From f3a2e812bf3c746463c4ad080170137d96af8d16 Mon Sep 17 00:00:00 2001 From: joshua Date: Fri, 28 Aug 2026 12:36:55 +0200 Subject: [PATCH] Bump version to 1.10.1 Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01CSWFWQsjTc9GyffPiXEDQT --- CHANGELOG.md | 2 ++ backend/package-lock.json | 4 ++-- backend/package.json | 2 +- frontend/package-lock.json | 4 ++-- frontend/package.json | 2 +- package-lock.json | 4 ++-- package.json | 2 +- 7 files changed, 11 insertions(+), 9 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 49e3389..e4c2a2f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,8 @@ and this project follows [Semantic Versioning](https://semver.org/). ## [Unreleased] +## [1.10.1] - 2026-08-28 + ### Security - Fixed a path-traversal vulnerability in event-image, branding (logo/favicon), and event-attachment uploads: the stored filename embedded the client-supplied `originalname` unsanitized, so a crafted filename (e.g. containing `../`) could write the uploaded file outside the intended `public/uploads` subfolder anywhere the server process could write. Uploaded files are now always saved under a server-generated random name; the original filename is preserved only as display metadata. diff --git a/backend/package-lock.json b/backend/package-lock.json index 71091c4..9341fc3 100644 --- a/backend/package-lock.json +++ b/backend/package-lock.json @@ -1,12 +1,12 @@ { "name": "event-management-backend", - "version": "1.10.0", + "version": "1.10.1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "event-management-backend", - "version": "1.10.0", + "version": "1.10.1", "hasInstallScript": true, "dependencies": { "@prisma/client": "^5.4.2", diff --git a/backend/package.json b/backend/package.json index b3b9065..9055184 100644 --- a/backend/package.json +++ b/backend/package.json @@ -1,6 +1,6 @@ { "name": "event-management-backend", - "version": "1.10.0", + "version": "1.10.1", "description": "Event Management System Backend", "main": "src/index.js", "scripts": { diff --git a/frontend/package-lock.json b/frontend/package-lock.json index 730257e..65e4633 100644 --- a/frontend/package-lock.json +++ b/frontend/package-lock.json @@ -1,12 +1,12 @@ { "name": "hope-events-frontend", - "version": "1.10.0", + "version": "1.10.1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "hope-events-frontend", - "version": "1.10.0", + "version": "1.10.1", "dependencies": { "@hookform/resolvers": "^5.2.1", "@radix-ui/react-accordion": "^1.2.11", diff --git a/frontend/package.json b/frontend/package.json index 938c13b..3779be0 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -1,6 +1,6 @@ { "name": "hope-events-frontend", - "version": "1.10.0", + "version": "1.10.1", "private": true, "scripts": { "dev": "next dev --turbopack", diff --git a/package-lock.json b/package-lock.json index d91047e..608f67c 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "hope-events", - "version": "1.10.0", + "version": "1.10.1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "hope-events", - "version": "1.10.0", + "version": "1.10.1", "license": "ISC", "devDependencies": { "concurrently": "^9.2.1" diff --git a/package.json b/package.json index d5a1cef..b9e86d7 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "hope-events", - "version": "1.10.0", + "version": "1.10.1", "main": "index.js", "scripts": { "dev:backend": "cd backend && npm run dev",