Claude CodeandClaude Sonnet 5.5 0250b4bab2 fix(deps): patch HIGH/CRITICAL advisories ...

Lockfile-level update of the packages trivy flags on main, all within
their current major:

- next 16.3.1 -> 16.3.3 (CVE-2026-75604, CRITICAL)
- js-yaml 4.3.1 -> 4.3.2 (CVE-2026-84375)
- nodemailer 9.0.5 -> 9.1.1 (GHSA-2x7j-588g-ccc2, GHSA-8m3c-c648-2xjj)
- sharp 0.35.3 -> 0.35.5 (GHSA-rgj7-g3m4-5g8c)
- undici 6.28.0 -> 6.29.0 (CVE-2026-19534)
- brace-expansion -> 1.1.21 / 2.1.7 (CVE-2026-102276, CVE-2026-102278, dev)
- minimatch 9.0.5 -> 9.0.9 (CVE-2026-26996/27903/27904, dev)

next, js-yaml and nodemailer were exact-pinned, so their pins move too.
PINNED_DEPS in the antipattern guard follows nodemailer to 9.1.1; without
it the pinned-dep guard fails.

Remaining: nodemailer GHSA-v53p-9fqp-m79j is only fixed in 10.x (major
bump of a direct dependency, left for a separate reviewed change).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

2026-09-30 17:17:51 +02:00

..

__tests__

feat(connect): hosted connector-key registry + validate RPC + entitlements endpoint; instance sync writes connector grants hourly (#1748)

2026-08-31 20:51:17 +02:00

api-skill

feat(api): expose bank-connection freshness in MCP and v1 REST (#2124)

2026-09-01 20:54:55 +02:00

checks

fix(deps): patch HIGH/CRITICAL advisories

2026-09-30 17:17:51 +02:00

lib

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

parties

feat(parties): selection-step evaluation against document-anchored truth (#2169)

2026-09-02 17:38:20 +02:00

peppol

feat(peppol): gate Peppol per company: request access, operator enables with a sending cap (#1794)

2026-08-21 17:27:45 +02:00

perf

perf(bundle): drop the BAS chart and the Node crypto polyfill from the shared client baseline (#1942)

2026-08-26 15:07:49 +02:00

scb

feat(parties): fetch registry facts from SCB into the dossier, with a picker for parties without an org number (#2258)

2026-09-03 20:16:59 +02:00

self-host

docs(self-host): sovereign Sverige guide, backup/restore scripts, Speed Insights gate (#1744)

2026-08-31 08:18:14 +01:00

support

feat(auth): surface duplicate-account traps around BankID login (#1234)

2026-07-27 17:00:15 +02:00

tool-pg

fix(vat): make the ruta drill-down reconcile with the figure it explains (#2016)

2026-08-29 00:29:11 +02:00

.skill-body-manifest.json

feat(reports): log behandlingsregler changes and program versions (BFNAR 2013:2 p. 9.16) (#2097)

2026-09-01 20:31:10 +02:00

audit-settlement-account-mismatches.sql

fix(bookkeeping): resolve settlement account in all categorization flows and ship mis-booking audit (#1383)

2026-08-03 18:45:38 +02:00

audit-template-misbookings.probe.sql

fix(bookkeeping): classify template audit evidence (#1594)

2026-08-13 18:58:09 +02:00

audit-template-misbookings.sql

fix(bookkeeping): classify template audit evidence (#1594)

2026-08-13 18:58:09 +02:00

backfill-document-storage-paths.ts

fix: similar-sweep currency remediation, security hardening and v1 API fixes (#1215)

2026-07-27 03:34:56 +02:00

backfill-encrypt-personnummer.ts

Add/api and invoice (#911)

2026-07-07 01:14:59 +02:00

backfill-has-password.ts

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

backfill-import-accounts.ts

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

backfill-inbox-booked-underlag.ts

feat(inbox): per-item underlag anchoring status and a daily reconcile cron for stranded underlag (#1548) (#2012)

2026-08-28 17:45:10 +02:00

backfill-invoice-payment-rows.ts

fix(invoices): record manual and Stripe settlements in invoice_payments (#2236)

2026-09-03 19:42:43 +02:00

backfill-sie-files.ts

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

backfill-tax-deadlines.ts

chore: repo-wide bloat sweep, remove dead code and fold duplicate helpers (#2150)

2026-09-02 11:51:16 +02:00

backtest-categorize.ts

feat(settings): per-company data-analysis opt-in gating the calibration corpus (#1346) (#2007)

2026-08-28 17:38:36 +02:00

bl-balance-broken.ts

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

bl-delete-broken.ts

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

check-docs-freshness.mts

feat(settings): API & MCP tab: correct connector URL namespace, plugin path, Swedish guide (#2105)

2026-09-01 16:56:19 +02:00

check-handelsbanken-aspsp.mjs

Bug/open banking flow (#854)

2026-07-01 18:13:00 +02:00

check-masterplan-lock.sh

feat(scaffold): SIAX masterplan-lock-gate + PLAN/MASTERPLAN_INDEX.md integrering

2026-09-10 13:27:19 +02:00

check-pg-test-coverage.mjs

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

check-portal-urls.mts

feat(inbox): Underlag rebuilt to answer what is missing, where to get it, and how it would be booked (#1524)

