[pull] main from KelvinTegelaar:main

.github/workflows/Close_Stale_Issues.yml

@@ -10,8 +10,8 @@ jobs:
     steps:
       - uses: actions/stale@v10
         with:
-          stale-issue-message: "This issue is stale because it has been open 10 days with no activity. We will close this issue soon. If you want this feature implemented you can contribute it. See: https://docs.cipp.app/dev-documentation/contributing-to-the-code . Please notify the team if you are working on this yourself."
-          close-issue-message: "This issue was closed because it has been stalled for 14 days with no activity."
+          stale-issue-message: "This issue is stale because it has been open for 10 days with no activity. Please do not bump feature requests unless you are actively working on them, as bumps interfere with our triage process and make it harder to maintain a current list of feature requests. If you want this feature implemented, you can contribute it yourself; see https://docs.cipp.app/dev-documentation/contributing-to-the-code. Please notify the team if you are working on this."
+          close-issue-message: "This issue was closed because it has been stalled for 14 days without activity. We auto-close inactive feature requests to keep the backlog focused and actionable. If this request is still needed, you may submit it again after 30 days."
           stale-issue-label: "no-activity"
           exempt-issue-labels: "planned,bug,roadmap"
           days-before-stale: 9

.github/workflows/Node_Project_Check.yml

@@ -20,7 +20,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v6.3.0
+        uses: actions/setup-node@v6.4.0
         with:
           node-version: ${{ matrix.node-version }}
       - name: Install and Build Test

.github/workflows/cipp_dev_build.yml

@@ -26,7 +26,7 @@ jobs:
           echo "node_version=$node_sanitized_version" >> $GITHUB_OUTPUT
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6.3.0
+        uses: actions/setup-node@v6.4.0
         with:
           node-version: ${{ steps.get_node_version.outputs.node_version }}
 

.github/workflows/cipp_frontend_build.yml

@@ -26,7 +26,7 @@ jobs:
           echo "node_version=$node_sanitized_version" >> $GITHUB_OUTPUT
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6.3.0
+        uses: actions/setup-node@v6.4.0
         with:
           node-version: ${{ steps.get_node_version.outputs.node_version }}
 

.gitignore

@@ -40,3 +40,5 @@ AGENTS.md
 # azurite
 __*
 AzuriteConfig
+# Claude/Cursor worktrees and local AI tooling
+.claude/

.npmrc

@@ -0,0 +1,26 @@
+# Supply-chain hardening for CIPP
+# This file is honored by BOTH npm and yarn (yarn classic reads .npmrc).
+# Any change here should be reviewed for CI/CD impact.
+
+# Refuse to execute package lifecycle scripts (pre/postinstall, prepare, etc.)
+# on dependency install. CIPP has zero of its own lifecycle scripts in
+# package.json, so the only scripts this would block are from third-party
+# packages — exactly the attack surface we want to close.
+ignore-scripts=true
+
+# Pin the registry explicitly so an inherited per-user .npmrc cannot redirect
+# CI / contributor installs to a malicious mirror.
+registry=https://registry.npmjs.org/
+
+# Require integrity hashes (sha512) to match the lockfile on install.
+# npm honors this directly; yarn classic always verifies lockfile integrity
+# but this makes the intent explicit.
+audit-level=high
+
+# Don't auto-save changes to the lockfile from arbitrary install commands.
+# Lockfile edits should only happen via Dependabot PRs or explicit upgrades.
+save-exact=true
+
+# Disable funding/notifier noise so CI logs only show real signal.
+fund=false
+update-notifier=false

.yarnrc

@@ -0,0 +1,18 @@
+# Supply-chain hardening for CIPP (yarn 1 / classic)
+#
+# This complements .npmrc — yarn 1 honors `ignore-scripts` from .npmrc, but
+# we set the per-command equivalents here as defense in depth so the
+# protection survives even if .npmrc is missing or ignored.
+
+# Refuse to execute lifecycle scripts on `yarn install` / `yarn add` /
+# `yarn upgrade`. Mirrors `ignore-scripts=true` in .npmrc.
+--install.ignore-scripts true
+--add.ignore-scripts true
+--upgrade.ignore-scripts true
+
+# Pin the registry so a poisoned per-user .yarnrc cannot redirect installs.
+registry "https://registry.npmjs.org/"
+
+# Disable yarn's self-update check — CI should never auto-update its own
+# yarn binary mid-build.
+disable-self-update-check true

