Comparing e3deb37fbe..80dfaf43dc - meet

gsadmin/meet

Fork 0

mirror of https://github.com/suitenumerique/meet.git synced 2026-09-07 16:05:39 +00:00

Author	SHA1	Message	Date
lebaudantoine	80dfaf43dc	🔒️(frontend) upgrade base image to 1.30.4-alpine3.24 Bump the frontend base image to `1.30.4-alpine3.24`, which picks up fixes for the CVEs listed below and lets us drop the individual dependency pins that were only there to address earlier known CVEs. Address the following HIGH severity CVEs in libuuid / util-linux, reported by Trivy. Bumping to 2.41.6-r1 (bundled in the new base image) covers all of them: * CVE-2026-53612 — TOCTOU in mount post-mount ownership/mode changes. * CVE-2026-53613 — TOCTOU in mount via ancestor directory swap. * CVE-2026-53614 — SUID mount(8) nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2. * CVE-2026-76642 — failed external mount helper still runs privileged X-mount post-hooks. * CVE-2026-78408 — nsenter --join-cgroup leaks root cgroup migration authority (fixed in 2.41.6-r1). * CVE-2026-78410 — restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode escalation.	2026-09-07 16:07:42 +02:00
lebaudantoine	2a59b55128	🐛(frontend) keep feedback buttons on one line for fr/es/en A minor layout regression appeared when switching to the Marianne font: the feedback buttons wrapped onto two lines instead of staying on one. Adjust the layout so the buttons stay on a single line regardless of the font in use.	2026-09-07 16:07:34 +02:00

Author

SHA1

Message

Date

lebaudantoine

80dfaf43dc

🔒️(frontend) upgrade base image to 1.30.4-alpine3.24

Bump the frontend base image to `1.30.4-alpine3.24`, which picks up
fixes for the CVEs listed below and lets us drop the individual
dependency pins that were only there to address earlier known CVEs.

Address the following HIGH severity CVEs in libuuid / util-linux,
reported by Trivy. Bumping to 2.41.6-r1 (bundled in the new base
image) covers all of them:

* CVE-2026-53612 — TOCTOU in mount post-mount ownership/mode
  changes.
* CVE-2026-53613 — TOCTOU in mount via ancestor directory swap.
* CVE-2026-53614 — SUID mount(8) nosuid/noexec bypass via
  LIBMOUNT_FORCE_MOUNT2.
* CVE-2026-76642 — failed external mount helper still runs
  privileged X-mount post-hooks.
* CVE-2026-78408 — nsenter --join-cgroup leaks root cgroup
  migration authority (fixed in 2.41.6-r1).
* CVE-2026-78410 — restricted bind mounts do not pin the source,
  allowing X-mount.owner/group/mode escalation.

2026-09-07 16:07:42 +02:00

lebaudantoine

2a59b55128

🐛(frontend) keep feedback buttons on one line for fr/es/en

A minor layout regression appeared when switching to the Marianne
font: the feedback buttons wrapped onto two lines instead of
staying on one.

Adjust the layout so the buttons stay on a single line regardless
of the font in use.

2026-09-07 16:07:34 +02:00

Compare commits

2 Commits

main .. frontend-layout

Diff Content Not Available

Compare commits

2 Commits main .. frontend-layout

Diff Content Not Available

2 Commits

main .. frontend-layout