Sync master with upstream

[OS-miguelfreitas]

Description

Motivation and Context

How Has This Been Tested?

Screenshots (if appropriate):

Checklist

My PR contains...

• No code changes (src/ is unmodified: changes to documentation, CI, metadata, etc.)
• Dependency changes (any modification to dependencies in package.json)
• Bug fixes (non-breaking change which fixes an issue)
• Improvements (misc. changes to existing features)
• Features (non-breaking change which adds functionality)

My changes...

• are breaking changes to a public API (config options, System API, major UI change, etc).
• are breaking changes to a private API (Redux, component props, utility functions, etc.).
• are breaking changes to a developer API (npm script behavior changes, new dev system dependencies, etc).
• are not breaking changes.

Documentation

• My changes do not require a change to the project documentation.
• My changes require a change to the project documentation.
• If yes to above: I have updated the documentation accordingly.

Automated tests

• My changes can not or do not need to be tested.
• My changes can and should be tested by unit and/or integration tests.
• If yes to above: I have added tests to cover my changes.
• If yes to above: I have taken care to cover edge cases in my tests.
• All new and existing tests passed.

[wiz-code-outsystems]

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	-
Sensitive Data	-
Secrets	-
IaC Misconfigurations	1  1
SAST Findings	2
Software Management Findings	-
Total	1  2  1

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try the Wiz Code extension for VS Code, JetBrains, or Visual Studio.

Pull Request Developer Guidance

Questions? See the Wiz FAQ.

Please contact the Security Office if you encounter issues with Wiz pull request scanning.

[wiz-code-outsystems]

 IaC Finding

Missing User Instruction

More Details

This rule checks whether a `USER` instruction is specified in the Dockerfile. The rule fails when the `USER` instruction is missing, causing the container to run with root privileges (UID 0). If an attacker compromises an application running as root, they gain the privileges needed to potentially escape the container and attack the host node. It also increases the blast radius of a breach, allowing full control to modify files or install malware within the container. Enforcing a non-root user is a fundamental security measure that minimizes the attack surface and contains the impact of a potential compromise.

Expected

The Dockerfile stage should contain the 'USER' instruction

Found

The Dockerfile stage does not contain any 'USER' instruction

Rule ID: 6cd7a272-d9d1-4667-8224-73140fbaabdd

To ignore this finding as an exception, reply to this conversation with #wiz_ignore reason

If you'd like to ignore this finding in all future scans, add an exception in the .wiz file (learn more) or create an Ignore Rule (learn more).

To get more details on how to remediate this issue using AI, reply to this conversation with #wiz remediate

[OS-joaomurgeiro]

Blocker: upstream renamed master → main

The sync imports that rename into every branch filter, but our default branch is still master and main does not exist in this repo. On merge:

• .github/workflows/nodejs.yml:8,10 → branches: [ main, next ]. No build, no e2e-tests on any push to or PR against our default branch. This already happened on this PR — the check list here has CodeQL, Wiz and Slack Notification but no build/e2e-tests, whereas #199 (the last PR into master) ran all five.
• .github/dependabot.yaml:25 → target-branch: "main". Dependabot stops opening GitHub Actions update PRs.
• .github/workflows/dependabot-merge.yml:5 → auto-approve/auto-merge stops firing for PRs into our default branch.
• Same rename in codeql.yml:16,19, docker-build-push*.yml:8 and the three release-swagger-ui*.yml (harmless for us — those have no credentials configured on this fork and have never been run here).

Fix: rename our branch rather than patch the filters

This fixes all of the above at once and keeps future syncs conflict-free. Checked that it's safe:

• Zero master references remain anywhere in the repo's config after this merge — everything already points at main.
• Platform only pins b11 (OutSystemsJavascriptLocations.csv:12); nothing external points at master.
• The Wiz PR checks - 2026 Q2 ruleset already includes ~DEFAULT_BRANCH, refs/heads/main and refs/heads/main*, so required checks survive the rename.
• b11's workflows do reference master, but only in filters that never matched b11-targeted events — unaffected either way.

Order of actions

1. Rename the default branch master → main (Settings → Branches). GitHub retargets all open PRs, transfers protection, and sets up redirects.

2. Re-trigger this PR. The rename retargets it to main but does not re-fire pull_request workflows. Push to sync-master-with-upstream (or close/reopen) so nodejs.yml matches and build + the four e2e-tests shards actually run.

3. Merge once CI is green.

4. Have everyone update their local clones:

   git branch -m master main && git fetch origin && git branch -u origin/main main && git remote set-head origin -a