All pull requests

Pull requests

• fix(forms): prevent stored XSS in admin submissions view and render it in the admin layout

  #1100·josevenceslau opened Sep 16, 2026·

  ·

• fix(security): run the JWT_SECRET production check on every request

  #1097·mmcintosh opened Sep 13, 2026·

  ·

• ci(publish): fix OIDC auth - sed _authToken from NPM_CONFIG_USERCONFIG

  #1090·lane711 opened Sep 8, 2026·

  ·

• chore(deps-dev): bump vitest from 4.1.10 to 4.1.11 in /packages/core

  dependenciesjavascript
  #1085·dependabot[bot] opened Sep 8, 2026·

  ·

• chore(deps-dev): bump sharp from 0.35.0 to 0.35.4 in /www

  dependenciesjavascript
  #1083·dependabot[bot] opened Sep 8, 2026·

  ·

• chore(deps-dev): bump hono from 4.12.27 to 4.13.5 in /packages/core

  dependenciesjavascript
  #1084·dependabot[bot] opened Sep 8, 2026·

  ·

• chore(deps-dev): bump hono from 4.12.32 to 4.13.7 in /packages/stats

  dependenciesjavascript
  #1082·dependabot[bot] opened Sep 8, 2026·

  ·

• chore(deps): bump csv-parse from 6.2.1 to 7.0.2 in /packages/core

  dependenciesjavascript
  #1081·dependabot[bot] opened Sep 8, 2026·

  ·

• chore(deps): bump qs from 6.15.3 to 6.16.0

  dependenciesjavascript
  #1074·dependabot[bot] opened Sep 3, 2026·

  ·

• chore(deps-dev): bump browserslist from 4.28.5 to 4.28.9 in /demos/employee-directory

  dependenciesjavascript
  #1073·dependabot[bot] opened Sep 3, 2026·

  ·

• chore(deps): bump @humanfs/node from 0.16.7 to 0.16.8 in /packages/core

  dependenciesjavascript
  #1072·dependabot[bot] opened Sep 3, 2026·

  ·

• docs: Postgres portability — Kysely spike (compile-only)

  #1070·lane711 opened Sep 2, 2026·

  ·
  1

• fix: User plugin /api routes take precedence over catch all /api route

  #1068·jimmaaay opened Aug 25, 2026·

  ·
  1

• fix(admin): escape user-controlled values in admin templates (XSS)

  #1066·mmcintosh opened Aug 21, 2026·

  ·

• fix(api): harden the anonymous public surface (system info, rate limits, form DoS)

  #1065·mmcintosh opened Aug 20, 2026·

  ·

• fix(auth): gate /auth/seed-admin to non-production environments

  #1063·mmcintosh opened Aug 20, 2026·

  ·

• fix(auth): pin Better Auth to 1.6.25

  #1062·shoveller opened Aug 19, 2026·

  ·
  1

  1

• feat(views): no-code REST endpoints and public embeds over document collections

  #1060·mmcintosh opened Aug 19, 2026·

  ·

• feat(search): FTS5 lexical search + security hardening for /api/search

  #1058·mmcintosh opened Aug 18, 2026·

  ·

• fix(forms): escape stored HTML, gate submit on is_public, enforce RBAC on legacy forms routes

  #1057·mmcintosh opened Aug 18, 2026·

  ·

• feat: add support for devcontainer

  #1055·LukeSeers opened Aug 14, 2026·

  ·

• chore(deps): bump hono from 4.12.32 to 4.13.1

  dependenciesjavascript
  #1050·dependabot[bot] opened Aug 9, 2026·

  ·

• chore(deps): bump postcss and next

  dependenciesjavascript
  #1047·dependabot[bot] opened Aug 5, 2026·

  ·

• refactor(global-variables): strip remaining any from adminRoutes + resolver (types-only)

  #1025·mmcintosh opened Jul 22, 2026·

  ·

• fix(bootstrap): first-boot FK race + single-flight

  #1019·mmcintosh opened Jul 20, 2026·

  ·
  1

  1