All pull requests

Pull requests

• Fix: Exposure of Sensitive Information to an Unauthorized Actor and SQL Injection in Spring Data JPA

  #344·WesternConcrete opened Sep 21, 2026·

  ·
  4

  

• Modernise to Java 21 / Spring Boot 3.5 / Gradle 8 / Jakarta (per-module wave upgrade)

  #343·detectiveharree opened Sep 17, 2026·

  ·
  10

  

• Fix: CI downloads docker-compose binary over the network with no integrity verification and sudo-installs it

  #342·WesternConcrete opened Sep 15, 2026·

  ·
  5

  

• feature: extract Order domain into standalone ftgo-order-service with REST client

  #340·devin-ai-integration[bot] opened Sep 14, 2026Bot·

  ·
  9

• Stop exposing courier live location over HTTP and add location retention purge

  #333·WesternConcrete opened Sep 9, 2026·

  ·
  12

  

• Fix: Unvalidated menu item prices on POST /restaurants allow negative-priced menu items and negative order totals

  #330·WesternConcrete opened Sep 6, 2026·

  ·
  4

  

• Fix: API tracking persists client IP, User-Agent and query strings for every request and exposes them via unauthenticated /api/tracking endpoints

  #329·WesternConcrete opened Sep 5, 2026·

  ·
  8

  

• Fix: Deeply nested json in jackson-databind

  #328·WesternConcrete opened Sep 5, 2026·

  ·
  4

  

• Fix: DoS Attack via Range Requests

  #327·WesternConcrete opened Sep 5, 2026·

  ·
  1

  

• Fix: Production consumer database deployed from an unvetted third-party mutable image (msapatterns/mysql:latest) with imagePullPolicy Always

  #326·WesternConcrete opened Sep 4, 2026·

  ·
  1

  

• Fix: Spring Framework range requests denial of service (CVE-2018-15756)

  #325·WesternConcrete opened Sep 4, 2026·

  ·
  1

  

• Fix: Assembled monolith ships with no authentication or authorization layer over endpoints serving protected data

  #324·WesternConcrete opened Sep 3, 2026·

  ·
  10

  

• Fix: Build pinned to EOL Spring Boot 2.0.3.RELEASE with known CVEs

  #323·WesternConcrete opened Sep 3, 2026·

  ·
  2

  

• Fix: MySQL image is EOL and not digest-pinned; init script grants ALL PRIVILEGES WITH GRANT OPTION to a wildcard-host user

  #322·WesternConcrete opened Sep 3, 2026·

  ·
  10

  

• Fix: Unvalidated line-item quantities on POST /orders and POST /orders/{orderId}/revise allow negative or zero order totals

  #321·WesternConcrete opened Sep 3, 2026·

  ·
  6

  

• Fix: Consumer identity records enumerable by sequential ID via unauthenticated GET /consumers/{consumerId}

  #320·WesternConcrete opened Sep 3, 2026·

  ·
  6

  

• Fix: Apache Tomcat Improper Input Validation vulnerability

  #319·WesternConcrete opened Sep 3, 2026·

  ·
  1

  

• Fix: Missing authentication and authorization on order lifecycle state-transition endpoints

  #318·WesternConcrete opened Sep 2, 2026·

  ·
  8

  

• Fix: Unbounded query in /api/tracking endpoints enables memory-exhaustion denial of service

  #317·WesternConcrete opened Sep 1, 2026·

  ·
  9

  

• Fix: Relative Path Overwrite (RPO) in io.springfox:springfox-swagger-ui

  #316·WesternConcrete opened Aug 31, 2026·

  ·
  6

  

• Fix: Unauthenticated /api/tracking endpoints expose retained request telemetry including client IP addresses

  #315·WesternConcrete opened Aug 31, 2026·

  ·
  9

  

• Fix: Consumer PII transits and is logged in plaintext: TLS disabled on the production datasource and SQL statement logging enabled

  #314·WesternConcrete opened Aug 31, 2026·

  ·
  12

  

• Fix: Deeply nested json in jackson-databind

  #313·WesternConcrete opened Aug 31, 2026·

  ·
  8

  

• Fix: Consumer PII sent to MySQL over an unencrypted connection and written to DEBUG SQL logs

  #312·WesternConcrete opened Aug 30, 2026·

  ·
  7

  

• Fix: Unauthenticated /api/tracking endpoints expose client IP addresses and request metadata

  #311·WesternConcrete opened Aug 30, 2026·

  ·
  17