[pull] main from KelvinTegelaar:main

.github/workflows/CodeQL_Analyser.yml

@@ -1,6 +1,10 @@
----
+# OPTIONAL UPGRADE to the existing CodeQL_Analyser.yml (already deployed in CIPP).
+# Changes vs. current: adds push trigger on main/dev, security-extended query suite,
+# and javascript-typescript language alias.
 name: "CodeQL"
 on:
+  push:
+    branches: [main, dev]
   pull_request:
     branches: [master, main, dev, react]
   schedule:
@@ -17,14 +21,15 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        language: ["javascript"]
+        language: ["javascript-typescript"]
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v6
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4
         with:
           languages: ${{ matrix.language }}
+          queries: security-extended
       - name: Autobuild
         uses: github/codeql-action/autobuild@v4
       - name: Perform CodeQL Analysis

.github/workflows/Conventional_Commits.yml

@@ -0,0 +1,65 @@
+name: Conventional Commits Check
+
+on:
+  # Using pull_request_target instead of pull_request for secure handling of fork PRs
+  pull_request_target:
+    # Re-run on title edits so a corrected title clears the check
+    types: [opened, synchronize, reopened, edited]
+    # Only check PRs targeting the dev branch
+    branches:
+      - dev
+
+permissions:
+  pull-requests: write
+  issues: write
+
+jobs:
+  conventional-commits:
+    name: Validate Conventional Commits
+    runs-on: ubuntu-slim
+    steps:
+      - name: Validate PR title
+        uses: actions/github-script@v9
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const title = context.payload.pull_request.title || '';
+            const pattern = /^(feat|fix|docs|style|refactor|perf|test|chore|ci|build|revert)(\(.+\))?!?: .+/;
+
+            if (pattern.test(title)) {
+              console.log(`✓ PR title follows Conventional Commits format: "${title}"`);
+              return;
+            }
+
+            console.log(`❌ PR title does not follow Conventional Commits format: "${title}"`);
+
+            const message = [
+              '❌ **This PR title does not follow the [Conventional Commits](https://www.conventionalcommits.org/) format.**',
+              '',
+              'Expected format: `type(scope)?: description`',
+              '',
+              'Allowed types: `feat`, `fix`, `docs`, `style`, `refactor`, `perf`, `test`, `chore`, `ci`, `build`, `revert`',
+              '',
+              'Examples:',
+              '- `feat: add tenant filter to the user table`',
+              '- `fix(auth): handle expired refresh tokens`',
+              '- `docs: update self-hosting guide`',
+              '',
+              `Received: \`${title}\``,
+              '',
+              '🔒 This PR has been automatically closed. Please update the title to match the format above and reopen the PR.'
+            ].join('\n');
+
+            await github.rest.issues.createComment({
+              ...context.repo,
+              issue_number: context.issue.number,
+              body: message
+            });
+
+            await github.rest.pulls.update({
+              ...context.repo,
+              pull_number: context.issue.number,
+              state: 'closed'
+            });
+
+            core.setFailed(`PR title does not follow Conventional Commits format: "${title}"`);

.github/workflows/cipp_dev_build.yml

@@ -54,7 +54,7 @@ jobs:
 
       # Upload to Azure Blob Storage
       - name: Azure Blob Upload
-        uses: LanceMcCarthy/Action-AzureBlobUpload@v3.12.0
+        uses: LanceMcCarthy/Action-AzureBlobUpload@v3.15.0
         with:
           connection_string: ${{ secrets.AZURE_CONNECTION_STRING }}
           container_name: cipp

.github/workflows/cipp_frontend_build.yml

@@ -54,7 +54,7 @@ jobs:
 
       # Upload to Azure Blob Storage
       - name: Azure Blob Upload
-        uses: LanceMcCarthy/Action-AzureBlobUpload@v3.12.0
+        uses: LanceMcCarthy/Action-AzureBlobUpload@v3.15.0
         with:
           connection_string: ${{ secrets.AZURE_CONNECTION_STRING }}
           container_name: cipp

.github/workflows/dependency-review.yml

@@ -0,0 +1,28 @@
+# SCA: Fails PRs that introduce dependencies with known vulnerabilities
+# ISO 27001:2022 A.8.28/8.29 evidence — Software Composition Analysis at merge time
+name: Dependency Review
+on:
+  pull_request:
+    branches: [main, dev]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  dependency-review:
+    if: github.repository_owner == 'KelvinTegelaar'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Dependency review
+        uses: actions/dependency-review-action@v5
+        with:
+          # Block merge on known vulnerabilities of moderate severity or higher
+          fail-on-severity: moderate
+          # Surface results as a PR comment for contributor visibility
+          comment-summary-in-pr: on-failure
+          # Optional: block copyleft-incompatible licenses (adjust for AGPL-3.0 project policy)
+          # deny-licenses: GPL-1.0-only

