Update go.mod and go.sum (#41 )

Update go.mod and go.sum (#40 )
Update go.mod and go.sum (#39 )
2026-07-22 06:20:09 +00:00 · 2026-03-24 03:53:06 +00:00 · 2026-03-23 03:58:55 +00:00 · 2026-03-22 03:54:22 +00:00 · 2026-03-21 03:48:43 +00:00 · 2026-03-19 03:56:15 +00:00
25 changed files with 636 additions and 807 deletions
@@ -23,6 +23,12 @@ jobs:
    uses: lukaszraczylo/shared-actions/.github/workflows/go-release-cgo.yaml@main
    with:
      go-version: "1.25"
+      # Enable frontend build
+      node-enabled: true
+      node-version: "20"
+      node-build-script: "cd frontend && npm install -g pnpm && pnpm install --frozen-lockfile && pnpm run build"
+      node-output-path: "frontend/dist"
+      node-cache-dependency-path: "frontend/pnpm-lock.yaml"
    secrets: inherit

  benchmark:
@@ -7,14 +7,13 @@ project_name: gohoarder
 before:
  hooks:
    - go mod tidy
-    # Generate semantic version if not provided via git tag
-    # This script can be used by CI/CD to inject custom versions
-    # Usage: export GORELEASER_CURRENT_TAG=$(./script/generate-version.sh)
-    # - ./script/generate-version.sh
+    # Download and setup Zig for cross-compilation (Linux only)
+    - bash -c 'if [ "$(uname -s)" = "Linux" ]; then wget https://ziglang.org/download/0.15.2/zig-x86_64-linux-0.15.2.tar.xz -O /tmp/zig.tar.xz && ls -lh /tmp/zig.tar.xz && tar -xvf /tmp/zig.tar.xz -C /tmp && echo "/tmp/zig-x86_64-linux-0.15.2" >> $GITHUB_PATH; fi'

 # Build configuration
-# Builds run natively per-platform in split mode (no CGO cross-compilation)
-# Docker images also use multi-stage builds independently
+# All binaries built using Zig for consistent cross-compilation
+# Zig handles CGO cross-compilation without platform-specific toolchains
+# Binaries are injected into Docker images (no Docker compilation)
 builds:
  - id: gohoarder
    main: ./cmd/gohoarder
@@ -39,8 +38,21 @@ builds:
    ignore:
      - goos: darwin
        goarch: amd64
+    overrides:
+      # Use Zig only for Linux cross-compilation
      - goos: linux
-        goarch: arm64  # Skip linux/arm64 binaries (Docker handles multi-arch)
+        goarch: amd64
+        env:
+          - CGO_ENABLED=1
+          - CC=/tmp/zig-x86_64-linux-0.15.2/zig cc -target x86_64-linux-musl
+          - CXX=/tmp/zig-x86_64-linux-0.15.2/zig c++ -target x86_64-linux-musl
+      - goos: linux
+        goarch: arm64
+        env:
+          - CGO_ENABLED=1
+          - CC=/tmp/zig-x86_64-linux-0.15.2/zig cc -target aarch64-linux-musl
+          - CXX=/tmp/zig-x86_64-linux-0.15.2/zig c++ -target aarch64-linux-musl
+      # darwin/arm64 builds natively on macOS runner (no Zig)

  - id: migrate
    main: ./cmd/migrate
@@ -65,8 +77,21 @@ builds:
    ignore:
      - goos: darwin
        goarch: amd64
+    overrides:
+      # Use Zig only for Linux cross-compilation
      - goos: linux
-        goarch: arm64  # Skip linux/arm64 binaries (Docker handles multi-arch)
+        goarch: amd64
+        env:
+          - CGO_ENABLED=1
+          - CC=/tmp/zig-x86_64-linux-0.15.2/zig cc -target x86_64-linux-musl
+          - CXX=/tmp/zig-x86_64-linux-0.15.2/zig c++ -target x86_64-linux-musl
+      - goos: linux
+        goarch: arm64
+        env:
+          - CGO_ENABLED=1
+          - CC=/tmp/zig-x86_64-linux-0.15.2/zig cc -target aarch64-linux-musl
+          - CXX=/tmp/zig-x86_64-linux-0.15.2/zig c++ -target aarch64-linux-musl
+      # darwin/arm64 builds natively on macOS runner (no Zig)

 # Archives for releases
 archives:
@@ -123,124 +148,114 @@ release:
  prerelease: auto

 # Docker images (v2 - modern syntax)
+# Uses PRE-BUILT binaries from native builds (no Docker compilation - much faster!)
+# GoReleaser injects the platform-specific binary into each Docker image automatically
+# This avoids slow QEMU emulation for cross-architecture builds
 dockers_v2:
  # 1. Application Engine - Main GoHoarder server
+  # Uses pre-built binary from 'gohoarder' build (no Docker compilation)
+  # linux/arm64 binary is cross-compiled using Zig (fast, no QEMU!)
  - id: gohoarder-server
+    ids:
+      - gohoarder
    images:
      - ghcr.io/lukaszraczylo/gohoarder-server
-    platforms:
-      - linux/amd64
-      - linux/arm64
-    build_args:
-      VERSION: "{{ .Version }}"
-      GIT_COMMIT: "{{ .ShortCommit }}"
-      BUILD_TIME: "{{ .Date }}"
    tags:
      - "{{ .Version }}"
      - latest
+    platforms:
+      - linux/amd64
+      - linux/arm64
    dockerfile: Dockerfile.server
-    labels:
-      org.opencontainers.image.title: GoHoarder Server
-      org.opencontainers.image.description: Universal package cache proxy server
-      org.opencontainers.image.url: https://github.com/lukaszraczylo/gohoarder
-      org.opencontainers.image.source: https://github.com/lukaszraczylo/gohoarder
-      org.opencontainers.image.version: "{{ .Version }}"
-      org.opencontainers.image.created: "{{ .Date }}"
-      org.opencontainers.image.revision: "{{ .FullCommit }}"
+    flags:
+      - "--pull"
+      - "--label=org.opencontainers.image.title=GoHoarder Server"
+      - "--label=org.opencontainers.image.description=Universal package cache proxy server"
+      - "--label=org.opencontainers.image.url=https://github.com/lukaszraczylo/gohoarder"
+      - "--label=org.opencontainers.image.source=https://github.com/lukaszraczylo/gohoarder"
+      - "--label=org.opencontainers.image.version={{ .Version }}"
+      - "--label=org.opencontainers.image.created={{ .Date }}"
+      - "--label=org.opencontainers.image.revision={{ .FullCommit }}"
    extra_files:
      - config.yaml.example

  # 2. Website - Frontend Dashboard
+  # Note: Frontend is pre-built on CI runner and injected via frontend/dist
  - id: gohoarder-frontend
    images:
      - ghcr.io/lukaszraczylo/gohoarder-frontend
-    platforms:
-      - linux/amd64
-      - linux/arm64
    tags:
      - "{{ .Version }}"
      - latest
+    platforms:
+      - linux/amd64
+      - linux/arm64
    dockerfile: Dockerfile.frontend
-    labels:
-      org.opencontainers.image.title: GoHoarder Frontend
-      org.opencontainers.image.description: GoHoarder web dashboard
-      org.opencontainers.image.url: https://github.com/lukaszraczylo/gohoarder
-      org.opencontainers.image.source: https://github.com/lukaszraczylo/gohoarder
-      org.opencontainers.image.version: "{{ .Version }}"
-      org.opencontainers.image.created: "{{ .Date }}"
-      org.opencontainers.image.revision: "{{ .FullCommit }}"
+    flags:
+      - "--pull"
+      - "--label=org.opencontainers.image.title=GoHoarder Frontend"
+      - "--label=org.opencontainers.image.description=GoHoarder web dashboard"
+      - "--label=org.opencontainers.image.url=https://github.com/lukaszraczylo/gohoarder"
+      - "--label=org.opencontainers.image.source=https://github.com/lukaszraczylo/gohoarder"
+      - "--label=org.opencontainers.image.version={{ .Version }}"
+      - "--label=org.opencontainers.image.created={{ .Date }}"
+      - "--label=org.opencontainers.image.revision={{ .FullCommit }}"
    extra_files:
-      - frontend
+      - frontend/dist

  # 3. Scanning Engine - Background scanner worker
+  # Uses pre-built binary from 'gohoarder' build (no Docker compilation)
+  # linux/arm64 binary is cross-compiled using Zig (fast, no QEMU!)
  - id: gohoarder-scanner
+    ids:
+      - gohoarder
    images:
      - ghcr.io/lukaszraczylo/gohoarder-scanner
-    platforms:
-      - linux/amd64
-      - linux/arm64
-    build_args:
-      VERSION: "{{ .Version }}"
-      GIT_COMMIT: "{{ .ShortCommit }}"
-      BUILD_TIME: "{{ .Date }}"
    tags:
      - "{{ .Version }}"
      - latest
+    platforms:
+      - linux/amd64
+      - linux/arm64
    dockerfile: Dockerfile.scanner
-    labels:
-      org.opencontainers.image.title: GoHoarder Scanner
-      org.opencontainers.image.description: GoHoarder vulnerability scanning engine
-      org.opencontainers.image.url: https://github.com/lukaszraczylo/gohoarder
-      org.opencontainers.image.source: https://github.com/lukaszraczylo/gohoarder
-      org.opencontainers.image.version: "{{ .Version }}"
-      org.opencontainers.image.created: "{{ .Date }}"
-      org.opencontainers.image.revision: "{{ .FullCommit }}"
+    flags:
+      - "--pull"
+      - "--label=org.opencontainers.image.title=GoHoarder Scanner"
+      - "--label=org.opencontainers.image.description=GoHoarder vulnerability scanning engine"
+      - "--label=org.opencontainers.image.url=https://github.com/lukaszraczylo/gohoarder"
+      - "--label=org.opencontainers.image.source=https://github.com/lukaszraczylo/gohoarder"
+      - "--label=org.opencontainers.image.version={{ .Version }}"
+      - "--label=org.opencontainers.image.created={{ .Date }}"
+      - "--label=org.opencontainers.image.revision={{ .FullCommit }}"
    extra_files:
      - config.yaml.example

