lukaszraczylo/gohoarder
1
0
Fork 0
mirror of https://github.com/lukaszraczylo/gohoarder.git synced 2026-10-12 00:45:16 +00:00
Code Issues Packages Projects Releases Wiki Activity
225 Commits 2 Branches 174 Tags
cc7d822a0a0df350f2246f7b1d90258ec97378cb
Commit Graph
225 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
github-actions[bot]andGitHub cc7d822a0a chore(deps): update dependency postcss-selector-parser@<6.1.4 to v7 
Automated dependency update. All tests passed.
v0.1.221 		2026-10-03 16:50:54 +00:00
github-actions[bot]andGitHub 30e113fbbe chore(deps): update dependency minimatch@<9.0.9 to v10 
Automated dependency update. All tests passed.
 2026-10-03 16:48:32 +00:00
github-actions[bot]andGitHub cbceb6101b chore(deps): update dependency marked to v18 
Automated dependency update. All tests passed.
 2026-10-03 16:47:22 +00:00
github-actions[bot]andGitHub 3b6d2e7258 chore(deps): update dependency jsdom to v30 
Automated dependency update. All tests passed.
 2026-10-03 16:45:11 +00:00
github-actions[bot]andGitHub 328f764024 chore(deps): update module github.com/gofiber/fiber/v2 to v3 
Automated dependency update. All tests passed.
 2026-10-03 16:44:01 +00:00
github-actions[bot]andGitHub 8f5ed9c972 chore(deps): update module github.com/cenkalti/backoff/v4 to v7 
Automated dependency update. All tests passed.
 2026-10-03 16:39:46 +00:00
github-actions[bot]andGitHub 21d004eae9 chore(deps): update dependencies 
Automated dependency update. All tests passed.
 2026-10-03 16:35:25 +00:00
github-actions[bot]andGitHub 436633bc68 chore(deps): update dependencies 
Automated dependency update. All tests passed.
v0.1.214 		2026-10-03 16:12:39 +00:00
lukaszraczyloandGitHub 8fae680cbe Update go.mod and go.sum (#151) v0.1.213 2026-10-03 04:29:22 +01:00
lukaszraczyloGitHubcopilot-swe-agent[bot] <[email protected]>
 		b172788741 fix(frontend): override vulnerable transitive dependencies (#150) 
Dependabot security updates report update_not_possible because the
vulnerable packages are transitive and their parents pin them. The
Dependabot job fails on every run.

pnpm overrides raise minimatch to 9.0.9, esbuild to 0.28.2 and
postcss-selector-parser to 6.1.4. All three versions are older than the
seven day minimum release age. pnpm audit reports no known
vulnerabilities. The build and the 47 tests pass.

Co-authored-by: copilot-swe-agent[bot] <[email protected]>
 2026-10-03 00:56:29 +01:00
lukaszraczylo 48c12a4869 fix(deps): override vulnerable frontend packages 
Dependabot could not raise esbuild, minimatch and postcss-selector-parser, because their parents pin older ranges. The workspace now overrides them to the patched versions. The frontend builds and its tests pass.
 2026-10-03 00:30:11 +01:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		8396284de3 chore(deps): bump the npm_and_yarn group across 1 directory with 8 updates (#148) 
Bumps the npm_and_yarn group with 8 updates in the /frontend directory:

| Package | From | To |
| --- | --- | --- |
| [axios](https://github.com/axios/axios) | `1.18.0` | `1.20.0` |
| [@vitest/mocker](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker) | `4.1.0` | `5.0.3` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `2.0.2` | `2.1.7` |
| [browserslist](https://github.com/browserslist/browserslist) | `4.28.1` | `4.29.3` |
| [defu](https://github.com/unjs/defu) | `6.1.4` | `6.1.7` |
| [js-cookie](https://github.com/js-cookie/js-cookie) | `3.0.5` | `3.0.8` |
| [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `2.3.2` |
| [ws](https://github.com/websockets/ws) | `8.18.3` | `8.22.0` |



Updates `axios` from 1.18.0 to 1.20.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](https://github.com/axios/axios/compare/v1.18.0...v1.20.0)

Updates `@vitest/mocker` from 4.1.0 to 5.0.3
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.3/packages/mocker)

Updates `brace-expansion` from 2.0.2 to 2.1.7
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v2.0.2...v2.1.7)

