Skip to content

0.5.2 (2026-05-10)

Security release: frontend dependency updates to resolve critical and high vulnerabilities reported by Snyk under the Secure Developer Program for Open Source.

⬆️ Upgrades

  • axios: 1.12.2 → 1.16.0 (resolves 2 critical, 5 high, and 5 medium vulnerabilities: Prototype Pollution, HTTP Response Splitting, SSRF, sensitive information in headers).
  • jspdf: 2.5.2 → 4.2.1 (resolves 1 critical, 7 high, and 2 medium vulnerabilities: external file control, output encoding, unbounded resource consumption, ReDoS).
  • react-router-dom: 7.9.4 → 7.15.0 (resolves 2 high and 2 medium vulnerabilities: XSS, Open Redirect, CSRF).
  • mermaid: 11.4.1 → 11.14.0 (resolves transitive dependency vulnerabilities: dompurify XSS, lodash-es Prototype Pollution, dagre-d3-es Prototype Pollution, uuid input validation).
  • easymde: 2.18.0 → 2.21.0 (resolves transitive ReDoS vulnerability in codemirror).

🐛 Fixes

  • Fixed application version in backend/app/core/config.py: was incorrectly showing 1.0.0, now reflects 0.5.2.

🔧 Internal

  • Integrated Snyk Secure Developer Program for Open Source for continuous vulnerability monitoring.
  • Added Snyk badge to README.md showing known vulnerability status.
  • Updated version across all repository files (CLAUDE.md, VERSIONING.md, .kiro/steering/versioning.md, pyproject.toml, package.json).