July 25th, 2026

QA

release: prod-readiness hardening — auth RAG route, sanitize embed HTML, Users stats [qa twin of #150]

  • fix(security): resolve TS build failure + QA scan gap + Node EOL
  • Merge pull request #139 from tpromni/fix/wiz-remediation-2026-07-23
  • fix(security): bump next 16.2.6 -> 16.2.11 (9 CVEs, Wiz Vulnerability Policy)
  • Merge pull request #141 from tpromni/fix/next-cve-16.2.11
  • Merge pull request #137 from tpromni/parity/admin-dev-20260723
  • fix(build): commit package-lock.json and switch Docker build to npm ci
  • Merge pull request #143 from tpromni/fix/admin-lockfile-npm-ci
  • fix(rag): pin Ask Pulse response language to the app locale (L10N audit F1)
  • Merge pull request #145 from tpromni/fix/l10n-audit-v1-full-application
  • fix(rag): quoted example scripts must follow the response language too
  • Merge pull request #147 from tpromni/fix/l10n-audit-v1-full-application
  • fix(auth): SSO is the only admin auth path — remove the password login form entirely
  • fix(auth): identity normalization + best-match profile selection (hsilverstein lockout class)
  • test+build: auth-path test suite + build gate against password-login resurrection
  • Merge pull request #148 from tpromni/fix/aws-admin-sso-only-identity-resolution
  • merge: repair-script employeeRole precedence guard (PR #133) into prod-readiness release
  • fix(P0): auth the RAG chat route, sanitize embed HTML, fix Users stat population, real health check
  • Merge pull request #150 from tpromni/release/prod-readiness-2026-07
  • Merge remote-tracking branch 'origin/dev' into release/prod-readiness-2026-07-qa
  • Merge pull request #151 from tpromni/release/prod-readiness-2026-07

Source: tpromni/coach-pulse-admin-uiqa

View commits