fix: upstream sync (7 fixes) + security hardening — authz, webhooks, TLS, Dependabot - #68

Merged

JOY (JOY) merged 31 commits into

mainfrom

Sep 12, 2026

Commits on Sep 8, 2026

Merge branch 'calcom:main' into dev
JOY (JOY)
authored
a78b1be
chore(deps): register @calcom/crovecrm workspace in yarn.lock
JOY (JOY)
committed
7782de6
fix(auth): remove hardcoded DOS.Me OIDC credentials and re-anchor JWT identity
JOY (JOY)
committed
2e7df3e
fix(webhooks): require HMAC signatures and honest delivery reporting on CRM sync routes
JOY (JOY)
committed
82397d2
fix(workflows): enforce team membership and re-add dropped workflow tables
JOY (JOY)
committed
f77912e
fix(teams-orgs): enforce membership, role hierarchy and consent on tenant endpoints
JOY (JOY)
committed
8bb6826
fix(mcp-server): remove unsafe ownership fallbacks and enable type checking
JOY (JOY)
committed
7dbe386
fix(upstream-sync): restore platform-types permission type and drop user-blind event-type cache
JOY (JOY)
committed
45a4a5a
fix(i18n): add missing teams listing strings
JOY (JOY)
committed
47a4804
docs(audit): add full-repo audit report with prioritized findings
JOY (JOY)
committed
4adef44
fix(security): resolve dependabot alerts — bump axios/hono/vite/protobufjs/xmldom/brace-expansion/tar/next/next-auth
JOY (JOY)
committed
d8eba1a
fix(hygiene): stop leaking DB errors from /api/health, declare crovecrm deps, surface husky failures
JOY (JOY)
committed
b2b693f

Commits on Sep 10, 2026

Commits on Sep 11, 2026

refactor(webhooks): rename DOS sync secret to the product-prefixed convention
JOY
committed
341cc71

Commits on Sep 12, 2026

fix(deps): bump next to 16.3.3 for newly published critical advisories
JOY
committed
324b397