fix(deps): update @types/node to 26 with synced lockfile

The Renovate branch changed ui/package.json only, so npm ci failed on a stale lockfile. This commit updates package.json, package.json.tpl and package-lock.json together.
ci(deps): update dependencies with Renovate [skip ci]
2026-10-12 04:55:18 +00:00 · 2026-10-04 10:14:20 +01:00 · 2026-10-03 18:44:24 +01:00 · 2026-10-03 11:07:45 +00:00 · 2026-10-03 12:02:17 +01:00 · 2026-10-03 04:05:45 +00:00
13 changed files with 148 additions and 51 deletions
@@ -1,4 +1,4 @@
-name: Autoupdate go.mod and go.sum
+name: Update dependencies

 on:
  workflow_dispatch:
@@ -6,16 +6,16 @@ on:
    - cron: "0 3 * * *"

 permissions:
-  contents: write
  actions: write
+  contents: write
+  issues: write
  pull-requests: write
-  security-events: write

 jobs:
-  autoupdate:
-    uses: lukaszraczylo/shared-actions/.github/workflows/go-autoupdate.yaml@main
+  update:
+    uses: lukaszraczylo/shared-actions/.github/workflows/renovate-autoupdate.yaml@main
    with:
      go-version: ">=1.24"
-      release-workflow: "release.yaml"
-      lfs: false
-    secrets: inherit
+      node-working-directory: ui
+      require-node-tests: false
+      release-workflow: release.yaml
@@ -9,8 +9,8 @@ require (
 	github.com/fsnotify/fsnotify v1.10.1
 	github.com/go-chi/chi/v5 v5.3.2
 	github.com/go-gormigrate/gormigrate/v2 v2.1.7
-	github.com/goccy/go-json v0.11.1
-	github.com/lukaszraczylo/oss-telemetry v0.2.3
+	github.com/goccy/go-json v0.11.2
+	github.com/lukaszraczylo/oss-telemetry v0.2.5
 	github.com/mattn/go-sqlite3 v1.14.52
 	github.com/rs/zerolog v1.35.1
 	github.com/stretchr/testify v1.12.1
@@ -12,14 +12,14 @@ github.com/go-chi/chi/v5 v5.3.2 h1:5YQkICvTCSZ25hoRsyJazN0scjzKGiu4VAUc7H1o1nY=
 github.com/go-chi/chi/v5 v5.3.2/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto=
 github.com/go-gormigrate/gormigrate/v2 v2.1.7 h1:PdT4jVPbRb4R+0Ey2R0yJOdctVf4Whiq1Qi4necaZdg=
 github.com/go-gormigrate/gormigrate/v2 v2.1.7/go.mod h1:3ouXglTuPrKF5+7cQyVGfvAXTU4vLMaYh9+EPl03uog=
-github.com/goccy/go-json v0.11.1 h1:4FEh3QBVpTCIvrCDucNJU2LZYUM9sxxW5O0UuUhxumk=
-github.com/goccy/go-json v0.11.1/go.mod h1:z7UbbpDz59QAZPnhVSNOjPyprGnfWu/gT3J3EpeLXGU=
+github.com/goccy/go-json v0.11.2 h1:jdZv93Tt4ioR8yW1CoNsvSxrcZlCXAUU1aZXN7gpXUA=
+github.com/goccy/go-json v0.11.2/go.mod h1:3NdmfEkZlB7YI5UFw/qdFKq8XN1aiWR0YyRPWZNQltY=
 github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
 github.com/jinzhu/inflection v1.0.0/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
 github.com/jinzhu/now v1.1.5 h1:/o9tlHleP7gOFmsnYNz3RGnqzefHA47wQpKrrdTIwXQ=
 github.com/jinzhu/now v1.1.5/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
-github.com/lukaszraczylo/oss-telemetry v0.2.3 h1:xoDtBqeZGmXj7IteiE1M5WMuzeoqag58qEleI0Cf2Ms=
-github.com/lukaszraczylo/oss-telemetry v0.2.3/go.mod h1:+Cn78qZo8rc3T9eZt0v3oICYRdd75wORtSidc8lNjDQ=
+github.com/lukaszraczylo/oss-telemetry v0.2.5 h1:W6Qgwp7IY4yBRO361MmnEAmM59motdQpbAFAx8v6fJM=
+github.com/lukaszraczylo/oss-telemetry v0.2.5/go.mod h1:+Cn78qZo8rc3T9eZt0v3oICYRdd75wORtSidc8lNjDQ=
 github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY=
 github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
@@ -500,15 +500,13 @@ func TestObservationStore_CleanupOldObservations(t *testing.T) {

