2026-04-09 - 2026-07-09
Overview
262 Pull requests merged by 2 users
Merged
#266 chore(deps): update analog monorepo to v2.5.3
Merged
#268 fix(gitignore): ignore infra/*-tenant.personas.json (ADR-0026)
Merged
#267 chore(deps): bump dompurify override to >=3.4.5 (GHSA-87xg-pxx2-7hvx)
Merged
#265 feat(infra): single-file toggle between apps-profile dev modes
Merged
#264 docs(infra): document team mkcert CA on vm-gitlab (cross-VM trust)
Merged
#262 chore(deps): update dependency vite to v8.0.16
Merged
#263 feat(spa): opt-in 'https' nx serve config for dev-server TLS
Merged
#257 chore(deps): update dependency lint-staged to v17.0.6
Merged
#261 fix(infra): exclude serve-static from 'dev.sh up all' (port collision with apps)
Merged
#260 fix(security): normalize IPv6 in rate-limit keyGenerator (ADR-0021)
Merged
#259 feat(spa): proxy /api in dev-server, relative bffApiBaseUrl
Merged
#258 feat(infra): dockerised full-stack dev mode — apps compose profile (ADR-0030)
Merged
#256 docs(decisions): add ADR-0030 dockerised full-stack dev mode (proposed)
Merged
#255 fix(setup): mirror nvm init into .zshrc so zsh sees node + pnpm
Merged
#254 fix(deps): update dependency ioredis to v5.11.0
Merged
#253 fix(deps): update dependency helmet to v8.2.0
Merged
#252 chore(deps): update typescript tooling to v8.60.0
Merged
#251 chore(deps): update pnpm to v10.34.1
Merged
#250 chore(deps): update dependency @oxc-project/runtime to ^0.133.0
Merged
#249 fix(deps): update vitest to v4.1.7
Merged
#248 fix(deps): update nx to v22.7.5
Merged
#247 fix(deps): update angular to v21.2.15
Merged
#246 fix(deps): update nestjs
Merged
#245 fix(deps): update dependency nestjs-cls to v6.2.1
Merged
#244 fix(deps): update angular to v21.2.13
Merged
#242 chore(deps): update dependency dayjs to v1.11.21
Merged
#243 fix(ci): give gitlab perf job a discoverable chromium (ADR-0028)
Merged
#241 ci(gitlab): land .gitlab-ci.yml alongside gitea workflow (ADR-0028 phase 2)
Merged
#239 chore(deps): update dependency @swc/helpers to v0.5.23
Merged
#240 chore(deps): bump tmp override to >=0.2.6 (GHSA-ph9p-34f9-6g65)
Merged
#238 chore(gitlab): add MR template (ADR-0028 phase 1)
Merged
#237 fix(admin): unbreak ci:check on PR2b (TS2454 + missing fr translation)
Merged
#236 feat(admin): add /admin/users/:oid/scopes screen + endpoints (ADR-0026 PR 2b)
Merged
#235 fix(seed): use tsconfig.app.json instead of inline --compiler-options
Merged
#234 fix(seed): route prisma db seed through pnpm run for cwd resolution
Merged
#233 feat(auth): swap stub for PrismaScopeResolver + add test-tenant seed (ADR-0026 PR 2a)
Merged
#232 feat(users): add Person + User + UserScope + lazy provisioner (ADR-0026 PR 1)
Merged
#231 fix(structures): widen via String() in narrowing test to satisfy lint
Merged
#225 fix(deps): update dependency @scalar/nestjs-api-reference to v1.1.19
Merged
#230 refactor(users): rename Prisma User model to UserDirectoryEntry
Merged
#229 fix(structures): align Structure.delegation_code FK action with Prisma default
Merged
#228 feat(structures): add Region/Delegation/Structure schema + seed (ADR-0027 PR 1)
Merged
#227 docs(adr-0028): accept CI/CD + git hosting migration to GitLab
Merged
#226 docs(adr-0028): propose CI/CD + git hosting migration Gitea -> GitLab
Merged
#224 docs(setup): version aliases.zsh + gitconfig.txt under docs/setup/dotfiles
Merged
#223 docs(setup): drop deprecated apt packages on Debian 13 trixie
Merged
#222 docs(setup): make fail2ban opt-in in 70-hardening.sh
Merged
#221 docs(setup): use ~/.bashrc hand-off instead of chsh for zsh switch
Merged
#220 docs(setup): add Debian 13 dev-VM setup procedure + scripts + devcontainer
Merged
#219 docs(adr): accept ADR-0026 + ADR-0027
Merged
#218 fix(deps): update dependency @grpc/grpc-js to v1.14.4
Merged
#217 docs(adr): split ADR-0026 + propose ADR-0027 (Structure hierarchy)
Merged