Updates `browserslist` from 4.28.1 to 4.29.3
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](https://github.com/browserslist/browserslist/compare/4.28.1...4.29.3)

Updates `defu` from 6.1.4 to 6.1.7
- [Release notes](https://github.com/unjs/defu/releases)
- [Changelog](https://github.com/unjs/defu/blob/main/CHANGELOG.md)
- [Commits](https://github.com/unjs/defu/compare/v6.1.4...v6.1.7)

Updates `js-cookie` from 3.0.5 to 3.0.8
- [Release notes](https://github.com/js-cookie/js-cookie/releases)
- [Commits](https://github.com/js-cookie/js-cookie/compare/v3.0.5...v3.0.8)

Updates `picomatch` from 2.3.1 to 2.3.2
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2)

Updates `ws` from 8.18.3 to 8.22.0
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](https://github.com/websockets/ws/compare/8.18.3...8.22.0)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.20.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@vitest/mocker"
  dependency-version: 5.0.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 2.1.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: browserslist
  dependency-version: 4.29.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: defu
  dependency-version: 6.1.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-cookie
  dependency-version: 3.0.8
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 8.22.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-02 13:56:28 +01:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		d57a21817b chore(deps): bump go.opentelemetry.io/otel/sdk (#149) 
Bumps the go_modules group with 1 update in the / directory: [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go).


Updates `go.opentelemetry.io/otel/sdk` from 1.44.0 to 1.45.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.44.0...v1.45.0)

---
updated-dependencies:
- dependency-name: go.opentelemetry.io/otel/sdk
  dependency-version: 1.45.0
  dependency-type: indirect
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
v0.1.209 		2026-10-02 13:56:19 +01:00
lukaszraczylo 1ebb4cfd95 fix(smb): use the cloudsoda go-smb2 fork 
hirochachacha/go-smb2 has no fix for GO-2026-5051, an out-of-bounds read in ReadDir that govulncheck reports as called from walkPath. The cloudsoda fork carries the fix. Dialer.DialConn replaces Dial.
v0.1.208 		2026-10-02 13:24:13 +01:00
lukaszraczylo 8112b4859f fix(auth): restore ValidationCache.Stop 
Stop was deleted while its field and doc comment stayed. The cleanup goroutine could not be stopped, and staticcheck flagged stopOnce as unused.
 2026-10-02 13:23:58 +01:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		a412b61d8d chore(deps): bump the npm_and_yarn group across 1 directory with 8 updates (#128) 
Bumps the npm_and_yarn group with 4 updates in the /frontend directory: [axios](https://github.com/axios/axios), [postcss](https://github.com/postcss/postcss), [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest).


Updates `axios` from 1.13.5 to 1.18.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](https://github.com/axios/axios/compare/v1.13.5...v1.18.0)

Updates `postcss` from 8.5.6 to 8.5.23
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/postcss/postcss/compare/8.5.6...8.5.23)

Updates `vite` from 7.3.0 to 7.3.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v7.3.5/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v7.3.5/packages/vite)

Updates `vitest` from 4.0.16 to 4.1.0
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.0/packages/vitest)

Updates `follow-redirects` from 1.15.11 to 1.16.0
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](https://github.com/follow-redirects/follow-redirects/compare/v1.15.11...v1.16.0)

Updates `form-data` from 4.0.5 to 4.0.6
- [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md)
- [Commits](https://github.com/form-data/form-data/compare/v4.0.5...v4.0.6)

Updates `nanoid` from 3.3.11 to 3.3.18
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/3.3.18/CHANGELOG.md)
- [Commits](https://github.com/ai/nanoid/compare/3.3.11...3.3.18)

Updates `rollup` from 4.54.0 to 4.63.1
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rollup/rollup/compare/v4.54.0...v4.63.1)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.18.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: postcss
  dependency-version: 8.5.23
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 7.3.5
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: vitest
  dependency-version: 4.1.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: follow-redirects
  dependency-version: 1.16.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: form-data
  dependency-version: 4.0.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: nanoid
  dependency-version: 3.3.18
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: rollup
  dependency-version: 4.63.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-02 13:14:56 +01:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		cbfb16aebd chore(deps): bump the go_modules group across 1 directory with 3 updates (#129) 
Bumps the go_modules group with 3 updates in the / directory: [github.com/moby/go-archive](https://github.com/moby/go-archive), [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) and [google.golang.org/grpc](https://github.com/grpc/grpc-go).


