github-actions[bot] and GitHub
616abc8701
chore(deps): update dependencies
...
Automated dependency update. All tests passed.
2026-10-11 03:34:12 +00:00
github-actions[bot] and GitHub
1bb258ef59
chore(deps): update dependencies
...
Automated dependency update. All tests passed.
2026-10-10 03:39:05 +00:00
github-actions[bot] and GitHub
9c2da8fe7a
chore(deps): update dependencies
...
Automated dependency update. All tests passed.
2026-10-09 03:26:31 +00:00
github-actions[bot] and GitHub
e1715cdc7a
chore(deps): update dependencies
...
Automated dependency update. All tests passed.
2026-10-08 03:40:38 +00:00
github-actions[bot] and GitHub
c58e4f23ff
chore(deps): update dependency jsdom to v30.1.2
...
Automated dependency update. All tests passed.
2026-10-07 03:30:53 +00:00
github-actions[bot] and GitHub
37874387e7
chore(deps): update dependencies
...
Automated dependency update. All tests passed.
2026-10-04 10:34:08 +00:00
lukaszraczylo
70d6c8988a
chore(deps): update tailwindcss to v4
...
Switch to the @tailwindcss/vite plugin and the @import entry. Load the existing config with @config and keep class-based dark mode through a custom variant. Remove the postcss config and its autoprefixer dependency, which v4 no longer needs.
2026-10-04 10:15:44 +01:00
lukaszraczylo
20470bfd3e
chore(deps): update typescript to v6
...
TypeScript 6 deprecates baseUrl and checks side-effect imports. Drop baseUrl, which paths does not need, and load the vite/client types so the CSS import resolves. Remove trailing commas from tsconfig.json so the JSON hook accepts it.
2026-10-04 10:15:10 +01:00
lukaszraczylo
dbbe254bfc
chore(deps): update vue-router to v5
...
The lockfile now resolves vue-router 5.3.1 on top of vite 8. Install, tests and build pass.
2026-10-04 10:14:04 +01:00
github-actions[bot] and GitHub
08552d8968
chore(deps): update dependency vite to v8
...
Automated dependency update. All tests passed.
2026-10-04 04:39:10 +00:00
github-actions[bot] and GitHub
80928c6e21
chore(deps): update dependency @vueuse/core to v15
...
Automated dependency update. All tests passed.
2026-10-03 17:19:50 +00:00
github-actions[bot] and GitHub
5bcbe08573
chore(deps): update dependency @testing-library/jest-dom to v7
...
Automated dependency update. All tests passed.
2026-10-03 17:18:18 +00:00
github-actions[bot] and GitHub
5c86b9a5e6
chore(deps): update dependency pinia to v4
...
Automated dependency update. All tests passed.
2026-10-03 17:16:50 +00:00
github-actions[bot] and GitHub
e246206e9c
chore(deps): update dependency lucide-vue-next to v1
...
Automated dependency update. All tests passed.
2026-10-03 17:15:47 +00:00
github-actions[bot] and GitHub
cc7d822a0a
chore(deps): update dependency postcss-selector-parser@<6.1.4 to v7
...
Automated dependency update. All tests passed.
2026-10-03 16:50:54 +00:00
github-actions[bot] and GitHub
30e113fbbe
chore(deps): update dependency minimatch@<9.0.9 to v10
...
Automated dependency update. All tests passed.
2026-10-03 16:48:32 +00:00
github-actions[bot] and GitHub
cbceb6101b
chore(deps): update dependency marked to v18
...
Automated dependency update. All tests passed.
2026-10-03 16:47:22 +00:00
github-actions[bot] and GitHub
3b6d2e7258
chore(deps): update dependency jsdom to v30
...
Automated dependency update. All tests passed.
2026-10-03 16:45:11 +00:00
github-actions[bot] and GitHub
436633bc68
chore(deps): update dependencies
...
Automated dependency update. All tests passed.
2026-10-03 16:12:39 +00:00
b172788741
fix(frontend): override vulnerable transitive dependencies ( #150 )
...