#215 fix(deps): update angular
Merged
#214 chore(deps): update dependency ts-jest to v29.4.11
Merged
#213 docs(adr-0026): person + user portal-side data model (proposed)
Merged
#212 docs(claude.md): refresh Repository status with ADR-0022/0023/0025 shipments
Merged
#211 feat(ci): catalogue-drift gate for @RequirePrivilege/@RequireRole literals (ADR-0025)
Merged
#210 fix(deps): bump uuid to >=11.1.1 via pnpm.overrides (GHSA-w5hq-g745-h8pq)
Merged
#209 fix(ci): align shared-auth build outputPath with tsconfig.lib.json outDir
Merged
#208 feat(auth): @RequirePrivilege/@RequireRole/@RequireScope guards (ADR-0025)
Merged
#207 fix(ci): refresh lockfile for the new shared-auth lib
Merged
#204 chore(deps): update dependency @swc/core to v1.15.40
Merged
#206 feat(auth): authorization catalogues + Principal builder skeleton (ADR-0025)
Merged
#205 docs(adr-0025): promote to accepted + sync persona matrix with test tenant
Merged
#203 chore(deps): update analog monorepo to v2.5.2
Merged
#202 chore(deps): update dependency vite to v8.0.14
Merged
#201 docs(adr-0025): authorization model — privileges × roles × scopes
Merged
#200 fix(ci): move grpc-tools to optionalDependencies (revert NODE_OPTIONS attempt)
Merged
#199 fix(ci): pass NODE_OPTIONS=--use-system-ca to clear grpc-tools tls install
Merged
#198 fix(deps): update dependency @azure/msal-node to v5.2.2
Merged
#197 feat(portal-shell): chatbot widget — SSE-bridged AI assistant with full a11y uplift
Merged
#196 feat(portal-bff): ai-bridge controller — SSE chat + JSON rag/models
Merged
#195 feat(portal-bff): ai-client skeleton — vendored protos + grpc client + Principal mapper
Merged
#194 docs(adr-0024): ai service relay — gRPC dial + SSE bridge + POC principal
Merged
#193 chore(deps): update dependency cytoscape to v3.33.4
Merged
#192 chore(deps): update dependency ts-jest to v29.4.10
Merged
#191 chore(deps): update dependency postcss to v8.5.15
Merged
#190 chore(deps): bump brace-expansion + ws overrides to clear audit
Merged
#189 feat(portal-shell): ghost-style Sign-in button with log-in icon
Merged
#188 chore(deps): update typescript tooling to v8.59.4
Merged
#187 chore(deps): lock file maintenance
Merged
#186 chore(deps): lock file maintenance
Merged
#184 fix(deps): update opentelemetry-js-contrib monorepo
Merged
#183 fix(deps): update opentelemetry-js monorepo
Merged
#182 chore(deps): update dependency @playwright/test to v1.60.0
Merged
#181 chore(deps): update dependency @oxc-project/runtime to ^0.131.0
Merged
#185 chore(shared-charts): soften the curated palette
Merged
#180 fix(deps): update vitest to v4.1.6
Merged
#179 fix(deps): update nx to v22.7.2
Merged
#178 fix(deps): update nx to v22.7.2
Merged
#177 fix(portal-shell): same html/body overflow-y hidden shield as admin
Merged
#176 fix(portal-admin): html/body overflow-y hidden as a shell shield
Merged
#175 fix(audit): chart colours + Charts-tab layout regressions
Merged
#174 feat(portal-admin): audit log tabs (Table / Charts) + server-side stats consumption
Merged
#173 feat(portal-bff): audit-stats endpoint — server-side aggregations with redis cache
Merged
#172 feat(portal-admin): audit dashboard — bar / donut / stacked-bar above the table
Merged
#171 feat(shared-charts): foundations + bar / donut / stacked-bar components
Merged
#170 docs(adr-0023): charts and dashboards — d3 + observable plot
Merged
#169 fix(deps): update nestjs to v11.1.21
Merged
#168 fix(deps): update dependency express-rate-limit to v8.5.2
Merged
#167 chore(deps): update dependency lint-staged to v17.0.5
Merged
#166 feat(portal-admin): jaeger deep link on trace_id + actor-pivot on actor_id_hash
Merged
#165 feat(shared-ui): move the role label from the portal-shell sidebar into the user menu
Merged
#164 feat(portal-shell): align theme switcher trigger with locale switcher shape
Merged
#163 fix(deps): scope the vite < 7 override to vitepress so @angular/build keeps vite 8
