lucamzanon 2b83bce8c3 Merge remote-tracking branch 'origin/main' into fix/admin-cookie-secure-by-request ...

# Conflicts:
#	app/api/admin/auth/route.ts

2026-09-30 08:54:14 +02:00

..

app-frame-origins-client.ts

fix: keep sibling subdomains from widening the sidebar-app frame-src

2026-09-26 16:27:03 +02:00

app-frame-origins.ts

fix: keep sibling subdomains from widening the sidebar-app frame-src

2026-09-26 16:27:03 +02:00

ip-ranges.ts

fix: block loopback, CGNAT and IPv6 transition ranges in the SSRF guard

2026-09-26 14:00:01 +02:00

request-protocol.ts

fix: derive the admin cookie's Secure flag from the request

2026-09-19 11:19:35 +02:00

same-origin.ts

fix: reject cross-site requests to /api/auth/* to stop session fixation (GHSA-qvr9-m8cq-7wvg)

2026-09-17 20:01:35 +02:00

url-guard.ts

fix: block loopback, CGNAT and IPv6 transition ranges in the SSRF guard

2026-09-26 14:00:01 +02:00