLength and harden Mermaid SVG rendering ...

Close two defense-in-depth gaps surfaced by the v3.8.1 release vulnerability scan:

- Field-level credential encryption (src/lib/db/encryption.ts) and the CLI
  decrypt path (bin/cli/encryption.mjs) now pass authTagLength: 16 to every
  createDecipheriv call. Authentication was already enforced via setAuthTag +
  final(), but pinning the tag length rejects truncated GCM tags up front,
  closing the tag-truncation forgery vector (Semgrep gcm-no-tag-length).
- MermaidDiagram switches securityLevel from "loose" to "strict" (Mermaid's
  default), so the rendered SVG is sanitized by Mermaid's bundled DOMPurify
  before the innerHTML assignment.

Adds a regression test asserting decrypt() fails closed on a truncated auth tag.

2026-05-21 01:02:06 -03:00

..

cli

fix(security): pin GCM authTagLength and harden Mermaid SVG rendering

2026-05-21 01:02:06 -03:00

mcp-server.mjs

node dependency updates (#2259)

2026-05-14 20:20:54 -03:00

nodeRuntimeSupport.mjs

fix(infrastructure): move wreq-js to optionalDependencies and add Node 25/26 to secure runtime policy (#1924)

2026-05-04 02:03:20 -03:00

omniroute.mjs

Release/v3.8.0 (#2430)

2026-05-20 09:12:49 -03:00

reset-password.mjs

Release/v3.8.0 — full changelog with 660+ commits (#2419)

2026-05-20 02:05:50 -03:00