-  # 4. Gateway - Nginx reverse proxy for unified deployment
-  - id: gohoarder-gateway
-    images:
-      - ghcr.io/lukaszraczylo/gohoarder-gateway
-    platforms:
-      - linux/amd64
-      - linux/arm64
-    tags:
-      - "{{ .Version }}"
-      - latest
-    dockerfile: Dockerfile.gateway
-    labels:
-      org.opencontainers.image.title: GoHoarder Gateway
-      org.opencontainers.image.description: Nginx reverse proxy for unified GoHoarder deployment
-      org.opencontainers.image.url: https://github.com/lukaszraczylo/gohoarder
-      org.opencontainers.image.source: https://github.com/lukaszraczylo/gohoarder
-      org.opencontainers.image.version: "{{ .Version }}"
-      org.opencontainers.image.created: "{{ .Date }}"
-      org.opencontainers.image.revision: "{{ .FullCommit }}"
-
-  # 5. Migration Engine - Database migration tool
+  # 4. Migration Engine - Database migration tool
+  # Uses pre-built binary from 'migrate' build (no Docker compilation)
+  # linux/arm64 binary is cross-compiled using Zig (fast, no QEMU!)
  - id: gohoarder-migrate
+    ids:
+      - migrate
    images:
      - ghcr.io/lukaszraczylo/gohoarder-migrate
-    platforms:
-      - linux/amd64
-      - linux/arm64
-    build_args:
-      VERSION: "{{ .Version }}"
-      GIT_COMMIT: "{{ .ShortCommit }}"
-      BUILD_TIME: "{{ .Date }}"
    tags:
      - "{{ .Version }}"
      - latest
+    platforms:
+      - linux/amd64
+      - linux/arm64
    dockerfile: Dockerfile.migrate
-    labels:
-      org.opencontainers.image.title: GoHoarder Migrate
-      org.opencontainers.image.description: Database migration tool for GoHoarder V2 schema
-      org.opencontainers.image.url: https://github.com/lukaszraczylo/gohoarder
-      org.opencontainers.image.source: https://github.com/lukaszraczylo/gohoarder
-      org.opencontainers.image.version: "{{ .Version }}"
-      org.opencontainers.image.created: "{{ .Date }}"
-      org.opencontainers.image.revision: "{{ .FullCommit }}"
+    flags:
+      - "--pull"
+      - "--label=org.opencontainers.image.title=GoHoarder Migrate"
+      - "--label=org.opencontainers.image.description=Database migration tool for GoHoarder V2 schema"
+      - "--label=org.opencontainers.image.url=https://github.com/lukaszraczylo/gohoarder"
+      - "--label=org.opencontainers.image.source=https://github.com/lukaszraczylo/gohoarder"
+      - "--label=org.opencontainers.image.version={{ .Version }}"
+      - "--label=org.opencontainers.image.created={{ .Date }}"
+      - "--label=org.opencontainers.image.revision={{ .FullCommit }}"
+    extra_files:
+      - migrations

 # Artifact signing with cosign
 signs:
@@ -1,28 +1,15 @@
-# Website - Frontend Dashboard
-# Build stage
-FROM node:20-alpine AS builder
+# Website - Frontend Dashboard with integrated reverse proxy
+# Combines frontend serving and backend proxy (previously separate gateway)
+# EXPECTS: Pre-built frontend files in frontend/dist/ directory

-WORKDIR /build
-
-# Copy frontend source
-COPY frontend/package.json frontend/pnpm-lock.yaml ./
-COPY frontend/ ./
-
-# Install pnpm and dependencies
-RUN npm install -g pnpm && \
-    pnpm install --frozen-lockfile
-
-# Build the frontend
-RUN pnpm run build
-
-# Production stage
 FROM nginx:alpine

 # Install envsubst for runtime configuration
 RUN apk add --no-cache gettext

-# Copy built frontend
-COPY --from=builder /build/dist /usr/share/nginx/html
+# Copy pre-built frontend files
+# These are built on the CI runner and injected via extra_files
+COPY frontend/dist /usr/share/nginx/html

 # Create runtime config injection script
 RUN cat > /docker-entrypoint.d/40-inject-config.sh <<'EOF'
@@ -48,21 +35,121 @@ EOF

 RUN chmod +x /docker-entrypoint.d/40-inject-config.sh

-# Copy nginx configuration
-RUN cat > /etc/nginx/conf.d/default.conf <<'EOF'
+# Create nginx templates directory and configuration template with backend proxy support
+RUN mkdir -p /etc/nginx/templates && \
+    cat > /etc/nginx/templates/default.conf.template <<'EOF'
+# Upstream backend server
+upstream backend {
+    server ${BACKEND_HOST}:${BACKEND_PORT};
+    keepalive 32;
+}
+
+# Cache configuration
+proxy_cache_path /var/cache/nginx/static levels=1:2 keys_zone=static_cache:10m max_size=100m inactive=60m use_temp_path=off;
+
 server {
    listen 80;
-    server_name _;
+    server_name ${SERVER_NAME};
    root /usr/share/nginx/html;
    index index.html;

+    # Security headers
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+
+    # Client body size for package uploads
+    client_max_body_size 500M;
+    client_body_timeout 300s;
+
+    # Logging
+    access_log /var/log/nginx/access.log combined;
+    error_log /var/log/nginx/error.log warn;
+
    # Compression
    gzip on;
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml text/javascript;

-    # SPA routing
-    location / {
-        try_files $uri $uri/ /index.html;
+    # API endpoints - proxy to backend
+    location /api/ {
+        # Proxy settings
+        proxy_pass http://backend;
+        proxy_http_version 1.1;
+
+        # Headers
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_set_header X-Forwarded-Port $server_port;
+        proxy_set_header Connection "";
+
+        # Timeouts for long-running operations
+        proxy_connect_timeout 60s;
+        proxy_send_timeout 300s;
+        proxy_read_timeout 300s;
+
+        # Buffer settings
+        proxy_buffering on;
+        proxy_buffer_size 4k;
+        proxy_buffers 8 4k;
+        proxy_busy_buffers_size 8k;
+    }
+
+    # Health check endpoint
+    location /health {
+        proxy_pass http://backend/health;
+        proxy_http_version 1.1;
+        proxy_set_header Connection "";
+        access_log off;
+    }
+
+    # Metrics endpoint
+    location /metrics {
+        proxy_pass http://backend/metrics;
+        proxy_http_version 1.1;
+        proxy_set_header Connection "";
+    }
+
+    # Package download endpoints
+    location ~ ^/(npm|pypi|go)/ {
+        proxy_pass http://backend;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Connection "";
+
+        # Extended timeouts for package downloads
+        proxy_connect_timeout 60s;
+        proxy_send_timeout 600s;
+        proxy_read_timeout 600s;
+
+        # Large buffer for package downloads
+        proxy_buffering on;
+        proxy_buffer_size 128k;
+        proxy_buffers 4 256k;
+        proxy_busy_buffers_size 256k;
+    }
+
+    # WebSocket support
+    location /ws/ {
+        proxy_pass http://backend/ws/;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # WebSocket timeouts
+        proxy_connect_timeout 7d;
+        proxy_send_timeout 7d;
+        proxy_read_timeout 7d;
    }

    # Runtime configuration endpoint
@@ -72,19 +159,23 @@ server {
        add_header Expires "0";
    }

-    # Security headers
-    add_header X-Frame-Options "SAMEORIGIN" always;
-    add_header X-Content-Type-Options "nosniff" always;
-    add_header X-XSS-Protection "1; mode=block" always;
-
    # Cache static assets
    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
    }
+
+    # Frontend SPA - serve index.html for all other routes
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
 }
 EOF

+# Create cache directory
+RUN mkdir -p /var/cache/nginx/static && \
+    chown -R nginx:nginx /var/cache/nginx
+
 # Expose port
 EXPOSE 80

@@ -95,6 +186,10 @@ HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
 # Environment variables with defaults
 ENV API_BASE_URL=/api \
    APP_VERSION=unknown \
-    APP_NAME=GoHoarder
+    APP_NAME=GoHoarder \
+    BACKEND_HOST=gohoarder-server \
+    BACKEND_PORT=8080 \
+    SERVER_NAME=_