Tests/Shapes/ListTests.json

@@ -119,6 +119,7 @@
       "ExoSafeLinksRules": "number",
       "ExoSharingPolicy": "number",
       "ExoTenantAllowBlockList": "number",
+      "ExoTransportConfig": "number",
       "ExoTransportRules": "number",
       "Groups": "number",
       "Guests": "number",

next.config.js

@@ -16,6 +16,7 @@ const config = {
           'mui-tiptap',
           'recharts',
           '@react-pdf/renderer',
+          'lodash',
         ],
     webpackMemoryOptimizations: true,
     preloadEntriesOnStart: false,

package.json

@@ -1,6 +1,6 @@
 {
   "name": "cipp",
-  "version": "10.4.5",
+  "version": "10.5.0",
   "author": "CIPP Contributors",
   "homepage": "https://cipp.app/",
   "bugs": {
@@ -42,55 +42,51 @@
     "@react-pdf/renderer": "^4.3.2",
     "@reduxjs/toolkit": "^2.11.2",
     "@tanstack/query-sync-storage-persister": "^5.90.25",
-    "@tanstack/react-query": "^5.96.2",
-    "@tanstack/react-query-devtools": "^5.51.11",
-    "@tanstack/react-query-persist-client": "^5.76.0",
+    "@tanstack/react-query": "^5.100.10",
+    "@tanstack/react-query-devtools": "^5.96.2",
+    "@tanstack/react-query-persist-client": "^5.96.2",
     "@tanstack/react-table": "^8.19.2",
-    "@tiptap/core": "^3.4.1",
+    "@tiptap/core": "^3.22.3",
     "@tiptap/extension-heading": "^3.4.1",
-    "@tiptap/extension-image": "^3.20.5",
-    "@tiptap/extension-table": "^3.19.0",
+    "@tiptap/extension-table": "^3.20.5",
     "@tiptap/pm": "^3.22.3",
     "@tiptap/react": "^3.20.5",
     "@tiptap/starter-kit": "^3.20.5",
-    "@uiw/react-json-view": "^2.0.0-alpha.41",
     "@vvo/tzdb": "^6.198.0",
     "apexcharts": "5.10.4",
     "axios": "1.15.0",
     "date-fns": "4.1.0",
     "diff": "^8.0.3",
+    "dompurify": "^3.4.3",
+    "driver.js": "^1.4.0",
     "eml-parse-js": "^1.2.0-beta.0",
     "export-to-csv": "^1.3.0",
     "formik": "2.4.9",
     "gray-matter": "4.0.3",
-    "i18next": "25.8.18",
     "javascript-time-ago": "^2.6.2",
     "jspdf": "^4.2.0",
     "jspdf-autotable": "^5.0.7",
     "leaflet": "^1.9.4",
-    "leaflet-defaulticon-compatibility": "^0.1.2",
     "leaflet.markercluster": "^1.5.3",
+    "lodash": "^4.18.1",
     "lodash.isequal": "4.5.0",
     "material-react-table": "^3.0.1",
     "monaco-editor": "^0.55.1",
-    "mui-tiptap": "^1.29.1",
+    "mui-tiptap": "^1.30.0",
     "next": "^16.2.2",
     "nprogress": "0.2.0",
     "numeral": "2.0.6",
     "prop-types": "15.8.1",
     "punycode": "^2.3.1",
-    "react": "19.2.5",
+    "react": "19.2.6",
     "react-apexcharts": "2.1.0",
     "react-beautiful-dnd": "13.1.1",
-    "react-copy-to-clipboard": "^5.1.0",
-    "react-dom": "19.2.5",
+    "react-dom": "19.2.6",
     "react-dropzone": "15.0.0",
     "react-error-boundary": "^6.1.1",
-    "react-grid-layout": "^2.2.3",
     "react-hook-form": "^7.72.0",
     "react-hot-toast": "2.6.0",
     "react-html-parser": "^2.0.2",
-    "react-i18next": "16.6.5",
     "react-leaflet": "5.0.0",
     "react-leaflet-markercluster": "^5.0.0-rc.0",
     "react-markdown": "10.1.0",
@@ -101,28 +97,23 @@
     "react-syntax-highlighter": "^16.1.0",
     "react-time-ago": "^7.3.3",
     "react-virtuoso": "^4.18.5",
-    "react-window": "^2.2.7",
-    "recharts": "^3.7.0",
+    "recharts": "^3.8.1",
     "redux": "5.0.1",
-    "redux-devtools-extension": "2.13.9",
     "redux-persist": "^6.0.0",
-    "redux-thunk": "3.1.0",
     "rehype-raw": "^7.0.0",
     "remark-gfm": "^4.0.0",
+    "remark-parse": "^11.0.0",
     "simplebar": "6.3.3",
     "simplebar-react": "3.3.2",
     "stylis-plugin-rtl": "2.1.1",
-    "typescript": "5.9.3",
+    "unified": "^11.0.5",
     "yup": "1.7.1"
   },
   "devDependencies": {
     "@svgr/webpack": "8.1.0",
-    "@types/react": "^19.2.14",
-    "@types/react-dom": "^19.2.3",
     "eslint": "^9.39.4",
     "eslint-config-next": "^16.2.3",
     "eslint-config-prettier": "^10.1.8",
-    "prettier": "^3.8.1",
-    "prettier-eslint": "^16.4.2"
+    "prettier": "^3.8.1"
   }
 }

