Skip to content

bigcapital

v0.25.21 Security

This release patches 1 CVE for security teams tracking exposure across their dependency inventory.

Published 1mo Productivity & Wikis
1 patched CVE
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE CVE-2025-31125 EPSS 59%
1 CVEs patched

Topics

accounting bills double-entry-accounting expenses financial inventory
+2 more
invoicing payments

Affected surfaces

auth rbac rce_ssrf

Summary

AI summary

Server fixes cross‑tenant access, SQL injection, webhook signatures; EE adds audit logs and multi‑organization workspaces; Webapp refactors stores, hooks, and queries to kebab‑case with improved type safety.

Full changelog

What's Changed

  • fix(server): handle missing ContentType in attachment download by @Y8C68 in https://github.com/bigcapitalhq/bigcapital/pull/1063
  • fix(server): use correct base currency in financial reports by @abouolia in https://github.com/bigcapitalhq/bigcapital/pull/1074
  • fix(server): localize i18n column headers in CSV/XLSX/PDF exports by @abouolia in https://github.com/bigcapitalhq/bigcapital/pull/1075
  • fix(server): correct "Liabilties" typo to "Liabilities" in balance sheet by @rebekah-create in https://github.com/bigcapitalhq/bigcapital/pull/1090
  • Fix pagination params silently ignored on collection GET endpoints by @c-premus in https://github.com/bigcapitalhq/bigcapital/pull/1089
  • chore(sdk): update OpenAPI spec and generated types by @github-actions[bot] in https://github.com/bigcapitalhq/bigcapital/pull/1091
  • fix(server): prevent cross-tenant attachment access (IDOR) by @abouolia in https://github.com/bigcapitalhq/bigcapital/pull/1093
  • fix(server): prevent cross-tenant access via organization-id header by @abouolia in https://github.com/bigcapitalhq/bigcapital/pull/1094
  • fix(server): use CSPRNG for attachment S3 keys (GHSA-gj48-p5ff-g67f) by @abouolia in https://github.com/bigcapitalhq/bigcapital/pull/1096
  • fix(server): prevent SQL injection via sortOrder in DynamicListing (GHSA-hcp2-qqg6-jjpm) by @abouolia in https://github.com/bigcapitalhq/bigcapital/pull/1097
  • feat(ee): audit logs domain level by @abouolia in https://github.com/bigcapitalhq/bigcapital/pull/1076
  • chore(sdk): update OpenAPI spec and generated types by @github-actions[bot] in https://github.com/bigcapitalhq/bigcapital/pull/1098
  • fix(server): verify Plaid webhook signatures (GHSA-g56w-g54f-whq5) by @abouolia in https://github.com/bigcapitalhq/bigcapital/pull/1095
  • feat(ee): add multi-organization workspaces feature by @abouolia in https://github.com/bigcapitalhq/bigcapital/pull/1078
  • feat(ee): add workspaces feature by @abouolia in https://github.com/bigcapitalhq/bigcapital/pull/1049
  • refactor(webapp): rename store files and folders to kebab-case by @abouolia in https://github.com/bigcapitalhq/bigcapital/pull/1100
  • refactor(webapp): standardize withX HOC types with shared MapState generic and props interfaces by @abouolia in https://github.com/bigcapitalhq/bigcapital/pull/1101
  • fix(server): resolve all TypeScript errors without unsafe type casts by @abouolia in https://github.com/bigcapitalhq/bigcapital/pull/1102
  • refactor(webapp): rename query hooks to kebab-case convention by @abouolia in https://github.com/bigcapitalhq/bigcapital/pull/1018
  • feat(sdk): add table accept header to report fetchers and refactor audit log hooks by @abouolia in https://github.com/bigcapitalhq/bigcapital/pull/1104
  • refactor: convert containers default exports to named exports by @abouolia in https://github.com/bigcapitalhq/bigcapital/pull/1105
  • refactor(typescript): add proper types to Preferences container files by @abouolia in https://github.com/bigcapitalhq/bigcapital/pull/1106
  • ci: add Prettier format check GitHub Action by @abouolia in https://github.com/bigcapitalhq/bigcapital/pull/1107
  • chore(sdk): update OpenAPI spec and generated types by @github-actions[bot] in https://github.com/bigcapitalhq/bigcapital/pull/1108
  • refactor: remove Project Profitability Summary report by @abouolia in https://github.com/bigcapitalhq/bigcapital/pull/1110
  • fix(webapp): resolve TypeScript errors across components and financial statements by @abouolia in https://github.com/bigcapitalhq/bigcapital/pull/1109
  • refactor(server): replace direct TenancyContext/TransformerInjectable providers with TenancyModule import by @abouolia in https://github.com/bigcapitalhq/bigcapital/pull/1113
  • fix(auth): add ownership check to API key revocation to prevent IDOR (GHSA-xc3g-x39m-684g) by @abouolia in https://github.com/bigcapitalhq/bigcapital/pull/1114
  • fix(import): enforce file type validation to prevent unrestricted upload (GHSA-4c3x-fp46-xp4r) by @abouolia in https://github.com/bigcapitalhq/bigcapital/pull/1115
  • fix(auth): replace weak uniqid reset token with crypto.randomBytes and fix broken expiry check (GHSA-qx24-x69m-97wr) by @abouolia in https://github.com/bigcapitalhq/bigcapital/pull/1116
  • refactor(webapp): simplify financial statements export progress toast by @abouolia in https://github.com/bigcapitalhq/bigcapital/pull/1119
  • feat(payment-services): add OpenAPI DTOs and derive SDK types from schema by @abouolia in https://github.com/bigcapitalhq/bigcapital/pull/1122
  • refactor(webapp): add proper TypeScript types to infinite-query hooks by @abouolia in https://github.com/bigcapitalhq/bigcapital/pull/1123
  • fix(webapp): dynamically load moment.js locales by @abouolia in https://github.com/bigcapitalhq/bigcapital/pull/1124
  • refactor(server): convert DTO properties to camelCase and add Vendor response DTOs by @abouolia in https://github.com/bigcapitalhq/bigcapital/pull/1125
  • refactor(server): add OpenAPI schema for vendor/import endpoints and derive SDK types by @abouolia in https://github.com/bigcapitalhq/bigcapital/pull/1126
  • fix(server): unify FinancialStatements number format DTOs by @abouolia in https://github.com/bigcapitalhq/bigcapital/pull/1127
  • fix(server): add OpenAPI schema for contacts auto-complete endpoint by @abouolia in https://github.com/bigcapitalhq/bigcapital/pull/1128
  • chore: format all packages by @abouolia in https://github.com/bigcapitalhq/bigcapital/pull/1129
  • fix(server): document numberFormat query param via @ApiQuery by @abouolia in https://github.com/bigcapitalhq/bigcapital/pull/1130
  • refactor: FS query type-safety and response DTO ids by @abouolia in https://github.com/bigcapitalhq/bigcapital/pull/1131
  • fix(webapp): extract flattenInfinityPages utility and harden Account select types by @abouolia in https://github.com/bigcapitalhq/bigcapital/pull/1132
  • fix(server): only pass SMTP auth when credentials are configured by @DogInfantry in https://github.com/bigcapitalhq/bigcapital/pull/1135
  • refactor(webapp): tighten query types across banking, cashflow and items by @abouolia in https://github.com/bigcapitalhq/bigcapital/pull/1136

