fix(security): batch rattrapage sécurité upstream CE — 9 correctifs (GHSA + scoping) - #103

Merged

userLinpy merged 11 commits into

fix/security-clean

Jul 21, 2026

Commits on Jul 21, 2026

[WEB-7945] fix(security): prevent shell injection in feature-deployment.yml (#9334)

authored and
userLinpy
committed
58ed9d0
[WEB-7892] fix(security): scope attachment PATCH/DELETE/GET by issue_id, drop created_by overwrite (GHSA-5mxw-g5mw-3v3w) (#9315)

authored and
userLinpy
committed
bb8b258
[WEB-7877] fix(security): enforce token + auth validation on project invite accept/reject (#9308)

authored and
userLinpy
committed
839ad52
[WEB-7888] fix(security): normalize href before protocol check in CustomLinkExtension (GHSA-v2vv-7wq3-8w2j) (#9313)

authored and
userLinpy
committed
6c57d46
[WEB-7895] fix: scope UserProjectInvitationsViewset to workspace-validated project IDs (GHSA-45hc-q4mw-jhxm) (#9333)

authored and
userLinpy
committed
f8a9fac
[WEB-8060] fix(security): enforce authz on is_active member (de)activation (#9367)

authored and
userLinpy
committed
fd92f4c
fix(user): clone user data before updates to prevent mutations (#9285)

codingwolf-at
authored and
userLinpy
committed
1311d02
[WEB-8066] fix: scope workspace asset get/patch/delete to project membership (#9372)

authored and
userLinpy
committed
43eaafb
[WEB-8075] fix: scope ProjectMemberPermission SAFE_METHODS to project membership (#9375)

authored and
userLinpy
committed
10e9a31
chore(live): oxfmt tests/services/page (pré-existant, débloque check:format --affected)

userLinpy
and
claude
committed
3052f93
chore(format): oxfmt fichiers apps/web de features Zelian pré-existants

userLinpy
and
claude
committed
6b1572c