public/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "10.4.5"
+  "version": "10.5.0"
 }

src/components/CippCards/CippExchangeInfoCard.jsx

@@ -247,7 +247,9 @@ export const CippExchangeInfoCard = (props) => {
                   <>
                     <Grid size={{ xs: 12, md: 6 }}>
                       <Typography variant="inherit" color="text.primary" gutterBottom>
-                        Auto Expanding Archive:
+                        {exchangeData?.AutoExpandingArchiveScope === 'Organization'
+                          ? 'Auto Expanding Archive: (org)'
+                          : 'Auto Expanding Archive:'}
                       </Typography>
                       <Typography variant="inherit">
                         {getCippFormatting(

src/components/CippCards/CippPropertyListCard.jsx

@@ -15,6 +15,7 @@ import { PropertyListItem } from "../../components/property-list-item";
 import { useDialog } from "../../hooks/use-dialog";
 import { CippApiDialog } from "../CippComponents/CippApiDialog";
 import { useState } from "react";
+import { getIconByName } from "../../utils/icon-registry";
 
 export const CippPropertyListCard = (props) => {
   const {
@@ -51,6 +52,12 @@ export const CippPropertyListCard = (props) => {
     return false;
   };
 
+  const renderActionIcon = (icon) => {
+    if (!icon) return null;
+    if (typeof icon === "string") return getIconByName(icon, { fontSize: "small" });
+    return <SvgIcon fontSize="small">{icon}</SvgIcon>;
+  };
+
   return (
     <>
       <Card sx={cardSx} {...other}>
@@ -160,7 +167,7 @@ export const CippPropertyListCard = (props) => {
             actionItems.map((item, index) => (
               <ActionListItem
                 key={`${item.label}-${index}-ActionList-OffCanvas`}
-                icon={<SvgIcon fontSize="small">{item.icon}</SvgIcon>}
+                icon={renderActionIcon(item.icon)}
                 label={item.label}
                 onClick={() => {
                   setActionData({

