Release v1.9-20260304 — Security Patch - #206
Merged
Merged
Conversation
Merge tag 'v1.7-20241211'
…the tests to pass locally
Unit test updates
177: isApproved feature
feature addition: manual solicitation check
Increase disk_quota to 4096M for larger Docker image
More robust boolean handling
fix: update boolean handling to support both string and boolean compl…
security: fix npm audit vulnerabilities (57→10)
Finding #1 (Moderate): Add HSTS Strict-Transport-Security header - max-age=31536000 (1 year), includeSubDomains, preload Finding #3 (Low): Tighten CORS configuration - Reject CORS for requests with no Origin header in production - Remove unused dev/staging origins from shared CORSWhitelist Finding #4 (Low): Remove information disclosure headers - Strip Server and X-Powered-By headers - Add X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy security headers Ref: SRT Penetration Test Report v1 (March 2026) by Valiant Solutions
The apt-get install of cf8-cli was failing intermittently because the underlying GitHub release CDN returns 500 errors. This replaces the two-step Debian repo approach with a single direct binary download from packages.cloudfoundry.org with 3 retry attempts.
fix: replace flaky Debian CF CLI install with direct download + retry
The pen test remediation over-trimmed the CORSWhitelist, removing legitimate dev/staging/prod client URLs. The actual CORS fix was in the callback logic (rejecting undefined origins), not in removing real client origins.
…diate CVE-2026-2391 Addresses CISA KEV finding SNYK-JS-QS-15268416 (Allocation of Resources Without Limits or Throttling in qs >=6.7.0 <6.14.2).
fix(security): upgrade express to 4.22.1 and pin qs to 6.14.2
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…ed pipeline stats, database card cleanup
…ational LLM + srt-ml compliance
- Production: smtp.gsa.gov (internal DNS A record, port 25, no auth) - Dev/Test: 159.142.160.13 (direct IP, port 25, no auth) - Removed SendGrid API key dependency - Added test-email.js script for verification - Per Ted Kruelski (GSA IT, IADA)
Broker-issued SMTP credentials were hardcoded in the clouddev block of config.js, which put a live AWS GovCloud SES key into git history. The credential has been rotated via cf unbind-service/bind-service. Reads from the aws-ses binding the same way dbConfig.js already reads Postgres, so future rotations are picked up on restage with no code change. Only applies when an aws-ses instance is bound, so SendGrid environments are unaffected. Also adds .env, .claude/ and .venv/ to .gitignore. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Adds the session-scoped drafts API with 30-minute retention, the user feedback endpoint, and the pipeline-v4 routes backing the BM25 plus ML scoring path. Includes the bm25 shared module and the quota-free SAM.gov bulk-extract ingest script used for backfills. Migrations: draft solicitations table, and Users.reviewStatus for the richer reviewer statuses. Both are already applied in production. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
There was a problem hiding this comment.
CodeQL found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release v1.9-20260304 — Security Patch
Security Fixes
qsto 6.14.2 via Express 4.22.1 (CISA KEV finding)Features