Updates `github.com/moby/go-archive` from 0.2.0 to 0.3.0
- [Release notes](https://github.com/moby/go-archive/releases)
- [Changelog](https://github.com/moby/go-archive/blob/main/changes_test.go)
- [Commits](https://github.com/moby/go-archive/compare/v0.2.0...v0.3.0)

Updates `go.opentelemetry.io/otel` from 1.39.0 to 1.41.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.39.0...v1.41.0)

Updates `google.golang.org/grpc` from 1.79.3 to 1.83.2
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](https://github.com/grpc/grpc-go/compare/v1.79.3...v1.83.2)

---
updated-dependencies:
- dependency-name: github.com/moby/go-archive
  dependency-version: 0.3.0
  dependency-type: indirect
- dependency-name: go.opentelemetry.io/otel
  dependency-version: 1.41.0
  dependency-type: indirect
- dependency-name: google.golang.org/grpc
  dependency-version: 1.83.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
v0.1.205 		2026-10-02 13:14:41 +01:00
lukaszraczylo 854245c4f3 ci: push benchmark data to gh-pages 
The action wrote results to a local gh-pages branch and never pushed them. The next step then failed because docs/bench does not exist on main. The action now pushes gh-pages itself, and the manual push step is gone.
 2026-10-02 12:43:30 +01:00
lukaszraczylo d96e724755 build(frontend): allow esbuild and vue-demi build scripts 
pnpm 11 stops a frozen install when a dependency build script is not approved.
v0.1.203 		2026-10-02 12:04:18 +01:00
lukaszraczylo d0b3d82508 ci: build with Go 1.27 and grant PR checks access 
go.mod needs Go 1.26 but the workflows pinned Go 1.25. The pull request workflow also lacked the permissions that the shared workflow requires, so it never started.
 2026-10-02 12:04:17 +01:00
lukaszraczyloandGitHub 6d4ce976c7 Update go.mod and go.sum (#147) 2026-10-01 04:24:41 +01:00
lukaszraczyloandGitHub d760757c46 Update go.mod and go.sum (#146) 2026-09-30 04:23:17 +01:00
lukaszraczyloandGitHub 67d87ed66b Update go.mod and go.sum (#145) 2026-09-29 04:20:53 +01:00
lukaszraczyloandGitHub 22fc1b454b Update go.mod and go.sum (#144) 2026-09-28 04:23:33 +01:00
lukaszraczyloandGitHub 2c483445a1 Update go.mod and go.sum (#143) 2026-09-26 04:19:22 +01:00
lukaszraczyloandGitHub f5beaea3e0 Update go.mod and go.sum (#142) 2026-09-25 04:19:21 +01:00
lukaszraczyloandGitHub 4d61ed1557 Update go.mod and go.sum (#141) 2026-09-24 04:18:16 +01:00
lukaszraczyloandGitHub f1bcfa02f5 Update go.mod and go.sum (#140) 2026-09-22 04:19:59 +01:00
lukaszraczyloandGitHub 16e09c0515 Update go.mod and go.sum (#139) 2026-09-19 04:17:35 +01:00
lukaszraczyloandGitHub 0ff7719d8a Update go.mod and go.sum (#138) 2026-09-16 04:20:31 +01:00
lukaszraczyloandGitHub 1d7ee6c27b Update go.mod and go.sum (#137) 2026-09-15 04:18:48 +01:00
lukaszraczyloandGitHub e00233943b Update go.mod and go.sum (#136) 2026-09-12 04:19:03 +01:00
lukaszraczyloandGitHub 6c2448bb03 Update go.mod and go.sum (#135) 2026-09-11 04:19:38 +01:00
lukaszraczyloandGitHub a511c380ba Update go.mod and go.sum (#134) 2026-09-10 04:20:11 +01:00
lukaszraczyloandGitHub fa66501e5c Update go.mod and go.sum (#133) 2026-09-09 04:21:00 +01:00
lukaszraczyloandGitHub 35ea5b8a5b Update go.mod and go.sum (#132) 2026-09-08 04:18:09 +01:00
lukaszraczyloandGitHub e5d7242dc1 Update go.mod and go.sum (#131) 2026-09-06 04:19:50 +01:00
lukaszraczyloandGitHub 3c994687ff Update go.mod and go.sum (#130) 2026-09-05 04:19:01 +01:00
lukaszraczylo 171386f7a7 fix: remediate severity-ordered review findings across cache, scanners, and proxies 
- H2: gormstore soft-delete + storage_key UNIQUE collision; re-save after eviction succeeds
- H1: cache getOrFetch cache-hit branch no longer runs CheckVulnerabilities on metadata entries
- M2: cache store() streams upstream body to temp file + SHA256 instead of double-buffering
- H3/L3: FetchResult/FetchFunc plumbing (+RequiresAuth/AuthProvider); proxy closures adapted;
        goproxy strips git+ prefix from UpstreamURL
- H4: scanner normalizes bypass package names; CheckVulnerabilities builds normalized packageKey
- M4: requireAdmin routes through extractAPIKey -> ValidateAPIKey -> admin role check
- M5: network client keeps only final RecordFailure (one count per attempt cycle)
- M3: normalizeOriginHost + buildCheckOrigin rewrite; origin_test.go added
- M1: app lifecycle cancel func; Run -> Shutdown on listen error (sole cache owner); JoinHostPort
- M6: VulnerabilityThresholds defaults all -1 so BlockOnSeverity governs
- L4: metadata.NormalizeSeverity at 4 severity-count sites (MEDIUM->MODERATE consistency)
- L1: handleDeleteBypass uses structured *errors.Error + ErrCodeNotFound
- L2: pypi extractVersionFromFilename (wheel/2nd segment, non-wheel/last digit segment);
      cacheVersion uses full unique basename; regression tests added
- L5: document per-instance ValidationCache key scoping; rename packageURL param to resource

