Back to the changelog

• Security

  Security audit addendum

  Eight security issues found in an audit and fixed: **demoting a role or deleting a custom role now revokes active sessions immediately** (a stale token no longer keeps its privileges); the **Data Shield anonymizer only ever sees already-shielded text**; item **history hides sensitive fields** (nested too) for every role; task instances are created **before** entry tasks (correct n8n callback tokens + AI audit trail); the **Flow Agent re-validates start permissions on confirm**; private-network AI/n8n targets sit behind a dedicated environment switch; AI provider/assistant routes now have size limits and audit logging.

• Security

  Dependencies: 24 → 0 vulnerabilities

  `pnpm audit --prod` now reports **zero** vulnerabilities (was 24, incl. 3 high): nodemailer, dompurify, react-router and form-data/hono updated.