3 posts tagged with "security"

Published on July 26, 2026

Just one day after 1.3.0, Uni-Verein 1.3.1 follows with a clear focus: noticeably better frontend performance and an important security fix.

Improvements​

• 🚀 Lazy loading of frontend routes: Page components (Mail, Members, SEPA, Contributions, user/link/contribution-plan/email/creditor/general/member-category configuration, Audit, Backup) are now loaded on demand instead of being bundled into the initial payload, the main bundle shrinks from about 1.4 MB to about 577 kB
• 🖼️ The icon picker ("Select icon") now caps the number of rendered icon tiles at 250 and prompts for a more specific search beyond that, instead of mounting all ~8,600 icons at once, this previously froze the UI for over a second every time the dialog was reopened
• ⏳ The icon picker now waits for icons to be fully loaded/cached before revealing the grid, showing a loading spinner in the meantime instead of an empty or partially populated dialog
• 🧹 IconPickerDialog.tsx no longer redundantly dynamically imports muiIcons for loadIconNames when it's already imported statically elsewhere, resolving a Vite build warning and allowing the module to be chunked correctly
• ⚙️ The enforce-source-branch CI job from 1.3.0 now also runs for pull requests targeting development, so merging main back into development isn't blocked by a status check that previously only evaluated PRs targeting main

Bug Fixes​

• 🐛 Vite's chunk-size warning for the @mui/icons-material barrel (loaded on demand by the icon picker) is now suppressed via chunkSizeWarningLimit, since that chunk is expected to be large and is never part of the initial page load

Security​

• 🔐 Bumped the brace-expansion npm override to ^5.0.8 to close a high-severity ReDoS advisory (exponential-time expansion of consecutive non-expanding {} groups); the previous override version had drifted out of sync with the lockfile and a duplicate vulnerable copy remained nested under filelist

Why These Updates Matter​

The icon picker in particular had felt noticeably sluggish, thanks to lazy loading and capping the number of rendered icons, the UI now responds much more smoothly. The smaller main bundle also means Uni-Verein loads faster, especially on mobile connections. The ReDoS fix additionally closes a high-severity vulnerability in a transitive dependency.

What's Next?​

This performance work pays off directly in the user experience. Bigger feature additions are up next. Check back soon!

Published on July 25, 2026

Uni-Verein 1.3.0 brings a handy new search feature for sending newsletters, along with a number of under-the-hood improvements that make deployments and CI runs more reliable.

New Features​

• 🔍 Name search in the Broadcast email "Recipient" tab: Recipients can now be filtered by first or last name (fuzzy, Jaro-Winkler similarity), in addition to the existing member category filter
• ❤️ /health endpoint: A new unauthenticated GET /health endpoint plus Docker HEALTHCHECKs for backend and frontend

Improvements​

• 🩺 backend, frontend, and proxy now have proper health checks (previously only the database did), and each service waits for its dependencies to be actually ready (service_healthy) instead of just started, across all docker-compose*.yml files
• 🚦 CI now fails immediately with container logs attached when the stack doesn't become healthy in time, instead of silently continuing on to the Playwright tests and failing there with no diagnostics
• ⏱️ Increased the database health check's retry budget to tolerate occasional slow first-time initialization on CI runners
• 📝 .env.example now lists BACKUP_PATH, matching every value docker-compose-ini.yml generates
• 🔒 CI now enforces that PRs into main may only come from development (new enforce-source-branch job)

Bug Fixes​

• 🐛 The newsletter recipient category dropdown showed the raw translation key instead of the category name for custom (non-default) member categories
• 🐛 The proxy container could stay unhealthy indefinitely because its health check resolved localhost to IPv6 while nginx.conf only listens on IPv4
• 🐛 The backend Docker image build occasionally failed due to transient package-mirror errors during apt-get install

Security​

• 🔐 Pinned sharp to ^0.35.3 via npm overrides to pull in a fixed version instead of the vulnerable transitive one

Why These Updates Matter​

The name search saves a lot of time for larger organizations that need to quickly find individual newsletter recipients. Just as important are the health check improvements: they make deployments start up more reliably and surface CI problems immediately with meaningful logs, instead of only showing up late and without context.

What's Next?​

Work on performance and infrastructure continues, the next release already focuses on noticeably faster load times.

Published on July 12, 2026

Just a few days after the big release of the first version, the first update has already arrived: Uni-Verein 1.0.1 is here. This time it's a small but important security update.

What Changed?​

A security vulnerability (CVE-2026-33630) was identified in the frontend's Docker image. This update adjusts the underlying Dockerfile to close the vulnerability.

• 🔒 Security fix: Updated the frontend Dockerfile to resolve CVE-2026-33630

Why Does This Matter?​

Since Uni-Verein is used by organizations with sensitive member data, the security of the software is a top priority for me. Security updates like this one are therefore rolled out as quickly as possible whenever known vulnerabilities are identified.