All pull requests

Pull requests

• Restrict ZookeeperDistributedQueue deserialization to an exact-class allowlist (CWE-502)

  #269·Colhodm opened Nov 5, 2026·

  ·
  1

  

• Restrict ZookeeperDistributedQueue deserialization to an exact-class allowlist (CWE-502)

  #268·Colhodm opened Nov 4, 2026·

  ·
  1

  

• Restrict ZookeeperDistributedQueue deserialization with an ObjectInputFilter allowlist (CWE-502)

  #267·Colhodm opened Nov 2, 2026·

  ·
  4

  

• Restrict ZookeeperDistributedQueue deserialization with an ObjectInputFilter allowlist (CWE-502)

  #266·Colhodm opened Oct 29, 2026·

  ·
  4

  

• Fixes MVEL expression injection through rule builder values in offer rules

  #265·devin-ai-integration[bot] opened Oct 29, 2026Bot·

  ·
  6

• Clear shopper-supplied override prices on nested child add-to-cart requests

  #264·devin-ai-integration[bot] opened Oct 29, 2026Bot·

  ·
  1

• Block MVEL code injection through [REDACTED SECRET] rule-builder JSON

  #263·devin-ai-integration[bot] opened Oct 29, 2026Bot·

  ·
  9

• Require StaticAsset permission for [REDACTED SECRET] asset uploads and stop serving uploaded HTML inline

  #262·devin-ai-integration[bot] opened Oct 29, 2026Bot·

  ·
  1

• Prevents OAuth registration from merging over existing customers through customer.id

  #261·devin-ai-integration[bot] opened Oct 29, 2026Bot·

  ·
  10

• Rejecting path traversal in [REDACTED SECRET] asset uploads and requiring upload authorization

  #260·devin-ai-integration[bot] opened Oct 29, 2026Bot·

  ·
  9

• Sandbox [REDACTED SECRET]-authored MVEL rules and stop rule builder values from injecting MVEL

  #259·devin-ai-integration[bot] opened Oct 29, 2026Bot·

  ·
  6

• Prevents customer registration from binding customer id and privileged fields

  #258·devin-ai-integration[bot] opened Oct 29, 2026Bot·

  ·
  1

• Preventing request binding of server-owned EntityForm dynamic form state

  #257·devin-ai-integration[bot] opened Oct 29, 2026Bot·

  ·
  1

• Prevent registration from binding customer.id and taking over existing customer accounts

  #256·devin-ai-integration[bot] opened Oct 29, 2026Bot·

  ·
  1

• Rejects saved-payment ids that don't belong to the active customer at checkout

  #255·devin-ai-integration[bot] opened Oct 29, 2026Bot·

  ·
  1

• Bind payment gateway callbacks to the current shopper and require gateways to mark responses valid

  #254·devin-ai-integration[bot] opened Oct 29, 2026Bot·

  ·
  4

• Require CSR permission before addWithPriceOverride honors override prices

  #253·devin-ai-integration[bot] opened Oct 29, 2026Bot·

  ·
  1

• Capping [REDACTED SECRET] list pageSize/maxResults request parameters

  #252·devin-ai-integration[bot] opened Oct 29, 2026Bot·

  ·
  4

• Require saved customer payments used in checkout to belong to the active customer

  #251·devin-ai-integration[bot] opened Oct 29, 2026Bot·

  ·
  1

• Store content-detected MIME type for static asset uploads and serve active types as attachments

  #250·devin-ai-integration[bot] opened Oct 29, 2026Bot·

  ·
  6

• Default [REDACTED SECRET] and site password encoders to BCrypt so passwords and reset tokens are not stored in plaintext

  #249·devin-ai-integration[bot] opened Oct 29, 2026Bot·

  ·
  4

• Fixes static compression cache storing empty HEAD/304/Range responses and replaying them to everyone

  #247·devin-ai-integration[bot] opened Oct 29, 2026Bot·

  ·
  13

• Limit forgot-password reset tokens per customer and throttle forgot-password requests

  #248·devin-ai-integration[bot] opened Oct 29, 2026Bot·

  ·
  22

• Stop evaluating stored asset URL query strings as Thymeleaf expressions in blc:src

  #246·devin-ai-integration[bot] opened Oct 29, 2026Bot·

  ·
  4

• Enforce ADD/FETCH and row-level checks on [REDACTED SECRET] entity duplicate endpoint

  #245·devin-ai-integration[bot] opened Oct 29, 2026Bot·

  ·
  4