 	// Store observations beyond the limit WITHOUT async cleanup
 	// We disable async cleanup by not setting cleanupFunc
-	var allIDs []int64
 	for i := 0; i < 105; i++ {
 		observation := &models.ParsedObservation{
 			Type:  models.ObsTypeDiscovery,
 			Title: "Observation",
 		}
-		id, _, err := observationStore.StoreObservation(ctx, "claude-1", "test-project", observation, i, 10)
+		_, _, err := observationStore.StoreObservation(ctx, "claude-1", "test-project", observation, i, 10)
 		require.NoError(t, err)
-		allIDs = append(allIDs, id)
 		time.Sleep(2 * time.Millisecond) // Ensure different timestamps
 	}

@@ -218,9 +218,8 @@ func (s *Service) handleUpdateRestart(w http.ResponseWriter, r *http.Request) {

 	// Restart in background after response is sent
 	go func() {
-		if err := s.updater.Restart(); err != nil {
-			log.Error().Err(err).Msg("Failed to restart worker")
-		}
+		// Restart only returns when the new worker failed to start.
+		log.Error().Err(s.updater.Restart()).Msg("Failed to restart worker")
 	}()
 }

@@ -244,8 +243,7 @@ func (s *Service) handleRestart(w http.ResponseWriter, r *http.Request) {
 	go func() {
 		// Small delay to ensure response is sent
 		time.Sleep(100 * time.Millisecond)
-		if err := s.updater.Restart(); err != nil {
-			log.Error().Err(err).Msg("Failed to restart worker")
-		}
+		// Restart only returns when the new worker failed to start.
+		log.Error().Err(s.updater.Restart()).Msg("Failed to restart worker")
 	}()
 }
@@ -2,6 +2,7 @@
 package worker

 import (
+	"net"
 	"net/http"
 	"sync"
 	"time"
@@ -206,14 +207,13 @@ func (pcrl *PerClientRateLimiter) Stats() map[string]any {
 }

 // PerClientRateLimitMiddleware creates middleware that applies per-client rate limiting.
-// Uses X-Forwarded-For or RemoteAddr to identify clients.
+// Identifies clients by the peer IP of the connection; forwarding headers are spoofable and ignored.
 func PerClientRateLimitMiddleware(limiter *PerClientRateLimiter) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			// Get client identifier (prefer X-Real-IP from RealIP middleware)
 			clientKey := r.RemoteAddr
-			if xff := r.Header.Get("X-Real-IP"); xff != "" {
-				clientKey = xff
+			if host, _, err := net.SplitHostPort(clientKey); err == nil {
+				clientKey = host
 			}

 			if !limiter.Allow(clientKey) {
@@ -0,0 +1,35 @@
+package worker
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestPerClientRateLimitMiddleware_KeysOnPeerIP(t *testing.T) {
+	h := PerClientRateLimitMiddleware(NewPerClientRateLimiter(0.001, 1))(
+		http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { w.WriteHeader(http.StatusOK) }))
+
+	do := func(remote, realIP string) int {
+		req := httptest.NewRequest(http.MethodGet, "/", nil)
+		req.RemoteAddr = remote
+		if realIP != "" {
+			req.Header.Set("X-Real-IP", realIP)
+		}
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		return rec.Code
+	}
+
+	if got := do("10.0.0.1:1111", "1.1.1.1"); got != http.StatusOK {
+		t.Fatalf("first request: got %d", got)
+	}
+	// Same peer, new port and forged header: must share the exhausted bucket.
+	if got := do("10.0.0.1:2222", "2.2.2.2"); got != http.StatusTooManyRequests {
+		t.Fatalf("spoofed header/new port bypassed limit: got %d", got)
+	}
+	// Different peer is unaffected.
+	if got := do("10.0.0.2:1111", ""); got != http.StatusOK {
+		t.Fatalf("other peer: got %d", got)
+	}
+}
@@ -1,6 +1,7 @@
 package sdk

 import (
+	"context"
 	"testing"

 	"github.com/lukaszraczylo/claude-mnemonic/internal/vector/sqlitevec"
@@ -121,7 +122,7 @@ func TestCheckVectorDeduplication_NilClient(t *testing.T) {
 		Narrative: "Some narrative text",
 	}

-	result := p.checkVectorDeduplication(nil, obs, "test-project")
+	result := p.checkVectorDeduplication(context.Background(), obs, "test-project")
 	if result.Action != "insert" {
 		t.Errorf("expected Action='insert' when vectorClient is nil, got %q", result.Action)
 	}
@@ -136,7 +137,7 @@ func TestCheckVectorDeduplication_EmptySearchText(t *testing.T) {
 		// All empty fields
 	}

