mirror of
https://github.com/taylanbakircioglu/flowfish.git
synced 2026-09-12 05:48:55 +00:00
taylanbakircioglu
613ed0bf99
- python-jose[cryptography] 3.3.0 -> 3.4.0 (CVE-2024-33663 algorithm confusion) in backend + api-gateway. App uses HS256 only; encode/decode API unchanged; 3.3.0<->3.4.0 tokens cross-verifiable (rolling-deploy safe). - jspdf 4.0.0 -> 4.2.1 (CVE-2026-31938 HTML injection in new-window paths) in frontend; @babel/runtime bumped 7.28.4 -> 7.28.6 (required by jspdf 4.2.1). App uses only new jsPDF()/autoTable()/doc.save() — vulnerable output path not used. Verified: jose roundtrip + cross-version, frontend npm build, backend & frontend docker images, and Kubernetes (kind) jose 3.4.0 + frontend serve. No feature/UI behavior change; backward compatible.