Levandor

InstaCash eSign 1.3.0.11 — release composition

4 min read

InstaCash eSign 1.3.0.11 — release composition

InstaCash electronic-signature release. Two components only — esign_oss + esign_css — tagged instacash-1.3.0.11. Changelog = a devel core update plus a batch of vulnerability fixes. No DB migration, no breaking change; rollback is a straight redeploy of the prior 1.3.0.8.

For Agents

  • Release issue: ASSICASH-92 (InstaCash YouTrack suffix = ICASH; see client-registry).
  • Install tickets: ASSICASH-93 = TESZT, ASSICASH-96 = PROD (approved 2026-06-26, upgrading from the deployed 1.3.0.8).
  • Components: esign_oss + esign_css only. No vuer_*, no pdfservice in this release.
  • Source tag: instacash-1.3.0.11 on both esign repos (2026-06-08). Harbor images instacash-esign-oss:1.3.0.11-20260608 and instacash-esign-css:1.3.0.11-20260608.
  • Build pipeline: eSign / bizalmi_szolgaltatas_build (the InstaCash-specific pipeline — not vuer-release / vuer_build; per client-registry).
  • Dev ticket: FKITDEV-8817, assignee andras.lederer.
  • Risk: no DB migration, no breaking change. Rollback = redeploy 1.3.0.8.

Composition at a glance

FieldValue
Release issueASSICASH-92 (eSign 1.3.0.11 release)
Install — TESZTASSICASH-93
Install — PRODASSICASH-96 (approved 2026-06-26, from 1.3.0.8)
Version1.3.0.11 (prev deployed 1.3.0.8)
Componentsesign_oss, esign_css
Source taginstacash-1.3.0.11 (2026-06-08, both repos)
Harbor imagesinstacash-esign-oss:1.3.0.11-20260608, instacash-esign-css:1.3.0.11-20260608
Dev ticketFKITDEV-8817 (andras.lederer)
DB migrationnone
Breaking changenone
Rollbackredeploy 1.3.0.8

PROD jumps 1.3.0.8 → 1.3.0.11

The currently-deployed PROD version is 1.3.0.8; 1.3.0.9 / 1.3.0.10 are not in this PROD line (the instacash branch HEAD was the squashed 1.3.0.10 orphan commit b7cee2f, 2025-11-20). The PROD install therefore steps straight from .8 to .11.

Changelog — devel update + vulnerability fixes

The release content is (a) a periodic devel core update folded into the InstaCash customization, plus (b) the security batch tracked under FKITDEV-8817:

Vulnerability fixes (FKITDEV-8817)

AreaFixWhere
jQuery XSSCVE-2020-11023 remediatedesign_css (PR #250)
jQuery input-validation / prototype-pollutionCVE-2019-11358 remediatedesign_css (PR #250)
HSTSHTTP Strict-Transport-Security header addedhardening
nginx HTTP hardeningHTTP-level hardening in the nginx layerhardening
WAF / ModSecuritymodsec WAF ruleshardening

CVE references

  • CVE-2020-11023 — jQuery: passing <option>-containing HTML to DOM-manipulation methods can execute untrusted code (XSS).
  • CVE-2019-11358 — jQuery jQuery.extend(true, {}, …) prototype pollution (the “input-validation” item). Both were remediated on esign_css via PR #250. The hardening items (HSTS, nginx HTTP hardening, WAF/ModSecurity) ship alongside.

Core update

A standard devel → customization/instacash sync (the general core-update step in release-process). For esign_css this customization branch is a squashed orphan with no shared history to devel — any sync must follow the constraints in esign-css-instacash-orphan-history (a blind git merge origin/devel halts with refusing to merge unrelated histories).

Deploy / verify

  • PROD install is gated by ASSICASH-96 (approved 2026-06-26). Harbor pull of the two …:1.3.0.11-20260608 images.
  • A dev-box smoke test of this exact release was run on ssh Facekom — full chain-alignment + verification recipe in instacash-esign-dev-box-deploy.
  • Rollback: redeploy the prior instacash-esign-{oss,css}:1.3.0.8-… images (no schema rollback needed — there is no migration).

Test record (tesztjegyzőkönyv)

This release produced the first-ever InstaCash eSign Tesztelési jegyzőkönyv — historically InstaCash had none (see youtrack-tesztjegyzokonyv-attachment-recipe). Generated by dogfooding fk-tjk: 5 test cases, rendered to ~/Downloads/tesztjegyzokonyv_instacash_1.3.0.11.docx. instacash was added to the flow’s partners.json (display “InstaCash”, ytProject = ASSICASH). Not yet attached to YouTrack (the flow does not auto-write).

Status log

  • 2026-06-08 — Source tag instacash-1.3.0.11 cut on esign_oss + esign_css; Harbor images …:1.3.0.11-20260608 built (eSign pipeline).
  • 2026-06-26 — PROD install ASSICASH-96 approved (from 1.3.0.8). First InstaCash eSign TJK generated via /fk-tjk (5 cases). Dev-box smoke test of the full InstaCash chain run on ssh Facekom — see instacash-esign-dev-box-deploy.

Graph View

Backlinks