fix(deps): update @types/node to 26 with synced lockfile

The Renovate branch changed ui/package.json only, so npm ci failed on a stale lockfile. This commit updates package.json, package.json.tpl and package-lock.json together.
ci(deps): update dependencies with Renovate [skip ci]
2026-10-13 04:59:05 +00:00 · 2026-10-04 10:14:20 +01:00 · 2026-10-03 18:44:24 +01:00 · 2026-10-03 11:07:45 +00:00 · 2026-10-03 12:02:17 +01:00 · 2026-10-03 04:05:45 +00:00
8 changed files with 133 additions and 32 deletions
@@ -1,4 +1,4 @@
-name: Autoupdate go.mod and go.sum
+name: Update dependencies

 on:
  workflow_dispatch:
@@ -6,16 +6,16 @@ on:
    - cron: "0 3 * * *"

 permissions:
-  contents: write
  actions: write
+  contents: write
+  issues: write
  pull-requests: write
-  security-events: write

 jobs:
-  autoupdate:
-    uses: lukaszraczylo/shared-actions/.github/workflows/go-autoupdate.yaml@main
+  update:
+    uses: lukaszraczylo/shared-actions/.github/workflows/renovate-autoupdate.yaml@main
    with:
      go-version: ">=1.24"
-      release-workflow: "release.yaml"
-      lfs: false
-    secrets: inherit
+      node-working-directory: ui
+      require-node-tests: false
+      release-workflow: release.yaml
@@ -2,6 +2,7 @@
 package worker

 import (
+	"net"
 	"net/http"
 	"sync"
 	"time"
@@ -206,14 +207,13 @@ func (pcrl *PerClientRateLimiter) Stats() map[string]any {
 }

 // PerClientRateLimitMiddleware creates middleware that applies per-client rate limiting.
-// Uses X-Forwarded-For or RemoteAddr to identify clients.
+// Identifies clients by the peer IP of the connection; forwarding headers are spoofable and ignored.
 func PerClientRateLimitMiddleware(limiter *PerClientRateLimiter) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			// Get client identifier (prefer X-Real-IP from RealIP middleware)
 			clientKey := r.RemoteAddr
-			if xff := r.Header.Get("X-Real-IP"); xff != "" {
-				clientKey = xff
+			if host, _, err := net.SplitHostPort(clientKey); err == nil {
+				clientKey = host
 			}

 			if !limiter.Allow(clientKey) {
@@ -0,0 +1,35 @@
+package worker
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestPerClientRateLimitMiddleware_KeysOnPeerIP(t *testing.T) {
+	h := PerClientRateLimitMiddleware(NewPerClientRateLimiter(0.001, 1))(
+		http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { w.WriteHeader(http.StatusOK) }))
+
+	do := func(remote, realIP string) int {
+		req := httptest.NewRequest(http.MethodGet, "/", nil)
+		req.RemoteAddr = remote
+		if realIP != "" {
+			req.Header.Set("X-Real-IP", realIP)
+		}
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		return rec.Code
+	}
+
+	if got := do("10.0.0.1:1111", "1.1.1.1"); got != http.StatusOK {
+		t.Fatalf("first request: got %d", got)
+	}
+	// Same peer, new port and forged header: must share the exhausted bucket.
+	if got := do("10.0.0.1:2222", "2.2.2.2"); got != http.StatusTooManyRequests {
+		t.Fatalf("spoofed header/new port bypassed limit: got %d", got)
+	}
+	// Different peer is unaffected.
+	if got := do("10.0.0.2:1111", ""); got != http.StatusOK {
+		t.Fatalf("other peer: got %d", got)
+	}
+}
@@ -1226,7 +1226,7 @@ func (s *Service) setupMiddleware() {
 	// Add gzip compression for responses >1KB (reduces bandwidth ~70% for JSON)
 	s.router.Use(middleware.Compress(5)) // Level 5 = good balance of speed vs compression

