Merge branch 'KelvinTegelaar:main' into main

Author: luke255

.github/workflows/cipp_dev_build.yml

@@ -54,7 +54,7 @@ jobs:
 
       # Upload to Azure Blob Storage
       - name: Azure Blob Upload
-        uses: LanceMcCarthy/Action-AzureBlobUpload@v3.11.0
+        uses: LanceMcCarthy/Action-AzureBlobUpload@v3.12.0
         with:
           connection_string: ${{ secrets.AZURE_CONNECTION_STRING }}
           container_name: cipp

.github/workflows/cipp_frontend_build.yml

@@ -54,7 +54,7 @@ jobs:
 
       # Upload to Azure Blob Storage
       - name: Azure Blob Upload
-        uses: LanceMcCarthy/Action-AzureBlobUpload@v3.11.0
+        uses: LanceMcCarthy/Action-AzureBlobUpload@v3.12.0
         with:
           connection_string: ${{ secrets.AZURE_CONNECTION_STRING }}
           container_name: cipp

package.json

@@ -1,6 +1,6 @@
 {
   "name": "cipp",
-  "version": "10.5.2",
+  "version": "10.5.5",
   "author": "CIPP Contributors",
   "homepage": "https://cipp.app/",
   "bugs": {
@@ -16,7 +16,7 @@
   },
   "scripts": {
     "dev": "next -H 127.0.0.1",
-    "build": "next build --webpack && rm -rf package.json yarn.lock",
+    "build": "node scripts/skip-export-build-traces.mjs && next build --webpack && rm -rf package.json yarn.lock",
     "start": "next start",
     "export": "next export",
     "lint": "npx eslint .",
@@ -40,10 +40,10 @@
     "@nivo/core": "^0.99.0",
     "@nivo/sankey": "^0.99.0",
     "@react-pdf/renderer": "^4.5.1",
-    "@reduxjs/toolkit": "^2.11.2",
+    "@reduxjs/toolkit": "^2.12.0",
     "@tanstack/query-sync-storage-persister": "^5.90.25",
     "@tanstack/react-query": "^5.100.10",
-    "@tanstack/react-query-devtools": "^5.96.2",
+    "@tanstack/react-query-devtools": "^5.100.10",
     "@tanstack/react-query-persist-client": "^5.96.2",
     "@tanstack/react-table": "^8.19.2",
     "@tiptap/core": "^3.22.3",
@@ -53,11 +53,11 @@
     "@tiptap/react": "^3.20.5",
     "@tiptap/starter-kit": "^3.20.5",
     "@vvo/tzdb": "^6.198.0",
-    "apexcharts": "5.10.4",
+    "apexcharts": "5.14.0",
     "axios": "1.16.1",
     "date-fns": "4.1.0",
     "diff": "^8.0.3",
-    "dompurify": "^3.4.3",
+    "dompurify": "^3.4.9",
     "driver.js": "^1.4.0",
     "eml-parse-js": "^1.2.0-beta.0",
     "export-to-csv": "^1.3.0",
@@ -72,7 +72,7 @@
     "lodash.isequal": "4.5.0",
     "material-react-table": "^3.0.1",
     "monaco-editor": "^0.55.1",
-    "mui-tiptap": "^1.30.0",
+    "mui-tiptap": "^1.31.0",
     "next": "^16.2.2",
     "nprogress": "0.2.0",
     "numeral": "2.0.6",

src/data/intuneCollection.json public/intuneCollection.jsonsrc/data/intuneCollection.json renamed to public/intuneCollection.json

@@ -1,3 +1,3 @@
 {
-  "version": "10.5.2"
+  "version": "10.5.5"
 }

public/version.json

@@ -0,0 +1,41 @@
+// Workaround for a Next.js 16 build-time waste on `output: 'export'` builds.
+//
+// Next traces server-side file dependencies with @vercel/nft ("Collecting build traces") on every
+// webpack build. For a static export there is NO server runtime, so that trace is never used — yet it
+// costs roughly HALF the build wall-clock (measured ~256s; the single biggest serial phase, and on a
+// 2-core CI runner it stacks on top of static generation). Next 14 let you skip it with
+// `outputFileTracing: false`; Next 15+ removed that option and ships no replacement.
+//
+// This idempotently patches the installed Next build to gate the NFT step on `config.output !== 'export'`
+// — exactly what the old flag did. It's safe: the trace result is never consumed for an export build
+// (only `output: 'standalone'` reads it), and Next already does `await buildTracesPromise` where an
+// unset (undefined) promise is a no-op. Run it immediately before `next build`. Re-running is harmless.
+// Remove once Next skips build traces for `output: 'export'` upstream (track: vercel/next.js).
+import { readFileSync, writeFileSync } from "node:fs";
+import { createRequire } from "node:module";
+
+const require = createRequire(import.meta.url);
+
+let target;
+try {
+  target = require.resolve("next/dist/build/index.js");
+} catch {
+  console.warn("[skip-export-traces] next/dist/build/index.js not resolvable — skipping (build still works)");
+  process.exit(0);
+}
+
+const NEEDLE = "!isGenerateMode && !buildTracesPromise) {";
+const PATCHED = "!isGenerateMode && !buildTracesPromise && config.output !== 'export') {";
+
+let src = readFileSync(target, "utf8");
+if (src.includes(PATCHED)) {
+  console.log("[skip-export-traces] already patched — Next will skip build traces for output: export");
+} else if (src.includes(NEEDLE)) {
+  writeFileSync(target, src.replace(NEEDLE, PATCHED));
+  console.log("[skip-export-traces] patched: Next will skip @vercel/nft build traces for output: export");
+} else {
+  console.warn(
+    "[skip-export-traces] WARNING: patch site not found — Next internals changed for this version. " +
+      "Build proceeds unpatched (just slower). Re-verify the gate in next/dist/build/index.js."
+  );
+}

scripts/skip-export-build-traces.mjs

@@ -36,7 +36,7 @@ import {
   ExpandMore as ExpandMoreIcon,
 } from '@mui/icons-material'
 import { SvgIcon } from '@mui/material'
-import standards from '../../data/standards.json'
+import { getStandards } from '../../utils/standards-data'
 
 const getCategoryIcon = (category) => {
   switch (category) {
@@ -136,7 +136,7 @@ export const CippStandardsDialog = ({ open, onClose, standardsData, currentTenan
   let totalStandardsCount = 0
 
