From b2011b689910cea3a8e0f8f587793d0cde497623 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Sat, 5 Sep 2026 07:40:10 +0000 Subject: [PATCH 1/3] chore(release): prepare 3.0.1 - Bump version to 3.0.1 - Update CHANGELOG.md with release notes --- CHANGELOG.md | 2 ++ package.json | 2 +- packages/backend/package.json | 2 +- packages/frontend/package.json | 2 +- packages/shared/package.json | 2 +- 5 files changed, 6 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index b3b77ca0..bf5acd64 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,8 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [3.0.1] - 2026-09-05 + ## [3.0.0] - 2026-08-25 ### Breaking Changes diff --git a/package.json b/package.json index 1a65c3d5..cd0fa719 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "scrumooth", - "version": "3.0.0", + "version": "3.0.1", "private": true, "license": "Apache-2.0", "description": "Scrumooth - Self-hosted Scrum tool, faithful to the Scrum Guide", diff --git a/packages/backend/package.json b/packages/backend/package.json index f9ad9a54..61953f1c 100644 --- a/packages/backend/package.json +++ b/packages/backend/package.json @@ -1,6 +1,6 @@ { "name": "@scrumooth/backend", - "version": "3.0.0", + "version": "3.0.1", "private": true, "license": "Apache-2.0", "type": "module", diff --git a/packages/frontend/package.json b/packages/frontend/package.json index ac3bc394..1d9a01bf 100644 --- a/packages/frontend/package.json +++ b/packages/frontend/package.json @@ -1,6 +1,6 @@ { "name": "@scrumooth/frontend", - "version": "3.0.0", + "version": "3.0.1", "private": true, "license": "Apache-2.0", "description": "Frontend UI for Scrumooth - Self-hosted Scrum tool, faithful to the Scrum Guide", diff --git a/packages/shared/package.json b/packages/shared/package.json index 614da23d..44ab2e09 100644 --- a/packages/shared/package.json +++ b/packages/shared/package.json @@ -1,6 +1,6 @@ { "name": "@scrumooth/shared", - "version": "3.0.0", + "version": "3.0.1", "private": true, "type": "module", "license": "Apache-2.0", From e6efbc97ce684e132b73f46a4383d51e82ca57c3 Mon Sep 17 00:00:00 2001 From: orbivort <273379167+orbivort@users.noreply.github.com> Date: Sat, 5 Sep 2026 15:41:29 +0800 Subject: [PATCH 2/3] Add security updates for dependencies in CHANGELOG Updated CHANGELOG.md to include security fixes for various dependencies, detailing vulnerabilities and their resolutions. --- CHANGELOG.md | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index bf5acd64..e1c8d068 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,35 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [3.0.1] - 2026-09-05 +### Security + +- Remediate **high**- and **moderate**-severity transitive dependency vulnerabilities: + - `browserslist` → 4.28.8 — fixes unbounded memory growth (no cache eviction) from + distinct query results leading to eventual OOM + ([GHSA-c83g-rgw3-j3cx](https://github.com/advisories/GHSA-c83g-rgw3-j3cx)) and an + uncaught crash / prototype write via untrusted `browserslist-stats.json` custom stats + ([GHSA-73wf-gq98-2v4g](https://github.com/advisories/GHSA-73wf-gq98-2v4g)). It is pulled + by `@babel/helper-compilation-targets`, `core-js-compat`, `doiuse`, and + `stylelint-no-unsupported-browser-features` + - `mysql2` 3.15.3 → 3.24.3 — fixes an auth-plugin downgrade to `mysql_clear_password` + that leaks plaintext credentials + ([GHSA-3f6p-5ww8-9rcr](https://github.com/advisories/GHSA-3f6p-5ww8-9rcr)) and an + unbounded zlib-inflate decompression-bomb DoS in the compressed protocol handler + ([GHSA-rgwj-5xj2-c3m3](https://github.com/advisories/GHSA-rgwj-5xj2-c3m3)). It is pulled + by the Prisma CLI, which pins the vulnerable version exactly + - `fast-uri` 3.1.5 → 3.1.7 — fixes SSRF / host confusion via malformed IPv6, + percent-decoding, and IDN normalization + ([GHSA-5jgf-p345-68v8](https://github.com/advisories/GHSA-5jgf-p345-68v8), + [GHSA-f65p-4m7j-42xc](https://github.com/advisories/GHSA-f65p-4m7j-42xc), + [GHSA-fph4-wmhf-6fwf](https://github.com/advisories/GHSA-fph4-wmhf-6fwf), + [GHSA-jqff-g426-hqxp](https://github.com/advisories/GHSA-jqff-g426-hqxp)). It is pulled by + `ajv` through the commitlint and stylelint toolchains + - `qs` 6.15.3 → 6.16.0 — fixes an array-limit bypass via bracket-key comma parsing + ([GHSA-x5fp-wj9c-mxmx](https://github.com/advisories/GHSA-x5fp-wj9c-mxmx)) and a DoS via + an attacker-controlled `isBuffer` + ([GHSA-4mjr-xmp4-gh2g](https://github.com/advisories/GHSA-4mjr-xmp4-gh2g)). It is pulled + by Express, body-parser, and superagent + ## [3.0.0] - 2026-08-25 ### Breaking Changes From b612b0008209206e5d23284abe6ef9837fac3d69 Mon Sep 17 00:00:00 2001 From: orbivort <273379167+orbivort@users.noreply.github.com> Date: Sat, 5 Sep 2026 15:47:19 +0800 Subject: [PATCH 3/3] Formatting in CHANGELOG for security section --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index e1c8d068..923dbbc2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,7 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Security -- Remediate **high**- and **moderate**-severity transitive dependency vulnerabilities: +- Remediate **high**- and **moderate**-severity transitive dependency vulnerabilities: - `browserslist` → 4.28.8 — fixes unbounded memory growth (no cache eviction) from distinct query results leading to eventual OOM ([GHSA-c83g-rgw3-j3cx](https://github.com/advisories/GHSA-c83g-rgw3-j3cx)) and an