Skip to main content

v0.99.5.1 — Security Patch, Document Downloads, GS1 Annex XIII Gate

Sprint 25 patch release. Closes seven high-severity security vulnerabilities, fixes a document download failure affecting some verification workflows, completes the GS1 Annex XIII publish-gate with German localisation, and ships supplier standalone certificate upload.

Security — Seven HIGH Vulnerabilities Patched​

Seven HIGH-severity vulnerabilities in platform dependencies have been resolved in this release, affecting the core Next.js framework and the HTML sanitisation library. All production paths that accept or render user-supplied content were verified after the patches were applied.

Additionally:

  • The Content Security Policy was updated to allow Vercel Speed Insights and Google Analytics 4 scripts, which were previously blocked by a CSP directive. Operators using these tools in their operator-portal integrations will see correct analytics data.
  • A login-page CSP unsafe-eval requirement from the authentication library has been formally risk-accepted with compliance sign-off documented.

Document Download — Multi-Bucket Fallback​

A document download failure that affected some verification tasks has been resolved. Documents uploaded across different storage periods were stored in different storage buckets; the download resolver now checks all relevant buckets in sequence, so older documents that previously returned a download error are now accessible again.

This fix also closes a six-day failure in the automated end-to-end test suite (E2E Tier 2) that was blocked by the same root cause.

GS1 Annex XIII Publish-Gate — Complete with German Localisation​

The GS1 publish-gate introduced in v0.99.5 now fully covers the Annex XIII regulatory requirement. The gate enforces that a valid, registered GS1 prefix is present before a DPP can be published — in line with the EU Battery Regulation's product identification requirements.

German-language copy has been added for all publish-gate error messages, so operators on the German locale see native regulatory wording rather than translated English.

Supplier Standalone Certificate Upload​

Suppliers can now upload compliance certificates directly to their Certificates page without needing an open data request. Previously, certificate uploads required an active data request as context. Standalone upload allows suppliers to maintain their evidence library proactively, making certificates available to link against future data requests.

Cascade Tree — Security Fix​

The supply chain cascade tree now fails closed when an invalid or cross-tenant request ID is supplied. Previously, a malformed cascade URL could return a partial result. The page now returns an empty state for any request that cannot be validated against the authenticated supplier's membership scope.

Data Request Error Display​

Error information returned in data request responses is now normalised and stripped of internal formatting before display. Suppliers and operators no longer see raw internal error codes in the data request detail view when a processing error occurs.

Infrastructure​

  • Production migration parity gate — a new automated workflow now runs daily and fires an alert if the production database schema drifts from the expected state. This closes the root-cause gap identified in the 2026-05-18 schema drift incident, where a production migration had not been applied correctly.