-CMD ["nginx", "-g", "daemon off;"]
+# Use nginx template substitution and start nginx
+CMD ["/bin/sh", "-c", "envsubst '$$BACKEND_HOST $$BACKEND_PORT $$SERVER_NAME' < /etc/nginx/templates/default.conf.template > /etc/nginx/conf.d/default.conf && nginx -g 'daemon off;'"]
@@ -1,197 +0,0 @@
-# Gateway - Nginx reverse proxy for unified deployment
-# Routes traffic between frontend and backend under single vhost
-FROM nginx:alpine
-
-# Install envsubst for runtime configuration
-RUN apk add --no-cache gettext
-
-# Copy nginx configuration template
-COPY <<'EOF' /etc/nginx/templates/default.conf.template
-# Upstream servers
-upstream backend {
-    server ${BACKEND_HOST}:${BACKEND_PORT};
-    keepalive 32;
-}
-
-upstream frontend {
-    server ${FRONTEND_HOST}:${FRONTEND_PORT};
-    keepalive 32;
-}
-
-# Rate limiting zones
-limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;
-limit_req_zone $binary_remote_addr zone=download_limit:10m rate=5r/s;
-
-# Cache configuration
-proxy_cache_path /var/cache/nginx/static levels=1:2 keys_zone=static_cache:10m max_size=100m inactive=60m use_temp_path=off;
-
-server {
-    listen 80;
-    server_name ${SERVER_NAME};
-
-    # Security headers
-    add_header X-Frame-Options "SAMEORIGIN" always;
-    add_header X-Content-Type-Options "nosniff" always;
-    add_header X-XSS-Protection "1; mode=block" always;
-    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
-
-    # Client body size for package uploads
-    client_max_body_size 500M;
-    client_body_timeout 300s;
-
-    # Logging
-    access_log /var/log/nginx/access.log combined;
-    error_log /var/log/nginx/error.log warn;
-
-    # API endpoints - proxy to backend
-    location /api/ {
-        # Rate limiting
-        limit_req zone=api_limit burst=20 nodelay;
-
-        # Proxy settings
-        proxy_pass http://backend/;
-        proxy_http_version 1.1;
-
-        # Headers
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header X-Forwarded-Port $server_port;
-
-        # Connection reuse
-        proxy_set_header Connection "";
-
-        # Timeouts for long-running operations
-        proxy_connect_timeout 60s;
-        proxy_send_timeout 300s;
-        proxy_read_timeout 300s;
-
-        # Buffer settings
-        proxy_buffering on;
-        proxy_buffer_size 4k;
-        proxy_buffers 8 4k;
-        proxy_busy_buffers_size 8k;
-    }
-
-    # Health check endpoint
-    location /health {
-        proxy_pass http://backend/health;
-        proxy_http_version 1.1;
-        proxy_set_header Connection "";
-        access_log off;
-    }
-
-    # Metrics endpoint (optional - may want to restrict access)
-    location /metrics {
-        # Uncomment to restrict to internal networks
-        # allow 10.0.0.0/8;
-        # allow 172.16.0.0/12;
-        # allow 192.168.0.0/16;
-        # deny all;
-
-        proxy_pass http://backend/metrics;
-        proxy_http_version 1.1;
-        proxy_set_header Connection "";
-    }
-
-    # Package download endpoints with rate limiting
-    location ~ ^/(npm|pypi|go)/ {
-        limit_req zone=download_limit burst=10 nodelay;
-
-        proxy_pass http://backend;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header Connection "";
-
-        # Extended timeouts for package downloads
-        proxy_connect_timeout 60s;
-        proxy_send_timeout 600s;
-        proxy_read_timeout 600s;
-
-        # Large buffer for package downloads
-        proxy_buffering on;
-        proxy_buffer_size 128k;
-        proxy_buffers 4 256k;
-        proxy_busy_buffers_size 256k;
-    }
-
-    # Frontend - serve SPA
-    location / {
-        proxy_pass http://frontend;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header Connection "";
-
-        # Cache static assets
-        proxy_cache static_cache;
-        proxy_cache_valid 200 1h;
-        proxy_cache_bypass $http_cache_control;
-        add_header X-Cache-Status $upstream_cache_status;
-    }
-
-    # WebSocket support (if needed for future features)
-    location /ws/ {
-        proxy_pass http://backend/ws/;
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-
-        # WebSocket timeouts
-        proxy_connect_timeout 7d;
-        proxy_send_timeout 7d;
-        proxy_read_timeout 7d;
-    }
-}
-
-# HTTPS server (uncomment and configure SSL certificates)
-# server {
-#     listen 443 ssl http2;
-#     server_name ${SERVER_NAME};
-#
-#     ssl_certificate /etc/nginx/ssl/cert.pem;
-#     ssl_certificate_key /etc/nginx/ssl/key.pem;
-#
-#     # SSL configuration
-#     ssl_protocols TLSv1.2 TLSv1.3;
-#     ssl_ciphers HIGH:!aNULL:!MD5;
-#     ssl_prefer_server_ciphers on;
-#     ssl_session_cache shared:SSL:10m;
-#     ssl_session_timeout 10m;
-#
-#     # Include all location blocks from above
-#     # ... (copy from HTTP server block)
-# }
-EOF
-
-# Create cache directory
-RUN mkdir -p /var/cache/nginx/static && \
-    chown -R nginx:nginx /var/cache/nginx
-
-# Expose port
-EXPOSE 80 443
-
-# Health check
-HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
-    CMD wget --quiet --tries=1 --spider http://localhost/health || exit 1
-
-# Environment variables with defaults
-ENV BACKEND_HOST=gohoarder-server \
-    BACKEND_PORT=8080 \
-    FRONTEND_HOST=gohoarder-frontend \
-    FRONTEND_PORT=80 \
-    SERVER_NAME=_
-
-# Use nginx with template substitution
-CMD ["/bin/sh", "-c", "envsubst '$$BACKEND_HOST $$BACKEND_PORT $$FRONTEND_HOST $$FRONTEND_PORT $$SERVER_NAME' < /etc/nginx/templates/default.conf.template > /etc/nginx/conf.d/default.conf && nginx -g 'daemon off;'"]
@@ -1,44 +1,10 @@
 # Migration Engine - Database Migration Tool
-# Multi-stage build to compile with CGO support
-ARG TARGETOS=linux
-ARG TARGETARCH=amd64
+# This Dockerfile expects a PRE-BUILT binary from GoReleaser (no compilation)
+# GoReleaser injects the platform-specific binary automatically

-# Build stage
-FROM --platform=$TARGETOS/$TARGETARCH golang:1.23-alpine AS builder
+FROM --platform=$TARGETPLATFORM alpine:latest

-# Install build dependencies for CGO
-RUN apk add --no-cache \
-    gcc \
-    g++ \
-    musl-dev \
-    sqlite-dev \
-    git
-
-WORKDIR /build
-
-# Copy go mod files
-COPY go.mod go.sum ./
-RUN go mod download
-
-# Copy source code
-COPY . .
-
-# Build with CGO enabled
-ARG TARGETOS
 ARG TARGETARCH
-ARG VERSION=dev
-ARG GIT_COMMIT=unknown
-ARG BUILD_TIME=unknown
-
-RUN CGO_ENABLED=1 GOOS=$TARGETOS GOARCH=$TARGETARCH \
-    go build -ldflags="-s -w \
-    -X main.Version=${VERSION} \
-    -X main.GitCommit=${GIT_COMMIT} \
-    -X main.BuildTime=${BUILD_TIME}" \
-    -o migrate ./cmd/migrate
-
-# Runtime stage
-FROM alpine:latest

 # Install runtime dependencies (including CGO/SQLite dependencies)
 RUN apk add --no-cache \
@@ -54,10 +20,15 @@ RUN apk add --no-cache \
 RUN addgroup -g 1000 gohoarder && \
    adduser -D -u 1000 -G gohoarder gohoarder

-# Copy binary from builder
-COPY --from=builder /build/migrate /usr/local/bin/migrate
+# Copy pre-built binary from GoReleaser
+# GoReleaser will automatically inject the correct binary for the target platform
+# In split/merge mode, binaries are in linux/${TARGETARCH}/ subdirectories
+COPY linux/${TARGETARCH}/migrate /usr/local/bin/migrate
 RUN chmod +x /usr/local/bin/migrate

+# Copy migration SQL files
+COPY migrations /migrations
+
 WORKDIR /app
 USER gohoarder

@@ -1,44 +1,10 @@
 # Scanning Engine - Background Scanner Worker
-# Multi-stage build to compile with CGO support
-ARG TARGETOS=linux
-ARG TARGETARCH=amd64
+# This Dockerfile expects a PRE-BUILT binary from GoReleaser (no compilation)
+# GoReleaser injects the platform-specific binary automatically

-# Build stage
-FROM --platform=$TARGETOS/$TARGETARCH golang:1.23-alpine AS builder
+FROM --platform=$TARGETPLATFORM alpine:latest

-# Install build dependencies for CGO
-RUN apk add --no-cache \
-    gcc \
-    g++ \
-    musl-dev \
-    sqlite-dev \
-    git
-
-WORKDIR /build
-
-# Copy go mod files
-COPY go.mod go.sum ./
-RUN go mod download
-
-# Copy source code
-COPY . .
-
-# Build with CGO enabled
-ARG TARGETOS
 ARG TARGETARCH
-ARG VERSION=dev
-ARG GIT_COMMIT=unknown
-ARG BUILD_TIME=unknown
-
-RUN CGO_ENABLED=1 GOOS=$TARGETOS GOARCH=$TARGETARCH \
-    go build -ldflags="-s -w \
-    -X github.com/lukaszraczylo/gohoarder/internal/version.Version=${VERSION} \
-    -X github.com/lukaszraczylo/gohoarder/internal/version.GitCommit=${GIT_COMMIT} \
-    -X github.com/lukaszraczylo/gohoarder/internal/version.BuildTime=${BUILD_TIME}" \
-    -o gohoarder ./cmd/gohoarder
-
-# Runtime stage
-FROM alpine:latest

 # Install scanning tools and runtime dependencies (including CGO/SQLite dependencies)
 RUN apk add --no-cache \
@@ -50,6 +16,10 @@ RUN apk add --no-cache \
    bash \
    sqlite-libs \
    musl \
+    python3 \
+    py3-pip \
+    npm \
+    go \
    && update-ca-certificates

 # Install Trivy for container scanning
@@ -58,6 +28,13 @@ RUN curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/
 # Install Grype for vulnerability scanning
 RUN curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin

+# Install govulncheck for Go vulnerability scanning
+RUN go install golang.org/x/vuln/cmd/govulncheck@latest && \
+    mv /root/go/bin/govulncheck /usr/local/bin/
+
+# Install pip-audit for Python package vulnerability scanning
+RUN pip3 install --no-cache-dir pip-audit --break-system-packages
+
 # Create non-root user
 RUN addgroup -g 1000 scanner && \
    adduser -D -u 1000 -G scanner scanner
@@ -75,8 +52,10 @@ RUN mkdir -p /var/cache/gohoarder \
                 /var/lib/gohoarder \
                 /var/lib/trivy

-# Copy binary from builder
-COPY --from=builder /build/gohoarder /usr/local/bin/gohoarder
+# Copy pre-built binary from GoReleaser
+# GoReleaser will automatically inject the correct binary for the target platform
+# In split/merge mode, binaries are in linux/${TARGETARCH}/ subdirectories
+COPY linux/${TARGETARCH}/gohoarder /usr/local/bin/gohoarder
 RUN chmod +x /usr/local/bin/gohoarder

 # Copy example config
@@ -1,46 +1,12 @@
-# Application Engine - GoHoarder Server
-# Multi-stage build to compile with CGO support
-ARG TARGETOS=linux
-ARG TARGETARCH=amd64
+# Application Engine - Main GoHoarder Server
+# This Dockerfile expects a PRE-BUILT binary from GoReleaser (no compilation)
+# GoReleaser injects the platform-specific binary automatically

-# Build stage
-FROM --platform=$TARGETOS/$TARGETARCH golang:1.23-alpine AS builder
+FROM --platform=$TARGETPLATFORM alpine:latest

-# Install build dependencies for CGO
-RUN apk add --no-cache \
-    gcc \
-    g++ \
-    musl-dev \
-    sqlite-dev \
-    git
-
-WORKDIR /build
-
-# Copy go mod files
-COPY go.mod go.sum ./
-RUN go mod download
-
-# Copy source code
-COPY . .
-
-# Build with CGO enabled
-ARG TARGETOS
 ARG TARGETARCH
-ARG VERSION=dev
-ARG GIT_COMMIT=unknown
-ARG BUILD_TIME=unknown

