github-actions[bot] and GitHub
436633bc68
chore(deps): update dependencies
...
Automated dependency update. All tests passed.
2026-10-03 16:12:39 +00:00
lukaszraczylo and GitHub
8fae680cbe
Update go.mod and go.sum ( #151 )
2026-10-03 04:29:22 +01:00
b172788741
fix(frontend): override vulnerable transitive dependencies ( #150 )
...
Dependabot security updates report update_not_possible because the
vulnerable packages are transitive and their parents pin them. The
Dependabot job fails on every run.
pnpm overrides raise minimatch to 9.0.9, esbuild to 0.28.2 and
postcss-selector-parser to 6.1.4. All three versions are older than the
seven day minimum release age. pnpm audit reports no known
vulnerabilities. The build and the 47 tests pass.
Co-authored-by: copilot-swe-agent[bot] <[email protected]
2026-10-03 00:56:29 +01:00
lukaszraczylo
48c12a4869
fix(deps): override vulnerable frontend packages
...
Dependabot could not raise esbuild, minimatch and postcss-selector-parser, because their parents pin older ranges. The workspace now overrides them to the patched versions. The frontend builds and its tests pass.
2026-10-03 00:30:11 +01:00
8396284de3
chore(deps): bump the npm_and_yarn group across 1 directory with 8 updates ( #148 )
...
Bumps the npm_and_yarn group with 8 updates in the /frontend directory:
| Package | From | To |
| --- | --- | --- |
| [axios](https://github.com/axios/axios ) | `1.18.0` | `1.20.0` |
| [@vitest/mocker](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker ) | `4.1.0` | `5.0.3` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion ) | `2.0.2` | `2.1.7` |
| [browserslist](https://github.com/browserslist/browserslist ) | `4.28.1` | `4.29.3` |
| [defu](https://github.com/unjs/defu ) | `6.1.4` | `6.1.7` |
| [js-cookie](https://github.com/js-cookie/js-cookie ) | `3.0.5` | `3.0.8` |
| [picomatch](https://github.com/micromatch/picomatch ) | `2.3.1` | `2.3.2` |
| [ws](https://github.com/websockets/ws ) | `8.18.3` | `8.22.0` |
Updates `axios` from 1.18.0 to 1.20.0
- [Release notes](https://github.com/axios/axios/releases )
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md )
- [Commits](https://github.com/axios/axios/compare/v1.18.0...v1.20.0 )
Updates `@vitest/mocker` from 4.1.0 to 5.0.3
- [Release notes](https://github.com/vitest-dev/vitest/releases )
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md )
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.3/packages/mocker )
Updates `brace-expansion` from 2.0.2 to 2.1.7
- [Release notes](https://github.com/juliangruber/brace-expansion/releases )
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v2.0.2...v2.1.7 )
Updates `browserslist` from 4.28.1 to 4.29.3
- [Release notes](https://github.com/browserslist/browserslist/releases )
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md )
- [Commits](https://github.com/browserslist/browserslist/compare/4.28.1...4.29.3 )
Updates `defu` from 6.1.4 to 6.1.7
- [Release notes](https://github.com/unjs/defu/releases )
- [Changelog](https://github.com/unjs/defu/blob/main/CHANGELOG.md )
- [Commits](https://github.com/unjs/defu/compare/v6.1.4...v6.1.7 )
Updates `js-cookie` from 3.0.5 to 3.0.8
- [Release notes](https://github.com/js-cookie/js-cookie/releases )
- [Commits](https://github.com/js-cookie/js-cookie/compare/v3.0.5...v3.0.8 )
Updates `picomatch` from 2.3.1 to 2.3.2
- [Release notes](https://github.com/micromatch/picomatch/releases )
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md )
- [Commits](https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2 )
Updates `ws` from 8.18.3 to 8.22.0
- [Release notes](https://github.com/websockets/ws/releases )
- [Commits](https://github.com/websockets/ws/compare/8.18.3...8.22.0 )
---
updated-dependencies:
- dependency-name: axios
dependency-version: 1.20.0
dependency-type: direct:production
dependency-group: npm_and_yarn
- dependency-name: "@vitest/mocker"
dependency-version: 5.0.3
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: brace-expansion
dependency-version: 2.1.7
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: browserslist
dependency-version: 4.29.3
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: defu
dependency-version: 6.1.7
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: js-cookie
dependency-version: 3.0.8
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: picomatch
dependency-version: 2.3.2
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: ws
dependency-version: 8.22.0
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <[email protected]
2026-10-02 13:56:28 +01:00
d57a21817b
chore(deps): bump go.opentelemetry.io/otel/sdk ( #149 )
...
Bumps the go_modules group with 1 update in the / directory: [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go ).
