lukaszraczylo and GitHub
16e09c0515
Update go.mod and go.sum ( #139 )
2026-09-19 04:17:35 +01:00
lukaszraczylo and GitHub
0ff7719d8a
Update go.mod and go.sum ( #138 )
2026-09-16 04:20:31 +01:00
lukaszraczylo and GitHub
1d7ee6c27b
Update go.mod and go.sum ( #137 )
2026-09-15 04:18:48 +01:00
lukaszraczylo and GitHub
e00233943b
Update go.mod and go.sum ( #136 )
2026-09-12 04:19:03 +01:00
lukaszraczylo and GitHub
6c2448bb03
Update go.mod and go.sum ( #135 )
2026-09-11 04:19:38 +01:00
lukaszraczylo and GitHub
a511c380ba
Update go.mod and go.sum ( #134 )
2026-09-10 04:20:11 +01:00
lukaszraczylo and GitHub
fa66501e5c
Update go.mod and go.sum ( #133 )
2026-09-09 04:21:00 +01:00
lukaszraczylo and GitHub
35ea5b8a5b
Update go.mod and go.sum ( #132 )
2026-09-08 04:18:09 +01:00
lukaszraczylo and GitHub
e5d7242dc1
Update go.mod and go.sum ( #131 )
2026-09-06 04:19:50 +01:00
lukaszraczylo and GitHub
3c994687ff
Update go.mod and go.sum ( #130 )
2026-09-05 04:19:01 +01:00
lukaszraczylo
171386f7a7
fix: remediate severity-ordered review findings across cache, scanners, and proxies
...
- H2: gormstore soft-delete + storage_key UNIQUE collision; re-save after eviction succeeds
- H1: cache getOrFetch cache-hit branch no longer runs CheckVulnerabilities on metadata entries
- M2: cache store() streams upstream body to temp file + SHA256 instead of double-buffering
- H3/L3: FetchResult/FetchFunc plumbing (+RequiresAuth/AuthProvider); proxy closures adapted;
goproxy strips git+ prefix from UpstreamURL
- H4: scanner normalizes bypass package names; CheckVulnerabilities builds normalized packageKey
- M4: requireAdmin routes through extractAPIKey -> ValidateAPIKey -> admin role check
- M5: network client keeps only final RecordFailure (one count per attempt cycle)
- M3: normalizeOriginHost + buildCheckOrigin rewrite; origin_test.go added
- M1: app lifecycle cancel func; Run -> Shutdown on listen error (sole cache owner); JoinHostPort
- M6: VulnerabilityThresholds defaults all -1 so BlockOnSeverity governs
- L4: metadata.NormalizeSeverity at 4 severity-count sites (MEDIUM->MODERATE consistency)
- L1: handleDeleteBypass uses structured *errors.Error + ErrCodeNotFound
- L2: pypi extractVersionFromFilename (wheel/2nd segment, non-wheel/last digit segment);
cacheVersion uses full unique basename; regression tests added
- L5: document per-instance ValidationCache key scoping; rename packageURL param to resource
All: go build ./... && go vet ./... && go test ./... pass; golangci-lint clean.
2026-09-04 14:24:13 +01:00
edeb2eca0c
chore(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3 in the go_modules group across 1 directory ( #36 )
...
* chore(deps): bump google.golang.org/grpc
Bumps the go_modules group with 1 update in the / directory: [google.golang.org/grpc](https://github.com/grpc/grpc-go ).
Updates `google.golang.org/grpc` from 1.78.0 to 1.79.3
- [Release notes](https://github.com/grpc/grpc-go/releases )
- [Commits](https://github.com/grpc/grpc-go/compare/v1.78.0...v1.79.3 )
---
updated-dependencies:
- dependency-name: google.golang.org/grpc
dependency-version: 1.79.3
dependency-type: indirect
dependency-group: go_modules
...
Signed-off-by: dependabot[bot] <[email protected] [email protected] [email protected] [email protected] [email protected]
2026-09-03 11:16:29 +01:00
7fb596aafd
chore(deps): bump axios ( #14 )
...
Bumps the npm_and_yarn group with 1 update in the /frontend directory: [axios](https://github.com/axios/axios ).
