Backlog/v12 instance setup

[AlexSanchez-bit]

No description provided.

[github-actions]

🛑 AI review — Sensitive area, extra care recommended

This PR touches critical paths or introduces changes the model cannot judge with sufficient confidence. Review carefully before merging.

🛑 architecture (gemini-3-flash-lite) — high/critical — please review

Summary: Changes to installer and default bootstrap values without backwards compatibility considerations.

• high installer/services/postgres.go:78 — Direct modification of the default email check in the installer script touches installer/ and alters user handling logic. Ensure existing installations or upgrades correctly handle the shift from 'admin@localhost' to 'admin' without locking out administrators.

🛑 bugs (gemini-3-flash-lite) — high/critical — please review

Summary: Changed default admin identifier from an email format to 'admin', but database queries, validations, and constraints still expect a valid email address.

• high backend/main.go:41 — Changed default admin email fallback to 'admin', which is not a valid email address. This will likely fail database validation or downstream features (like alert notifications and threat-intel registration) that expect a valid email format for the admin user.
• high frontend/src/features/onboarding/AdminSetupGate.tsx:13 — DEFAULT_ADMIN_EMAIL changed to 'admin', but EMAIL_RE validation (line 21) still checks for a valid email structure. If the backend creates 'admin', the onboarding gate may fail to recognize it needs setup or fail validation.

🛑 security (gemini-3-flash-lite) — high/critical — please review

Summary: Changed default admin email placeholder from admin@localhost to admin, breaking email validation and SQL exclusion in postgres.go.

• medium installer/services/postgres.go:78 — The SQL query filters out u.email <> 'admin', but since the default is no longer a valid email format, email validation regex checks in frontend/backend may incorrectly handle or reject this value, or allow an invalid email to bypass setup gates. Ensure proper email validation and string matching.

🔴 go-deps — pending updates

🔍 Discovered 30 Go projects

📦 Dependencies with updates available:

  📁 ./plugins/crowdstrike:
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.31

  📁 ./plugins/azure:
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.31

  📁 ./plugins/soc-ai:
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.31

  📁 ./plugins/events:
     - github.com/threatwinds/go-sdk: v1.1.27-0.20260811073440-251cb9d842cd → v1.1.31

  📁 ./plugins/gcp:
     - cloud.google.com/go/pubsub: v1.51.0 → v1.51.1
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.31

  📁 ./plugins/bitdefender:
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.31

  📁 ./plugins/o365:
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.31

  📁 ./plugins/rule-flood-guard:
     - github.com/threatwinds/go-sdk: v1.1.27-0.20260811073440-251cb9d842cd → v1.1.31

  📁 ./plugins/stats:
     - github.com/threatwinds/go-sdk: v1.1.27-0.20260811073440-251cb9d842cd → v1.1.31

  📁 ./plugins/feeds:
     - github.com/threatwinds/go-sdk: v1.1.27-0.20260811073440-251cb9d842cd → v1.1.31

  📁 ./plugins/geolocation:
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.31

  📁 ./plugins/playground:
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.31

  📁 ./plugins/soar:
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.31

  📁 ./plugins/sophos:
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.31

  📁 ./plugins/alerts:
     - github.com/threatwinds/go-sdk: v1.1.27-0.20260811073440-251cb9d842cd → v1.1.31

  📁 ./plugins/aws:
     - github.com/aws/aws-sdk-go-v2: v1.43.6 → v1.43.7
     - github.com/aws/aws-sdk-go-v2/config: v1.32.37 → v1.32.38
     - github.com/aws/aws-sdk-go-v2/credentials: v1.19.36 → v1.19.37
     - github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs: v1.82.2 → v1.82.3
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.31

  📁 ./log-input:
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.31
     - google.golang.org/grpc: v1.83.0 → v1.83.1

  📁 ./backend:
     - cloud.google.com/go/pubsub: v1.51.0 → v1.51.1
     - github.com/aws/aws-sdk-go-v2/config: v1.32.36 → v1.32.38
     - github.com/aws/aws-sdk-go-v2/credentials: v1.19.35 → v1.19.37
     - github.com/aws/aws-sdk-go-v2/service/sts: v1.45.5 → v1.45.7
     - google.golang.org/grpc: v1.83.0 → v1.83.1

  📁 ./collectors/collector:
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.31
     - google.golang.org/grpc: v1.83.0 → v1.83.1

  📁 ./collectors/forwarder:
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.31
     - google.golang.org/grpc: v1.83.0 → v1.83.1

  📁 ./collectors/as400:
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.31
     - google.golang.org/grpc: v1.83.0 → v1.83.1

  📁 ./collectors/utmstack:
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.31
     - google.golang.org/grpc: v1.83.0 → v1.83.1

  📁 ./tools/rulecheck:
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.31

  📁 ./agent-manager:
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.31
     - google.golang.org/grpc: v1.83.0 → v1.83.1

  📁 ./agent:
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.31
     - google.golang.org/grpc: v1.83.0 → v1.83.1

❌ Please update dependencies before merging.