Issues

• fix(oracle): idx_users_provider_lookup rejects multiple rows with the same provider and NULL provider_user_id

  bug
  Bug

  ericfitz/tmi#1170 · Filter by author ericfitz opened on Nov 13, 2026

• fix: unreadable system_settings row makes admin settings reads return 500

  apibug
  Bug

  ericfitz/tmi#1169 · Filter by author ericfitz opened on Nov 13, 2026

• fix: SettingsService GetString/GetBool/GetInt and GetResolvedString use different precedence

  bug
  Bug

  ericfitz/tmi#1168 · Filter by author ericfitz opened on Nov 13, 2026

• fix: config drift check and dbtool strip classify by YAML path, missing two renamed settings

  bug
  Bug

  ericfitz/tmi#1167 · Filter by author ericfitz opened on Nov 13, 2026

• fix: settings Explicit detection misses YAML-file values when the setting key differs from its YAML path

  apibug
  Bug

  ericfitz/tmi#1166 · Filter by author ericfitz opened on Nov 13, 2026

• chore: reconcile timmy.* setting mutability labels with their runtime DB readers

  Task

  ericfitz/tmi#1163 · Filter by author ericfitz opened on Nov 12, 2026

• fix: first-user auto-promotion fails with 'user: not found' on fresh test DB

  bug
  Bug

  ericfitz/tmi#1162 · Filter by author ericfitz opened on Nov 12, 2026

• fix: admin settings GET shows config default instead of stored value for non-explicit settings

  apibug
  Bug

  ericfitz/tmi#1161 · Filter by author ericfitz opened on Nov 12, 2026

• fix: note update response returns stale modified_at

  apibug
  ericfitz/tmi#1148 · Filter by author ericfitz opened on Nov 10, 2026

• fix(api): make bulk threat PATCH transactional and cover cross-threat-model case

  apibug
  ericfitz/tmi#1144 · Filter by author ericfitz opened on Nov 9, 2026

• fix(api): JSON Patch silently ignores valid add ops on threats, assets, documents, repositories

  apibugrfc-compliance
  ericfitz/tmi#1142 · Filter by author ericfitz opened on Nov 9, 2026

• fix: stop logging SAML response XML and NameID values

  bugsecurity
  ericfitz/tmi#1140 · Filter by author ericfitz opened on Nov 6, 2026

• fix: reject non-SAML-namespace attribute elements in SAML assertions (defense in depth)

  bugsecurity
  ericfitz/tmi#1139 · Filter by author ericfitz opened on Nov 6, 2026

• fix: mitigate GO-2026-6909 (crewjam/saml nil Issuer panic and namespace-blind NameID)

  bugdependenciessecurity
  ericfitz/tmi#1138 · Filter by author ericfitz opened on Nov 6, 2026
  1

• fix: mitigate GO-2026-6909 (crewjam/saml nil Issuer panic and namespace-blind NameID)

  bugdependenciessecurity
  ericfitz/tmi#1137 · Filter by author ericfitz opened on Nov 6, 2026
  1

• fix: integration harness never regenerates expired test TLS leaf certificates

  bug
  ericfitz/tmi#1135 · Filter by author ericfitz opened on Nov 3, 2026

• fix: integration harness never regenerates expired test TLS leaf certificates

  bug
  ericfitz/tmi#1134 · Filter by author ericfitz opened on Nov 3, 2026

• fix: dev-down leaves tmi-rotator CronJob running, which then fails nightly

  bug
  ericfitz/tmi#1130 · Filter by author ericfitz opened on Oct 30, 2026

• fix: dev-down leaves tmi-rotator CronJob running, which then fails nightly

  bug
  ericfitz/tmi#1129 · Filter by author ericfitz opened on Oct 30, 2026

• fix(api): bulk PATCH/PUT can partially commit when a store-time error hits a later entry

  apibug
  ericfitz/tmi#1120 · Filter by author ericfitz opened on Oct 18, 2026

• fix(api): shared store-error mapper can return undocumented 409 on duplicate-key errors

  apibug
  ericfitz/tmi#1118 · Filter by author ericfitz opened on Oct 18, 2026

• fix(dbtool): make setting seed writes atomic and reject non-string setting values

  bug
  ericfitz/tmi#1117 · Filter by author ericfitz opened on Oct 18, 2026

• fix(api): survey list endpoints ignore documented sort and date-range parameters

  apibug
  ericfitz/tmi#1116 · Filter by author ericfitz opened on Oct 18, 2026

• chore(auth): split saml_error by status in a future breaking change

  ericfitz/tmi#1077 · Filter by author ericfitz opened on Oct 8, 2026

• feat(websocket): adopt the documented error-code vocabulary for WebSocket messages

  enhancement
  ericfitz/tmi#1076 · Filter by author ericfitz opened on Oct 8, 2026
  1