Dependabot security updates report update_not_possible because the
vulnerable packages are transitive and their parents pin them. The
Dependabot job fails on every run.
pnpm overrides raise minimatch to 9.0.9, esbuild to 0.28.2 and
postcss-selector-parser to 6.1.4. All three versions are older than the
seven day minimum release age. pnpm audit reports no known
vulnerabilities. The build and the 47 tests pass.
Co-authored-by: copilot-swe-agent[bot] <[email protected]
2026-10-03 00:56:29 +01:00
lukaszraczylo
48c12a4869
fix(deps): override vulnerable frontend packages
...
Dependabot could not raise esbuild, minimatch and postcss-selector-parser, because their parents pin older ranges. The workspace now overrides them to the patched versions. The frontend builds and its tests pass.
2026-10-03 00:30:11 +01:00
8396284de3
chore(deps): bump the npm_and_yarn group across 1 directory with 8 updates ( #148 )
...
Bumps the npm_and_yarn group with 8 updates in the /frontend directory:
| Package | From | To |
| --- | --- | --- |
| [axios](https://github.com/axios/axios ) | `1.18.0` | `1.20.0` |
| [@vitest/mocker](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker ) | `4.1.0` | `5.0.3` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion ) | `2.0.2` | `2.1.7` |
| [browserslist](https://github.com/browserslist/browserslist ) | `4.28.1` | `4.29.3` |
| [defu](https://github.com/unjs/defu ) | `6.1.4` | `6.1.7` |
| [js-cookie](https://github.com/js-cookie/js-cookie ) | `3.0.5` | `3.0.8` |
| [picomatch](https://github.com/micromatch/picomatch ) | `2.3.1` | `2.3.2` |
| [ws](https://github.com/websockets/ws ) | `8.18.3` | `8.22.0` |
Updates `axios` from 1.18.0 to 1.20.0
- [Release notes](https://github.com/axios/axios/releases )
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md )
- [Commits](https://github.com/axios/axios/compare/v1.18.0...v1.20.0 )
Updates `@vitest/mocker` from 4.1.0 to 5.0.3
- [Release notes](https://github.com/vitest-dev/vitest/releases )
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md )
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.3/packages/mocker )
Updates `brace-expansion` from 2.0.2 to 2.1.7
- [Release notes](https://github.com/juliangruber/brace-expansion/releases )
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v2.0.2...v2.1.7 )
Updates `browserslist` from 4.28.1 to 4.29.3
- [Release notes](https://github.com/browserslist/browserslist/releases )
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md )
- [Commits](https://github.com/browserslist/browserslist/compare/4.28.1...4.29.3 )
Updates `defu` from 6.1.4 to 6.1.7
- [Release notes](https://github.com/unjs/defu/releases )
- [Changelog](https://github.com/unjs/defu/blob/main/CHANGELOG.md )
- [Commits](https://github.com/unjs/defu/compare/v6.1.4...v6.1.7 )
Updates `js-cookie` from 3.0.5 to 3.0.8
- [Release notes](https://github.com/js-cookie/js-cookie/releases )
- [Commits](https://github.com/js-cookie/js-cookie/compare/v3.0.5...v3.0.8 )
Updates `picomatch` from 2.3.1 to 2.3.2
- [Release notes](https://github.com/micromatch/picomatch/releases )
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md )
- [Commits](https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2 )
Updates `ws` from 8.18.3 to 8.22.0
- [Release notes](https://github.com/websockets/ws/releases )
- [Commits](https://github.com/websockets/ws/compare/8.18.3...8.22.0 )
---
updated-dependencies:
- dependency-name: axios
dependency-version: 1.20.0
dependency-type: direct:production
dependency-group: npm_and_yarn
- dependency-name: "@vitest/mocker"
dependency-version: 5.0.3
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: brace-expansion
dependency-version: 2.1.7
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: browserslist
dependency-version: 4.29.3
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: defu
dependency-version: 6.1.7
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: js-cookie
dependency-version: 3.0.8
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: picomatch
dependency-version: 2.3.2
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: ws
dependency-version: 8.22.0
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <[email protected]
2026-10-02 13:56:28 +01:00
a412b61d8d
chore(deps): bump the npm_and_yarn group across 1 directory with 8 updates ( #128 )
...