.github/workflows/zap-scan.yml

@@ -0,0 +1,55 @@
+# DAST: OWASP ZAP scans against the CIPP staging deployment
+# ISO 27001:2022 A.8.29 evidence — Dynamic Application Security Testing
+#
+# Prerequisites:
+#   - Repo variable STAGING_URL pointing at a staging deployment (test-tenant data only, never production)
+#   - Optional: .zap/rules.tsv to suppress documented false positives (annotate each with justification)
+name: DAST - OWASP ZAP Scan
+on:
+  schedule:
+    - cron: "0 4 * * 1" # Weekly, Monday 04:00 UTC
+  workflow_dispatch: # Run on demand before each versioned release
+    inputs:
+      full_scan:
+        description: "Run full (active) scan instead of baseline"
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+  issues: write # ZAP action files findings as GitHub issues
+
+jobs:
+  zap_baseline:
+    if: github.repository_owner == 'KelvinTegelaar' && (github.event_name == 'schedule' || !inputs.full_scan)
+    name: ZAP Baseline Scan (passive)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout (for .zap rules file)
+        uses: actions/checkout@v6
+
+      - name: ZAP baseline scan
+        uses: zaproxy/action-baseline@v0.15.0
+        with:
+          target: ${{ vars.STAGING_URL }}
+          rules_file_name: ".zap/rules.tsv"
+          allow_issue_writing: true
+          issue_title: "ZAP baseline scan findings"
+          artifact_name: zap-baseline-report
+
+  zap_full:
+    if: github.repository_owner == 'KelvinTegelaar' && github.event_name == 'workflow_dispatch' && inputs.full_scan
+    name: ZAP Full Scan (active, pre-release)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout (for .zap rules file)
+        uses: actions/checkout@v6
+
+      - name: ZAP full scan
+        uses: zaproxy/action-full-scan@v0.13.0
+        with:
+          target: ${{ vars.STAGING_URL }}
+          rules_file_name: ".zap/rules.tsv"
+          allow_issue_writing: true
+          issue_title: "ZAP full scan findings (pre-release)"
+          artifact_name: zap-full-report

package.json

@@ -1,6 +1,6 @@
 {
   "name": "cipp",
-  "version": "10.5.5",
+  "version": "10.6.0",
   "author": "CIPP Contributors",
   "homepage": "https://cipp.app/",
   "bugs": {
@@ -42,20 +42,20 @@
     "@react-pdf/renderer": "^4.5.1",
     "@reduxjs/toolkit": "^2.12.0",
     "@tanstack/query-sync-storage-persister": "^5.90.25",
-    "@tanstack/react-query": "^5.100.10",
-    "@tanstack/react-query-devtools": "^5.100.10",
-    "@tanstack/react-query-persist-client": "^5.96.2",
+    "@tanstack/react-query": "^5.101.2",
+    "@tanstack/react-query-devtools": "^5.101.2",
+    "@tanstack/react-query-persist-client": "^5.101.2",
     "@tanstack/react-table": "^8.19.2",
     "@tiptap/core": "^3.22.3",
     "@tiptap/extension-heading": "^3.22.3",
     "@tiptap/extension-table": "^3.20.5",
-    "@tiptap/pm": "^3.22.3",
+    "@tiptap/pm": "^3.27.3",
     "@tiptap/react": "^3.20.5",
     "@tiptap/starter-kit": "^3.20.5",
     "@vvo/tzdb": "^6.198.0",
-    "apexcharts": "5.14.0",
+    "apexcharts": "5.16.0",
     "axios": "1.16.1",
-    "date-fns": "4.1.0",
+    "date-fns": "4.4.0",
     "diff": "^8.0.3",
     "dompurify": "^3.4.9",
     "driver.js": "^1.4.0",
@@ -65,25 +65,25 @@
     "gray-matter": "4.0.3",
     "javascript-time-ago": "^2.6.2",
     "jspdf": "^4.2.0",
-    "jspdf-autotable": "^5.0.7",
+    "jspdf-autotable": "^5.0.8",
     "leaflet": "^1.9.4",
     "leaflet.markercluster": "^1.5.3",
     "lodash": "^4.18.1",
     "lodash.isequal": "4.5.0",
     "material-react-table": "^3.0.1",
     "monaco-editor": "^0.55.1",
     "mui-tiptap": "^1.31.0",
-    "next": "^16.2.2",
+    "next": "^16.2.10",
     "nprogress": "0.2.0",
     "numeral": "2.0.6",
     "prop-types": "15.8.1",
     "punycode": "^2.3.1",
     "react": "19.2.6",
-    "react-apexcharts": "2.1.0",
+    "react-apexcharts": "2.1.1",
     "react-beautiful-dnd": "13.1.1",
     "react-dom": "19.2.6",
     "react-dropzone": "15.0.0",
-    "react-error-boundary": "^6.1.1",
+    "react-error-boundary": "^6.1.2",
     "react-hook-form": "^7.76.1",
     "react-hot-toast": "2.6.0",
     "react-html-parser": "^2.0.2",
@@ -93,7 +93,7 @@
     "react-media-hook": "^0.5.0",
     "react-papaparse": "^4.4.0",
     "react-quill": "^2.0.0",
-    "react-redux": "9.2.0",
+    "react-redux": "9.3.0",
     "react-syntax-highlighter": "^16.1.0",
     "react-time-ago": "^7.3.3",
     "react-virtuoso": "^4.18.7",
@@ -112,7 +112,7 @@
   "devDependencies": {
     "@svgr/webpack": "8.1.0",
     "eslint": "^9.39.4",
-    "eslint-config-next": "^16.2.3",
+    "eslint-config-next": "^16.2.10",
     "eslint-config-prettier": "^10.1.8",
     "prettier": "^3.8.1"
   }

public/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "10.5.5"
+  "version": "10.6.0"
 }