-RUN CGO_ENABLED=1 GOOS=$TARGETOS GOARCH=$TARGETARCH \
-    go build -ldflags="-s -w \
-    -X github.com/lukaszraczylo/gohoarder/internal/version.Version=${VERSION} \
-    -X github.com/lukaszraczylo/gohoarder/internal/version.GitCommit=${GIT_COMMIT} \
-    -X github.com/lukaszraczylo/gohoarder/internal/version.BuildTime=${BUILD_TIME}" \
-    -o gohoarder ./cmd/gohoarder
-
-# Runtime stage
-FROM alpine:latest
-
-# Install runtime dependencies (including CGO/SQLite dependencies)
+# Install runtime dependencies (CGO/SQLite requires these)
 RUN apk add --no-cache \
    ca-certificates \
    tzdata \
@@ -62,8 +28,10 @@ RUN mkdir -p /var/cache/gohoarder \
    chmod -R 750 /var/cache/gohoarder \
                 /var/lib/gohoarder

-# Copy binary from builder
-COPY --from=builder /build/gohoarder /usr/local/bin/gohoarder
+# Copy pre-built binary from GoReleaser
+# GoReleaser will automatically inject the correct binary for the target platform
+# In split/merge mode, binaries are in linux/${TARGETARCH}/ subdirectories
+COPY linux/${TARGETARCH}/gohoarder /usr/local/bin/gohoarder
 RUN chmod +x /usr/local/bin/gohoarder

 # Copy example config
@@ -1,5 +1,6 @@
 # GoHoarder - Kubernetes Deployment (All-in-One)
 # This manifest deploys all GoHoarder services under a single ingress
+# The frontend includes integrated nginx reverse proxy to the backend
 #
 # Usage:
 # kubectl create namespace gohoarder
@@ -222,6 +223,13 @@ spec:
          value: "1.0.0"
        - name: APP_NAME
          value: GoHoarder
+        # Backend proxy configuration (frontend includes nginx reverse proxy)
+        - name: BACKEND_HOST
+          value: gohoarder-server
+        - name: BACKEND_PORT
+          value: "8080"
+        - name: SERVER_NAME
+          value: hoarder.i.raczylo.com
        livenessProbe:
          httpGet:
            path: /
@@ -325,88 +333,6 @@ spec:
        configMap:
          name: gohoarder-config

---
-# Deployment - Gateway (Nginx Reverse Proxy)
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: gohoarder-gateway
-  namespace: gohoarder
-  labels:
-    app.kubernetes.io/name: gohoarder
-    app.kubernetes.io/component: gateway
-spec:
-  replicas: 2
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: gohoarder
-      app.kubernetes.io/component: gateway
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: gohoarder
-        app.kubernetes.io/component: gateway
-    spec:
-      containers:
-      - name: gateway
-        image: ghcr.io/lukaszraczylo/gohoarder-gateway:latest
-        imagePullPolicy: Always
-        ports:
-        - name: http
-          containerPort: 80
-          protocol: TCP
-        env:
-        - name: BACKEND_HOST
-          value: gohoarder-server
-        - name: BACKEND_PORT
-          value: "8080"
-        - name: FRONTEND_HOST
-          value: gohoarder-frontend
-        - name: FRONTEND_PORT
-          value: "80"
-        - name: SERVER_NAME
-          value: hoarder.i.raczylo.com
-        livenessProbe:
-          httpGet:
-            path: /health
-            port: 80
-          initialDelaySeconds: 5
-          periodSeconds: 30
-        readinessProbe:
-          httpGet:
-            path: /health
-            port: 80
-          initialDelaySeconds: 5
-          periodSeconds: 10
-        resources:
-          requests:
-            cpu: 100m
-            memory: 128Mi
-          limits:
-            cpu: 500m
-            memory: 256Mi
-
---
-# Service - Gateway
-apiVersion: v1
-kind: Service
-metadata:
-  name: gohoarder-gateway
-  namespace: gohoarder
-  labels:
-    app.kubernetes.io/name: gohoarder
-    app.kubernetes.io/component: gateway
-spec:
-  type: ClusterIP
-  ports:
-  - name: http
-    port: 80
-    targetPort: http
-    protocol: TCP
-  selector:
-    app.kubernetes.io/name: gohoarder
-    app.kubernetes.io/component: gateway
-
 ---
 # Ingress - Expose via domain
 apiVersion: networking.k8s.io/v1
@@ -436,7 +362,7 @@ spec:
        pathType: Prefix
        backend:
          service:
-            name: gohoarder-gateway
+            name: gohoarder-frontend
            port:
              number: 80
  # Uncomment for HTTPS/TLS
@@ -477,20 +403,20 @@ spec:
        averageUtilization: 80

 ---
-# HorizontalPodAutoscaler - Gateway
+# HorizontalPodAutoscaler - Frontend
 apiVersion: autoscaling/v2
 kind: HorizontalPodAutoscaler
 metadata:
-  name: gohoarder-gateway
+  name: gohoarder-frontend
  namespace: gohoarder
  labels:
    app.kubernetes.io/name: gohoarder
-    app.kubernetes.io/component: gateway
+    app.kubernetes.io/component: frontend
 spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
-    name: gohoarder-gateway
+    name: gohoarder-frontend
  minReplicas: 2
  maxReplicas: 10
  metrics:
@@ -2,7 +2,7 @@ version: '3.8'

 # GoHoarder - Unified Deployment Example
 # This docker-compose file demonstrates deploying all GoHoarder services
-# under a single domain using the gateway reverse proxy
+# The frontend includes integrated reverse proxy to the backend

 services:
  # Backend - Main application server
@@ -39,7 +39,7 @@ services:
      retries: 3
      start_period: 5s

-  # Frontend - Web dashboard
+  # Frontend - Web dashboard with integrated reverse proxy
  gohoarder-frontend:
    image: ghcr.io/lukaszraczylo/gohoarder-frontend:latest
    container_name: gohoarder-frontend
@@ -49,8 +49,19 @@ services:
      - API_BASE_URL=/api
      - APP_VERSION=1.0.0
      - APP_NAME=GoHoarder
+      # Backend proxy configuration (frontend includes nginx reverse proxy)
+      - BACKEND_HOST=gohoarder-server
+      - BACKEND_PORT=8080
+      - SERVER_NAME=hoarder.i.raczylo.com
+    ports:
+      # Map to host port 80 (HTTP)
+      - "80:80"
+      # Map to host port 443 (HTTPS) - uncomment if using SSL
+      # - "443:443"
    networks:
      - gohoarder-internal
+    depends_on:
+      - gohoarder-server
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost/"]
      interval: 30s
@@ -82,41 +93,6 @@ services:
    # profiles:
    #   - scanner

-  # Gateway - Nginx reverse proxy
-  gohoarder-gateway:
-    image: ghcr.io/lukaszraczylo/gohoarder-gateway:latest
-    container_name: gohoarder-gateway
-    restart: unless-stopped
-    environment:
-      # Backend service connection
-      - BACKEND_HOST=gohoarder-server
-      - BACKEND_PORT=8080
-      # Frontend service connection
-      - FRONTEND_HOST=gohoarder-frontend
-      - FRONTEND_PORT=80
-      # Server configuration
-      - SERVER_NAME=hoarder.i.raczylo.com
-    ports:
-      # Map to host port 80 (HTTP)
-      - "80:80"
-      # Map to host port 443 (HTTPS) - uncomment if using SSL
-      # - "443:443"
-    networks:
-      - gohoarder-internal
-    depends_on:
-      - gohoarder-server
-      - gohoarder-frontend
-    # Uncomment if using custom SSL certificates
-    # volumes:
-    #   - ./ssl/cert.pem:/etc/nginx/ssl/cert.pem:ro
-    #   - ./ssl/key.pem:/etc/nginx/ssl/key.pem:ro
-    healthcheck:
-      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost/health"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-      start_period: 5s
-
 networks:
  gohoarder-internal:
    driver: bridge
@@ -144,7 +120,7 @@ volumes:
 # - Metrics: http://localhost/metrics
 #
 # For production:
-# - Enable HTTPS in the gateway container
+# - Enable HTTPS in the frontend container (add SSL certificates to nginx)
 # - Set up proper SSL certificates
 # - Configure firewall rules
 # - Set appropriate resource limits
@@ -0,0 +1,8 @@
+{
+  "hash": "eb707743",
+  "configHash": "e17a1322",
+  "lockfileHash": "c2e83396",
+  "browserHash": "ab796ace",
+  "optimized": {},
+  "chunks": {}
+}
@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}
@@ -3,17 +3,17 @@ module github.com/lukaszraczylo/gohoarder
 go 1.25.5

 require (
-	github.com/aws/aws-sdk-go-v2 v1.41.0
-	github.com/aws/aws-sdk-go-v2/config v1.32.6
-	github.com/aws/aws-sdk-go-v2/credentials v1.19.6
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.95.0
+	github.com/aws/aws-sdk-go-v2 v1.41.4
+	github.com/aws/aws-sdk-go-v2/config v1.32.12
+	github.com/aws/aws-sdk-go-v2/credentials v1.19.12
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.97.2
 	github.com/go-gormigrate/gormigrate/v2 v2.1.5
 	github.com/go-sql-driver/mysql v1.9.3
-	github.com/goccy/go-json v0.10.5
-	github.com/gofiber/fiber/v2 v2.52.10
+	github.com/goccy/go-json v0.10.6
+	github.com/gofiber/fiber/v2 v2.52.12
 	github.com/gorilla/websocket v1.5.3
 	github.com/hirochachacha/go-smb2 v1.1.0
-	github.com/lib/pq v1.10.9
+	github.com/lib/pq v1.12.0
 	github.com/prometheus/client_golang v1.23.2
 	github.com/rs/zerolog v1.34.0
 	github.com/spf13/cobra v1.10.2
@@ -22,9 +22,9 @@ require (
 	github.com/testcontainers/testcontainers-go v0.40.0
 	github.com/testcontainers/testcontainers-go/modules/mysql v0.40.0
 	github.com/testcontainers/testcontainers-go/modules/postgres v0.40.0
-	golang.org/x/crypto v0.46.0
-	golang.org/x/sync v0.19.0
-	golang.org/x/time v0.14.0
+	golang.org/x/crypto v0.49.0
+	golang.org/x/sync v0.20.0
+	golang.org/x/time v0.15.0
 	gorm.io/driver/mysql v1.6.0
 	gorm.io/driver/postgres v1.6.0
 	gorm.io/driver/sqlite v1.6.0
@@ -33,30 +33,29 @@ require (

