Security Fixes
- [SEC] SQL Injection in Schedulers — Fixed SQL injection vulnerability in the Schedulers module by sanitizing query parameters in the SchedulerRepository.
New Features
- WCAG — Main page accessibility attributes for AI agent support — Added aria-label and aria-description attributes to key UI elements (Kudos/News drawer, top bar buttons, global search, sidebar modules) to improve screen reader support and WCAG compliance.
Bug Fixes
- Mint CLI installer permission issue — Fixed a permission error (
chmod: cannot read directory) occurring during MintHCM CLI installation. - Kudos drawer showing incorrect records on tab switch — Fixed a race condition where switching Kudos tabs (All/Received/Given) before data loaded would display incorrect records.
- Incorrect display of quotes in list view and calendar — Fixed HTML entity encoding issue causing single and double quotes to render as escaped entities (
") in list views and calendar entries. - Supervisor change not saving on Employee record — Fixed an issue where changing the “Reports to” field on an Employee record would not persist, by restricting association handling in getRecord to scalar (ManyToOne/OneToOne) relationships.
- Incorrect record search on list views — Fixed search functionality on list views where records were not found correctly when using partial name queries.