   Object.entries(combinedStandards).forEach(([standardKey, standardConfig]) => {
-    const standardInfo = standards.find((s) => s.name === `standards.${standardKey}`)
+    const standardInfo = getStandards().find((s) => s.name === `standards.${standardKey}`)
     if (standardInfo) {
       const category = standardInfo.cat
       if (!standardsByCategory[category]) {

src/components/CippCards/CippStandardsDialog.jsx

@@ -16,8 +16,23 @@ export const AuthMethodCard = ({ data, isLoading }) => {
       return null;
     }
 
-    const phishableMethods = ["mobilePhone", "email", "microsoftAuthenticatorPush"];
-    const phishResistantMethods = ["fido2", "windowsHelloForBusiness", "x509Certificate"];
+    const phishableMethods = [
+      "mobilePhone",
+      "alternateMobilePhone",
+      "officePhone",
+      "email",
+      "microsoftAuthenticatorPush",
+      "softwareOneTimePasscode",
+      "hardwareOneTimePasscode",
+    ];
+    const passkeyMethods = [
+      "fido2SecurityKey",
+      "passKeyDeviceBound",
+      "passKeyDeviceBoundAuthenticator",
+      "passKeyDeviceBoundWindowsHello",
+      "x509Certificate",
+    ];
+    const phishResistantMethods = [...passkeyMethods, "windowsHelloForBusiness"];
 
     let singleFactor = 0;
     let phishableCount = 0;
@@ -48,20 +63,26 @@ export const AuthMethodCard = ({ data, isLoading }) => {
 
       if (hasPhishResistant) {
         phishResistantCount++;
-        if (methods.includes("fido2") || methods.includes("x509Certificate")) {
+        if (methods.some((m) => passkeyMethods.includes(m))) {
           passkeyCount++;
         }
         if (methods.includes("windowsHelloForBusiness")) {
           whfbCount++;
         }
       } else if (hasPhishable) {
         phishableCount++;
-        if (methods.includes("mobilePhone") || methods.includes("email")) {
+        if (
+          methods.includes("mobilePhone") ||
+          methods.includes("alternateMobilePhone") ||
+          methods.includes("officePhone") ||
+          methods.includes("email")
+        ) {
           phoneCount++;
         }
         if (
           methods.includes("microsoftAuthenticatorPush") ||
-          methods.includes("softwareOneTimePasscode")
+          methods.includes("softwareOneTimePasscode") ||
+          methods.includes("hardwareOneTimePasscode")
         ) {
           authenticatorCount++;
         }

src/components/CippComponents/AuthMethodCard.jsx

@@ -13,9 +13,23 @@ export const AuthMethodSankey = ({ data }) => {
     return null;
   }
 
-  // Categorize MFA methods as phishable or phish-resistant
-  const phishableMethods = ["mobilePhone", "email", "microsoftAuthenticatorPush"];
-  const phishResistantMethods = ["fido2", "windowsHelloForBusiness", "x509Certificate"];
+  const phishableMethods = [
+    "mobilePhone",
+    "alternateMobilePhone",
+    "officePhone",
+    "email",
+    "microsoftAuthenticatorPush",
+    "softwareOneTimePasscode",
+    "hardwareOneTimePasscode",
+  ];
+  const passkeyMethods = [
+    "fido2SecurityKey",
+    "passKeyDeviceBound",
+    "passKeyDeviceBoundAuthenticator",
+    "passKeyDeviceBoundWindowsHello",
+    "x509Certificate",
+  ];
+  const phishResistantMethods = [...passkeyMethods, "windowsHelloForBusiness"];
 
   let singleFactor = 0;
   let phishableCount = 0;
@@ -54,21 +68,26 @@ export const AuthMethodSankey = ({ data }) => {
     if (hasPhishResistant) {
       phishResistantCount++;
       // Count specific phish-resistant methods
-      if (methods.includes("fido2") || methods.includes("x509Certificate")) {
+      if (methods.some((m) => passkeyMethods.includes(m))) {
         passkeyCount++;
       }
       if (methods.includes("windowsHelloForBusiness")) {
         whfbCount++;
       }
     } else if (hasPhishable) {
       phishableCount++;
-      // Count specific phishable methods
-      if (methods.includes("mobilePhone") || methods.includes("email")) {
+      if (
+        methods.includes("mobilePhone") ||
+        methods.includes("alternateMobilePhone") ||
+        methods.includes("officePhone") ||
+        methods.includes("email")
+      ) {
         phoneCount++;
       }
       if (
         methods.includes("microsoftAuthenticatorPush") ||
-        methods.includes("softwareOneTimePasscode")
+        methods.includes("softwareOneTimePasscode") ||
+        methods.includes("hardwareOneTimePasscode")
       ) {
         authenticatorCount++;
       }