Updates `axios` from 1.13.2 to 1.13.5
- [Release notes](https://github.com/axios/axios/releases )
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md )
- [Commits](https://github.com/axios/axios/compare/v1.13.2...v1.13.5 )
---
updated-dependencies:
- dependency-name: axios
dependency-version: 1.13.5
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <[email protected]
2026-09-03 10:47:50 +01:00
lukaszraczylo and GitHub
eb4517a45d
Update go.mod and go.sum ( #127 )
2026-09-03 05:32:05 +01:00
lukaszraczylo and GitHub
fa1b8cf6c4
Update go.mod and go.sum ( #126 )
2026-09-02 04:20:02 +01:00
lukaszraczylo and GitHub
a5ac6f41e2
Update go.mod and go.sum ( #125 )
2026-09-01 04:20:37 +01:00
lukaszraczylo and GitHub
7de67d6a7a
Update go.mod and go.sum ( #124 )
2026-08-29 04:17:50 +01:00
lukaszraczylo and GitHub
db5dfef2d5
Update go.mod and go.sum ( #123 )
2026-08-28 06:49:21 +01:00
lukaszraczylo and GitHub
b6a0a0800f
Update go.mod and go.sum ( #122 )
2026-08-27 05:55:12 +01:00
lukaszraczylo and GitHub
36b99d528e
Update go.mod and go.sum ( #121 )
2026-08-26 04:25:36 +01:00
lukaszraczylo and GitHub
601455cb9b
Update go.mod and go.sum ( #120 )
2026-08-22 04:20:58 +01:00
lukaszraczylo and GitHub
e0a489e471
Update go.mod and go.sum ( #119 )
2026-08-21 04:25:00 +01:00
lukaszraczylo and GitHub
aa4b79ab0c
Update go.mod and go.sum ( #118 )
2026-08-18 04:21:39 +01:00
lukaszraczylo and GitHub
8db5aa099b
Update go.mod and go.sum ( #117 )
2026-08-15 04:18:04 +01:00
lukaszraczylo and GitHub
47f63e3b06
Update go.mod and go.sum ( #116 )
2026-08-13 04:51:47 +01:00
lukaszraczylo and GitHub
43f23900e0
Update go.mod and go.sum ( #115 )
2026-08-12 04:48:48 +01:00
lukaszraczylo and GitHub
3a113557cd
Update go.mod and go.sum ( #114 )
2026-08-11 04:36:08 +01:00
lukaszraczylo and GitHub
22163595fd
Update go.mod and go.sum ( #113 )
2026-08-08 04:35:19 +01:00
lukaszraczylo and GitHub
4dc7e2fcfb
Update go.mod and go.sum ( #112 )
2026-08-07 05:01:46 +01:00
lukaszraczylo and GitHub
557ebc8410
Update go.mod and go.sum ( #111 )
2026-08-06 05:05:19 +01:00
lukaszraczylo and GitHub
2c82cd8a7a
Update go.mod and go.sum ( #110 )
2026-08-04 06:51:26 +01:00
lukaszraczylo and GitHub
47cc2900a6
Update go.mod and go.sum ( #109 )
2026-08-01 06:58:29 +01:00
lukaszraczylo and GitHub
c6e7c0d4c8
Update go.mod and go.sum ( #108 )
2026-07-30 06:45:43 +01:00
lukaszraczylo and GitHub
c6ad90f742
Update go.mod and go.sum ( #107 )
2026-07-29 06:56:36 +01:00
lukaszraczylo and GitHub
dfc7d0c917
Update go.mod and go.sum ( #106 )
2026-07-28 06:51:45 +01:00
lukaszraczylo and GitHub
4442cb3062
Update go.mod and go.sum ( #105 )
2026-07-27 07:33:24 +01:00
lukaszraczylo and GitHub
3ce6d274d5
Update go.mod and go.sum ( #104 )
2026-07-25 06:48:25 +01:00
lukaszraczylo and GitHub
ce7cb769b3
Update go.mod and go.sum ( #103 )
2026-07-24 06:54:19 +01:00
lukaszraczylo and GitHub
f3a210fd8d
Update go.mod and go.sum ( #102 )
2026-07-23 06:59:04 +01:00
lukaszraczylo and GitHub
c7f05c426f
Update go.mod and go.sum ( #101 )
2026-07-22 06:55:12 +01:00
lukaszraczylo and GitHub
bd3e8f024c
Update go.mod and go.sum ( #100 )
2026-07-21 06:54:11 +01:00
lukaszraczylo and GitHub
c390074f1c
Update go.mod and go.sum ( #99 )
2026-07-17 06:46:38 +01:00
lukaszraczylo and GitHub
43d39bb07a
Update go.mod and go.sum ( #98 )
2026-07-14 06:35:56 +01:00
lukaszraczylo and GitHub
a95cd85155
Update go.mod and go.sum ( #97 )
2026-07-13 07:23:08 +01:00
lukaszraczylo and GitHub
d48079e859
Update go.mod and go.sum ( #96 )
2026-07-11 05:05:30 +01:00
lukaszraczylo
12a629c652
fixup! feat: comprehensive audit + Tier 3 wiring (security/correctness/features)
2026-07-10 09:38:46 +01:00
lukaszraczylo
e39d6a0f0d
feat: comprehensive audit + Tier 3 wiring (security/correctness/features)
...