src/components/CippCards/CippRemediationCard.jsx

@@ -1,13 +1,13 @@
-import { Button, Typography, List, ListItem, SvgIcon } from "@mui/material";
-import CippButtonCard from "./CippButtonCard"; // Adjust the import path as needed
-import { CippApiDialog } from "../CippComponents/CippApiDialog";
-import { useDialog } from "../../hooks/use-dialog";
-import { Sync } from "@mui/icons-material";
-import { ShieldCheckIcon } from "@heroicons/react/24/outline";
+import { Button, Typography, List, ListItem, SvgIcon } from '@mui/material'
+import CippButtonCard from './CippButtonCard' // Adjust the import path as needed
+import { CippApiDialog } from '../CippComponents/CippApiDialog'
+import { useDialog } from '../../hooks/use-dialog'
+import { Sync } from '@mui/icons-material'
+import { ShieldCheckIcon } from '@heroicons/react/24/outline'
 
 export default function CippRemediationCard(props) {
-  const { userPrincipalName, isFetching, userId, tenantFilter, restartProcess } = props;
-  const createDialog = useDialog();
+  const { userPrincipalName, isFetching, userId, tenantFilter, restartProcess } = props
+  const createDialog = useDialog()
   return (
     <CippButtonCard
       title={
@@ -60,20 +60,21 @@ export default function CippRemediationCard(props) {
         <ListItem>Disconnect all current sessions</ListItem>
         <ListItem>Remove all MFA methods for the user</ListItem>
         <ListItem>Disable all inbox rules for the user</ListItem>
+        <ListItem>Disable OneDrive sharing</ListItem>
       </List>
       <CippApiDialog
         title="Remediate User"
         createDialog={createDialog}
         api={{
-          url: "/api/execBecRemediate",
+          url: '/api/execBecRemediate',
           confirmText:
-            "This will remediate this user, blocking their signin, resetting their password, disconnecting their sessions, and disabling all their inbox rules. Are you sure you want to continue?",
-          type: "POST",
-          data: { tenantFilter: tenantFilter, userId: "userId", username: "userPrincipalName" },
-          replacementBehaviour: "removeNulls",
+            'This will remediate this user, blocking their signin, resetting their password, disconnecting their sessions, and disabling all their inbox rules. Are you sure you want to continue?',
+          type: 'POST',
+          data: { tenantFilter: tenantFilter, userId: 'userId', username: 'userPrincipalName' },
+          replacementBehaviour: 'removeNulls',
         }}
         row={props}
       />
     </CippButtonCard>
-  );
+  )
 }

src/components/CippCards/CippStandardsDialog.jsx

@@ -1,5 +1,5 @@
 import React, { useState } from 'react'
-import _ from 'lodash'
+import { get } from 'lodash'
 import {
   Dialog,
   DialogTitle,
@@ -311,7 +311,7 @@ export const CippStandardsDialog = ({ open, onClose, standardsData, currentTenan
                                       </Typography>
                                       <Stack spacing={0.5}>
                                         {info.addedComponent.map((component, componentIndex) => {
-                                          const value = _.get(templateItem, component.name)
+                                          const value = get(templateItem, component.name)
                                           let displayValue = 'N/A'
 
                                           if (value) {
@@ -427,7 +427,7 @@ export const CippStandardsDialog = ({ open, onClose, standardsData, currentTenan
                                         let extractedValue = null
 
                                         // Try direct access first
-                                        componentValue = _.get(config, component.name)
+                                        componentValue = get(config, component.name)
 
                                         // If direct access fails and component name contains dots (nested structure)
                                         if (
@@ -441,7 +441,7 @@ export const CippStandardsDialog = ({ open, onClose, standardsData, currentTenan
                                           if (pathParts[0] === 'standards' && config.standards) {
                                             // Remove 'standards.' prefix and try to find the value in config.standards
                                             const nestedPath = pathParts.slice(1).join('.')
-                                            extractedValue = _.get(config.standards, nestedPath)
+                                            extractedValue = get(config.standards, nestedPath)
 
                                             // If still not found, try alternative nested structures
                                             // Some standards have double nesting like: config.standards.StandardName.fieldName
@@ -452,7 +452,7 @@ export const CippStandardsDialog = ({ open, onClose, standardsData, currentTenan
                                             ) {
                                               const standardName = pathParts[1]
                                               const fieldPath = pathParts.slice(2).join('.')
-                                              extractedValue = _.get(
+                                              extractedValue = get(
                                                 config.standards,
                                                 `${standardName}.${fieldPath}`
                                               )