Bumps the npm_and_yarn group with 4 updates in the /frontend directory: [axios](https://github.com/axios/axios ), [postcss](https://github.com/postcss/postcss ), [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite ) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest ).
Updates `axios` from 1.13.5 to 1.18.0
- [Release notes](https://github.com/axios/axios/releases )
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md )
- [Commits](https://github.com/axios/axios/compare/v1.13.5...v1.18.0 )
Updates `postcss` from 8.5.6 to 8.5.23
- [Release notes](https://github.com/postcss/postcss/releases )
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md )
- [Commits](https://github.com/postcss/postcss/compare/8.5.6...8.5.23 )
Updates `vite` from 7.3.0 to 7.3.5
- [Release notes](https://github.com/vitejs/vite/releases )
- [Changelog](https://github.com/vitejs/vite/blob/v7.3.5/packages/vite/CHANGELOG.md )
- [Commits](https://github.com/vitejs/vite/commits/v7.3.5/packages/vite )
Updates `vitest` from 4.0.16 to 4.1.0
- [Release notes](https://github.com/vitest-dev/vitest/releases )
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md )
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.0/packages/vitest )
Updates `follow-redirects` from 1.15.11 to 1.16.0
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases )
- [Commits](https://github.com/follow-redirects/follow-redirects/compare/v1.15.11...v1.16.0 )
Updates `form-data` from 4.0.5 to 4.0.6
- [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md )
- [Commits](https://github.com/form-data/form-data/compare/v4.0.5...v4.0.6 )
Updates `nanoid` from 3.3.11 to 3.3.18
- [Release notes](https://github.com/ai/nanoid/releases )
- [Changelog](https://github.com/ai/nanoid/blob/3.3.18/CHANGELOG.md )
- [Commits](https://github.com/ai/nanoid/compare/3.3.11...3.3.18 )
Updates `rollup` from 4.54.0 to 4.63.1
- [Release notes](https://github.com/rollup/rollup/releases )
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md )
- [Commits](https://github.com/rollup/rollup/compare/v4.54.0...v4.63.1 )
---
updated-dependencies:
- dependency-name: axios
dependency-version: 1.18.0
dependency-type: direct:production
dependency-group: npm_and_yarn
- dependency-name: postcss
dependency-version: 8.5.23
dependency-type: direct:development
dependency-group: npm_and_yarn
- dependency-name: vite
dependency-version: 7.3.5
dependency-type: direct:development
dependency-group: npm_and_yarn
- dependency-name: vitest
dependency-version: 4.1.0
dependency-type: direct:development
dependency-group: npm_and_yarn
- dependency-name: follow-redirects
dependency-version: 1.16.0
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: form-data
dependency-version: 4.0.6
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: nanoid
dependency-version: 3.3.18
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: rollup
dependency-version: 4.63.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <[email protected]
2026-10-02 13:14:56 +01:00
lukaszraczylo
d96e724755
build(frontend): allow esbuild and vue-demi build scripts
...
pnpm 11 stops a frozen install when a dependency build script is not approved.
2026-10-02 12:04:18 +01:00
7fb596aafd
chore(deps): bump axios ( #14 )
...
Bumps the npm_and_yarn group with 1 update in the /frontend directory: [axios](https://github.com/axios/axios ).
Updates `axios` from 1.13.2 to 1.13.5
- [Release notes](https://github.com/axios/axios/releases )
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md )
- [Commits](https://github.com/axios/axios/compare/v1.13.2...v1.13.5 )
---
updated-dependencies:
- dependency-name: axios
dependency-version: 1.13.5
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <[email protected]
2026-09-03 10:47:50 +01:00
lukaszraczylo
e39d6a0f0d
feat: comprehensive audit + Tier 3 wiring (security/correctness/features)
...
Multi-agent audit + fix pass covering bugs, security, dead config wiring,
and missing features. All quality gates green: build/vet/test -race/govulncheck/
golangci-lint. Frontend tests 47/47.
