All pull requests

Pull requests

• docs: add test-method naming convention to AGENTS.md

  #4735·by jekkos was merged Oct 6, 2026Member·

  ·
  2

• fix(auth): return 401 JSON for AJAX requests on session timeout

  #4728·by jekkos was merged Oct 5, 2026Member·

  ·
  1

  7

• chore(deps): bump dompurify from 3.4.13 to 3.4.16

  dependenciesjavascript
  #4723·by dependabot[bot] was merged Oct 1, 2026Bot·

  ·
  1

• chore(deps): bump moment from 2.30.1 to 2.31.0

  dependenciesjavascript
  #4722·by dependabot[bot] was merged Oct 2, 2026Bot·

  ·
  2

• chore(deps): bump brace-expansion

  dependenciesjavascript
  #4721·by dependabot[bot] was merged Oct 2, 2026Bot·

  ·
  2

• chore: strip security advisory IDs from code and changelog

  #4720·by jekkos was merged Sep 30, 2026Member·

  ·
  2

• fix(release): keep package-lock.json version in sync on bump

  #4718·by jekkos was merged Sep 29, 2026Member·

  ·
  1

  4

• Fix [REDACTED]: strip all HTML tags from $.notify alert messages

  #4716·by jekkos was merged Sep 29, 2026Member·

  ·
  3

• Fix [REDACTED]: HTML-escape attribute dropdown option labels in items attributes view

  #4715·by jekkos was merged Sep 28, 2026Member·

  ·
  3

• fix(security): report unwritable .env.lock, make throttle limits configurable

  #4714·by jekkos was merged Sep 30, 2026Member·

  ·
  30

• fix(i18n): add missing toggle_cost_and_profit key to 32 locales

  #4712·by minutechreview was merged Oct 5, 2026Contributor·4 tasks·

  ·
  1

  4

• chore(release): unified git-cliff release workflow (changelog + tag + optional bump)

  enhancement
  #4711·by jekkos was merged Sep 24, 2026Member·

  ·

  · 3.4.2
  23

  

• fix(ci): stop stamping app version onto master and branch Docker tags

  #4709·by jekkos was merged Sep 23, 2026Member·

  ·
  19

  

• Merge pull request #3 from opensourcepos/master

  #4708·by zulfiqarpk92 was closed Sep 22, 2026·

  ·

• feat(security): add THROTTLE_KEY env-var fallback for throttle.key

  #4707·by jekkos was merged Sep 22, 2026Member·

  ·

  · 3.4.2
  5

• Fix GHSA-frx7-c5vv-m3mr: recompute cashup total server-side and force owner identity

  #4706·by jekkos was merged Sep 21, 2026Member·

  ·

  · 3.4.2
  3

• fix(locale): validate language_code against known locales to block path traversal

  #4704·by jekkos was merged Sep 21, 2026Member·

  ·

  · 3.4.2
  4

• fix(i18n): translate remaining English labels in Swiss German Items.php

  #4701·by minutechreview was merged Sep 23, 2026Contributor·3 tasks done·

  ·
  1

  7

• fix(i18n): swap print_delay_autoreturn number/required messages in 5 locales

  #4699·by minutechreview was merged Sep 24, 2026Contributor·3 tasks done·

  ·

  · 3.4.2
  1

  9

• fix(build): await all async gulp copy/exec calls to fix race condition breaking fresh-clone builds

  bug
  #4698·by objecttothis was merged Sep 10, 2026Member·2 tasks done·

  ·

  · 3.4.2
  1

  13

  

• fix(validation): allow Windows sendmail paths in PLAIN_FILESYSTEM_PATH_STRICT rule

  bug
  #4697·by objecttothis was merged Sep 10, 2026Member·2 tasks done·

  ·

  · 3.4.2
  1

  10

  

• fix(barcode): resolve string interpolation issue in barcode display html

  #4692·by VighneshNilajakar was merged Sep 6, 2026Contributor·

  ·
  1

• fix(tests): resolve all phpunit failures — clean-DB suite green (#4626)

  #4691·by jekkos was merged Sep 8, 2026Member·

  ·

  · 3.4.2
  1

  21

• chore(deps): bump fflate from 0.8.2 to 0.8.3

  dependenciesjavascript
  #4690·by dependabot[bot] was merged Sep 23, 2026Bot·

  ·

  · 3.4.3
  1

• fix(sales): enforce authorization and status check on unsuspend

  bug
  #4686·by objecttothis was merged Sep 7, 2026Member·3 tasks done·

  ·

  · 3.4.2
  4