Merged
#162 feat(portal-shell): move theme switcher to footer, drop redundant settings icon
Merged
#161 fix(docs): cap vite below 7 (rolldown-vite) and pin mermaid transitives
Merged
#160 docs(development): refresh after phase-3a + add topology / trace diagrams
Merged
#158 fix(deps): update dependency axios to v1.16.1
Merged
#159 chore(security): override vite + esbuild past vitepress's vulnerable transitives
Merged
#156 fix(deps): update dependency @scalar/nestjs-api-reference to v1.1.16
Merged
#157 fix(docs): pre-bundle mermaid deps so the dev server resolves dayjs/cytoscape
Merged
#155 fix(deps): update angular
Merged
#154 feat(docs): vitepress site for docs/, mermaid rendering, ci build workflow
Merged
#153 fix(portal-admin): adr refs point at gitea, not the madr template repo
Merged
#152 fix(portal-admin): adr refs point at gitea, not the madr template repo
Merged
#151 feat(portal): /api/me/capabilities + cross-app menu links + real role label
Merged
#150 feat(portal-admin): profile page on /profile guarded by authGuard
Merged
#149 feat(shared-ui): user menu dropdown + integration on portal-shell + portal-admin
Merged
#148 feat(portal-admin): header brand logo + sidebar background covers full column
Merged
#147 chore(workspace): tsconfig composite refs + axe-linter false-positive config
Merged
#146 chore(deps): update typescript tooling to v8.59.3
Merged
#145 fix(portal-bff): align admin entra role name with Portal.Admin
Merged
#144 chore(deps): update dependency vite to v8.0.13
Merged
#143 feat(portal-bff): openapi spec + scalar api reference UI (dev-only)
Merged
#142 feat(portal-admin): user directory viewer screen
Merged
#141 feat(portal-bff): admin user-directory read endpoint
Merged
#140 feat(portal-bff): user directory upserted at sign-in
Merged
#139 fix(portal-bff): serve /.well-known/jwks.json via express (path-to-regexp v8 ducks the dot)
Merged
#138 feat(portal-bff): signed-assertion strategy + /.well-known/jwks.json
Merged
#137 feat(portal-bff): obo strategy + encrypted downstream token cache
Merged
#136 feat(portal-admin): audit log viewer screen
Merged
#135 fix(feature-auth): use AUTH_PATH_PREFIX to skip the /me endpoint in the 401 interceptor
Merged
#134 feat(portal-admin): spa auth wiring + admin shell skeleton
Merged
#133 feat(ci): assert gzip transfer sizes against ADR-0017 budgets
Merged
#132 feat(portal-bff): admin audit-log read endpoint + audit_reader-locked path
Merged
#131 fix(portal-bff): use the real portal-admin dev port (4300) in admin-flow references
Merged
#130 chore(deps): update analog monorepo to v2.5.1
Merged
#129 feat(portal-bff): distinct admin session + /api/admin/auth flow
Merged
#128 feat(portal-bff): @RequireMfa decorator + freshness guard (ADR-0011)
Merged
#127 feat(portal-bff): admin module + role guard + /api/admin/me self-test
Merged
#126 feat(portal-bff): extract Entra roles claim onto AuthenticatedUser
Merged
#125 docs: refresh CLAUDE.md "Repository status" section
Merged
#124 docs(adr-0021): phase-2 security baseline (helmet, CORS, CSRF, rate-limit, error envelope)
Merged
#123 feat(portal-bff): rate limiting + structured error filter
Merged
#122 feat(portal-bff): helmet + env-driven CORS allowlist + double-submit CSRF
Merged
#121 fix(portal-bff): audit writes use raw INSERT (audit_writer has no SELECT for RETURNING)
Merged
#120 feat(portal-bff): wire ADR-0013 audit pipeline to the auth lifecycle
Merged
#118 chore(deps): update dependency vite to v8.0.12
Merged
#119 docs(architecture): refresh containers + nx boundaries diagrams, add local-infra diagram
Merged
#117 feat(portal-shell): authGuard + BFF http interceptors + /profile demo route
Merged
#116 fix(portal-bff): set REDIS_URL + SESSION_* in auth.module.spec so ci:check passes on a clean runner
Merged
#115 feat(portal-bff): absolute-timeout middleware + user_sessions index per ADR-0010