 require (
 	dario.cat/mergo v1.0.2 // indirect
-	filippo.io/edwards25519 v1.1.0 // indirect
+	filippo.io/edwards25519 v1.2.0 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/andybalholm/brotli v1.2.0 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.16 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.16 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.16 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.16 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.7 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.16 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.16 // indirect
-	github.com/aws/aws-sdk-go-v2/service/signin v1.0.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.30.8 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.12 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.41.5 // indirect
-	github.com/aws/smithy-go v1.24.0 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.20 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.20 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.21 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.12 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.20 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.20 // indirect
+	github.com/aws/aws-sdk-go-v2/service/signin v1.0.8 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.30.13 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.41.9 // indirect
+	github.com/aws/smithy-go v1.24.2 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/clipperhouse/stringish v0.1.1 // indirect
-	github.com/clipperhouse/uax29/v2 v2.3.0 // indirect
+	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
 	github.com/containerd/errdefs v1.0.0 // indirect
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
@@ -74,23 +73,23 @@ require (
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-ole/go-ole v1.3.0 // indirect
-	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
+	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.4 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
-	github.com/jackc/pgx/v5 v5.8.0 // indirect
+	github.com/jackc/pgx/v5 v5.9.1 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/jinzhu/now v1.1.5 // indirect
-	github.com/klauspost/compress v1.18.2 // indirect
+	github.com/klauspost/compress v1.18.5 // indirect
 	github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3 // indirect
 	github.com/magiconair/properties v1.8.10 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/mattn/go-runewidth v0.0.19 // indirect
-	github.com/mattn/go-sqlite3 v1.14.33 // indirect
+	github.com/mattn/go-runewidth v0.0.21 // indirect
+	github.com/mattn/go-sqlite3 v1.14.37 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/go-archive v0.2.0 // indirect
 	github.com/moby/patternmatcher v0.6.0 // indirect
@@ -107,8 +106,8 @@ require (
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.67.4 // indirect
-	github.com/prometheus/procfs v0.19.2 // indirect
+	github.com/prometheus/common v0.67.5 // indirect
+	github.com/prometheus/procfs v0.20.1 // indirect
 	github.com/sagikazarmark/locafero v0.12.0 // indirect
 	github.com/shirou/gopsutil/v4 v4.25.12 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
@@ -120,17 +119,17 @@ require (
 	github.com/tklauser/go-sysconf v0.3.16 // indirect
 	github.com/tklauser/numcpus v0.11.0 // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
-	github.com/valyala/fasthttp v1.68.0 // indirect
+	github.com/valyala/fasthttp v1.69.0 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.64.0 // indirect
 	go.opentelemetry.io/otel v1.39.0 // indirect
 	go.opentelemetry.io/otel/metric v1.39.0 // indirect
 	go.opentelemetry.io/otel/trace v1.39.0 // indirect
-	go.yaml.in/yaml/v2 v2.4.3 // indirect
+	go.yaml.in/yaml/v2 v2.4.4 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/sys v0.39.0 // indirect
-	golang.org/x/text v0.32.0 // indirect
+	golang.org/x/sys v0.42.0 // indirect
+	golang.org/x/text v0.35.0 // indirect
 	google.golang.org/grpc v1.78.0 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
@@ -1,7 +1,7 @@
 dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
 dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
-filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
-filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
+filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
+filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
 github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg=
@@ -10,54 +10,52 @@ github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERo
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
 github.com/andybalholm/brotli v1.2.0 h1:ukwgCxwYrmACq68yiUqwIWnGY0cTPox/M94sVwToPjQ=
 github.com/andybalholm/brotli v1.2.0/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
-github.com/aws/aws-sdk-go-v2 v1.41.0 h1:tNvqh1s+v0vFYdA1xq0aOJH+Y5cRyZ5upu6roPgPKd4=
-github.com/aws/aws-sdk-go-v2 v1.41.0/go.mod h1:MayyLB8y+buD9hZqkCW3kX1AKq07Y5pXxtgB+rRFhz0=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4 h1:489krEF9xIGkOaaX3CE/Be2uWjiXrkCH6gUX+bZA/BU=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4/go.mod h1:IOAPF6oT9KCsceNTvvYMNHy0+kMF8akOjeDvPENWxp4=
-github.com/aws/aws-sdk-go-v2/config v1.32.6 h1:hFLBGUKjmLAekvi1evLi5hVvFQtSo3GYwi+Bx4lpJf8=
-github.com/aws/aws-sdk-go-v2/config v1.32.6/go.mod h1:lcUL/gcd8WyjCrMnxez5OXkO3/rwcNmvfno62tnXNcI=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.6 h1:F9vWao2TwjV2MyiyVS+duza0NIRtAslgLUM0vTA1ZaE=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.6/go.mod h1:SgHzKjEVsdQr6Opor0ihgWtkWdfRAIwxYzSJ8O85VHY=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.16 h1:80+uETIWS1BqjnN9uJ0dBUaETh+P1XwFy5vwHwK5r9k=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.16/go.mod h1:wOOsYuxYuB/7FlnVtzeBYRcjSRtQpAW0hCP7tIULMwo=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.16 h1:rgGwPzb82iBYSvHMHXc8h9mRoOUBZIGFgKb9qniaZZc=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.16/go.mod h1:L/UxsGeKpGoIj6DxfhOWHWQ/kGKcd4I1VncE4++IyKA=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.16 h1:1jtGzuV7c82xnqOVfx2F0xmJcOw5374L7N6juGW6x6U=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.16/go.mod h1:M2E5OQf+XLe+SZGmmpaI2yy+J326aFf6/+54PoxSANc=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 h1:WKuaxf++XKWlHWu9ECbMlha8WOEGm0OUEZqm4K/Gcfk=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4/go.mod h1:ZWy7j6v1vWGmPReu0iSGvRiise4YI5SkR3OHKTZ6Wuc=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.16 h1:CjMzUs78RDDv4ROu3JnJn/Ig1r6ZD7/T2DXLLRpejic=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.16/go.mod h1:uVW4OLBqbJXSHJYA9svT9BluSvvwbzLQ2Crf6UPzR3c=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4 h1:0ryTNEdJbzUCEWkVXEXoqlXV72J5keC1GvILMOuD00E=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4/go.mod h1:HQ4qwNZh32C3CBeO6iJLQlgtMzqeG17ziAA/3KDJFow=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.7 h1:DIBqIrJ7hv+e4CmIk2z3pyKT+3B6qVMgRsawHiR3qso=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.7/go.mod h1:vLm00xmBke75UmpNvOcZQ/Q30ZFjbczeLFqGx5urmGo=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.16 h1:oHjJHeUy0ImIV0bsrX0X91GkV5nJAyv1l1CC9lnO0TI=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.16/go.mod h1:iRSNGgOYmiYwSCXxXaKb9HfOEj40+oTKn8pTxMlYkRM=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.16 h1:NSbvS17MlI2lurYgXnCOLvCFX38sBW4eiVER7+kkgsU=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.16/go.mod h1:SwT8Tmqd4sA6G1qaGdzWCJN99bUmPGHfRwwq3G5Qb+A=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.95.0 h1:MIWra+MSq53CFaXXAywB2qg9YvVZifkk6vEGl/1Qor0=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.95.0/go.mod h1:79S2BdqCJpScXZA2y+cpZuocWsjGjJINyXnOsf5DTz8=
-github.com/aws/aws-sdk-go-v2/service/signin v1.0.4 h1:HpI7aMmJ+mm1wkSHIA2t5EaFFv5EFYXePW30p1EIrbQ=
-github.com/aws/aws-sdk-go-v2/service/signin v1.0.4/go.mod h1:C5RdGMYGlfM0gYq/tifqgn4EbyX99V15P2V3R+VHbQU=
-github.com/aws/aws-sdk-go-v2/service/sso v1.30.8 h1:aM/Q24rIlS3bRAhTyFurowU8A0SMyGDtEOY/l/s/1Uw=
-github.com/aws/aws-sdk-go-v2/service/sso v1.30.8/go.mod h1:+fWt2UHSb4kS7Pu8y+BMBvJF0EWx+4H0hzNwtDNRTrg=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.12 h1:AHDr0DaHIAo8c9t1emrzAlVDFp+iMMKnPdYy6XO4MCE=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.12/go.mod h1:GQ73XawFFiWxyWXMHWfhiomvP3tXtdNar/fi8z18sx0=
-github.com/aws/aws-sdk-go-v2/service/sts v1.41.5 h1:SciGFVNZ4mHdm7gpD1dgZYnCuVdX1s+lFTg4+4DOy70=
-github.com/aws/aws-sdk-go-v2/service/sts v1.41.5/go.mod h1:iW40X4QBmUxdP+fZNOpfmkdMZqsovezbAeO+Ubiv2pk=
-github.com/aws/smithy-go v1.24.0 h1:LpilSUItNPFr1eY85RYgTIg5eIEPtvFbskaFcmmIUnk=
-github.com/aws/smithy-go v1.24.0/go.mod h1:LEj2LM3rBRQJxPZTB4KuzZkaZYnZPnvgIhb4pu07mx0=
+github.com/aws/aws-sdk-go-v2 v1.41.4 h1:10f50G7WyU02T56ox1wWXq+zTX9I1zxG46HYuG1hH/k=
+github.com/aws/aws-sdk-go-v2 v1.41.4/go.mod h1:mwsPRE8ceUUpiTgF7QmQIJ7lgsKUPQOUl3o72QBrE1o=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 h1:eBMB84YGghSocM7PsjmmPffTa+1FBUeNvGvFou6V/4o=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8/go.mod h1:lyw7GFp3qENLh7kwzf7iMzAxDn+NzjXEAGjKS2UOKqI=
+github.com/aws/aws-sdk-go-v2/config v1.32.12 h1:O3csC7HUGn2895eNrLytOJQdoL2xyJy0iYXhoZ1OmP0=
+github.com/aws/aws-sdk-go-v2/config v1.32.12/go.mod h1:96zTvoOFR4FURjI+/5wY1vc1ABceROO4lWgWJuxgy0g=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.12 h1:oqtA6v+y5fZg//tcTWahyN9PEn5eDU/Wpvc2+kJ4aY8=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.12/go.mod h1:U3R1RtSHx6NB0DvEQFGyf/0sbrpJrluENHdPy1j/3TE=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 h1:zOgq3uezl5nznfoK3ODuqbhVg1JzAGDUhXOsU0IDCAo=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20/go.mod h1:z/MVwUARehy6GAg/yQ1GO2IMl0k++cu1ohP9zo887wE=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.20 h1:CNXO7mvgThFGqOFgbNAP2nol2qAWBOGfqR/7tQlvLmc=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.20/go.mod h1:oydPDJKcfMhgfcgBUZaG+toBbwy8yPWubJXBVERtI4o=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.20 h1:tN6W/hg+pkM+tf9XDkWUbDEjGLb+raoBMFsTodcoYKw=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.20/go.mod h1:YJ898MhD067hSHA6xYCx5ts/jEd8BSOLtQDL3iZsvbc=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6 h1:qYQ4pzQ2Oz6WpQ8T3HvGHnZydA72MnLuFK9tJwmrbHw=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6/go.mod h1:O3h0IK87yXci+kg6flUKzJnWeziQUKciKrLjcatSNcY=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.21 h1:SwGMTMLIlvDNyhMteQ6r8IJSBPlRdXX5d4idhIGbkXA=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.21/go.mod h1:UUxgWxofmOdAMuqEsSppbDtGKLfR04HGsD0HXzvhI1k=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 h1:5EniKhLZe4xzL7a+fU3C2tfUN4nWIqlLesfrjkuPFTY=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7/go.mod h1:x0nZssQ3qZSnIcePWLvcoFisRXJzcTVvYpAAdYX8+GI=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.12 h1:qtJZ70afD3ISKWnoX3xB0J2otEqu3LqicRcDBqsj0hQ=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.12/go.mod h1:v2pNpJbRNl4vEUWEh5ytQok0zACAKfdmKS51Hotc3pQ=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.20 h1:2HvVAIq+YqgGotK6EkMf+KIEqTISmTYh5zLpYyeTo1Y=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.20/go.mod h1:V4X406Y666khGa8ghKmphma/7C0DAtEQYhkq9z4vpbk=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.20 h1:siU1A6xjUZ2N8zjTHSXFhB9L/2OY8Dqs0xXiLjF30jA=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.20/go.mod h1:4TLZCmVJDM3FOu5P5TJP0zOlu9zWgDWU7aUxWbr+rcw=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.97.2 h1:MRNiP6nqa20aEl8fQ6PJpEq11b2d40b16sm4WD7QgMU=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.97.2/go.mod h1:FrNA56srbsr3WShiaelyWYEo70x80mXnVZ17ZZfbeqg=
+github.com/aws/aws-sdk-go-v2/service/signin v1.0.8 h1:0GFOLzEbOyZABS3PhYfBIx2rNBACYcKty+XGkTgw1ow=
+github.com/aws/aws-sdk-go-v2/service/signin v1.0.8/go.mod h1:LXypKvk85AROkKhOG6/YEcHFPoX+prKTowKnVdcaIxE=
+github.com/aws/aws-sdk-go-v2/service/sso v1.30.13 h1:kiIDLZ005EcKomYYITtfsjn7dtOwHDOFy7IbPXKek2o=
+github.com/aws/aws-sdk-go-v2/service/sso v1.30.13/go.mod h1:2h/xGEowcW/g38g06g3KpRWDlT+OTfxxI0o1KqayAB8=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17 h1:jzKAXIlhZhJbnYwHbvUQZEB8KfgAEuG0dc08Bkda7NU=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17/go.mod h1:Al9fFsXjv4KfbzQHGe6V4NZSZQXecFcvaIF4e70FoRA=
+github.com/aws/aws-sdk-go-v2/service/sts v1.41.9 h1:Cng+OOwCHmFljXIxpEVXAGMnBia8MSU6Ch5i9PgBkcU=
+github.com/aws/aws-sdk-go-v2/service/sts v1.41.9/go.mod h1:LrlIndBDdjA/EeXeyNBle+gyCwTlizzW5ycgWnvIxkk=
+github.com/aws/smithy-go v1.24.2 h1:FzA3bu/nt/vDvmnkg+R8Xl46gmzEDam6mZ1hzmwXFng=
+github.com/aws/smithy-go v1.24.2/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
 github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/clipperhouse/stringish v0.1.1 h1:+NSqMOr3GR6k1FdRhhnXrLfztGzuG+VuFDfatpWHKCs=
-github.com/clipperhouse/stringish v0.1.1/go.mod h1:v/WhFtE1q0ovMta2+m+UbpZ+2/HEXNWYXQgCt4hdOzA=
-github.com/clipperhouse/uax29/v2 v2.3.0 h1:SNdx9DVUqMoBuBoW3iLOj4FQv3dN5mDtuqwuhIGpJy4=
-github.com/clipperhouse/uax29/v2 v2.3.0/go.mod h1:Wn1g7MK6OoeDT0vL+Q0SQLDz/KpfsVRgg6W7ihQeh4g=
+github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=
+github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
 github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
 github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
@@ -106,13 +104,13 @@ github.com/go-ole/go-ole v1.3.0 h1:Dt6ye7+vXGIKZ7Xtk4s6/xVdGDQynvom7xCFEdWr6uE=
 github.com/go-ole/go-ole v1.3.0/go.mod h1:5LS6F96DhAwUc7C+1HLexzMXY1xGRSryjyPPKW6zv78=
 github.com/go-sql-driver/mysql v1.9.3 h1:U/N249h2WzJ3Ukj8SowVFjdtZKfu9vlLZxjPXV1aweo=
 github.com/go-sql-driver/mysql v1.9.3/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
-github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
-github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
-github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
-github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
+github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
+github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/goccy/go-json v0.10.6 h1:p8HrPJzOakx/mn/bQtjgNjdTcN+/S6FcG2CTtQOrHVU=
+github.com/goccy/go-json v0.10.6/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
-github.com/gofiber/fiber/v2 v2.52.10 h1:jRHROi2BuNti6NYXmZ6gbNSfT3zj/8c0xy94GOU5elY=
-github.com/gofiber/fiber/v2 v2.52.10/go.mod h1:YEcBbO/FB+5M1IZNBP9FO3J9281zgPAreiI1oqg8nDw=
+github.com/gofiber/fiber/v2 v2.52.12 h1:0LdToKclcPOj8PktUdIKo9BUohjjwfnQl42Dhw8/WUw=
+github.com/gofiber/fiber/v2 v2.52.12/go.mod h1:YEcBbO/FB+5M1IZNBP9FO3J9281zgPAreiI1oqg8nDw=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
@@ -129,24 +127,24 @@ github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsI
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
-github.com/jackc/pgx/v5 v5.8.0 h1:TYPDoleBBme0xGSAX3/+NujXXtpZn9HBONkQC7IEZSo=
-github.com/jackc/pgx/v5 v5.8.0/go.mod h1:QVeDInX2m9VyzvNeiCJVjCkNFqzsNb43204HshNSZKw=
+github.com/jackc/pgx/v5 v5.9.1 h1:uwrxJXBnx76nyISkhr33kQLlUqjv7et7b9FjCen/tdc=
+github.com/jackc/pgx/v5 v5.9.1/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4=
 github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
