Merge branch 'main' into dependabot/npm_and_yarn/client-ts/axios-1.12.2

Author: decode2

.github/dependabot.yml

@@ -1,58 +1,90 @@
 version: 2
 updates:
-  # Enable version updates for npm
+  # Frontend dependencies (npm) - SECURE CONFIG
   - package-ecosystem: "npm"
     directory: "/client-ts"
     schedule:
       interval: "weekly"
       day: "monday"
       time: "09:00"
-    open-pull-requests-limit: 10
+    # STRICT LIMITS
+    open-pull-requests-limit: 3
+    # ONLY security and patch updates
+    ignore:
+      # Ignore major (breaking) updates for all
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+      # Ignore minor/major updates for risky deps
+      - dependency-name: "react"
+        update-types: ["version-update:semver-minor", "version-update:semver-major"]
+      - dependency-name: "react-dom"
+        update-types: ["version-update:semver-minor", "version-update:semver-major"]
+      - dependency-name: "typescript"
+        update-types: ["version-update:semver-minor", "version-update:semver-major"]
+    # REVIEW SETTINGS
     reviewers:
       - "devel"
     assignees:
       - "devel"
     commit-message:
-      prefix: "chore"
+      prefix: "security"
       include: "scope"
     labels:
       - "dependencies"
       - "frontend"
+      - "security-review-required"
 
-  # Enable version updates for NuGet
+  # Backend dependencies (NuGet) - SECURE CONFIG
   - package-ecosystem: "nuget"
     directory: "/"
     schedule:
       interval: "weekly"
       day: "monday"
       time: "09:00"
-    open-pull-requests-limit: 10
+    # STRICT LIMITS
+    open-pull-requests-limit: 2
+    # ONLY security and patch updates
+    ignore:
+      # Ignore major updates globally
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+      # Ignore minor/major for critical framework packages
+      - dependency-name: "Microsoft.AspNetCore.*"
+        update-types: ["version-update:semver-minor", "version-update:semver-major"]
+      - dependency-name: "Microsoft.EntityFrameworkCore.*"
+        update-types: ["version-update:semver-minor", "version-update:semver-major"]
+    # REVIEW SETTINGS
     reviewers:
       - "devel"
     assignees:
       - "devel"
     commit-message:
-      prefix: "chore"
+      prefix: "security"
       include: "scope"
     labels:
       - "dependencies"
       - "backend"
+      - "security-review-required"
 
-  # Enable version updates for GitHub Actions
+  # GitHub Actions - SECURE CONFIG
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "weekly"
+      interval: "monthly"
       day: "monday"
       time: "09:00"
-    open-pull-requests-limit: 5
+    # VERY STRICT LIMITS
+    open-pull-requests-limit: 1
+    # REVIEW SETTINGS
     reviewers:
       - "devel"
     assignees:
       - "devel"
     commit-message:
-      prefix: "chore"
+      prefix: "security"
       include: "scope"
     labels:
       - "dependencies"
       - "github-actions"
+      - "security-review-required"
+      - "manual-review-required"

.github/pull_request_template/dependabot-security.md

@@ -0,0 +1,45 @@
+## 🔒 Security Review Checklist
+
+### ⚠️ CRITICAL: This PR contains dependency updates
+
+**Before merging, please verify:**
+
+#### 📦 Package Verification
+- [ ] **Package source is trusted** (npmjs.com, nuget.org, etc.)
+- [ ] **No new packages added** (only version updates)
+- [ ] **Package maintainer is verified** (check package page)
+- [ ] **Version jump is reasonable** (no suspicious major version jumps)
+
+#### 🔍 Security Checks
+- [ ] **No high/critical vulnerabilities** in updated packages
+- [ ] **Package integrity verified** (checksums match)
+- [ ] **No suspicious package names** or typosquatting
+- [ ] **Dependencies are from official sources**
+
+#### 🧪 Testing Required
+- [ ] **Application builds successfully**
+- [ ] **All tests pass**
+- [ ] **No runtime errors**
+- [ ] **Functionality works as expected**
+
+#### 📋 Manual Review
+- [ ] **Changelog reviewed** for breaking changes
+- [ ] **Migration guide checked** if applicable
+- [ ] **Performance impact assessed**
+- [ ] **Compatibility verified**
+
+### 🚨 Red Flags to Watch For
+- ❌ Packages from unknown sources
+- ❌ Suspicious package names (typosquatting)
+- ❌ Unusually large version jumps
+- ❌ Packages with very few downloads
+- ❌ Packages with no recent updates
+- ❌ Packages with poor documentation
+
+### 📚 Resources
+- [npm Security Best Practices](https://docs.npmjs.com/cli/v8/configuring-npm/security)
+- [NuGet Security](https://docs.microsoft.com/en-us/nuget/concepts/security-best-practices)
+- [OWASP Dependency Check](https://owasp.org/www-project-dependency-check/)
+
+---
+**⚠️ DO NOT MERGE without completing this checklist!**

