Inventoros v1.0.3 — Security & Reliability
Implements every actionable finding from the 2026-06-03 security + reliability audit, each with regression tests. Full test suite green (1255 tests); cPanel package is now signed.
Security
- Plugin slug path containment (reject traversal/separators + realpath-contained deletes)
- GraphQL category/location references scoped to the caller's organization (IDOR)
- Update-availability check requires admin; backup filenames validated against an allowlist + the known-backup set
- GraphQL free-text length caps to match REST
- SSRF guard fails closed on empty DNS in production
- Nonce-based Content-Security-Policy (Vite + Ziggy nonce, vue-i18n JIT); deprecated X-XSS-Protection removed
- Plugin manifest guard + a startup warning when uploads are enabled without signature verification
Reliability / data integrity
- Shared, locked cancel-restock across web/REST/GraphQL (GraphQL no longer leaks stock on cancel)
- Transactions + row locks + status re-checks on PO receiving, work-order complete/cancel, stock-audit complete, web order cancel, and return receive
- Org-scoped, fail-fast product lookup in web order updates
- Stock notifications deferred until after the locked transaction commits
- All advertised webhook events now actually dispatch (stock, order, and purchase-order lifecycle)
- In-app updater auto-restores from backup if file replacement fails
- Product imports retry transient failures and keep the upload until the final attempt
Signed updates
Release archives are now signed with a detached Ed25519 signature (inventoros-cpanel-1.0.3.zip.sig). The in-app updater verifies the archive against the public key shipped in .env.example before extracting. Set INVENTOROS_UPDATE_PUBLIC_KEY (already in .env.example); to install unsigned builds set INVENTOROS_UPDATE_SIGNATURE_REQUIRED=false.
Known limitation
Stock transfers between locations remain a no-op audit record (global stock model); per-location stock tracking is a future change.
See INSTALL.md inside the zip for cPanel installation steps.