2GT-Media-Group-LLC/mikrotik-manager v0.42.1-beta

on GitHub

0.42.1: Build preview parameter copies safely (CodeQL js/remote-property-injection)

The change preview copied request-body keys into plain objects with
out[k] = v, so a key like proto could reach Object.prototype. Copies
are now built with Object.fromEntries and prototype keys are dropped;
RouterOS has no such parameters. Test added.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com

Container images (published once CI passes):

• ghcr.io/2gt-media-group-llc/mikrotik-manager-backend:0.42.1-beta
• ghcr.io/2gt-media-group-llc/mikrotik-manager-nginx:0.42.1-beta

Documentation: https://2gt-media-group-llc.github.io/mikrotik-manager/