Updates `go.opentelemetry.io/otel/sdk` from 1.44.0 to 1.45.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases )
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md )
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.44.0...v1.45.0 )
---
updated-dependencies:
- dependency-name: go.opentelemetry.io/otel/sdk
dependency-version: 1.45.0
dependency-type: indirect
dependency-group: go_modules
...
Signed-off-by: dependabot[bot] <[email protected]
2026-10-02 13:56:19 +01:00
lukaszraczylo
1ebb4cfd95
fix(smb): use the cloudsoda go-smb2 fork
...
hirochachacha/go-smb2 has no fix for GO-2026-5051, an out-of-bounds read in ReadDir that govulncheck reports as called from walkPath. The cloudsoda fork carries the fix. Dialer.DialConn replaces Dial.
2026-10-02 13:24:13 +01:00
lukaszraczylo
8112b4859f
fix(auth): restore ValidationCache.Stop
...
Stop was deleted while its field and doc comment stayed. The cleanup goroutine could not be stopped, and staticcheck flagged stopOnce as unused.
2026-10-02 13:23:58 +01:00
a412b61d8d
chore(deps): bump the npm_and_yarn group across 1 directory with 8 updates ( #128 )
...
Bumps the npm_and_yarn group with 4 updates in the /frontend directory: [axios](https://github.com/axios/axios ), [postcss](https://github.com/postcss/postcss ), [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite ) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest ).
Updates `axios` from 1.13.5 to 1.18.0
- [Release notes](https://github.com/axios/axios/releases )
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md )
- [Commits](https://github.com/axios/axios/compare/v1.13.5...v1.18.0 )
Updates `postcss` from 8.5.6 to 8.5.23
- [Release notes](https://github.com/postcss/postcss/releases )
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md )
- [Commits](https://github.com/postcss/postcss/compare/8.5.6...8.5.23 )
Updates `vite` from 7.3.0 to 7.3.5
- [Release notes](https://github.com/vitejs/vite/releases )
- [Changelog](https://github.com/vitejs/vite/blob/v7.3.5/packages/vite/CHANGELOG.md )
- [Commits](https://github.com/vitejs/vite/commits/v7.3.5/packages/vite )
Updates `vitest` from 4.0.16 to 4.1.0
- [Release notes](https://github.com/vitest-dev/vitest/releases )
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md )
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.0/packages/vitest )
Updates `follow-redirects` from 1.15.11 to 1.16.0
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases )
- [Commits](https://github.com/follow-redirects/follow-redirects/compare/v1.15.11...v1.16.0 )
Updates `form-data` from 4.0.5 to 4.0.6
- [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md )
- [Commits](https://github.com/form-data/form-data/compare/v4.0.5...v4.0.6 )
Updates `nanoid` from 3.3.11 to 3.3.18
- [Release notes](https://github.com/ai/nanoid/releases )
- [Changelog](https://github.com/ai/nanoid/blob/3.3.18/CHANGELOG.md )
- [Commits](https://github.com/ai/nanoid/compare/3.3.11...3.3.18 )
Updates `rollup` from 4.54.0 to 4.63.1
- [Release notes](https://github.com/rollup/rollup/releases )
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md )
- [Commits](https://github.com/rollup/rollup/compare/v4.54.0...v4.63.1 )
---
updated-dependencies:
- dependency-name: axios
dependency-version: 1.18.0
dependency-type: direct:production
dependency-group: npm_and_yarn
- dependency-name: postcss
dependency-version: 8.5.23
dependency-type: direct:development
dependency-group: npm_and_yarn
- dependency-name: vite
dependency-version: 7.3.5
dependency-type: direct:development
dependency-group: npm_and_yarn
- dependency-name: vitest
dependency-version: 4.1.0
dependency-type: direct:development
dependency-group: npm_and_yarn
- dependency-name: follow-redirects
dependency-version: 1.16.0
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: form-data
dependency-version: 4.0.6
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: nanoid
dependency-version: 3.3.18
dependency-type: indirect
dependency-group: npm_and_yarn
- dependency-name: rollup
dependency-version: 4.63.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <[email protected]
2026-10-02 13:14:56 +01:00
cbfb16aebd
chore(deps): bump the go_modules group across 1 directory with 3 updates ( #129 )
...
Bumps the go_modules group with 3 updates in the / directory: [github.com/moby/go-archive](https://github.com/moby/go-archive ), [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go ) and [google.golang.org/grpc](https://github.com/grpc/grpc-go ).