 github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
 github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
 github.com/jinzhu/inflection v1.0.0/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
 github.com/jinzhu/now v1.1.5 h1:/o9tlHleP7gOFmsnYNz3RGnqzefHA47wQpKrrdTIwXQ=
 github.com/jinzhu/now v1.1.5/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
-github.com/klauspost/compress v1.18.2 h1:iiPHWW0YrcFgpBYhsA6D1+fqHssJscY/Tm/y2Uqnapk=
-github.com/klauspost/compress v1.18.2/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
+github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
+github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
-github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
-github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/lib/pq v1.12.0 h1:mC1zeiNamwKBecjHarAr26c/+d8V5w/u4J0I/yASbJo=
+github.com/lib/pq v1.12.0/go.mod h1:/p+8NSbOcwzAEI7wiMXFlgydTwcgTr3OSKMsD2BitpA=
 github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3 h1:PwQumkgq4/acIiZhtifTV5OUqqiP82UAl0h87xj/l9k=
 github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
 github.com/magiconair/properties v1.8.10 h1:s31yESBquKXCV9a/ScB3ESkOjUYYv+X0rg8SYxI99mE=
@@ -158,10 +156,10 @@ github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/
 github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/mattn/go-runewidth v0.0.19 h1:v++JhqYnZuu5jSKrk9RbgF5v4CGUjqRfBm05byFGLdw=
-github.com/mattn/go-runewidth v0.0.19/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
-github.com/mattn/go-sqlite3 v1.14.33 h1:A5blZ5ulQo2AtayQ9/limgHEkFreKj1Dv226a1K73s0=
-github.com/mattn/go-sqlite3 v1.14.33/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
+github.com/mattn/go-runewidth v0.0.21 h1:jJKAZiQH+2mIinzCJIaIG9Be1+0NR+5sz/lYEEjdM8w=
+github.com/mattn/go-runewidth v0.0.21/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
+github.com/mattn/go-sqlite3 v1.14.37 h1:3DOZp4cXis1cUIpCfXLtmlGolNLp2VEqhiB/PARNBIg=
+github.com/mattn/go-sqlite3 v1.14.37/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/mdelapenya/tlscert v0.2.0 h1:7H81W6Z/4weDvZBNOfQte5GpIMo0lGYEeWbkGp5LJHI=
 github.com/mdelapenya/tlscert v0.2.0/go.mod h1:O4njj3ELLnJjGdkN7M/vIVCpZ+Cf0L6muqOG4tLSl8o=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
@@ -200,10 +198,10 @@ github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h
 github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
 github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
 github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
-github.com/prometheus/common v0.67.4 h1:yR3NqWO1/UyO1w2PhUvXlGQs/PtFmoveVO0KZ4+Lvsc=
-github.com/prometheus/common v0.67.4/go.mod h1:gP0fq6YjjNCLssJCQp0yk4M8W6ikLURwkdd/YKtTbyI=
-github.com/prometheus/procfs v0.19.2 h1:zUMhqEW66Ex7OXIiDkll3tl9a1ZdilUOd/F6ZXw4Vws=
-github.com/prometheus/procfs v0.19.2/go.mod h1:M0aotyiemPhBCM0z5w87kL22CxfcH05ZpYlu+b4J7mw=
+github.com/prometheus/common v0.67.5 h1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4=
+github.com/prometheus/common v0.67.5/go.mod h1:SjE/0MzDEEAyrdr5Gqc6G+sXI67maCxzaT3A2+HqjUw=
+github.com/prometheus/procfs v0.20.1 h1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc=
+github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4UlK79eF5TGGo=
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
 github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0=
@@ -248,8 +246,8 @@ github.com/tklauser/numcpus v0.11.0 h1:nSTwhKH5e1dMNsCdVBukSZrURJRoHbSEQjdEbY+9R
 github.com/tklauser/numcpus v0.11.0/go.mod h1:z+LwcLq54uWZTX0u/bGobaV34u6V7KNlTZejzM6/3MQ=
 github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
 github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
-github.com/valyala/fasthttp v1.68.0 h1:v12Nx16iepr8r9ySOwqI+5RBJ/DqTxhOy1HrHoDFnok=
-github.com/valyala/fasthttp v1.68.0/go.mod h1:5EXiRfYQAoiO/khu4oU9VISC/eVY6JqmSpPJoHCKsz4=
+github.com/valyala/fasthttp v1.69.0 h1:fNLLESD2SooWeh2cidsuFtOcrEi4uB4m1mPrkJMZyVI=
+github.com/valyala/fasthttp v1.69.0/go.mod h1:4wA4PfAraPlAsJ5jMSqCE2ug5tqUPwKXxVj8oNECGcw=
 github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZqKjWU=
 github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E=
 github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
@@ -276,19 +274,19 @@ go.opentelemetry.io/proto/otlp v1.0.0 h1:T0TX0tmXU8a3CbNXzEKGeU5mIVOdf0oykP+u2lI
 go.opentelemetry.io/proto/otlp v1.0.0/go.mod h1:Sy6pihPLfYHkr3NkUbEhGHFhINUSI/v80hjKIs5JXpM=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
-go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
-go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
+go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
+go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20200728195943-123391ffb6de/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.46.0 h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU=
-golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0=
+golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
+golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
-golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
-golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
-golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo=
+golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -299,15 +297,15 @@ golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk=
-golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/term v0.38.0 h1:PQ5pkm/rLO6HnxFR7N2lJHOZX6Kez5Y1gDSJla6jo7Q=
-golang.org/x/term v0.38.0/go.mod h1:bSEAKrOT1W+VSu9TSCMtoGEOUcKxOKgl3LE5QEF/xVg=
+golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
+golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
+golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU=
-golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY=
-golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
-golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
+golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
+golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
+golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
+golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 google.golang.org/genproto/googleapis/api v0.0.0-20251222181119-0a764e51fe1b h1:uA40e2M6fYRBf0+8uN5mLlqUtV192iiksiICIBkYJ1E=
 google.golang.org/genproto/googleapis/api v0.0.0-20251222181119-0a764e51fe1b/go.mod h1:Xa7le7qx2vmqB/SzWUBa7KdMjpdpAHlh5QCSnjessQk=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20251222181119-0a764e51fe1b h1:Mv8VFug0MP9e5vUxfBcE3vUkV6CImK3cMNMIDFjmzxU=
@@ -19,4 +19,4 @@ sources:
 maintainers:
  - name: Lukasz Raczylo
    email: [email protected]
-icon: https://raw.githubusercontent.com/lukaszraczylo/gohoarder/main/docs/logo.png
+# icon: https://raw.githubusercontent.com/lukaszraczylo/gohoarder/main/docs/logo.png  # TODO: Add logo
@@ -93,24 +93,30 @@ data:
        low: {{ .Values.security.blockThresholds.low }}
      scanners:
        trivy:
-          enabled: {{ .Values.security.scanners.trivy.enabled }}
+          # Disabled in server config (no trivy binary), enabled via env var in scanner pod
+          enabled: false
          timeout: {{ .Values.security.scanners.trivy.timeout | quote }}
          cache_db: {{ .Values.security.scanners.trivy.cacheDb | quote }}
        osv:
+          # API-based scanner - works in both server and scanner pods
          enabled: {{ .Values.security.scanners.osv.enabled }}
          api_url: {{ .Values.security.scanners.osv.apiUrl | quote }}
          timeout: {{ .Values.security.scanners.osv.timeout | quote }}
        grype:
-          enabled: {{ .Values.security.scanners.grype.enabled }}
+          # Disabled in server config (no grype binary), enabled via env var in scanner pod
+          enabled: false
          timeout: {{ .Values.security.scanners.grype.timeout | quote }}
        govulncheck:
-          enabled: {{ .Values.security.scanners.govulncheck.enabled }}
+          # Disabled in server config (no go/govulncheck binary), enabled via env var in scanner pod
+          enabled: false
          timeout: {{ .Values.security.scanners.govulncheck.timeout | quote }}
        npm_audit:
-          enabled: {{ .Values.security.scanners.npmAudit.enabled }}
+          # Disabled in server config (no npm binary), enabled via env var in scanner pod
+          enabled: false
          timeout: {{ .Values.security.scanners.npmAudit.timeout | quote }}
        pip_audit:
-          enabled: {{ .Values.security.scanners.pipAudit.enabled }}
+          # Disabled in server config (no pip binary), enabled via env var in scanner pod
+          enabled: false
          timeout: {{ .Values.security.scanners.pipAudit.timeout | quote }}
        ghsa:
          enabled: {{ .Values.security.scanners.ghsa.enabled }}
@@ -67,11 +67,18 @@ spec:
          protocol: TCP
        env:
        - name: API_BASE_URL
-          value: {{ .Values.frontend.backendUrl | default (printf "http://%s-server:%d" (include "gohoarder.fullname" .) (.Values.server.service.port | int)) | quote }}
+          value: {{ .Values.frontend.backendUrl | default "/api" | quote }}
        - name: APP_VERSION
          value: {{ .Chart.AppVersion | quote }}
        - name: APP_NAME
          value: "GoHoarder"
+        # Backend proxy configuration (frontend now includes reverse proxy)
+        - name: BACKEND_HOST
+          value: {{ include "gohoarder.fullname" . }}-server
+        - name: BACKEND_PORT
+          value: {{ .Values.server.service.port | quote }}
+        - name: SERVER_NAME
+          value: {{ .Values.frontend.serverName | default "_" | quote }}
        {{- with .Values.frontend.env }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
@@ -109,6 +109,17 @@ spec:
        env:
        - name: CONFIG_FILE
          value: /etc/gohoarder/config.yaml
+        # Enable tool-based scanners only in scanner pod (server doesn't have the tools)
+        - name: GOHOARDER_SECURITY_SCANNERS_TRIVY_ENABLED
+          value: "{{ .Values.security.scanners.trivy.enabled }}"
+        - name: GOHOARDER_SECURITY_SCANNERS_GRYPE_ENABLED
+          value: "{{ .Values.security.scanners.grype.enabled }}"
+        - name: GOHOARDER_SECURITY_SCANNERS_GOVULNCHECK_ENABLED
+          value: "{{ .Values.security.scanners.govulncheck.enabled }}"
+        - name: GOHOARDER_SECURITY_SCANNERS_NPM_AUDIT_ENABLED
+          value: "{{ .Values.security.scanners.npmAudit.enabled }}"
+        - name: GOHOARDER_SECURITY_SCANNERS_PIP_AUDIT_ENABLED
+          value: "{{ .Values.security.scanners.pipAudit.enabled }}"
        {{- if and (eq .Values.metadata.backend "postgresql") .Values.metadata.postgresql.existingSecret }}
        - name: POSTGRES_USER
          valueFrom:
@@ -1,11 +1,10 @@
 {{- if .Values.ingress.enabled -}}
-{{- if .Values.ingress.frontend.enabled -}}
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: {{ include "gohoarder.fullname" . }}-frontend
+  name: {{ include "gohoarder.fullname" . }}
  labels:
-    {{- include "gohoarder.frontend.labels" . | nindent 4 }}
+    {{- include "gohoarder.labels" . | nindent 4 }}
  {{- with .Values.ingress.annotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
@@ -14,65 +13,17 @@ spec:
  {{- if .Values.ingress.className }}
  ingressClassName: {{ .Values.ingress.className }}
  {{- end }}
-  {{- if .Values.ingress.frontend.tls.enabled }}
+  {{- if .Values.ingress.tls.enabled }}
  tls:
    - hosts:
-        - {{ .Values.ingress.frontend.host | default (printf "%s.%s" "gohoarder" .Values.global.domain) | quote }}
-      secretName: {{ .Values.ingress.frontend.tls.secretName }}
+        - {{ .Values.ingress.host | default (printf "%s.%s" "gohoarder" .Values.global.domain) | quote }}
+      secretName: {{ .Values.ingress.tls.secretName }}
  {{- end }}
  rules:
-    - host: {{ .Values.ingress.frontend.host | default (printf "%s.%s" "gohoarder" .Values.global.domain) | quote }}
+    - host: {{ .Values.ingress.host | default (printf "%s.%s" "gohoarder" .Values.global.domain) | quote }}
      http:
        paths:
-          - path: /npm
-            pathType: Prefix
-            backend:
-              service:
-                name: {{ include "gohoarder.fullname" . }}-server
-                port:
-                  number: {{ .Values.server.service.port }}
-          - path: /pypi
-            pathType: Prefix
-            backend:
-              service:
-                name: {{ include "gohoarder.fullname" . }}-server
-                port:
-                  number: {{ .Values.server.service.port }}
-          - path: /go
-            pathType: Prefix
-            backend:
-              service:
-                name: {{ include "gohoarder.fullname" . }}-server
-                port:
-                  number: {{ .Values.server.service.port }}
-          - path: /api
-            pathType: Prefix
-            backend:
-              service:
-                name: {{ include "gohoarder.fullname" . }}-server
-                port:
-                  number: {{ .Values.server.service.port }}
-          - path: /ws
-            pathType: Prefix
-            backend:
-              service:
-                name: {{ include "gohoarder.fullname" . }}-server
-                port:
-                  number: {{ .Values.server.service.port }}
-          - path: /health
-            pathType: Prefix
-            backend:
-              service:
-                name: {{ include "gohoarder.fullname" . }}-server
-                port:
-                  number: {{ .Values.server.service.port }}
-          - path: /metrics
-            pathType: Prefix
-            backend:
-              service:
-                name: {{ include "gohoarder.fullname" . }}-server
-                port:
-                  number: {{ .Values.server.service.port }}
+          # Route all traffic to frontend (which now includes reverse proxy to backend)
          - path: /
            pathType: Prefix
            backend:
@@ -81,38 +32,3 @@ spec:
                port:
                  number: {{ .Values.frontend.service.port }}
 {{- end }}
---
-{{- if .Values.ingress.api.enabled }}
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: {{ include "gohoarder.fullname" . }}-api
-  labels:
-    {{- include "gohoarder.server.labels" . | nindent 4 }}
-  {{- with .Values.ingress.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-spec:
-  {{- if .Values.ingress.className }}
-  ingressClassName: {{ .Values.ingress.className }}
-  {{- end }}
-  {{- if .Values.ingress.api.tls.enabled }}
-  tls:
-    - hosts:
-        - {{ .Values.ingress.api.host | default (printf "api.%s.%s" "gohoarder" .Values.global.domain) | quote }}
-      secretName: {{ .Values.ingress.api.tls.secretName }}
-  {{- end }}
-  rules:
-    - host: {{ .Values.ingress.api.host | default (printf "api.%s.%s" "gohoarder" .Values.global.domain) | quote }}
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: {{ include "gohoarder.fullname" . }}-server
-                port:
-                  number: {{ .Values.server.service.port }}
-{{- end }}
-{{- end }}
@@ -507,21 +507,12 @@ ingress:
    nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "300"

