Please apply the following diffs and create a pull request.
Once the PR is ready, give it a title based on the messages of the fixes being applied.

[{"message":"Loading JavaScript from external CDN without integrity hash creates a security vulnerability. The CDN could be compromised or the script could be modified. Add integrity and crossorigin attributes to verify the script's authenticity.","fixFiles":[{"filePath":"src/services/stats/v1/index.ts","diff":"diff --git a/src/services/stats/v1/index.ts b/src/services/stats/v1/index.ts\n--- a/src/services/stats/v1/index.ts\n+++ b/src/services/stats/v1/index.ts\n@@ -223,7 +223,7 @@\n     <meta charset=\"UTF-8\">\n     <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n     <title>FOSSBilling Release Statistics</title>\n-    <script src=\"https://cdn.jsdelivr.net/npm/[email protected]/dist/chart.umd.js\"></script>\n+    <script src=\"https://cdn.jsdelivr.net/npm/[email protected]/dist/chart.umd.js\" integrity=\"sha256-w44wdlkamna5Z9JxfutBsqcJLqVY5rrBTn0xXIFXh0g=\" crossorigin=\"anonymous\"></script>\n \n     <style>\n         body {\n"}]},{"message":"The regex pattern has double-escaped backslashes which will not match intended pattern. The pattern should be /(\\d+\\.\\d+)/ instead of /(\\\\d+\\\\.\\\\d+)/ to properly match version numbers like '7.4' or '8.1'.","fixFiles":[{"filePath":"src/services/stats/v1/index.ts","diff":"diff --git a/src/services/stats/v1/index.ts b/src/services/stats/v1/index.ts\n--- a/src/services/stats/v1/index.ts\n+++ b/src/services/stats/v1/index.ts\n@@ -330,7 +330,7 @@\n         \n         function parsePhpVersion(phpVersion) {\n             if (!phpVersion || phpVersion === 'unknown') return 0;\n-            const match = phpVersion.match(/(\\\\d+\\\\.\\\\d+)/);\n+            const match = phpVersion.match(/(\\d+\\.\\d+)/);\n             return match ? parseFloat(match[1]) : 0;\n         }\n         \n"}]},{"message":"Using relative URL '/stats/v1/data' may fail if the HTML page is served from a different path or subdomain. Consider using a full URL or making the path configurable to ensure the fetch request reaches the correct endpoint.","fixFiles":[{"filePath":"src/services/stats/v1/index.ts","diff":"diff --git a/src/services/stats/v1/index.ts b/src/services/stats/v1/index.ts\n--- a/src/services/stats/v1/index.ts\n+++ b/src/services/stats/v1/index.ts\n@@ -544,7 +544,8 @@\n             showLoading();\n             \n             try {\n-                const response = await fetch('/stats/v1/data');\n+                const statsUrl = window.location.origin + '/stats/v1/data';\n+                const response = await fetch(statsUrl);\n                 \n                 if (!response.ok) {\n                     throw new Error('Failed to load statistics');\n"}]},{"message":"[nitpick] CORS policy allows requests from any origin (*) which may expose the API to unauthorized cross-origin requests. Consider restricting to specific allowed origins or implementing proper authentication if this is intentional for a public API.","fixFiles":[{"filePath":"src/services/stats/v1/index.ts","diff":"diff --git a/src/services/stats/v1/index.ts b/src/services/stats/v1/index.ts\n--- a/src/services/stats/v1/index.ts\n+++ b/src/services/stats/v1/index.ts\n@@ -20,12 +20,17 @@\n const STATS_CACHE_CONTROL = \"max-age: 86400\";\n const STATS_CACHE_TTL = 86400;\n \n+const ALLOWED_ORIGINS = [\n+  \"https://fossbilling.org\",\n+  \"https://www.fossbilling.org\"\n+];\n+\n const statsV1 = new Hono<StatsEnv>();\n \n statsV1.use(\n   \"/*\",\n   cors({\n-    origin: \"*\"\n+    origin: (origin) => (origin ? ALLOWED_ORIGINS.includes(origin) : false)\n   }),\n   trimTrailingSlash()\n );\n"}]}]