- Bumped `vitest` and `vite` versions in both root and agent-client lockfiles.
- Added `web-nodejs` overrides for `@babel/core` and `js-yaml` to address Dependabot alerts.
- Implemented `NewConnLimiterFromInt` for relay per-IP limits in the Go server, removing the deprecated `deepSet` function from the patch-role-scope-i18n script.
- Extended CodeQL coverage to include new query filters and improved npm audit configurations.
- Implemented input validation for `orgId` and `deviceId` in CDAP and organization detail routes using `assertSafeApiId`, returning a 400 error for invalid inputs.
- Added HTML escaping for `deviceId` and `orgId` in views to prevent XSS vulnerabilities.
- Hardened `patch-role-scope-i18n.js` against prototype pollution with a guard for unsafe nested keys.
- Updated CodeQL configuration to include new exclusions and ensure documented exclusions are applied.
Add inline CodeQL suppressions for MeshAgent TLS pin and EJS layout body, and exclude those files from analysis so alerts #280 and #281 clear on the next scan.
Bump support-agent Go deps, harden relay recording paths and clipboard HTML stripping, update agent-client Rust lockfile, and extend CodeQL/Dependabot config for known upstream limits.
Document safePath consumers, escaped chat/cdap DOM updates, test harness,
and dev-only i18n audit script in codeql-config.yml for PR gate parity.
Refs #196
Use plainBodyObject() for device file read API to avoid array .length
tampering; rate-limit ticket DELETE; document intentional sanitizers in
codeql-config.yml for branding, fonts, network monitor, and server paths.
Refs #196
Updated CodeQL configuration to exclude additional paths for security checks. Introduced a new file access rate limiter to prevent abuse of file download endpoints. Improved path resolution functions to ensure confined access and added validation in body scalar functions to reject non-scalar types. Enhanced error handling in API endpoint validation to prevent invalid inputs.
UNITRONIX