SECURITY & CORRECTNESS
- Scanner pipeline fail-closed: cache.go scan timeout now 503 (was goto servePkg);
scanner.go all-scanners-fail saves ScanStatusError; CheckVulnerabilities blocks
on missing/error result instead of allowing.
- Scanner argv corrections: govulncheck source-mode + go.mod discovery;
npm-audit generates lockfile via npm install --package-lock-only --ignore-scripts;
pip-audit per-extension dispatch (wheel direct / sdist extract+pyproject).
- GHSA version-range filtering implemented (was always-include); url.QueryEscape
on package name.
- pypi SSRF closed via host allowlist on original_url; url.QueryEscape on
rewriteURL output.
- Path traversal: cache temp file uses os.CreateTemp; smb keyToPath sanitized;
filesystem keyToPath returns error + filepath.Abs prefix-verify.
- Goroutine leaks plugged: cache.cleanupWorker stop channel; auth.ValidationCache
Stop() with sync.Once; ws.unregister buffered with non-blocking send.
- WebSocket double-close panic fixed via sync.Once Client.closeSend().
- Race conditions: gormstore.registryCache sync.RWMutex (was concurrent map
panic); auth.LastUsedAt no longer mutated under RLock; analytics strict
lock-ordering invariant (statsMu before downloadsMu).
- Auth validator fails CLOSED on transport/unknown-status errors (was returning
true,err 'allow cache fallback').
- Credential cache hash full SHA256 (was 8-byte truncate; eliminates 2^32
collision risk).
- filesystem.fs.used incremented after successful rename (no quota inflation
race).
- gormstore aggregation events deleted in same tx as insert (no double-counting).
- gormstore.SavePackage uses Updates(map) so zero-value security flags
(RequiresAuth=false) can be cleared.
- partition_manager validates partition name regex before DROP TABLE.
- vcs/git: version regex validation rejects --option-injection; checkout uses
--detach -- separator; removed TrimPrefix(repo,'v') that corrupted vault/
vitess/vim-go.
- WebSocket CheckOrigin allowlist (was return true; CSWSH closed); same-origin
default + ServerConfig.AllowedOrigins.
- fiber CVE GO-2026-4543 patched (v2.52.10 -> v2.52.12).
FUNCTIONAL FEATURES
- API key DB persistence: APIKeyModel + migration 202604280002, full CRUD,
async LastUsedAt updates with WaitGroup-tracked goroutines drained on Close.
- Admin bootstrap via GOHOARDER_BOOTSTRAP_ADMIN_KEY env var; idempotent
(skipped when non-revoked admin already exists).
- Auth middleware factory in pkg/app: RequireAuth, RequireRole, RequirePermission,
OptionalAuth. Mounted on proxy + read APIs when Auth.Enabled=true.
DELETE /api/packages/* requires admin role. /health public for k8s probes.
- NFS storage backend: pkg/storage/nfs wraps filesystem with /proc/mounts
detection (Linux), post-write fsync, read-after-write health probe.
- WebSocket real-time pipeline: pkg/events Broadcaster interface; cache + scanner
managers emit EventPackageCached / EventPackageDownloaded / EventScanComplete;
app.go runs 30s EventStatsUpdate ticker. Frontend has full WS client (reconnect
with exponential backoff 1s->30s, 25s heartbeat, subscriber pattern), Pinia
realtime store, Dashboard live indicator + activity feed + reactive stats
override.
- TLS termination: fiber.ListenTLS when Server.TLS.Enabled.
- Pre-warming: Prewarming.Enabled flag wired (was hardcoded false); Interval,
MaxConcurrent, TopPackages plumbed.
- NetworkConfig wired (timeouts, retry, rate-limit, circuit-breaker).
- AuthConfig.BcryptCost wired.
- Security.Scanners.Static.MaxPackageSize plumbed to cache.io.LimitReader.
- Handlers.{Go,NPM,PyPI}.Enabled gates route mounting.
- Graceful shutdown: authManager.Close drains async writes.
