Security fixes 20260409#1

Merged

buggedcom merged 14 commits into

mainfrom

security-fixes-20260409

Apr 9, 2026

Commits on Apr 9, 2026

chore(tooling): add package.json version linting and renovate trust policy
buggedcom
committed
fix(security): harden input validation across WS API and service schema
buggedcom
committed
chore(eslint): migrate from airbnb-base to eslint-config-airbnb-extended
buggedcom
committed
fix(build): enable experimentalDecorators to prevent accessor syntax in bundle
buggedcom
committed
feat(annotation-dialog): redesign layout and fix target selector UX
buggedcom
committed
fix(security): enforce entity-level read permissions on all data endpoints
buggedcom
committed
chore(tooling): add version:patch/minor/major scripts to package.json
buggedcom
committed
fix(deps): override lodash to ^4.18.0 to patch prototype pollution (GHSA)
buggedcom
committed
fix(ci): add explicit least-privilege permissions to all workflows (CodeQL)
buggedcom
committed
fix(ci): exclude generated JS bundle from CodeQL analysis
buggedcom
committed
fix(security): escape ha-stubs field label/value via Lit html+render
buggedcom
committed
fix(security): replace innerHTML with adoptedStyleSheets + Lit render in stubs
buggedcom
committed
refactor: migrate esc() innerHTML patterns to Lit html+render throughout
buggedcom
committed
feat(dev): Add dev-sync build ID to browser console badge
buggedcom
committed