.github/workflows/ci.yml

@@ -24,15 +24,14 @@ jobs:
           node-version: ${{ env.NODE_VERSION }}
           cache: 'npm'
           cache-dependency-path: client-ts/package-lock.json
-          
+
       - name: Install dependencies
         working-directory: ./client-ts
         run: npm ci
-        
+
       - name: Check version consistency
-        run: |
-          cd client-ts
-          npm run version:check
+        working-directory: ./client-ts
+        run: npm run version:check
         continue-on-error: false
 
   frontend-tests:
@@ -42,26 +41,26 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v5
-        
+
       - name: Setup Node.js
         uses: actions/setup-node@v5
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: 'npm'
           cache-dependency-path: client-ts/package-lock.json
-          
+
       - name: Install dependencies
         working-directory: ./client-ts
         run: npm ci
-        
+
       - name: Run linting
         working-directory: ./client-ts
         run: npm run lint
-        
+
       - name: Run type checking
         working-directory: ./client-ts
         run: npm run type-check
-        
+
       - name: Run tests
         working-directory: ./client-ts
         run: npm run test:ci
@@ -79,24 +78,24 @@ jobs:
         ports:
           - 3306:3306
         options: --health-cmd="mysqladmin ping" --health-interval=10s --health-timeout=5s --health-retries=3
-    
+
     steps:
       - name: Checkout code
         uses: actions/checkout@v5
-        
+
       - name: Setup .NET
         uses: actions/setup-dotnet@v5
         with:
           dotnet-version: ${{ env.DOTNET_VERSION }}
-            
+
       - name: Restore dependencies
         run: dotnet restore
-        
+
       - name: Build project
         run: dotnet build --configuration Release --no-restore
-        
+
       - name: Run tests
-        run: dotnet test --configuration Release --no-build
+        run: dotnet test --configuration Release --no-build --verbosity normal
         env:
           ConnectionStrings__DefaultConnection: "Server=localhost;Database=TaskManagerDbTest;Uid=root;Pwd=testpassword;"
 
@@ -111,25 +110,25 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v5
-        
+
       - name: Run Trivy vulnerability scanner
         uses: aquasecurity/trivy-action@master
         with:
           scan-type: 'fs'
           scan-ref: '.'
           format: 'sarif'
           output: 'trivy-results.sarif'
-          
+
       - name: Upload Trivy scan results to GitHub Security tab
         uses: github/codeql-action/upload-sarif@v3
         if: always()
         with:
           sarif_file: 'trivy-results.sarif'
-          
+
       - name: Run npm audit for frontend
         working-directory: ./client-ts
         run: npm audit --audit-level moderate || true
-          
+
       - name: Run dotnet list package vulnerabilities
         run: dotnet list package --vulnerable || true
 
@@ -140,36 +139,36 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v5
-        
+
       - name: Setup Node.js
         uses: actions/setup-node@v5
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: 'npm'
           cache-dependency-path: client-ts/package-lock.json
-          
+
       - name: Setup .NET
         uses: actions/setup-dotnet@v5
         with:
           dotnet-version: ${{ env.DOTNET_VERSION }}
-          
+
       - name: Install frontend dependencies
         working-directory: ./client-ts
         run: npm ci
-        
+
       - name: Build frontend
         working-directory: ./client-ts
         run: npm run build
-        
+
       - name: Restore backend dependencies
         run: dotnet restore
-        
+
       - name: Build backend
         run: dotnet build --configuration Release --no-restore
-        
+
       - name: Publish backend
         run: dotnet publish --configuration Release --no-build
-        
+
       - name: Upload build artifacts
         uses: actions/upload-artifact@v5
         with:
@@ -192,20 +191,20 @@ jobs:
         uses: actions/checkout@v5
         with:
           fetch-depth: 0
-          
+
       - name: Download build artifacts
         uses: actions/download-artifact@v5
         with:
           name: build-artifacts
-          
+
       - name: Get version from package.json
         id: version
         working-directory: ./client-ts
         run: |
           VERSION=$(node -p "require('./package.json').version")
           echo "version=$VERSION" >> $GITHUB_OUTPUT
           echo "tag=v$VERSION" >> $GITHUB_OUTPUT
-          
+
       - name: Check if tag exists
         id: check-tag
         run: |
@@ -214,7 +213,7 @@ jobs:
           else
             echo "exists=false" >> $GITHUB_OUTPUT
           fi
-          
+
       - name: Create Release
         if: steps.check-tag.outputs.exists == 'false'
         uses: actions/create-release@v1
@@ -227,19 +226,19 @@ jobs:
           prerelease: false
           body: |
             ## 🚀 Release ${{ steps.version.outputs.version }}
-            
+
             ### Changes
             - Automated release from CI/CD pipeline
             - All tests passed ✅
             - Security scan completed ✅
             - Application built successfully ✅
-            
+
             ### Build Artifacts
             - Frontend build ready for deployment
             - Backend publish ready for deployment
-            
+
             ### Installation
             Download the artifacts from the Actions tab or use the built application directly.
           files: |
             build-artifacts/client-ts/build/*
-            build-artifacts/publish/*
+            build-artifacts/publish/*