-	result := p.checkVectorDeduplication(nil, obs, "test-project")
+	result := p.checkVectorDeduplication(context.Background(), obs, "test-project")
 	if result.Action != "insert" {
 		t.Errorf("expected Action='insert' for empty observation, got %q", result.Action)
 	}
@@ -1213,7 +1213,6 @@ func (s *Service) setupMiddleware() {

 	s.router.Use(middleware.Logger)
 	s.router.Use(middleware.Recoverer)
-	s.router.Use(middleware.RealIP)

 	// Add security headers (X-Frame-Options, X-Content-Type-Options, CSP, etc.)
 	s.router.Use(SecurityHeaders)
@@ -1227,7 +1226,7 @@ func (s *Service) setupMiddleware() {
 	// Add gzip compression for responses >1KB (reduces bandwidth ~70% for JSON)
 	s.router.Use(middleware.Compress(5)) // Level 5 = good balance of speed vs compression

-	// Apply per-client rate limiting (after RealIP so we get the real client IP)
+	// Apply per-client rate limiting (keyed on the socket peer address; forwarding headers are untrusted)
 	if s.rateLimiter != nil {
 		s.router.Use(PerClientRateLimitMiddleware(s.rateLimiter))
 	}
@@ -13,7 +13,7 @@
    {
      "name": "claude-mnemonic",
      "description": "Persistent memory system for Claude Code - Go implementation with SQLite and ChromaDB vector search",
-      "version": "0.21.65",
+      "version": "0.21.85",
      "author": {
        "name": "lukaszraczylo",
        "url": "https://github.com/lukaszraczylo"
@@ -23,25 +23,25 @@
      "license": "MIT",
      "homepage": "https://github.com/lukaszraczylo/claude-mnemonic",
      "releases": {
-        "latest": "0.21.65",
+        "latest": "0.21.85",
        "versions": {
-          "0.21.65": {
-            "releaseDate": "2026-09-30",
+          "0.21.85": {
+            "releaseDate": "2026-10-03",
            "downloads": {
              "darwin-arm64": {
-                "url": "https://github.com/lukaszraczylo/claude-mnemonic/releases/download/v0.21.65/claude-mnemonic_0.21.65_darwin_arm64.tar.gz",
+                "url": "https://github.com/lukaszraczylo/claude-mnemonic/releases/download/v0.21.85/claude-mnemonic_0.21.85_darwin_arm64.tar.gz",
                "format": "tar.gz",
-                "sha256": "881c99d9fed98e64df3cdfde751492692f1de512d66504a194575e994642e3d3"
+                "sha256": "d526cf5a3c48f15ece1e0e55313c7446766b6b7c8b9dd23404af921015595bd9"
              },
              "linux-amd64": {
-                "url": "https://github.com/lukaszraczylo/claude-mnemonic/releases/download/v0.21.65/claude-mnemonic_0.21.65_linux_amd64.tar.gz",
+                "url": "https://github.com/lukaszraczylo/claude-mnemonic/releases/download/v0.21.85/claude-mnemonic_0.21.85_linux_amd64.tar.gz",
                "format": "tar.gz",
-                "sha256": "30eedb663a18afc466b6a8486ca93249b611ad5f8ae8a787afc751e6e45eca9f"
+                "sha256": "7510acf546aaf3f4583c125028bf42be03a875d8a91ec5341c5914997579bafa"
              },
              "windows-amd64": {
-                "url": "https://github.com/lukaszraczylo/claude-mnemonic/releases/download/v0.21.65/claude-mnemonic_0.21.65_windows_amd64.zip",
+                "url": "https://github.com/lukaszraczylo/claude-mnemonic/releases/download/v0.21.85/claude-mnemonic_0.21.85_windows_amd64.zip",
                "format": "zip",
-                "sha256": "7e3ee608ce4ec89929e57b5aef274fbbc331499e1127323106b227b5bbdec516"
+                "sha256": "fea15fe6e4155161db74bf3b76505f405a6ed107a5e856e418d0d13be414ecec"
              }
            }
          }
@@ -15,7 +15,7 @@
      "devDependencies": {
        "@fortawesome/fontawesome-free": "^7.3.1",
        "@tailwindcss/postcss": "^4.3.3",
-        "@types/node": "^25.9.8",
+        "@types/node": "^26.0.0",
        "@vitejs/plugin-vue": "^6.0.9",
        "postcss": "^8.5.28",
        "tailwindcss": "^4.3.3",
@@ -680,6 +680,72 @@
        "node": ">=14.0.0"
      }
    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/core": {
+      "version": "1.11.1",
+      "dev": true,
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/wasi-threads": "1.2.2",
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/runtime": {
+      "version": "1.11.1",
+      "dev": true,
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/wasi-threads": {
+      "version": "1.2.2",
+      "dev": true,