-  # Ingress for frontend
-  frontend:
-    enabled: true
-    host: "gohoarder.local"
-    tls:
-      enabled: false
-      secretName: "gohoarder-frontend-tls"
-
-  # Ingress for API (if you want separate ingress)
-  api:
+  # Single ingress routes all traffic to frontend
+  # Frontend now includes reverse proxy to backend (merged gateway functionality)
+  host: "gohoarder.local"
+  tls:
    enabled: false
-    host: "api.gohoarder.local"
-    tls:
-      enabled: false
-      secretName: "gohoarder-api-tls"
+    secretName: "gohoarder-tls"

 # Autoscaling configuration
 autoscaling:
@@ -290,7 +290,9 @@ func (a *App) initializeComponents() error {
 	a.healthChecker.AddCheck("scanner", func(ctx context.Context) (health.Status, string) {
 		if a.config.Security.Enabled {
 			if err := a.scanManager.Health(ctx); err != nil {
-				return health.StatusUnhealthy, err.Error()
+				// Scanner failures (e.g., API rate limits) shouldn't mark server as unhealthy
+				// Server can still serve cached packages, just can't scan new ones
+				return health.StatusDegraded, err.Error()
 			}
 		}
 		return health.StatusHealthy, ""
@@ -145,7 +145,37 @@ func (m *Manager) getOrFetch(ctx context.Context, registry, name, version string
 			if err == nil {
 				// Cache hit!
 				metrics.RecordCacheHit(registry)
-				_ = m.metadata.UpdateDownloadCount(ctx, registry, name, version) // #nosec G104 -- Async update, error logged
+
+				// Update download count (log errors for debugging)
+				if err := m.metadata.UpdateDownloadCount(ctx, registry, name, version); err != nil {
+					log.Warn().
+						Err(err).
+						Str("registry", registry).
+						Str("package", name).
+						Str("version", version).
+						Msg("Failed to update download count - package may not exist in database")
+
+					// Try to save package to database if it doesn't exist
+					// This handles the case where storage has files but database was migrated/reset
+					if saveErr := m.metadata.SavePackage(ctx, pkg); saveErr != nil {
+						log.Error().
+							Err(saveErr).
+							Str("registry", registry).
+							Str("package", name).
+							Str("version", version).
+							Msg("Failed to save package to database")
+					} else {
+						// Retry download count update after saving package
+						if retryErr := m.metadata.UpdateDownloadCount(ctx, registry, name, version); retryErr != nil {
+							log.Error().
+								Err(retryErr).
+								Str("registry", registry).
+								Str("package", name).
+								Str("version", version).
+								Msg("Failed to update download count even after saving package")
+						}
+					}
+				}

