Summary

This release hardens the public IP retrieval mechanism, resolves WCAG 2.1 AA accessibility issues in the admin UI, addresses multiple CVEs / Dependabot alerts across runtime and test dependencies, and refreshes contributor / AI assistant documentation.

---

Highlights

Security & Robustness

• Hardened public IP fetch (65aacad): switched from http://checkip.amazonaws.com to HTTPS, added connect/read timeouts, bounded the response read, and added strict IP address validation before returning the value. Prevents hangs on slow networks and rejects malformed responses.
• CVE fix (b03d58a): upgraded systeminformation from 5.31.5 to 5.31.6 via a Yarn resolutions override.
• Dependabot alert #44 (94e80fd): upgraded @babel/plugin-transform-modules-systemjs to 7.29.4.
• Dependabot alert #31 (944c291): upgraded ip-address to 10.2.0.
• Additional dependency bumps: fast-uri 3.1.0 → 3.1.2 (runtime + tests), postcss 8.5.9 → 8.5.14, axios 1.15.0 → 1.16.0 (tests), follow-redirects 1.15.11 → 1.16.0 (tests), webpack 5.94.0 → 5.104.1 (tests).
• Security policy revised (b22ae6c, 992745f) with updated reporting instructions and a Copilot Autofix.
• Added dependabot.yml for ongoing version-update automation (b691f35).

Accessibility (WCAG 2.1 AA)

• bc32445 — initial pass: resolved WCAG 2.1 AA accessibility issues in the admin UI.
• b5c5cd9 — resolved MAJOR-1 through MAJOR-4, MINOR-2 and MINOR-7 findings.
• 8d0be3e — hardened ipLabel contrast by dropping the theme token dependency to ensure reliable contrast ratio.

Code Quality

• SonarQube improvements (1de1a2d).
• Lint fixes on Cypress tests (460ebd8).

Documentation / Tooling

• Added AI assistant context (a950236) and renamed CLAUDE.md to AGENTS.md while keeping a CLAUDE.md pointer (d4403fb).

---

Functional Scope (unchanged)

• Single GraphQL query whatIsMyPublicServerIp (admin permission required) — returns the public IP string as observed by checkip.amazonaws.com.
• Admin UI route: /jahia/administration/whatIsMyPublicServerIp (read-only display).
• jahia-depends: serverSettings, graphql-dxm-provider, default.
• No new features, no API changes, no breaking changes.

---

Upgrade Notes

• Backward compatible — drop-in replacement for 2.0.2. No configuration migration required.
• Behavior change: the public IP endpoint is now reached over HTTPS (https://checkip.amazonaws.com). Environments that whitelist outbound traffic must permit TCP/443 to that host (previously TCP/80).
• On network failure, timeout, or invalid response, the query returns "unknown" (same fallback semantics as before).
• No caching — the external service is called on every query invocation.

Known Limitations (carry-over)

• checkip.amazonaws.com is an external dependency — air-gapped / firewalled servers will receive "unknown".
• No result caching — repeated UI loads trigger repeated outbound calls.
• In Docker test environments, the resolved IP reflects the host NAT/bridge, not necessarily a public internet address.

Full Changelog: 2_0_2...2_0_3