Merged
#114 fix(portal-shell): send withCredentials on /me so the session cookie crosses SPA→BFF in dev
Merged
#113 feat(portal-shell): wire SPA auth state to BFF /me + header login/logout widget
Merged
#112 feat(portal-bff): close the auth loop — callback persists session, /me, RP-initiated /logout
Merged
#111 chore(deps): pin protobufjs to >=8.0.2 to clear 7 transitive advisories
Merged
#110 feat(portal-bff): session middleware with AES-256-GCM at rest per ADR-0010
Merged
#109 feat(portal-bff): redis client foundation per ADR-0010
Merged
#108 fix(portal-bff): drop strict amr check — flow blocked when Entra omits the claim
Merged
#107 feat(portal-bff): /auth/callback route — token exchange + amr check
Merged
#106 chore(brand): swap header logo to a real svg + ship favicons for portal-admin
Merged
#105 feat(portal-bff): /auth/login route — pkce flow start + signed cookie
Merged
#104 feat(portal-bff): msal confidential client provider in AuthModule
Merged
#103 chore(deps): update dependency @types/node to v24.12.4
Merged
#102 feat(portal-bff): entra config foundation — boot validator + auth module
Merged
#101 chore(ts): drop deprecated baseUrl from tsconfig.base.json
Merged
#100 feat(portal-admin): skeleton app per ADR-0020
Merged
#99 refactor(libs): graduate Icon / LayoutStateService / brand tokens to libs/shared/*
Merged
#98 feat(portal-shell): ci gate — fail prod build on missing translations
Merged
#97 feat(infra): local serve-static profile — Caddy reverse proxy for the prod build
Merged
#96 fix(portal-shell): catch-all route prevents NG04002 on /fr in dev mode
Merged
#95 feat(portal-shell): locale switcher in the footer
Merged
#94 feat(portal-shell): collapse accessibility routes into one i18n-marked route
Merged
#93 feat(portal-shell): i18n string sweep — mark UI strings + FR translations
Merged
#92 fix(ci): perf job — point Lighthouse at /fr/ and /en/, drop spa fallback
Merged
#91 feat(portal-shell): wire @angular/localize plumbing per ADR-0019
Merged
#90 feat(portal-shell): wire environment.ts per ADR-0018
Merged
#89 docs(decisions): add ADR-0019 i18n + ADR-0020 portal-admin
Merged
#88 feat(portal-shell): thin full-width footer with copyright + a11y links
Merged
#87 fix(portal-shell): dark mode actually applies to component-scoped surfaces
Merged
#86 feat(portal-shell): light / dark / auto theme switcher
Merged
#85 feat(portal-shell): align header logo zone with the sidebar rail
Merged
#84 feat(portal-shell): full favicon set + PWA manifest
Merged
#83 feat(portal-shell): app-shell layout with collapsable sidebar
Merged
#82 feat(infra): reactivate act_runner cache by sharing the runners network
Merged
#81 feat(infra): add ci-runners.sh wrapper for the runner stack
Merged
#79 chore(deps): update dependency gitleaks/gitleaks to v8.30.1
Merged
#80 docs(decisions): add ADR-0018 — environment configuration strategy
Merged
#78 chore(ci): track trivy and gitleaks binary versions via renovate custom manager
Merged
#77 chore(ci): auto-merge low-risk renovate updates
Merged
#76 feat(portal-bff): audit log foundation per ADR-0013
Merged
#75 fix(portal-shell): use .postcssrc.json so tailwind utilities are emitted
Merged
#74 feat(portal-shell): replace nx-welcome with real shell and home + budgets per ADR-0017
Merged
#73 docs(development): add observability dev-loop section
Merged
#72 feat(portal-shell): wire spa-side opentelemetry tracing
Merged
#71 style(portal-bff): apply prettier to check-database-url.ts
Merged
#70 feat(portal-bff): observability foundations (Pino + CLS + OTel)
Merged
#69 chore(deps): update dependency lint-staged to v17.0.4
Merged
#68 feat(infra): add dev.sh wrapper for the local-dev compose stack
Merged
#67 docs(infra): document Compose profile + down/up symmetry gotcha
Merged
#65 chore(deps): update dependency jest to v30.4.2
Merged