Updates `github.com/moby/go-archive` from 0.2.0 to 0.3.0
- [Release notes](https://github.com/moby/go-archive/releases )
- [Changelog](https://github.com/moby/go-archive/blob/main/changes_test.go )
- [Commits](https://github.com/moby/go-archive/compare/v0.2.0...v0.3.0 )
Updates `go.opentelemetry.io/otel` from 1.39.0 to 1.41.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases )
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md )
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.39.0...v1.41.0 )
Updates `google.golang.org/grpc` from 1.79.3 to 1.83.2
- [Release notes](https://github.com/grpc/grpc-go/releases )
- [Commits](https://github.com/grpc/grpc-go/compare/v1.79.3...v1.83.2 )
---
updated-dependencies:
- dependency-name: github.com/moby/go-archive
dependency-version: 0.3.0
dependency-type: indirect
- dependency-name: go.opentelemetry.io/otel
dependency-version: 1.41.0
dependency-type: indirect
- dependency-name: google.golang.org/grpc
dependency-version: 1.83.1
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <[email protected]
2026-10-02 13:14:41 +01:00
lukaszraczylo
854245c4f3
ci: push benchmark data to gh-pages
...
The action wrote results to a local gh-pages branch and never pushed them. The next step then failed because docs/bench does not exist on main. The action now pushes gh-pages itself, and the manual push step is gone.
2026-10-02 12:43:30 +01:00
lukaszraczylo
d96e724755
build(frontend): allow esbuild and vue-demi build scripts
...
pnpm 11 stops a frozen install when a dependency build script is not approved.
2026-10-02 12:04:18 +01:00
lukaszraczylo
d0b3d82508
ci: build with Go 1.27 and grant PR checks access
...
go.mod needs Go 1.26 but the workflows pinned Go 1.25. The pull request workflow also lacked the permissions that the shared workflow requires, so it never started.
2026-10-02 12:04:17 +01:00
lukaszraczylo and GitHub
6d4ce976c7
Update go.mod and go.sum ( #147 )
2026-10-01 04:24:41 +01:00
lukaszraczylo and GitHub
d760757c46
Update go.mod and go.sum ( #146 )
2026-09-30 04:23:17 +01:00
lukaszraczylo and GitHub
67d87ed66b
Update go.mod and go.sum ( #145 )
2026-09-29 04:20:53 +01:00
lukaszraczylo and GitHub
22fc1b454b
Update go.mod and go.sum ( #144 )
2026-09-28 04:23:33 +01:00
lukaszraczylo and GitHub
2c483445a1
Update go.mod and go.sum ( #143 )
2026-09-26 04:19:22 +01:00
lukaszraczylo and GitHub
f5beaea3e0
Update go.mod and go.sum ( #142 )
2026-09-25 04:19:21 +01:00
lukaszraczylo and GitHub
4d61ed1557
Update go.mod and go.sum ( #141 )
2026-09-24 04:18:16 +01:00
lukaszraczylo and GitHub
f1bcfa02f5
Update go.mod and go.sum ( #140 )
2026-09-22 04:19:59 +01:00
lukaszraczylo and GitHub
16e09c0515
Update go.mod and go.sum ( #139 )
2026-09-19 04:17:35 +01:00
lukaszraczylo and GitHub
0ff7719d8a
Update go.mod and go.sum ( #138 )
2026-09-16 04:20:31 +01:00
lukaszraczylo and GitHub
1d7ee6c27b
Update go.mod and go.sum ( #137 )
2026-09-15 04:18:48 +01:00
lukaszraczylo and GitHub
e00233943b
Update go.mod and go.sum ( #136 )
2026-09-12 04:19:03 +01:00
lukaszraczylo and GitHub
6c2448bb03
Update go.mod and go.sum ( #135 )
2026-09-11 04:19:38 +01:00
lukaszraczylo and GitHub
a511c380ba
Update go.mod and go.sum ( #134 )
2026-09-10 04:20:11 +01:00
lukaszraczylo and GitHub
fa66501e5c
Update go.mod and go.sum ( #133 )
2026-09-09 04:21:00 +01:00
lukaszraczylo and GitHub
35ea5b8a5b
Update go.mod and go.sum ( #132 )
2026-09-08 04:18:09 +01:00
lukaszraczylo and GitHub
e5d7242dc1
Update go.mod and go.sum ( #131 )
2026-09-06 04:19:50 +01:00
lukaszraczylo and GitHub
3c994687ff
Update go.mod and go.sum ( #130 )
2026-09-05 04:19:01 +01:00
lukaszraczylo
171386f7a7
fix: remediate severity-ordered review findings across cache, scanners, and proxies
...