All: go build ./... && go vet ./... && go test ./... pass; golangci-lint clean.
 2026-09-04 14:24:13 +01:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>copilot-swe-agent[bot] <[email protected]>lukaszraczylo
 		edeb2eca0c chore(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3 in the go_modules group across 1 directory (#36) 
* chore(deps): bump google.golang.org/grpc

Bumps the go_modules group with 1 update in the / directory: [google.golang.org/grpc](https://github.com/grpc/grpc-go).


Updates `google.golang.org/grpc` from 1.78.0 to 1.79.3
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](https://github.com/grpc/grpc-go/compare/v1.78.0...v1.79.3)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.79.3
  dependency-type: indirect
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <[email protected]>

* Resolve merge conflicts and harden storage paths

Co-authored-by: lukaszraczylo <[email protected]>

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: lukaszraczylo <[email protected]>
 2026-09-03 11:16:29 +01:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		7fb596aafd chore(deps): bump axios (#14) 
Bumps the npm_and_yarn group with 1 update in the /frontend directory: [axios](https://github.com/axios/axios).


Updates `axios` from 1.13.2 to 1.13.5
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](https://github.com/axios/axios/compare/v1.13.2...v1.13.5)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.13.5
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-03 10:47:50 +01:00
lukaszraczyloandGitHub eb4517a45d Update go.mod and go.sum (#127) 2026-09-03 05:32:05 +01:00
lukaszraczyloandGitHub fa1b8cf6c4 Update go.mod and go.sum (#126) 2026-09-02 04:20:02 +01:00
lukaszraczyloandGitHub a5ac6f41e2 Update go.mod and go.sum (#125) 2026-09-01 04:20:37 +01:00
lukaszraczyloandGitHub 7de67d6a7a Update go.mod and go.sum (#124) 2026-08-29 04:17:50 +01:00
lukaszraczyloandGitHub db5dfef2d5 Update go.mod and go.sum (#123) 2026-08-28 06:49:21 +01:00
lukaszraczyloandGitHub b6a0a0800f Update go.mod and go.sum (#122) 2026-08-27 05:55:12 +01:00
lukaszraczyloandGitHub 36b99d528e Update go.mod and go.sum (#121) v0.1.174 2026-08-26 04:25:36 +01:00
lukaszraczyloandGitHub 601455cb9b Update go.mod and go.sum (#120) v0.1.173 2026-08-22 04:20:58 +01:00
lukaszraczyloandGitHub e0a489e471 Update go.mod and go.sum (#119) v0.1.172 2026-08-21 04:25:00 +01:00