Backport login-CSRF fix (GHSA-xf67-jxfx-jf88) to 1.x (Harper 4) - #215

Merged

heskew merged 6 commits into

v1.xfrom

backport/ghsa-xf67-1x

Sep 1, 2026

Commits on Aug 24, 2026

backport GHSA-xf67 login-CSRF fix to 1.x (Harper 4)

heskew
and
claude
committed
dafbf14
revert package.json peer dep change — handled separately

heskew
and
claude
committed
5ae2b6e

Commits on Aug 25, 2026

fix(security): close three GHSA-xf67 regressions on 1.x backport

heskew
and
claude
committed
72638c9
style: prettier-format the GHSA-xf67 backport fixes

heskew
and
claude
committed
93223da

Commits on Sep 1, 2026

fix(security): validate browser-secret cookie value and guard non-string compare inputs

heskew
and
claude
committed
04c4705
style: trim browser-binding comments to essentials

heskew
and
claude
committed
5dccb40