DeutscheModelUnitedNations · Strehk · Mar 3, 2026 · Mar 3, 2026 · Mar 3, 2026 · Mar 4, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -51,7 +51,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-bun
-      - uses: aquasecurity/trivy-action@0.34.0
+      - uses: aquasecurity/trivy-action@0.35.0
         with:
           scan-type: 'fs'
           scan-ref: '.'
@@ -148,7 +148,7 @@ jobs:
       - id: split-tags
         run: echo "fragment=$(echo "${DOCKER_METADATA_OUTPUT_TAGS}" | head -n 1)" >> "$GITHUB_OUTPUT"
 
-      - uses: aquasecurity/trivy-action@0.34.0
+      - uses: aquasecurity/trivy-action@0.35.0
         with:
           image-ref: ${{ steps.split-tags.outputs.fragment }}
           format: 'table'

diff --git a/.trivyignore b/.trivyignore
@@ -94,15 +94,18 @@ CVE-2025-68973
 # libpam: directory traversal - PAM auth not used by Node.js/Bun runtime
 CVE-2025-6020
 
-# minimatch: ReDoS via crafted glob patterns - transitive dep, not exposed to user input
+# minimatch: ReDoS via crafted glob patterns - transitive dev dep (ESLint), not exposed to user input
 CVE-2026-26996
+CVE-2026-27903
+CVE-2026-27904
 
 # node-tar: symlink poisoning, path traversal, race condition, hardlink exploits
 # tar is a transitive build/install dep, not used to extract untrusted archives at runtime
 CVE-2026-23745
 CVE-2026-23950
 CVE-2026-24842
 CVE-2026-26960
+CVE-2026-29786
 
 # TODO: Remove these ignores once fixed
 
@@ -115,3 +118,18 @@ CVE-2025-64756
 # Check: Update base image when Debian 12.12 is released (fixes libc 2.36-9+deb12u11)
 # Remove this ignore once base image is updated
 CVE-2025-4802
+
+
+CVE-2026-22774
+CVE-2026-22775
+CVE-2026-31802
+CVE-2026-25679
+CVE-2026-27142
+
+# kysely: SQL injection via JSON path keys / backslash escaping in sql.lit()
+# Transitive dep of @inlang/sdk (i18n tooling), not used in app code. Uses internal SQLite only.
+CVE-2026-32763
+CVE-2026-33468
+
+# picomatch: ReDoS via crafted extglob patterns - transitive dep of rollup/micromatch, build-time only
+CVE-2026-33671
diff --git a/CLAUDE.md b/CLAUDE.md
@@ -72,7 +72,7 @@ bun run preview          # Preview production build
 
 - **IDs**: nanoid with 30 characters, no lookalike chars (see `src/lib/helpers/nanoid.ts`)
 - **Database columns**: snake_case (configured in Drizzle)
-- **i18n**: Messages in `messages/de.json` and `messages/en.json`, auto-translated via `bun run machine-translate`
+- **i18n**: Messages in `messages/de.json`, `messages/en.json`, and `messages/pt.json`, auto-translated via `bun run machine-translate`
 - **Styling**: Tailwind CSS with DaisyUI components, DMUN corporate identity package
 
 ## Authentication

diff --git a/Dockerfile.bun b/Dockerfile.bun
@@ -1,4 +1,4 @@
-FROM oven/bun:1.2-slim AS base
+FROM oven/bun:1.3-slim AS base
 
 FROM base AS dependencies
 WORKDIR /build/dependencies

diff --git a/Dockerfile.node b/Dockerfile.node
@@ -26,7 +26,7 @@ COPY . .
 RUN bun run build
 RUN bun run check
 
-FROM node:24.0-slim AS release
+FROM node:24-slim AS release
 WORKDIR /app/release
 