-	// Apply per-client rate limiting (after RealIP so we get the real client IP)
+	// Apply per-client rate limiting (keyed on the socket peer address; forwarding headers are untrusted)
 	if s.rateLimiter != nil {
 		s.router.Use(PerClientRateLimitMiddleware(s.rateLimiter))
 	}
@@ -13,7 +13,7 @@
    {
      "name": "claude-mnemonic",
      "description": "Persistent memory system for Claude Code - Go implementation with SQLite and ChromaDB vector search",
-      "version": "0.21.77",
+      "version": "0.21.85",
      "author": {
        "name": "lukaszraczylo",
        "url": "https://github.com/lukaszraczylo"
@@ -23,25 +23,25 @@
      "license": "MIT",
      "homepage": "https://github.com/lukaszraczylo/claude-mnemonic",
      "releases": {
-        "latest": "0.21.77",
+        "latest": "0.21.85",
        "versions": {
-          "0.21.77": {
+          "0.21.85": {
            "releaseDate": "2026-10-03",
            "downloads": {
              "darwin-arm64": {
-                "url": "https://github.com/lukaszraczylo/claude-mnemonic/releases/download/v0.21.77/claude-mnemonic_0.21.77_darwin_arm64.tar.gz",
+                "url": "https://github.com/lukaszraczylo/claude-mnemonic/releases/download/v0.21.85/claude-mnemonic_0.21.85_darwin_arm64.tar.gz",
                "format": "tar.gz",
-                "sha256": "7bf9c814f4c2d1e9a727c24b0b487bd207dbdc45ed0828aef23e53017f3019d7"
+                "sha256": "d526cf5a3c48f15ece1e0e55313c7446766b6b7c8b9dd23404af921015595bd9"
              },
              "linux-amd64": {
-                "url": "https://github.com/lukaszraczylo/claude-mnemonic/releases/download/v0.21.77/claude-mnemonic_0.21.77_linux_amd64.tar.gz",
+                "url": "https://github.com/lukaszraczylo/claude-mnemonic/releases/download/v0.21.85/claude-mnemonic_0.21.85_linux_amd64.tar.gz",
                "format": "tar.gz",
-                "sha256": "cf5998292c72662b85a25df539a340b8c24e9caa2488fed9fd817d758124eac2"
+                "sha256": "7510acf546aaf3f4583c125028bf42be03a875d8a91ec5341c5914997579bafa"
              },
              "windows-amd64": {
-                "url": "https://github.com/lukaszraczylo/claude-mnemonic/releases/download/v0.21.77/claude-mnemonic_0.21.77_windows_amd64.zip",
+                "url": "https://github.com/lukaszraczylo/claude-mnemonic/releases/download/v0.21.85/claude-mnemonic_0.21.85_windows_amd64.zip",
                "format": "zip",
-                "sha256": "762ca4da50188763928802f148ec918e9f02d7678400fe17e46f84d82f5ed57b"
+                "sha256": "fea15fe6e4155161db74bf3b76505f405a6ed107a5e856e418d0d13be414ecec"
              }
            }
          }
@@ -15,7 +15,7 @@
      "devDependencies": {
        "@fortawesome/fontawesome-free": "^7.3.1",
        "@tailwindcss/postcss": "^4.3.3",
-        "@types/node": "^25.9.8",
+        "@types/node": "^26.0.0",
        "@vitejs/plugin-vue": "^6.0.9",
        "postcss": "^8.5.28",
        "tailwindcss": "^4.3.3",
@@ -680,6 +680,72 @@
        "node": ">=14.0.0"
      }
    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/core": {
+      "version": "1.11.1",
+      "dev": true,
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/wasi-threads": "1.2.2",
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/runtime": {
+      "version": "1.11.1",
+      "dev": true,
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/wasi-threads": {
+      "version": "1.2.2",
+      "dev": true,
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@napi-rs/wasm-runtime": {
+      "version": "1.1.4",
+      "dev": true,
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@tybys/wasm-util": "^0.10.1"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      },
+      "peerDependencies": {
+        "@emnapi/core": "^1.7.1",
+        "@emnapi/runtime": "^1.7.1"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@tybys/wasm-util": {
+      "version": "0.10.2",
+      "dev": true,
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/tslib": {
+      "version": "2.8.1",
+      "dev": true,
+      "inBundle": true,
+      "license": "0BSD",
+      "optional": true
+    },
    "node_modules/@tailwindcss/oxide-win32-arm64-msvc": {
      "version": "4.3.3",
      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.3.3.tgz",
@@ -736,13 +802,13 @@
      "peer": true
    },
    "node_modules/@types/node": {
-      "version": "25.9.8",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-25.9.8.tgz",
-      "integrity": "sha512-VfMrScDmMhUJQmd5hArdQnFvK0OIeD36uN2Va1FcpYaLB/BgkgM8Ulc50XtYISPMz7APJ30+N0T5EM0jlcdfRw==",
+      "version": "26.6.3",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.3.tgz",
+      "integrity": "sha512-dsqMQQoeTLqu9wynDD00q573mNzso3IdQOAfHRJqLCcmCFPoGo9A1bDpUcv/9tnKpErQWv9uKeGfl37EIS02Yg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "undici-types": ">=7.24.0 <7.24.7"
+        "undici-types": "~8.9.0"
      }
    },
    "node_modules/@vitejs/plugin-vue": {
@@ -1487,9 +1553,9 @@
      }
    },
    "node_modules/undici-types": {
-      "version": "7.24.6",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.24.6.tgz",
-      "integrity": "sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==",
+      "version": "8.9.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.9.0.tgz",
+      "integrity": "sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg==",
      "dev": true,
      "license": "MIT"
    },
@@ -17,7 +17,7 @@
  "devDependencies": {
    "@fortawesome/fontawesome-free": "^7.3.1",
    "@tailwindcss/postcss": "^4.3.3",
-    "@types/node": "^25.9.8",
+    "@types/node": "^26.0.0",
    "@vitejs/plugin-vue": "^6.0.9",
    "postcss": "^8.5.28",
    "tailwindcss": "^4.3.3",
@@ -17,7 +17,7 @@
  "devDependencies": {
    "@fortawesome/fontawesome-free": "^7.3.1",
    "@tailwindcss/postcss": "^4.3.3",
-    "@types/node": "^25.9.8",
+    "@types/node": "^26.0.0",
    "@vitejs/plugin-vue": "^6.0.9",
    "postcss": "^8.5.28",
    "tailwindcss": "^4.3.3",
Author	SHA1	Message	Date
lukaszraczylo	a8e9d0f256	fix(deps): update @types/node to 26 with synced lockfile The Renovate branch changed ui/package.json only, so npm ci failed on a stale lockfile. This commit updates package.json, package.json.tpl and package-lock.json together.	2026-10-04 10:14:20 +01:00
lukaszraczylo	8857cc9c72	ci(deps): update dependencies with Renovate [skip ci]	2026-10-03 18:44:24 +01:00
github-actions[bot]	096490a2d3	chore: update marketplace for v0.21.85	2026-10-03 11:07:45 +00:00
lukaszraczylo	eaf7c4ddca	fix(worker): key rate limiter on peer IP, not forged headers The rate limiter trusted X-Real-IP, so a client could dodge its limit by sending a new header value on each request. It must key on the connection peer address. The key also strips the port, so one client shares one bucket.	2026-10-03 12:02:17 +01:00
github-actions[bot]	2d1f52cdf4	chore: update marketplace for v0.21.81	2026-10-03 04:05:45 +00:00