Multi-agent audit + fix pass covering bugs, security, dead config wiring,
and missing features. All quality gates green: build/vet/test -race/govulncheck/
golangci-lint. Frontend tests 47/47.
SECURITY & CORRECTNESS
- Scanner pipeline fail-closed: cache.go scan timeout now 503 (was goto servePkg);
scanner.go all-scanners-fail saves ScanStatusError; CheckVulnerabilities blocks
on missing/error result instead of allowing.
- Scanner argv corrections: govulncheck source-mode + go.mod discovery;
npm-audit generates lockfile via npm install --package-lock-only --ignore-scripts;
pip-audit per-extension dispatch (wheel direct / sdist extract+pyproject).
- GHSA version-range filtering implemented (was always-include); url.QueryEscape
on package name.
- pypi SSRF closed via host allowlist on original_url; url.QueryEscape on
rewriteURL output.
- Path traversal: cache temp file uses os.CreateTemp; smb keyToPath sanitized;
filesystem keyToPath returns error + filepath.Abs prefix-verify.
- Goroutine leaks plugged: cache.cleanupWorker stop channel; auth.ValidationCache
Stop() with sync.Once; ws.unregister buffered with non-blocking send.
- WebSocket double-close panic fixed via sync.Once Client.closeSend().
- Race conditions: gormstore.registryCache sync.RWMutex (was concurrent map
panic); auth.LastUsedAt no longer mutated under RLock; analytics strict
lock-ordering invariant (statsMu before downloadsMu).
- Auth validator fails CLOSED on transport/unknown-status errors (was returning
true,err 'allow cache fallback').
- Credential cache hash full SHA256 (was 8-byte truncate; eliminates 2^32
collision risk).
- filesystem.fs.used incremented after successful rename (no quota inflation
race).
- gormstore aggregation events deleted in same tx as insert (no double-counting).
- gormstore.SavePackage uses Updates(map) so zero-value security flags
(RequiresAuth=false) can be cleared.
- partition_manager validates partition name regex before DROP TABLE.
- vcs/git: version regex validation rejects --option-injection; checkout uses
--detach -- separator; removed TrimPrefix(repo,'v') that corrupted vault/
vitess/vim-go.
- WebSocket CheckOrigin allowlist (was return true; CSWSH closed); same-origin
default + ServerConfig.AllowedOrigins.
- fiber CVE GO-2026-4543 patched (v2.52.10 -> v2.52.12).
FUNCTIONAL FEATURES
- API key DB persistence: APIKeyModel + migration 202604280002, full CRUD,
async LastUsedAt updates with WaitGroup-tracked goroutines drained on Close.
- Admin bootstrap via GOHOARDER_BOOTSTRAP_ADMIN_KEY env var; idempotent
(skipped when non-revoked admin already exists).
- Auth middleware factory in pkg/app: RequireAuth, RequireRole, RequirePermission,
OptionalAuth. Mounted on proxy + read APIs when Auth.Enabled=true.
DELETE /api/packages/* requires admin role. /health public for k8s probes.
