Back to the changelog

• Security

  Security audit addendum

  Eight security issues found in an audit and fixed: demoting a role or deleting a custom role now revokes active sessions immediately (a stale token no longer keeps its privileges); the Data Shield anonymizer only ever sees already-shielded text; item history hides sensitive fields (nested too) for every role; task instances are created before entry tasks (correct n8n callback tokens + AI audit trail); the Flow Agent re-validates start permissions on confirm; private-network AI/n8n targets sit behind a dedicated environment switch; AI provider/assistant routes now have size limits and audit logging.

• Security

  Dependencies: 24 → 0 vulnerabilities

  pnpm audit --prod now reports zero vulnerabilities (was 24, incl. 3 high): nodemailer, dompurify, react-router and form-data/hono updated.