#66 chore(deps): update tailwind css to v4.3.0
Merged
#64 chore(infra): migrate Jaeger to v2 for built-in dark theme
Merged
#63 fix(infra): pass pgweb credentials via discrete CLI flags
Merged
#62 fix(infra): rename pgweb DATABASE_URL to PGWEB_DATABASE_URL
Merged
#61 docs(setup): add psql and redis-cli to prerequisites
Merged
#60 fix(infra): grant audit roles to current_user, not hardcoded portal
Merged
#59 fix(infra): correct OTel collector image tag
Merged
#58 fix(infra): correct Jaeger image tag
Merged
#57 feat(infra): add local-dev Docker Compose stack
Merged
#55 chore(deps): update dependency lint-staged to v17.0.3
Merged
#54 chore(ci): add triage guide to Renovate dependency dashboard
Merged
#53 chore(deps): update jest monorepo to v30.4.1
Merged
#52 chore(deps): update dependency @types/node to v24.12.3
Merged
#47 fix(deps): update angular to v21.2.10
Merged
#46 chore(deps): update dependency vite to v8.0.11
Merged
#51 fix(ci): run scanners before pnpm install to avoid node_modules false positives
Merged
#50 fix(ci): replace gitleaks-action with manual install
Merged
#49 fix(ci): restrict Trivy to vulnerability scanner only
Merged
#48 fix(ci): restrict Trivy to vulnerability scanner only
Merged
#45 fix(ci): replace trivy-action with manual curl install
Merged
#44 fix(ci): authenticate trivy-action's github.com clone
Merged
#43 fix(deps): revert TS6/ESLint10/webpack-cli7 majors and gate future majors
Merged
#42 chore(deps): pin patched transitive deps via pnpm.overrides
Merged
#41 chore(deps): update dependency lint-staged to v17
Merged
#40 chore(deps): update pnpm to v10.33.4
Merged
#39 chore(deps): defer Prisma major updates pending coordinated upgrade ADR
Merged
#36 chore(deps): update eslint (major)
Merged
#37 chore(deps): update pnpm/action-setup action to v6
Merged
#34 chore(deps): update dependency webpack-cli to v7
Merged
#35 fix(deps): update dependency axios to v1.16.0
Merged
#33 chore(deps): update dependency typescript to v6
Merged
#30 chore(deps): update dependency jsdom to v29
Merged
#32 fix(deps): update dependency axios to v1.15.2 [security]
Merged
#31 chore(deps): update dependency jsonc-eslint-parser to v3
Merged
#29 chore(deps): update dependency @types/node to v24
Merged
#28 chore(deps): update actions/upload-artifact action to v7
Merged
#27 chore(deps): update actions/setup-node action to v6
Merged
#26 chore(deps): update actions/checkout action to v6
Merged
#25 fix(deps): update dependency reflect-metadata to ^0.2.0
Merged
#22 chore(deps): update dependency @oxc-project/runtime to ^0.129.0
Merged
#21 chore(deps): update analog monorepo to ~2.5.0
Merged
#20 chore(deps): update typescript tooling
Merged
#19 chore(deps): update swc
Merged
#23 chore(ci): skip perf and commits gates on Renovate-authored PRs
Merged
#15 chore(deps): update dependency nx to v22.7.1
Merged
#16 chore(deps): update dependency postcss to v8.5.14
Merged
#17 chore(deps): update pnpm to v10.33.3
Merged
#14 chore(deps): update dependency @types/node to v20.19.39
Merged
#13 fix(ci): give Renovate a git identity and a github.com token
Merged
#12 fix(ci): run Renovate via official Docker image
Merged
#11 chore(ci): set up Renovate dependency automation
Merged
#10 chore(infra): pin act_runner image pull policy
Merged
#9 chore(prisma): point root postinstall to BFF schema
Merged
#8 fix(ci): disable broken pnpm cache on actions/setup-node
Merged
#7 fix(ci): post-runner-image cleanup
Merged
#6 fix(ci): declare packageManager for pnpm/action-setup
Merged
#4 fix(ci): pin act_runner job image to catthehacker/ubuntu:act-22.04
Merged
#3 fix(portal-bff): downgrade Prisma to 6.x for nestjs-prisma compatibility
Merged
#2 chore: add docker compose for self-hosted Gitea act_runners
Merged
#1 docs: add docs/architecture.md with C4 contexts, Nx boundaries, and CI/CD pipeline
1 Issue created by 1 user
Opened
#18 Renovate Dependency Dashboard