- H2: gormstore soft-delete + storage_key UNIQUE collision; re-save after eviction succeeds
- H1: cache getOrFetch cache-hit branch no longer runs CheckVulnerabilities on metadata entries
- M2: cache store() streams upstream body to temp file + SHA256 instead of double-buffering
- H3/L3: FetchResult/FetchFunc plumbing (+RequiresAuth/AuthProvider); proxy closures adapted;
goproxy strips git+ prefix from UpstreamURL
- H4: scanner normalizes bypass package names; CheckVulnerabilities builds normalized packageKey
- M4: requireAdmin routes through extractAPIKey -> ValidateAPIKey -> admin role check
- M5: network client keeps only final RecordFailure (one count per attempt cycle)
- M3: normalizeOriginHost + buildCheckOrigin rewrite; origin_test.go added
- M1: app lifecycle cancel func; Run -> Shutdown on listen error (sole cache owner); JoinHostPort
- M6: VulnerabilityThresholds defaults all -1 so BlockOnSeverity governs
- L4: metadata.NormalizeSeverity at 4 severity-count sites (MEDIUM->MODERATE consistency)
- L1: handleDeleteBypass uses structured *errors.Error + ErrCodeNotFound
- L2: pypi extractVersionFromFilename (wheel/2nd segment, non-wheel/last digit segment);
cacheVersion uses full unique basename; regression tests added
- L5: document per-instance ValidationCache key scoping; rename packageURL param to resource
All: go build ./... && go vet ./... && go test ./... pass; golangci-lint clean.
2026-09-04 14:24:13 +01:00
edeb2eca0c
chore(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3 in the go_modules group across 1 directory ( #36 )
...
* chore(deps): bump google.golang.org/grpc
Bumps the go_modules group with 1 update in the / directory: [google.golang.org/grpc](https://github.com/grpc/grpc-go ).
Updates `google.golang.org/grpc` from 1.78.0 to 1.79.3
- [Release notes](https://github.com/grpc/grpc-go/releases )
- [Commits](https://github.com/grpc/grpc-go/compare/v1.78.0...v1.79.3 )
---
updated-dependencies:
- dependency-name: google.golang.org/grpc
dependency-version: 1.79.3
dependency-type: indirect
dependency-group: go_modules
...
Signed-off-by: dependabot[bot] <[email protected] [email protected] [email protected] [email protected] [email protected]
2026-09-03 11:16:29 +01:00
7fb596aafd
chore(deps): bump axios ( #14 )
...
Bumps the npm_and_yarn group with 1 update in the /frontend directory: [axios](https://github.com/axios/axios ).
Updates `axios` from 1.13.2 to 1.13.5
- [Release notes](https://github.com/axios/axios/releases )
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md )
- [Commits](https://github.com/axios/axios/compare/v1.13.2...v1.13.5 )
---
updated-dependencies:
- dependency-name: axios
dependency-version: 1.13.5
dependency-type: direct:production
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <[email protected]
2026-09-03 10:47:50 +01:00
lukaszraczylo and GitHub
eb4517a45d
Update go.mod and go.sum ( #127 )
2026-09-03 05:32:05 +01:00
lukaszraczylo and GitHub
fa1b8cf6c4
Update go.mod and go.sum ( #126 )
2026-09-02 04:20:02 +01:00
lukaszraczylo and GitHub
a5ac6f41e2
Update go.mod and go.sum ( #125 )
2026-09-01 04:20:37 +01:00
lukaszraczylo and GitHub
7de67d6a7a
Update go.mod and go.sum ( #124 )
2026-08-29 04:17:50 +01:00
lukaszraczylo and GitHub
db5dfef2d5
Update go.mod and go.sum ( #123 )
2026-08-28 06:49:21 +01:00
lukaszraczylo and GitHub
b6a0a0800f
Update go.mod and go.sum ( #122 )
2026-08-27 05:55:12 +01:00
lukaszraczylo and GitHub
36b99d528e
Update go.mod and go.sum ( #121 )
2026-08-26 04:25:36 +01:00
lukaszraczylo and GitHub
601455cb9b
Update go.mod and go.sum ( #120 )
2026-08-22 04:20:58 +01:00
lukaszraczylo and GitHub
e0a489e471
Update go.mod and go.sum ( #119 )
2026-08-21 04:25:00 +01:00
lukaszraczylo and GitHub
aa4b79ab0c
Update go.mod and go.sum ( #118 )
2026-08-18 04:21:39 +01:00
lukaszraczylo and GitHub
8db5aa099b
Update go.mod and go.sum ( #117 )
2026-08-15 04:18:04 +01:00
lukaszraczylo and GitHub
47f63e3b06
Update go.mod and go.sum ( #116 )
2026-08-13 04:51:47 +01:00
lukaszraczylo and GitHub
43f23900e0
Update go.mod and go.sum ( #115 )
2026-08-12 04:48:48 +01:00
lukaszraczylo and GitHub
3a113557cd
Update go.mod and go.sum ( #114 )
2026-08-11 04:36:08 +01:00
lukaszraczylo and GitHub
22163595fd
Update go.mod and go.sum ( #113 )
2026-08-08 04:35:19 +01:00
lukaszraczylo and GitHub
4dc7e2fcfb
Update go.mod and go.sum ( #112 )
2026-08-07 05:01:46 +01:00
lukaszraczyloandGitHub