Issues

• ci: a Codecov outage fails every test job even though the tests pass

  OpenSPP/OpenSPP2#587 · Filter by author gonzalesedwin1123 opened on Oct 5, 2026

• spp_base_common: the form "New" button ignores canCreate

  bug
  OpenSPP/OpenSPP2#582 · Filter by author reichie020212 opened on Oct 2, 2026
  

• spp_api_v2 / spp_dci_server: the Require consent checkbox no longer matches how consent is decided

  OpenSPP/OpenSPP2#579 · Filter by author gonzalesedwin1123 opened on Sep 29, 2026

• test: check that every spp_* module's JS imports resolve on the backend test page

  OpenSPP/OpenSPP2#578 · Filter by author gonzalesedwin1123 opened on Sep 29, 2026

• security(spp_api_v2): search next offsets are database positions, so consent-filtered clients can count hidden records [Severity: Low/Medium]

  bug
  OpenSPP/OpenSPP2#576 · Filter by author gonzalesedwin1123 opened on Sep 28, 2026

• security(spp_api_v2): POST /Individual/_search and /Group/_search skip scope checks and the consent total rule; the endpoint returns nothing [Severity: Medium, latent]

  bug
  OpenSPP/OpenSPP2#575 · Filter by author gonzalesedwin1123 opened on Sep 28, 2026

• spp_api_v2: paging and logging follow-ups from #554 (/_search paging, prev links, Program cursor, error logs, PII)

  bug
  OpenSPP/OpenSPP2#574 · Filter by author gonzalesedwin1123 opened on Sep 28, 2026

• spp_api_v2_service_points: duplicate names resolve arbitrarily; unencoded links; double-decoded path; unvalidated _lastUpdated

  bug
  OpenSPP/OpenSPP2#573 · Filter by author gonzalesedwin1123 opened on Sep 28, 2026

• spp_api_v2: ProgramMembership exitReason is dropped, re-enroll keeps exitDate, PUT bypasses the workflow; Group groupType not stored

  bug
  OpenSPP/OpenSPP2#572 · Filter by author gonzalesedwin1123 opened on Sep 28, 2026

• spp_api_v2: unknown or unsupported query parameters and PATCH fields are silently ignored

  bug
  OpenSPP/OpenSPP2#571 · Filter by author gonzalesedwin1123 opened on Sep 28, 2026

• spp_registry: a removed group member can't be re-added — "Duplication of Member" counts ended memberships

  bug
  OpenSPP/OpenSPP2#570 · Filter by author gonzalesedwin1123 opened on Sep 28, 2026

• spp_api_v2: GroupService._create_members logs identifier values (PII in logs)

  bug
  OpenSPP/OpenSPP2#566 · Filter by author gonzalesedwin1123 opened on Sep 25, 2026

• spp_api_v2: GET /Group?type= is documented and accepted but never applied

  bug
  OpenSPP/OpenSPP2#565 · Filter by author gonzalesedwin1123 opened on Sep 25, 2026

• spp_api_v2: bundle entry ETags use float seconds, not the microsecond versionId used elsewhere

  bug
  OpenSPP/OpenSPP2#564 · Filter by author gonzalesedwin1123 opened on Sep 25, 2026

• spp_api_v2: Location headers of POST /Individual, POST /Group and $split contain an unencoded '#'

  bug
  OpenSPP/OpenSPP2#563 · Filter by author gonzalesedwin1123 opened on Sep 25, 2026

• spp_api_v2_programs: program references are name slugs resolved with =ilike + limit=1 — hyphenated names never resolve, case variants can resolve to the wrong program

  bug
  OpenSPP/OpenSPP2#562 · Filter by author gonzalesedwin1123 opened on Sep 25, 2026

• spp_api_v2: If-Match is optional on PUT/PATCH although api-design.md requires it

  bug
  OpenSPP/OpenSPP2#561 · Filter by author gonzalesedwin1123 opened on Sep 25, 2026

• security(spp_api_v2_programs): POST /ProgramMembership "Beneficiary not found: <ref>" 422 reveals registrant existence [Severity: Low]

  bug
  OpenSPP/OpenSPP2#560 · Filter by author gonzalesedwin1123 opened on Sep 25, 2026

• security(spp_api_v2): "exists but no consent" 403 has no timing jitter, unlike "not found" [Severity: Low]

  bug
  OpenSPP/OpenSPP2#559 · Filter by author gonzalesedwin1123 opened on Sep 25, 2026

• security(spp_api_v2): consent is not enforced on write paths — ConsentService.check_access only checks consent for read/search [Severity: Medium]

  bug
  OpenSPP/OpenSPP2#558 · Filter by author gonzalesedwin1123 opened on Sep 25, 2026
  1

• spp_api_v2_* / spp_dci_server: identifier lookups outside spp_api_v2 still take the first match and resolve soft-removed IDs

  bug
  OpenSPP/OpenSPP2#557 · Filter by author gonzalesedwin1123 opened on Sep 25, 2026

• spp_api_v2: error responses are FastAPI {detail}, not the RFC 9457 Problem Details the API principles specify

  enhancement
  OpenSPP/OpenSPP2#556 · Filter by author gonzalesedwin1123 opened on Sep 25, 2026

• spp_cel_widget: the 10 cel_widget tours have no runner and target spp_programs menus that do not exist in OpenSPP2

  OpenSPP/OpenSPP2#553 · Filter by author gonzalesedwin1123 opened on Sep 24, 2026

• spp_cel_domain: finish the ADR-017 migration of the not-fresh metric() path and drop the remaining legacy spp.indicator probes

  OpenSPP/OpenSPP2#540 · Filter by author gonzalesedwin1123 opened on Sep 21, 2026

• spp_studio_change_requests: Studio-generated detail models get neither the post-submit freeze nor the registrant prefill

  OpenSPP/OpenSPP2#539 · Filter by author gonzalesedwin1123 opened on Sep 21, 2026