Services - 2.8.7

Issues

• Investigate fail open on audit log failure to write.

  CVEProject/cve-services#1985 · Filter by author david-rocca opened on Aug 28, 2026 · Services - 2.8.7

• Standardize legacy/registry format selection in repository APIs

  CVEProject/cve-services#1936 · Filter by author david-rocca opened on Jul 20, 2026 · Services - 2.8.7

• Migrate legacy Org compatibility to a BaseOrg-backed mask

  CVEProject/cve-services#1942 · Filter by author david-rocca opened on Jul 23, 2026 · Services - 2.8.7
  

• Migrate legacy User compatibility to a BaseUser-backed mask

  CVEProject/cve-services#1943 · Filter by author david-rocca opened on Jul 23, 2026 · Services - 2.8.7
  

• Update contribution guide & issue / PR templates.

  CVEProject/cve-services#1980 · Filter by author david-rocca opened on Aug 27, 2026 · Services - 2.8.7

• Remove __v from GET /api/registry/users

  CVEProject/cve-services#1984 · Filter by author david-rocca opened on Aug 28, 2026 · Services - 2.8.7

• Unused package candidates from depcheck

  CVEProject/cve-services#1922 · Filter by author david-rocca opened on Jul 13, 2026 · Services - 2.8.7

• Runtime dependencies include dev tooling and known moderate advisories

  CVEProject/cve-services#1923 · Filter by author david-rocca opened on Jul 13, 2026 · Services - 2.8.7

• Generated/local artifacts are present in the workspace

  CVEProject/cve-services#1926 · Filter by author david-rocca opened on Jul 13, 2026 · Services - 2.8.7
  

• Use a distroless Node.js runtime image

  Unread
  CVEProject/cve-services#1938·afoote-mitre opened Jul 22, 2026 · Updated Oct 1, 2026
  5

  

• Legacy role checks perform broad scans instead of direct role lookups

  CVEProject/cve-services#1924 · Filter by author david-rocca opened on Jul 13, 2026 · Services - 2.8.7

• Notifications

  draftuser story
  CVEProject/cve-services#2020 · Filter by author david-rocca opened on Sep 21, 2026 · Services - 2.8.7