You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardexpand all lines: CHANGELOG.md
+34-34
Original file line number
Diff line number
Diff line change
@@ -10,62 +10,62 @@ The library will attempt to self-install itself by running it via npx: `npx @min
10
10
11
11
It will then prompt you to perform some manual tasks - if you have stub tests for your health endpoints you might need add some additional stubbing.
12
12
13
-
See PR [#479](https://github.com/ministryofjustice/hmpps-template-typescript/pull/479)
13
+
See PR [#479](https://github.com/ministryofjustice/hmpps-managing-prisoner-apps-staff-ui/pull/479)
14
14
15
15
**November 18th 2024** - Moving away from csurf and to csrf-sync
16
16
17
17
[csurf](https://www.npmjs.com/package/csurf) has been deprecated for some time and this removes that dependency and implements the [synchronizer token pattern](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#transmissing-csrf-tokens-in-synchronized-patterns) using [csrf-sync](https://www.npmjs.com/package/csrf-sync).
18
18
19
19
**Note:** Previously csurf used to generate new tokens on every request. The new library generates tokens once per session which is preferrable due to the extra calls to redis that per-request would generate. It is possible to force a refresh/revocation of a token by explicitly calling: `req.csrfToken(true)`
20
20
21
-
See PR [#481](https://github.com/ministryofjustice/hmpps-template-typescript/pull/481)
21
+
See PR [#481](https://github.com/ministryofjustice/hmpps-managing-prisoner-apps-staff-ui/pull/481)
As part of this change we also renamed the env var names used for configuring our client's credentials. It was felt that the previous names were confusing/misleading.
We have recently introduced several enhancements to the ESBuild process to improve stability, logging, and basic type annotations. These are part of
91
91
92
-
PR: [#388](https://github.com/ministryofjustice/hmpps-template-typescript/pull/388) and PR: [#378](https://github.com/ministryofjustice/hmpps-template-typescript/pull/378)
92
+
PR: [#388](https://github.com/ministryofjustice/hmpps-managing-prisoner-apps-staff-ui/pull/388) and PR: [#378](https://github.com/ministryofjustice/hmpps-managing-prisoner-apps-staff-ui/pull/378)
93
93
94
94
Additionally, we have integrated a new and improved process for handling asset cache-busting. Previously, we appended a query string representing the build number or Git commit hash to our assets for cache-busting. With the recent introduction of ESBuild, we have implemented a more common asset-revving solution, using the hash of the asset in the asset's output filename, like `/assets/js/app.UG7VY7MS.js`.
95
95
@@ -99,7 +99,7 @@ In brief, this implementation creates a `manifest.json` file during the asset bu
99
99
100
100
To see the full conversation see the #typescript slack channel
**May 22nd 2024** – Remove prometheus metrics middleware and metrics app. We had discussed that very few teams actually go on to set up a dashboard to surface the information and tend to use application insights instead for the information. In addition it had also caused a memory leak and production issues (manifesting in increased 502 error rates) in at least two applications that had inherited from the template so it seems wise to remove this tooling by default.
**May 10th 2024** – Derive user details from the `authorization_code` "user" token instead of making an API call to `hmpps-manage-users-api`, thereby removing an unnecessary dependency.
This is to encourage services not to make additional calls to retrieve a user's role information.
164
164
Usually roles are cached with the session meaning that the user has to log out and in again to bring in changes to roles - as user details are also cached this will not change this behaviour.
**June 9th 2023** - Do not retry POST requests by default
248
248
249
249
It's not safe to retry idempotent calls as this introduces the risk of creating multiple resources. This fix changes the default to not carry out any retries but allows switching on retrying if desired.
Asset caching was only set to 20 seconds. This fix changes the default to 1 hour which has a profound effect on the number of requests the application serves.
**March 20th 2023** - CSP fix for redirects during POST on session timeout
272
272
273
273
Updates the Content Security Policy to fix issues when users would be stuck on pages after submitting a form after their session times out. (Lots more detail in the PR)
**February 3rd 2023** - Revert multi build docker image
280
280
281
281
Multibuild docker images ended up taking a very long time after the upgrade to node 18 (1hr+). Some work needs to be done to move to support multi host builds in our circle orb, in the meantime we’ve removed this and are just building images solely for deployment.
0 commit comments