A finding that describes a catch block the code does not have is now set aside with a line saying why. A finding that calls an error silent, when the catch it points to catches every error and logs it, is rated LOW at most and quotes the logging line. A value called a hardcoded secret that is plainly test data, a placeholder named for tests or a value found only in test code, is counted as INFO; a default password that ships in production keeps its rating.
Each rule was checked against findings we had verified by hand against the source they came from: none of them sets aside a finding that was real, or rates one below the severity it deserves.
axios, used only to renew a Let's Encrypt certificate when the portal is set to use one, moves to 1.20.0. The only server that code talks to is the Let's Encrypt certificate authority, so the exposure was low.
Full technical release notes for 7.4.36 are on the changelog, alongside every other Ghost Architect™ Local release.
Ghost Architect™ Local runs on your own hardware.
If you want an evaluation trial, the download page tells you how to get the tarball, verify it, and start the evaluation trial on your own hardware.
Request Ghost Architect™ LocalEJ Wisner, founder of Ghost Architect™. Local pricing is monthly, per team size, with no per-token bill; the numbers are on the pricing page.