LINT/HYGIENE
- 80 golangci-lint issues resolved: errcheck (Close/Write/RemoveAll wrapped),
gofmt, gosec G104/G306, govet shadow renames + fieldalignment reorders,
staticcheck ST1000 pkg comments + QF1003 tagged switches + QF1008 embedded
field selectors + QF1001 De Morgan's law.
BEHAVIOR CHANGES
- Scanner now fail-closed: deployments without scanner binaries
(trivy/govulncheck/npm-audit/pip-audit/grype) BLOCK packages instead of
serving unscanned. Add binaries or plan a future allow-on-scan-error flag.
- WS origin defaults to same-origin; cross-origin dashboards must set
server.allowed_origins.
- Validator no longer fails open; private packages won't serve from cache when
validation can't be performed.
- download_events retention dropped from 24h to ~5min (deleted in agg tx).
Migration 202604280001 purges pre-upgrade events.
- DELETE /api/packages/* requires admin role when auth enabled.
NEW PACKAGES
- pkg/events - Broadcaster interface
- pkg/storage/nfs - NFS-aware filesystem wrapper
DEFERRED (out of scope this pass)
- Static scanner implementation (config defines AllowedLicenses/MaxPackageSize/
BlockSuspicious but pkg/scanner/static/ does not exist).
- AuthConfig.AuditLog wiring (no audit log infra yet).
- CacheConfig.TTLOverrides passthrough (would touch cache.Config beyond
integrator scope).
2026-07-10 09:37:55 +01:00
lukaszraczylo
85c76150f5
fixup! fix: remove missing logo reference from Helm chart
2026-01-04 14:47:27 +00:00
lukaszraczylo
64f6f5cda4
Fix test files to include new Stats fields
...
Add max_cache_size and blocked_packages fields to all Stats mock objects in:
- Dashboard.spec.ts
- Stats.spec.ts
This fixes TypeScript compilation errors in the build process.
2026-01-03 21:22:31 +00:00
lukaszraczylo
0be529f7be
Add blocked packages counter and storage progress bar
...
Backend:
- Add blocked_packages count to stats API by checking vulnerabilities against thresholds
- Add max_cache_size to stats API from config
- Add isBlocked field to package API responses
Frontend:
- Add blocked_packages and max_cache_size to Stats interface
- Add blocked packages counter card to stats page with fa-hand icon
- Add storage usage progress bar with color coding (green/yellow/orange/red)
- Add /blocked-packages route that filters vulnerable packages by isBlocked
- Update VulnerabilityBadge to show BLOCKED badge with fa-hand icon
- Fix TypeScript imports for useRoute in VulnerablePackages
Features:
- Stats page now shows blocked packages count (clickable)
- Storage display shows usage vs max with visual progress bar
- Blocked packages view accessible from stats page
- All blocked indicators use fa-hand icon instead of fa-ban
2026-01-03 21:09:34 +00:00
lukaszraczylo
c0061b99e3
chore(schema): migrate to GORM V2 with multi-database support
...
- [x] Implement GORM V2 metadata store with SQLite, PostgreSQL, and MySQL support
- [x] Add database migration system using gormigrate for schema versioning
- [x] Create migration CLI tool with support for migrate, rollback, and status commands
- [x] Add Docker support for migration container (Dockerfile.migrate)
- [x] Implement automatic partition management for PostgreSQL time-series tables
- [x] Add background aggregation worker for download statistics
- [x] Support connection pooling configuration (max_open_conns, max_idle_conns, conn_max_lifetime)
- [x] Add blocking mechanism based on vulnerability thresholds in stats and handlers
- [x] Update Helm charts with migration init containers and multi-database configuration
- [x] Replace deprecated SQLite store with optimized GORM implementation
- [x] Add comprehensive integration tests for MySQL and PostgreSQL
- [x] Update frontend to display blocked packages and storage utilization
- [x] Add goreleaser configuration for migrate binary and container image
- [x] Update configuration examples with database backend options and recommendations
2026-01-03 20:44:23 +00:00
lukaszraczylo
48b834a62a
Initial commit
2026-01-02 23:14:23 +00:00
lukaszraczylo