2026-08-12 14:36:08 +02:00

clean-skv-test-drafts.ts

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

clear-user-data.sql

refactor: remove extension toggle system — compiled-in extensions are always active (#59)

2026-03-20 09:31:29 +01:00

create-extension.ts

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

create-skv-test-company.ts

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

debug-bl-list-consents.ts

fix(import): SIE bulk-delete on service client + provider/reporting/b… (#724)

2026-06-14 23:40:26 +02:00

debug-bl-unbalanced.ts

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

export-docs-to-website.mts

feat(settings): API & MCP tab: correct connector URL namespace, plugin path, Swedish guide (#2105)

2026-09-01 16:56:19 +02:00

fit-categorize-calibration.ts

feat(settings): per-company data-analysis opt-in gating the calibration corpus (#1346) (#2007)

2026-08-28 17:38:36 +02:00

fix-import-mojibake.ts

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

fix-replacement-chars.ts

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

generate-bas-account-numbers.ts

perf(bundle): drop the BAS chart and the Node crypto polyfill from the shared client baseline (#1942)

2026-08-26 15:07:49 +02:00

generate-crontabs.ts

feat(connect): self-host connector enablement: EB/SKV in the preset, connector-mode seam, status endpoint (#1758)

2026-08-31 23:18:43 +02:00

generate-extension-registry.ts

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

generate-skill-bodies.ts

fix(bookkeeping): drop non-standard account 2012, book EF F-skatt on 2013 (#1409) (#1489)

2026-08-10 14:04:08 +02:00

generate-taxonomy-registry.ts

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

import-tax-tables.ts

fix(salary): skatteavdrag rounding trio (whole kronor, ,50 table pick, import prefix guard) (#1582)

2026-08-13 16:39:00 +02:00

inject-public-branding.mjs

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

inspect-skv-readiness.ts

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

inspect-skv-tokens-table.ts

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

issue-connector-key.ts

feat(connect): Peppol through the connector (hosted proxy, instance transport, ownership ledger) (#2177)

2026-09-02 20:57:57 +02:00

list-dev-users.ts

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

list-incomplete-jamkning.ts

fix(payroll): require jamkning valid_to on every write path (#2058) (#2240)

2026-09-03 20:22:41 +02:00

mcp-bridge.mjs

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

migrate-sie-files-to-company-paths.ts

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

receipt-hunt-dryrun.mts

feat(receipt-hunt): find receipts in connected mailboxes and pair them on the amount (#1492)

2026-08-10 12:23:42 +02:00

repair-arcim-supplier-payments.ts

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

repair-capelix-invoice-payment.ts

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

repair-chart-of-accounts-charset.ts

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

repair-company-ib-duplicates.ts

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

repair-customer-personal-number-in-org-number.ts

fix(customers): personnummer via MCP lands in personal_number, masked everywhere; MCP payment terms follow settings (#1788)

2026-08-21 18:32:17 +02:00

repair-fiscal-period-chain.ts

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

repair-fx-fallback-rates.ts

feat(ops): personnummer backfill route (temporary) + FX repair script (#981)

2026-07-10 14:07:43 +02:00

repair-result-appropriation.ts

fix(year-end): conservative historical repair for carried-forward 2099 (#1373)

2026-08-03 18:41:54 +02:00

repair-stranded-categorized-transactions.ts

fix(transactions): repair pre-#1990 stranded rows through a dry-run-first, per-company RPC (#2350)

2026-09-06 19:59:32 +02:00

seed-agent-atom-registry.ts

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

seed-demo-account.ts

feat(inbox): staged upload ack, HEIC/HEIF validation, WhatsApp silence fixes (#1605)

2026-08-13 23:57:53 +02:00

seed-export-data.mjs

fix(db): enforce balance check on directly inserted posted journal entries (v2) (#1439)

2026-08-06 23:00:05 +02:00

seed-skv-test-data.ts

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

set-arcim-org-number.ts

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

set-company-settings-org.ts

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

setup-skv-test-company.sql

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

smoke-agent-tools.ts

Agent v1 bundle: TIC v2 onboarding, in-app assistant gating, sidebar nav, MCP fixes (#584)

2026-05-28 11:27:01 +02:00

smoke-ai-provider.ts

feat(ai): self-host enablement for BYO endpoints: poppler in the runner image, backend-agnostic smoke script, docs (#1743)

2026-08-20 19:48:21 +02:00

smoke-ai.ts

fix(ai): complete plain-key self-hosting path (#1584)

2026-08-13 15:45:24 +02:00

swedish-compliance-review.mjs

chore(ci): unblock the CVE gate, finish Sonnet 5, parallelize, harden the supply chain (#1223)

2026-07-27 12:01:03 +02:00

test-skv-other-endpoints.ts

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

undo-year-end-closing.ts

feat(year-end): administrative undo of executed year-end closing + skatteverket scope fixes (#1081)

2026-07-20 16:17:43 +02:00

validate-ixbrl.mjs

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

validate-packs.ts

fix(packs): repair the four broken system templates the validator found (#1388)

2026-08-03 18:46:55 +02:00

validate-registry.ts

feat(registry): move community registry source of truth into the public repo (#1458)

2026-08-08 10:54:09 +02:00