- NFS storage backend: pkg/storage/nfs wraps filesystem with /proc/mounts
detection (Linux), post-write fsync, read-after-write health probe.
- WebSocket real-time pipeline: pkg/events Broadcaster interface; cache + scanner
managers emit EventPackageCached / EventPackageDownloaded / EventScanComplete;
app.go runs 30s EventStatsUpdate ticker. Frontend has full WS client (reconnect
with exponential backoff 1s->30s, 25s heartbeat, subscriber pattern), Pinia
realtime store, Dashboard live indicator + activity feed + reactive stats
override.
- TLS termination: fiber.ListenTLS when Server.TLS.Enabled.
- Pre-warming: Prewarming.Enabled flag wired (was hardcoded false); Interval,
MaxConcurrent, TopPackages plumbed.
- NetworkConfig wired (timeouts, retry, rate-limit, circuit-breaker).
- AuthConfig.BcryptCost wired.
- Security.Scanners.Static.MaxPackageSize plumbed to cache.io.LimitReader.
- Handlers.{Go,NPM,PyPI}.Enabled gates route mounting.
- Graceful shutdown: authManager.Close drains async writes.
LINT/HYGIENE
- 80 golangci-lint issues resolved: errcheck (Close/Write/RemoveAll wrapped),
gofmt, gosec G104/G306, govet shadow renames + fieldalignment reorders,
staticcheck ST1000 pkg comments + QF1003 tagged switches + QF1008 embedded
field selectors + QF1001 De Morgan's law.
BEHAVIOR CHANGES
- Scanner now fail-closed: deployments without scanner binaries
(trivy/govulncheck/npm-audit/pip-audit/grype) BLOCK packages instead of
serving unscanned. Add binaries or plan a future allow-on-scan-error flag.
- WS origin defaults to same-origin; cross-origin dashboards must set
server.allowed_origins.
- Validator no longer fails open; private packages won't serve from cache when
validation can't be performed.
- download_events retention dropped from 24h to ~5min (deleted in agg tx).
Migration 202604280001 purges pre-upgrade events.
- DELETE /api/packages/* requires admin role when auth enabled.
NEW PACKAGES
- pkg/events - Broadcaster interface
- pkg/storage/nfs - NFS-aware filesystem wrapper
DEFERRED (out of scope this pass)
- Static scanner implementation (config defines AllowedLicenses/MaxPackageSize/
BlockSuspicious but pkg/scanner/static/ does not exist).
- AuthConfig.AuditLog wiring (no audit log infra yet).
- CacheConfig.TTLOverrides passthrough (would touch cache.Config beyond
integrator scope).
2026-07-10 09:37:55 +01:00
lukaszraczylo
3c8b3eb46c
fixup! fix: exclude Go module metadata files from package count stats
2026-07-10 09:35:45 +01:00
lukaszraczylo
c8bc8eca8f
fix: exclude Go module metadata files from package count stats
...
The dashboard was showing 335 packages while the packages page showed 141
because GetStats was counting .mod and .info files as separate packages.
Changes:
- Filter out .mod and .info files in GetStats query
- Now only counts actual packages (.zip files)
- Dashboard and packages page counts will match
This fixes the discrepancy where:
- Dashboard (/api/stats): was 335, now will be ~141
- Packages page (/api/packages): already 141 (deduplicated)
Resolves: "Dashboard showing 335 packages but /packages showing 141"
2026-07-10 09:35:45 +01:00
lukaszraczylo
d5979a8b88
fix: skip scanning Go module metadata files (.mod, .info)
...
Go module metadata files (.mod and .info) are not actual packages
and should not be scanned for vulnerabilities. Only .zip files
contain the actual module code.
Changes:
- Added .mod and .info suffix checks to isMetadataEntry filter
- These files are now excluded from database storage
- Scanner won't attempt to scan them during rescan cycles
This fixes OSV scanner 404 errors for metadata files like:
- github.com/mattn/go-isatty/@v/v0.0.20.mod
- github.com/clipperhouse/stringish/@v/v0.1.1.info
Resolves: OSV API errors "The current request is not defined by this API"
for Go module metadata files
2026-07-10 09:35:45 +01:00
lukaszraczyloandGitHub