Issues

• fix(api): bulk PATCH/PUT can partially commit when a store-time error hits a later entry

  apibug
  ericfitz/tmi#1120 · Filter by author ericfitz opened on Oct 18, 2026

• fix(api): content OAuth authorize returns 500 instead of 503 when the Redis state store is unavailable

  apibug
  ericfitz/tmi#1119 · Filter by author ericfitz opened on Oct 18, 2026

• fix(api): shared store-error mapper can return undocumented 409 on duplicate-key errors

  apibug
  ericfitz/tmi#1118 · Filter by author ericfitz opened on Oct 18, 2026

• fix(dbtool): make setting seed writes atomic and reject non-string setting values

  bug
  ericfitz/tmi#1117 · Filter by author ericfitz opened on Oct 18, 2026

• fix(api): survey list endpoints ignore documented sort and date-range parameters

  apibug
  ericfitz/tmi#1116 · Filter by author ericfitz opened on Oct 18, 2026

• chore(auth): split saml_error by status in a future breaking change

  ericfitz/tmi#1077 · Filter by author ericfitz opened on Oct 8, 2026

• feat(websocket): adopt the documented error-code vocabulary for WebSocket messages

  enhancement
  ericfitz/tmi#1076 · Filter by author ericfitz opened on Oct 8, 2026
  1

• chore: decide whether threat-model note descriptions should be sanitized

  ericfitz/tmi#1073 · Filter by author ericfitz opened on Oct 8, 2026

• fix: team and project note /sharable guard checks only op.path, so a JSON Patch move from /sharable bypasses it

  security
  ericfitz/tmi#1072 · Filter by author ericfitz opened on Oct 8, 2026

• fix: note PUT stores false for omitted include_in_report and timmy_enabled, while create uses the default true

  apibug
  ericfitz/tmi#1071 · Filter by author ericfitz opened on Oct 8, 2026

• fix: threat-model note Update logs a failed metadata update and still returns success

  apibug
  ericfitz/tmi#1070 · Filter by author ericfitz opened on Oct 8, 2026

• chore: confirm notes.name is character-length (not byte-length) on the production Oracle ADB

  ericfitz/tmi#1069 · Filter by author ericfitz opened on Oct 8, 2026

• fix: note PATCH has no transaction or row lock around read, apply and update (lost updates)

  apibug
  ericfitz/tmi#1066 · Filter by author ericfitz opened on Oct 8, 2026

• fix: GORM JSON Patch for assets, documents, threats and repositories silently ignores unsupported operations

  apibug
  ericfitz/tmi#1065 · Filter by author ericfitz opened on Oct 8, 2026

• test: integration framework leaks the sql.DB when the ping fails

  ericfitz/tmi#1062 · Filter by author ericfitz opened on Oct 8, 2026

• chore: add a style policy and restrict id/class in the markdown HTML sanitizer

  security
  ericfitz/tmi#1061 · Filter by author ericfitz opened on Oct 8, 2026

• fix: markdown sanitizer strips safe autolinks and angle-bracket link destinations

  bug
  ericfitz/tmi#1060 · Filter by author ericfitz opened on Oct 8, 2026

• fix: survey list endpoints accept created/modified range filters but never apply them

  bug
  ericfitz/tmi#1059 · Filter by author ericfitz opened on Oct 8, 2026

• fix: settings readers and the dbtool import treat encrypted setting values inconsistently

  bug
  ericfitz/tmi#1057 · Filter by author ericfitz opened on Oct 8, 2026

• test: run TestSettingsReEncryptAllOracleIntegration on a dedicated ADB schema

  ericfitz/tmi#1007 · Filter by author ericfitz opened on Sep 30, 2026

• chore: wire tmi-rotator CronJob for the Oracle image

  ericfitz/tmi#1004 · Filter by author ericfitz opened on Sep 30, 2026

• chore(dev): move k3s NodePort choices into .local config

  enhancement
  ericfitz/tmi#996 · Filter by author ericfitz opened on Sep 29, 2026

• fix(dev): make charlie the administrator on every fresh dev database

  bug
  ericfitz/tmi#994 · Filter by author ericfitz opened on Sep 29, 2026

• feat(nats): per-component subject permissions via verify_and_map

  enhancementsecurity
  ericfitz/tmi#990 · Filter by author ericfitz opened on Sep 29, 2026

• test: e2e platform harness host-side NATS clients need mTLS client certs

  enhancement
  ericfitz/tmi#989 · Filter by author ericfitz opened on Sep 29, 2026