From 27e187bac6df160b8d7136525160a64844d546c2 Mon Sep 17 00:00:00 2001 From: John Cardinal Date: Sat, 24 Oct 2026 10:42:32 -0700 Subject: [PATCH] Release 8.3.0 cases: John's edits of 2026-10-24 4713 takes F28; 4698 folded into 4711; F2 moved into 4579 (now priority 00); 4665 moved to the release after. Co-Authored-By: Claude Opus 5.5 --- devdocs/modernization/NET10-PORT.md | 14 +++++++------- devdocs/modernization/SECURITY-REVIEW.md | 4 ++-- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/devdocs/modernization/NET10-PORT.md b/devdocs/modernization/NET10-PORT.md index 48fabccc..00eb1f85 100644 --- a/devdocs/modernization/NET10-PORT.md +++ b/devdocs/modernization/NET10-PORT.md @@ -178,8 +178,9 @@ John's "next release" cases for AyaNova (exported 2026-10-24). Each is its own s | Case | Name | Findings | |---|---|---| | 4710 | 2FA step requires the temp token (raven and sockeye) | F5, F41 | -| 4711 | Placeholder/short JWT secret treated as unset | F1 | +| 4711 | Placeholder/short JWT secret treated as unset (4698 folded in: random secret generated at install, server ignores a leftover placeholder) | F1 | | 4712 | Customer contact route allowlist + ownership checks | F13, F14, F15, F16, F17 | +| 4713 | Contact users limited to customer roles | F28 | | 4715 | Download file names checked (one helper) | F21 | | 4716 | Pick-list search text as SQL parameters | F18 | | 4717 | KPI interval allowlist | F26 | @@ -192,9 +193,8 @@ John's "next release" cases for AyaNova (exported 2026-10-24). Each is its own s | 4724 | SMTP: certificate checked, password never returned | F30, F31 | | 4725 | Sessions: password change ends sessions, exact-path token exemption, default SuperUser refused when licensed | F7, F8, F9 | | 4726 | Login throttling/lockout | F6 | -| 4727 | Low severity hardening | F2, F10, F11, F12, F22, F23, F25, F29, F35, F36, F38; the AyaNova half of F39 (DB ID not shown anonymously) | +| 4727 | Low severity hardening | F10, F11, F12, F22, F23, F25, F29, F35, F36, F38; the AyaNova half of F39 (DB ID not shown anonymously) | | 4681 | Sockeye: licence/trial request hardening (tagged sockeye, rockfish) | F40; the Sockeye half of F39 (repeatable licence fetch) | -| (none yet) | Contact users limited to customer roles | **F28** | **From the port and earlier triage** @@ -207,7 +207,6 @@ John's "next release" cases for AyaNova (exported 2026-10-24). Each is its own s | 4695 | Shipping the Visual C++ runtime DLLs with the standalone install | 1 | | 4696 | JWT secret missing from the standalone config.json | 1 | | 4697 | Relative date filters using the server's time zone | 1 | -| 4698 | JWT placeholder in the LAN and Linux templates (same subject as 4711) | 1 | | 4699 | Linux desktop data-path note in the manual | 1, docs | | 4700 | Restore note for customers with a dedicated database role | 1, docs | | 4703 | Report JS console error logging | 1 | @@ -216,20 +215,21 @@ John's "next release" cases for AyaNova (exported 2026-10-24). Each is its own s | 4707 | Stray cypress.json in raven-client | 1, investigate | | 4687 | Generator polls every second (raven and sockeye) | 1 | | 4682 | Time-only picker keeps the old date's DST offset | 1 | -| 4665 | Health route: does it check the database? | 1, feature | | 4661 | Docs: password guidance | 1, docs | | 4636 | Docs: turn off 2FA before v7 to v8 migration | 1, docs | | 4634 | Docs: custom checkbox shows nothing for older records | 1, docs | | 4633 | Docs: pg_dump path quoting on Windows (likely fixed by the port; confirm) | 1, docs | -| 4632 | AYANOVA_REPORT_RENDER_API_URL_OVERRIDE breaks customer notification reports | 1, investigate | +| 4632 | AYANOVA_REPORT_RENDER_API_URL_OVERRIDE breaks customer notification reports (do before or with 4719) | 1, investigate | | 4628 | Deleting a work order tied to a CSR gives a raw server error | 1, bug | | 4623 | Docs: migration, what is erased and what is kept | 1, docs | | 4602 | Logo upload UI: hide Upload and Delete until usable | 1, client | -| 4579 | Windows permissions on folders AyaNova writes to (installers, docs, code) | 1, investigate | +| 4579 | Windows installer modify rights: only the folders AyaNova writes to, only for the account it runs as (includes F2) | 00 | | 4690 | .NET 10 port umbrella case | 1 | Sockeye cases (exported 2026-10-24): 4710 (also in the table above) and 4681. 4681 predates the review: a trial request with a made-up address made Sockeye send its verification email, which bounced to support@ (Fastmail notice, 2026-10-16). +Moved out of 8.3.0 by John (2026-10-24): 4665 (health route checks the database) goes to the release after. + Later, not 8.3.0: F42 (move the licence signing key out of Sockeye source) and F32 (rotate the FastMail password after the old Sockeye server is retired), John's cases. diff --git a/devdocs/modernization/SECURITY-REVIEW.md b/devdocs/modernization/SECURITY-REVIEW.md index 2789fe8d..f91a2a9a 100644 --- a/devdocs/modernization/SECURITY-REVIEW.md +++ b/devdocs/modernization/SECURITY-REVIEW.md @@ -851,8 +851,8 @@ by a customer contact. Pass 8: confirmed from code (`NotifyController.SendNotify John's cases for the findings (created 2026-10-24; full list in `NET10-PORT.md`, "Release 8.3.0 cases"): 4710 (F5, F41), 4711 (F1), 4712 (F13 to F17), 4715 (F21), 4716 (F18), 4717 (F26), 4718 (F19, F24), 4719 (F20), 4720 (F27), 4721 (F33), 4722 (F34), 4723 (F3, F4), 4724 (F30, F31), -4725 (F7, F8, F9), 4726 (F6), 4727 (F2, F10, F11, F12, F22, F23, F25, F29, F35, F36, F38, and -the AyaNova half of F39), Sockeye 4681 (F40 and the Sockeye half of F39). **F28 has no case yet.** Not in 8.3.0: F32, F42 (John's later cases); F37 accepted. When a +4725 (F7, F8, F9), 4726 (F6), 4579 (F2), 4713 (F28), 4727 (F10, F11, F12, F22, F23, F25, F29, F35, F36, F38, and +the AyaNova half of F39), Sockeye 4681 (F40 and the Sockeye half of F39). Not in 8.3.0: F32, F42 (John's later cases); F37 accepted. When a case is done, its findings' status becomes *fixed in case NNNN*. ## Customer contact route allowlist (draft, for the F13 to F17 fix)