New Contributors

  • @Y8C68 made their first contribution in https://github.com/bigcapitalhq/bigcapital/pull/1063
  • @rebekah-create made their first contribution in https://github.com/bigcapitalhq/bigcapital/pull/1090
  • @c-premus made their first contribution in https://github.com/bigcapitalhq/bigcapital/pull/1089
  • @DogInfantry made their first contribution in https://github.com/bigcapitalhq/bigcapital/pull/1135

Full Changelog: https://github.com/bigcapitalhq/bigcapital/compare/v0.25.20...v0.25.21

Security Fixes

  • GHSA-gj48-p5ff-g67f – use CSPRNG for attachment S3 keys (prevents predictable key generation)
  • GHSA-hcp2-qqg6-jjpm – prevent SQL injection via sortOrder in DynamicListing
  • GHSA-g56w-g54f-whq5 – verify Plaid webhook signatures
  • GHSA-xc3g-x39m-684g – add ownership check to API key revocation (prevents IDOR)
  • GHSA-4c3x-fp46-xp4r – enforce file type validation in import endpoint (prevents unrestricted upload)
  • GHSA-qx24-x69m-97wr – replace weak uniqid reset token with crypto.randomBytes and fix expiry check
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track bigcapital

Get notified when new releases ship.

Sign up free

About bigcapital

Independent financial accounting with intelligent reporting, alternative to Quickbooks, Xero, Wave.

All releases →

Related context

Beta — feedback welcome: [email protected]