Local security maintenance, 2026-11-02

Base: official HedgeDoc 1.12.0 source, AGPL-3.0.
This source preserves the September 15 deployment login gates, private upload
serving, authenticated Socket.IO, disabled application schema mutation, and
PostgreSQL application role. The CSP object and frame-ancestor directives are
normalized to a sole none token after upstream merging.

Security dependencies are pinned in package.json and yarn.lock. Sequelize 6
compatibility uses direct model imports, native Promise array results, and the
current addConstraint API. Mermaid 10 security backports use its async renderer
with strict security mode. The frontend was rebuilt so browser libraries are
actually updated. Build tooling and the unused SQLite test driver are dev-only.

To reproduce with Node 24.22.2:
  node .yarn/releases/yarn-4.13.0.cjs install
  NODE_OPTIONS=--openssl-legacy-provider node .yarn/releases/yarn-4.13.0.cjs build
  node .yarn/releases/yarn-4.13.0.cjs mocha-suite
  docker build -f Dockerfile.secured .

Production dependencies are installed in a separate build stage; the final
runtime is pinned to Node 24.22.2 on Debian trixie and refreshed with apt.
Configuration secrets and database/uploads are not part of this source archive.

Browser hardening additionally removes Bootstrap activation/options and state-text
data attributes from note HTML while keeping line/diagram metadata. Pretty and
slide views use the installed Bootstrap 3.4.1 tooltip, replacing the unused
vendored 3.3.7 code. Anonymous GET /config serves public login-page JavaScript;
anonymous userToken is empty and all note/upload access remains authenticated.

Reveal.js speaker notes include the upstream same-origin postMessage guard
from commit 32cdd3b1872ba8e2267c9e87ae216cb55f40f4d2. The build script applies
that backport and recalculates its inline-script CSP hash reproducibly.

November maintenance updates follow-redirects 1.16.1 to 1.16.2 for
CVE-2026-116689. Prior custom application and browser hardening is preserved.
