Issues

• docker-compose.demo.yml: add a cron container so background jobs and scheduled flows run

  enhancementtriage
  ConductionNL/openregister#5386 · Filter by author WilcoLouwerse opened on Nov 2, 2026
  1

  

• Audit-trail subject-lookup exposes the whole trail (incl. raw session ids) to any signed-in user

  bugsecuritytriage
  ConductionNL/openregister#5148 · Filter by author WilcoLouwerse opened on Oct 30, 2026
  1

  

• Residual risks from the deleted IDOR triage note have no tracking issue

  bugsecuritytriage
  ConductionNL/openregister#5147 · Filter by author WilcoLouwerse opened on Oct 30, 2026
  1

  

• Explicit service factories omit optional dependencies autowiring would supply

  bugtriage
  ConductionNL/openregister#5146 · Filter by author WilcoLouwerse opened on Oct 30, 2026
  1

  

• ObjectActionsController invoke routes are CSRF-exempt without a stated reason

  bugsecuritytriage
  ConductionNL/openregister#5145 · Filter by author WilcoLouwerse opened on Oct 30, 2026
  1

  

• Bulk save: a row whose schema cannot be loaded skips the property safeguard

  bugsecuritytriage
  ConductionNL/openregister#5144 · Filter by author WilcoLouwerse opened on Oct 30, 2026
  1

  

• SchemaMapper is built without ObjectActionValidator: elevate/bound-flow checks never run

  bugsecuritytriage
  ConductionNL/openregister#5143 · Filter by author WilcoLouwerse opened on Oct 30, 2026
  1

  

• Destruction-list register and schema ship without authorization (default-open)

  bugsecuritytriage
  ConductionNL/openregister#5142 · Filter by author WilcoLouwerse opened on Oct 30, 2026
  1

  

• ReferencedCalculationListener re-saves dependent objects inline in the user's write

  bugtriage
  ConductionNL/openregister#5141 · Filter by author WilcoLouwerse opened on Oct 30, 2026
  1

  

• Aggregations return explicit-reveal property values unmasked as group keys

  bugsecuritytriage
  ConductionNL/openregister#5140 · Filter by author WilcoLouwerse opened on Oct 30, 2026
  1

  

• File-verb opt-in falls back to the object rule once matrix rows expire

  bugsecuritytriage
  ConductionNL/openregister#5139 · Filter by author WilcoLouwerse opened on Oct 30, 2026
  1

  

• Action runs store writeOnly inputs (PINs, one-time codes) in FlowRun log and items

  bugsecuritytriage
  ConductionNL/openregister#5138 · Filter by author WilcoLouwerse opened on Oct 30, 2026
  1

  

• fix(object-actions): the selection route lists the actions of a schema the caller cannot read

  bugtriage
  ConductionNL/openregister#4926 · Filter by author WilcoLouwerse opened on Oct 26, 2026
  1

  

• Migration Version1Date20260915050000 fails on MariaDB/MySQL: column name row_number is a reserved word

  bugmariadb-column-querytriage
  ConductionNL/openregister#4909 · Filter by author WilcoLouwerse opened on Oct 26, 2026
  1

  

• Referential integrity: another user's hidden draft blocks a RESTRICT delete

  bugtriage
  ConductionNL/openregister#4709 · Filter by author rjzondervan opened on Oct 20, 2026
  1

  

• Drafts: personal data in a draft is not found by a data-subject request, and a removed draft's audit values remain

  bugtriage
  ConductionNL/openregister#4708 · Filter by author rjzondervan opened on Oct 20, 2026
  1

  

• Deferred listeners: an oversized deferred entry or webhook payload is dropped, not delivered

  bugtriage
  ConductionNL/openregister#4707 · Filter by author rjzondervan opened on Oct 20, 2026
  1

  

• Example sets: remove deletes the set's organisation without checking whether objects outside the set use it

  bugtriage
  ConductionNL/openregister#4706 · Filter by author rjzondervan opened on Oct 20, 2026
  1

  

• Facet labels: the distributed label cache is shared across callers and bypasses the per-caller read check

  bugtriage
  ConductionNL/openregister#4705 · Filter by author rjzondervan opened on Oct 20, 2026
  1

  

• Review policy: does a file without an owning object keep the open instance default?

  bugtriage
  ConductionNL/openregister#4692 · Filter by author WilcoLouwerse opened on Oct 19, 2026
  1

  

• Case flows: where a case-bound flow without a schedule trigger declares the identity it runs as

  bugtriage
  ConductionNL/openregister#4691 · Filter by author WilcoLouwerse opened on Oct 19, 2026
  1

  

• Bulk writer lets a _-named schema property overwrite metadata columns

  bugtriage
  ConductionNL/openregister#4668 · Filter by author rjzondervan opened on Oct 16, 2026
  1

  

• Tree fields returns writeOnly, property-restricted and encrypted values raw

  bugtriage
  ConductionNL/openregister#4667 · Filter by author rjzondervan opened on Oct 16, 2026
  1

  

• /api/audit-trails/readable shows other users' draft contents

  bugtriage
  ConductionNL/openregister#4666 · Filter by author rjzondervan opened on Oct 16, 2026
  1

  

• Bulk delete ignores every draft rule: others' drafts deleted, soft-deleted, no draft.removed

  bugtriage
  ConductionNL/openregister#4665 · Filter by author rjzondervan opened on Oct 16, 2026
  1