Added

• CVE-Clinic: status workflow of the findings, risk acceptance and fix planned on a version change
  • Findings follow a status workflow: new, in review, affected, not affected, fix planned, fixed, mitigated, risk accepted. The security team sets it for several findings at once, with a reason for "not affected" and the fixed version for "fixed".
  • A risk acceptance is requested with a reason and an end date and approved by the security officer, from priority P2 at the time of the request on by the management as well (new group setting managementGroup), never by the person who requested it; after its last day, or unapproved by then, the finding is affected again.
  • If the version of a technology changes so that a vulnerability no longer matches, its open findings are set to "fix planned" and the fix is confirmed per instance; a rollback to an affected version reopens planned and fixed findings. The list of vulnerabilities also counts the findings in progress and done.

Improved

• CVE-Clinic: the language of an AI prompt can be chosen (German or English), whatever language the web app is set to.
• Login: password spraying (the same password tried against many users) is slowed down. Failed logins are also counted per tried password, kept as a keyed hash in memory only.
• Order notifications: the daily summary shows status, net sum, customer and project of each order and which properties were changed.

Changed

• CVE-Clinic: the inventory and catalogue trees start collapsed; which nodes are open is remembered in the user settings.
• Docker: the image no longer contains curl, wget and gnupg of the base image (only needed for downloading the JDK), which removes their vulnerabilities.
• Docker: the compose examples run nginx on Alpine (stable-alpine-slim) instead of Debian, without curl, perl, libxml2 and the image libraries of the Debian image, which caused most of its known vulnerabilities.
• Two-factor setup revised: passkeys and security keys are easier to find and to add.

Fixed

• App Time sheet templates are applied again when booking (task, cost unit and texts were left empty).
• CVE-Clinic: if a component contains several affected versions of a library (e.g. two versions of one npm package), the finding, the libraries and the report now name all of them instead of only one.
• Scripts: the entities of the CVE-Clinic plugin (e.g. CvrCaseDO) are found again by Kotlin scripts ("Unresolved reference 'cveradar'").
• Tables: the horizontal scrollbar no longer hides the last row.
• E-invoice: a ZUGFeRD invoice without a buyer reference (BT-10) is no longer reported as faulty by the check, the rule BR-DE-15 belongs to XRechnung only. The XRechnung export names the missing reference (Leitweg-ID or customer reference) beforehand. Hints on the customer reference (BT-10) and on contact person and department (together BT-56).