acl-recovery-tracker

Releases 4

1. v1.0.32026-09-01

   Version bump only. No application code, dependency or database schema change since v1.0.2 — the two trees are identical apart from the version string. If you are running v1.0.2, there is nothing to upgrade for.

   This tag exists to give the fixed scanner an unburned version number to verify against. A scan verdict is terminal, so v1.0.2 cannot be re-scanned and stays failed.

   Why v1.0.2 failed

   Its 8 HIGH findings (1 react, 7 vite) were artefacts of the scanner, not of this repository.

   Caret ranges in package.json could not be resolved to an exact version, so every dependency was queried twice — once pinned from package-lock.json, once versionless from package.json. Those dedupe to different keys, so both queries ran. A versionless OSV query is not a narrower question; it returns every advisory ever filed against the package at any version. One of the eight was filed against Vite 2, while this repo runs 7.3.6.

   Measured separately over the v1.0.2 tree:

   Half	Packages	Vulnerabilities	HIGH/CRITICAL
   Pinned	545	0	0
   Versionless	20	26	8

   All 8 blockers came from the phantom queries. No upgrade could clear them — which is why v1.0.2 failed on the same eight as v1.0.1, despite the commit in between genuinely fixing 15 real advisories.

   The scanner-side fix (dedupePackages now drops a versionless entry when the same ecosystem|name is pinned elsewhere) lives in the scanner's own codebase, not in this repository.

   Verified on this tree

   npm audit 0 vulnerabilities · tsc -b clean · eslint 0 errors · production build succeeds.

   Unchanged from v1.0.0

   • The app ships without authentication. RLS is enabled but grants the anon role full access. See Security in the README.
   • MIT permits buyers to redistribute and resell the source.
   • Not medical advice.
2. v1.0.22026-09-01

   Fixes the dependency advisories that failed the v1.0.1 release scan. 15 HIGH vulnerabilities, now 0. No application code changed.

   Vulnerabilities fixed

   Package	Affected	Issue
   vite	<=7.3.3	Path traversal in optimized deps .map handling; server.fs.deny bypass via queries and Windows alternate paths; arbitrary file read via dev server WebSocket
   react-router-dom	<=7.14.1	Vulnerable via react-router
   ws	8.0.0–8.20.1	Uninitialized memory disclosure; memory exhaustion DoS
   serialize-javascript	<=7.0.4	RCE via RegExp.flags; CPU exhaustion DoS. Transitive through workbox-build → @rollup/plugin-terser

   The vite and react-router-dom floors were raised in package.json, not just pinned in the lockfile — otherwise regenerating package-lock.json could land back on a vulnerable version.

   Also checked

   The scan could have failed on a secret or a size limit. Both were audited and were clean:

   • Secrets — no .env has ever been committed, .env.example contains only placeholders, and no credential-shaped strings exist in any tracked file.
   • Size — 660 KB tracked in total, the largest file being the 292 KB lockfile.

   Added

   .github/workflows/audit.yml runs npm audit --audit-level=high on every push and weekly, so new advisories surface immediately rather than at the next release scan. It is deliberately separate from the deploy workflow: a new advisory in a transitive dependency should report itself, not block a deploy of code that was already fine.

   Verified

   npm ci clean · tsc -b clean · eslint 0 errors · root and sub-path production builds both succeed.

   Unchanged from v1.0.0

   • The app ships without authentication. RLS is enabled but grants the anon role full access. See Security in the README.
   • MIT permits buyers to redistribute and resell the source.
   • Not medical advice.
3. v1.0.12026-09-01

   A metadata release. No application code, dependencies or database schema changed since v1.0.0 — if you are already running it, there is nothing to upgrade for.

   Changed

   • LICENSE now names a real copyright holder. v1.0.0 shipped the placeholder Copyright (c) 2026 ACL Recovery Tracker, left over from stripping the fork of personal details. It now reads Copyright (c) 2026 Paul Martin.
   • Version bumped to 1.0.1 in package.json, package-lock.json and the README. The version is injected into the bundle at build time and shown on the Settings page, so all four now agree.
   • README tells redistributors to substitute their own name in the licence, rather than implying the field was left unset.

   Still worth knowing

   Unchanged from v1.0.0, and both still apply:

   • The app ships without authentication. RLS is enabled but grants the anon role full access, and the anon key is visible in the JavaScript bundle — fine for one person at an unlisted URL, wrong if you publish the link. See Security in the README.
   • MIT permits buyers to redistribute and resell the source. If that is not what you want from a paid product, swap the licence before distributing.
   • Not medical advice.