All pull requests

Pull requests

• build(deps): bump postcss-selector-parser in /frontend

  dependenciesjavascript
  #1651·dependabot[bot] opened Nov 1, 2026Bot·

  ·

• build(deps): bump fast-uri from 3.1.2 to 3.1.9 in /frontend

  dependenciesjavascript
  #1650·dependabot[bot] opened Oct 31, 2026Bot·

  ·

• build(deps): bump fast-uri from 3.1.2 to 3.1.9

  dependenciesjavascript
  #1649·dependabot[bot] opened Oct 31, 2026Bot·

  ·

• build(deps): bump undici from 7.28.0 to 7.30.1 in /frontend

  dependenciesjavascript
  #1648·dependabot[bot] opened Oct 30, 2026Bot·

  ·

• fix(orders): enforce wallet ownership in wallet-funded order creation (IDOR)

  #1647·zF4ke opened Oct 29, 2026·

  ·
  1

• fix(security): prevent IDOR in wallet-funded order creation (#1613)

  #1646·alfredoalvarado53-ui opened Oct 29, 2026·

  ·
  1

• build(deps): bump body-parser

  dependenciesjavascript
  #1645·dependabot[bot] opened Oct 28, 2026Bot·

  ·

• fix(security): enforce order ownership in POST /orders/:id/payments (#1627)

  #1644·alfredoalvarado53-ui opened Oct 28, 2026·

  ·
  1

• Fix organization task sorting before pagination

  #1643·newworldba opened Oct 27, 2026·

  ·
  1

• fix: authorize and cap task payments

  #1642·newworldba opened Oct 27, 2026·

  ·
  1

• fix: scope order read endpoints to owner

  #1641·newworldba opened Oct 27, 2026·

  ·
  1

• fix: require wallet ownership on update

  #1640·newworldba opened Oct 27, 2026·

  ·
  1

• fix(security): enforce task ownership check in removeAssignedUser (#1623)

  #1639·boumarate opened Oct 27, 2026·

  ·
  1

• fix: resolve #1623 - [Bug]: Missing ownership check in PUT /tasks/{id}/assignment

  #1638·fangjian-bit opened Oct 27, 2026·

  ·
  1

  1

• fix: resolve #1613 - GitPay Security Finding #1613

  #1637·fangjian-bit opened Oct 27, 2026·

  ·
  1

  1

• fix: resolve #1626 - [Bug]: Unverified userId query parameter in /callback/github

  #1636·fangjian-bit opened Oct 27, 2026·

  ·
  1

  2

• fix(wallet): enforce server-side state transitions and payment authorization

  #1635·adilalperenciftci opened Oct 27, 2026·

  ·
  2

  1

• fix(security): require authentication and enforce task ownership on invite, funding, and report endpoints (Fixes #1624)

  #1634·johannschiffer opened Oct 26, 2026·

  ·
  1

• fix(security): prevent IDOR in order and wallet-order read endpoints (Fixes #1625)

  #1633·johannschiffer opened Oct 26, 2026·

  ·
  1

• fix(wallets): prevent IDOR and enforce ownership in PUT /wallets/:id (fixes #1622)

  #1632·johannschiffer opened Oct 26, 2026·

  ·
  1

• fix(security): prevent BOLA and unauthorized task unassignment in removeAssignedUser (Fixes #1623)

  #1631·johannschiffer opened Oct 26, 2026·

  ·
  1

• fix(security): prevent BOLA and mass assignment in payment-request transfer endpoints (Fixes #1621)

  #1630·johannschiffer opened Oct 26, 2026·

  ·
  1

• fix: secure private task OAuth identity

  #1629·newworldba opened Oct 26, 2026·

  ·
  1

• fix: require order ownership for payments

  #1628·newworldba opened Oct 26, 2026·

  ·
  1

• fix(security): prevent BOLA and mass assignment in updateWalletOrder (Fixes #1612)

  #1620·arseniyaleksandrov47-debug opened Oct 26, 2026·

  ·
  1