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@napi-rs/wasm-runtime": {
+      "version": "1.1.4",
+      "dev": true,
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@tybys/wasm-util": "^0.10.1"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      },
+      "peerDependencies": {
+        "@emnapi/core": "^1.7.1",
+        "@emnapi/runtime": "^1.7.1"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@tybys/wasm-util": {
+      "version": "0.10.2",
+      "dev": true,
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/tslib": {
+      "version": "2.8.1",
+      "dev": true,
+      "inBundle": true,
+      "license": "0BSD",
+      "optional": true
+    },
    "node_modules/@tailwindcss/oxide-win32-arm64-msvc": {
      "version": "4.3.3",
      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.3.3.tgz",
@@ -736,13 +802,13 @@
      "peer": true
    },
    "node_modules/@types/node": {
-      "version": "25.9.8",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-25.9.8.tgz",
-      "integrity": "sha512-VfMrScDmMhUJQmd5hArdQnFvK0OIeD36uN2Va1FcpYaLB/BgkgM8Ulc50XtYISPMz7APJ30+N0T5EM0jlcdfRw==",
+      "version": "26.6.3",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.3.tgz",
+      "integrity": "sha512-dsqMQQoeTLqu9wynDD00q573mNzso3IdQOAfHRJqLCcmCFPoGo9A1bDpUcv/9tnKpErQWv9uKeGfl37EIS02Yg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "undici-types": ">=7.24.0 <7.24.7"
+        "undici-types": "~8.9.0"
      }
    },
    "node_modules/@vitejs/plugin-vue": {
@@ -1487,9 +1553,9 @@
      }
    },
    "node_modules/undici-types": {
-      "version": "7.24.6",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.24.6.tgz",
-      "integrity": "sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==",
+      "version": "8.9.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.9.0.tgz",
+      "integrity": "sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg==",
      "dev": true,
      "license": "MIT"
    },
@@ -17,7 +17,7 @@
  "devDependencies": {
    "@fortawesome/fontawesome-free": "^7.3.1",
    "@tailwindcss/postcss": "^4.3.3",
-    "@types/node": "^25.9.8",
+    "@types/node": "^26.0.0",
    "@vitejs/plugin-vue": "^6.0.9",
    "postcss": "^8.5.28",
    "tailwindcss": "^4.3.3",
@@ -17,7 +17,7 @@
  "devDependencies": {
    "@fortawesome/fontawesome-free": "^7.3.1",
    "@tailwindcss/postcss": "^4.3.3",
-    "@types/node": "^25.9.8",
+    "@types/node": "^26.0.0",
    "@vitejs/plugin-vue": "^6.0.9",
    "postcss": "^8.5.28",
    "tailwindcss": "^4.3.3",
Author	SHA1	Message	Date
lukaszraczylo	a8e9d0f256	fix(deps): update @types/node to 26 with synced lockfile The Renovate branch changed ui/package.json only, so npm ci failed on a stale lockfile. This commit updates package.json, package.json.tpl and package-lock.json together.	2026-10-04 10:14:20 +01:00
lukaszraczylo	8857cc9c72	ci(deps): update dependencies with Renovate [skip ci]	2026-10-03 18:44:24 +01:00
github-actions[bot]	096490a2d3	chore: update marketplace for v0.21.85	2026-10-03 11:07:45 +00:00
lukaszraczylo	eaf7c4ddca	fix(worker): key rate limiter on peer IP, not forged headers The rate limiter trusted X-Real-IP, so a client could dodge its limit by sending a new header value on each request. It must key on the connection peer address. The key also strips the port, so one client shares one bucket.	2026-10-03 12:02:17 +01:00
github-actions[bot]	2d1f52cdf4	chore: update marketplace for v0.21.81	2026-10-03 04:05:45 +00:00
lukaszraczylo	9d7959f98f	fix(lint): clear the staticcheck findings Drop the RealIP middleware: the worker listens on 127.0.0.1 only, and RealIP is deprecated because a client can set its own address. Log the restart error directly, since Restart only returns on failure. Remove an unused slice in a test and pass a real context instead of nil. staticcheck now reports nothing.	2026-10-03 05:00:27 +01:00
github-actions[bot]	daa9959961	chore: update marketplace for v0.21.77	2026-10-03 03:28:30 +00:00
lukaszraczyloandGitHub	f8e5b08de7	Update go.mod and go.sum (#63 )	2026-10-03 04:19:45 +01:00
github-actions[bot]	ad718f9292	chore: update marketplace for v0.21.73	2026-09-30 03:19:52 +00:00
lukaszraczyloandGitHub	1cfe6936de	Update go.mod and go.sum (#62 )	2026-09-30 04:11:59 +01:00
github-actions[bot]	2b2bc47fe5	chore: update marketplace for v0.21.69	2026-09-30 01:03:42 +00:00