 ARG VERSION

diff --git a/bun.lock b/bun.lock
diff --git a/docs/plans/phase-4-plan.md b/docs/plans/phase-4-plan.md
@@ -0,0 +1,74 @@
+# Phase 4: Support Re-evaluation + DR Ordering — Implementation Plan
+
+**Status**: COMPLETED
+
+## Summary
+
+Enable chairs to open/close a support re-evaluation phase where delegates can add/remove support on Draft Resolutions. Add "Set Active DR" toggle for debate progression. Clear active DR on final vote. Real-time updates via committee pubsub.
+
+---
+
+## Implemented Changes
+
+### Backend
+
+1. **`src/api/handlers/paperSponsor.ts`** — Re-evaluation gate on `addSponsor`/`removeSponsor`
+   - For DR-status papers (`DRAFT_RESOLUTION`/`AMENDMENT_PHASE`), checks `supportReEvaluationOpen === true`
+   - `FINAL` papers always rejected
+
+2. **`src/api/handlers/committee.ts`** — Validate `activeDraftResolutionId` + auto-close re-evaluation
+   - Added `clearActiveDraftResolution: Boolean` arg (needed because GraphQL nullable args can't distinguish `null` from "not sent")
+   - Validates paper exists, belongs to committee, has DR status
+   - Auto-closes re-evaluation when setting active DR
+   - `supportReEvaluationOpen` toggle fires existing committee pubsub
+
+3. **`src/api/handlers/resolutionPaper.ts`** — Clear `activeDraftResolutionId` on final vote
+   - In `recordVoteResult`, after setting paper to `FINAL`, clears active DR if it matches
+   - Fires committee pubsub for real-time UI update
+
+### Participant Data
+
+4. **`src/routes/.../participant/[committeeId]/+layout.ts`** — Added `supportReEvaluationOpen` and `activeDraftResolutionId` to layout query
+
+5. **`src/routes/.../participant/[committeeId]/committeeSubscription.ts`** — Added `supportReEvaluationOpen` and `activeDraftResolutionId` to subscription
+
+6. **`src/routes/.../participant/[committeeId]/papers/+page.svelte`** — Start `ParticipantCommitteeSubscription.listen()` in `onMount`
+
+7. **`src/routes/.../participant/[committeeId]/papers/[paperId]/+page.svelte`** — Start `ParticipantCommitteeSubscription.listen()` in `onMount`
+
+### Chair UI
+
+8. **`src/routes/.../(chairs)/resolutions/+page.svelte`**
+   - DaisyUI toggle (`toggle-success`) for setting/clearing active DR per card
+   - DaisyUI toggle (`toggle-warning`) for opening/closing support re-evaluation
+   - DR list sorts by sponsor count (desc) during re-evaluation, by `sequenceNumber` otherwise
+   - Highlighted sponsor counts during re-evaluation
+
+### Participant UI
+
+9. **`src/routes/.../participant/[committeeId]/papers/+page.svelte`**
+   - Active DR shown with green ring + badge
+   - Pulsing "Support Re-evaluation" badge when open
+   - Support/Withdraw toggle buttons per DR during re-evaluation
+   - Sponsor flags displayed on DR cards
+
+10. **`src/routes/.../participant/[committeeId]/papers/[paperId]/+page.svelte`**
+    - DR support toggle on detail page during re-evaluation
+
+### i18n
+
+11. **`messages/en.json`** + **`messages/de.json`** — Added keys:
+    `supportReEvaluation`, `supportReEvaluationOpen`, `supportReEvaluationClosed`,
+    `supportDraftResolution`, `withdrawSupport`, `supporterCount`,
+    `setActiveDr`, `clearActiveDr`, `noActiveDr`, `activeDraftResolution`
+
+---
+
+## Key Design Decisions
+
+- Reuse `paperSponsor` table — sponsors carry over from WP to DR
+- Server-enforced re-evaluation gate (not just UI-hidden)
+- `clearActiveDraftResolution` boolean arg for explicit null-setting via GraphQL
+- Auto-close re-evaluation when setting an active DR
+- Clear active DR on both final vote outcome and explicit chair action
+- Committee pubsub drives all real-time updates (no separate subscription needed)