 				// Track download in analytics if enabled
 				if m.analytics != nil {
@@ -290,6 +320,22 @@ servePkg:
 		return nil, errors.Wrap(err, errors.ErrCodeStorageFailure, "failed to retrieve just-stored package")
 	}

+	// Track download count for first-time download (cache miss)
+	// This ensures download count increments regardless of cache hit/miss
+	if err := m.metadata.UpdateDownloadCount(ctx, registry, name, version); err != nil {
+		log.Warn().
+			Err(err).
+			Str("registry", registry).
+			Str("package", name).
+			Str("version", version).
+			Msg("Failed to update download count for newly cached package")
+	}
+
+	// Track download in analytics if enabled
+	if m.analytics != nil {
+		m.trackDownload(registry, name, version, storedPkg.Size)
+	}
+
 	return &CacheEntry{
 		Package:     storedPkg,
 		Data:        storedData,
@@ -343,6 +343,7 @@ func TestGet(t *testing.T) {
 				s.On("Put", mock.Anything, "npm/lodash/4.17.21", mock.Anything, mock.Anything).Return(nil)
 				m.On("SavePackage", mock.Anything, mock.Anything).Return(nil)
 				s.On("Get", mock.Anything, "npm/lodash/4.17.21").Return(io.NopCloser(strings.NewReader("upstream data")), nil)
+				m.On("UpdateDownloadCount", mock.Anything, "npm", "lodash", "4.17.21").Return(nil)
 			},
 			fetchFunc: func(ctx context.Context) (io.ReadCloser, string, error) {
 				return io.NopCloser(strings.NewReader("upstream data")), "https://registry.npmjs.org/lodash", nil
@@ -374,6 +375,7 @@ func TestGet(t *testing.T) {
 				s.On("Put", mock.Anything, "npm/expired-pkg/1.0.0", mock.Anything, mock.Anything).Return(nil)
 				m.On("SavePackage", mock.Anything, mock.Anything).Return(nil)
 				s.On("Get", mock.Anything, "npm/expired-pkg/1.0.0").Return(io.NopCloser(strings.NewReader("refreshed data")), nil)
+				m.On("UpdateDownloadCount", mock.Anything, "npm", "expired-pkg", "1.0.0").Return(nil)
 			},
 			fetchFunc: func(ctx context.Context) (io.ReadCloser, string, error) {
 				return io.NopCloser(strings.NewReader("refreshed data")), "https://registry.npmjs.org/expired-pkg", nil
@@ -435,6 +437,7 @@ func TestGet(t *testing.T) {
 				m.On("SavePackage", mock.Anything, mock.Anything).Return(nil)
 				// Second Get succeeds (after re-storing)
 				s.On("Get", mock.Anything, "npm/inconsistent/1.0.0").Return(io.NopCloser(strings.NewReader("recovered data")), nil).Once()
+				m.On("UpdateDownloadCount", mock.Anything, "npm", "inconsistent", "1.0.0").Return(nil)
 			},
 			fetchFunc: func(ctx context.Context) (io.ReadCloser, string, error) {
 				return io.NopCloser(strings.NewReader("recovered data")), "https://registry.npmjs.org/inconsistent", nil
@@ -583,29 +583,38 @@ func (s *GORMStoreV2) GetTimeSeriesStats(ctx context.Context, period string, reg
 	// Determine which table to query based on period
 	var tableName string
 	var since time.Time
+	var bucketDuration time.Duration

 	switch period {
 	case "1h":
 		tableName = "download_stats_hourly"
-		since = time.Now().Add(-1 * time.Hour)
+		since = time.Now().Add(-1 * time.Hour).Truncate(time.Hour)
+		bucketDuration = time.Hour
 	case "1day":
 		tableName = "download_stats_hourly"
-		since = time.Now().Add(-24 * time.Hour)
+		since = time.Now().Add(-24 * time.Hour).Truncate(time.Hour)
+		bucketDuration = time.Hour
 	case "7day":
 		tableName = "download_stats_daily"
-		since = time.Now().Add(-7 * 24 * time.Hour)
+		since = time.Now().Add(-7 * 24 * time.Hour).Truncate(24 * time.Hour)
+		bucketDuration = 24 * time.Hour
 	case "30day":
 		tableName = "download_stats_daily"
-		since = time.Now().Add(-30 * 24 * time.Hour)
+		since = time.Now().Add(-30 * 24 * time.Hour).Truncate(24 * time.Hour)
+		bucketDuration = 24 * time.Hour
 	default:
 		tableName = "download_stats_hourly"
-		since = time.Now().Add(-24 * time.Hour)
+		since = time.Now().Add(-24 * time.Hour).Truncate(time.Hour)
+		bucketDuration = time.Hour
 	}

+	now := time.Now()
+
+	// Try to get registry-level aggregate stats first
 	query := s.db.WithContext(ctx).
 		Table(tableName).
 		Select("time_bucket as timestamp, download_count as value").
-		Where("time_bucket >= ?", since)
+		Where("time_bucket >= ? AND time_bucket <= ?", since, now)

 	// Filter by registry if specified
 	if registry != "" {
@@ -630,10 +639,45 @@ func (s *GORMStoreV2) GetTimeSeriesStats(ctx context.Context, period string, reg
 		return nil, errors.Wrap(err, errors.ErrCodeStorageFailure, "failed to get time series stats")
 	}

+	// If no aggregate data found, try summing package-level stats
+	if len(results) == 0 {
+		sumQuery := s.db.WithContext(ctx).
+			Table(tableName).
+			Select("time_bucket as timestamp, SUM(download_count) as value").
+			Where("time_bucket >= ? AND time_bucket <= ?", since, now)
+
+		if registry != "" {
+			registryID, err := s.getRegistryID(registry)
+			if err != nil {
+				return nil, err
+			}
+			sumQuery = sumQuery.Where("registry_id = ? AND package_id IS NOT NULL", registryID)
+		} else {
+			sumQuery = sumQuery.Where("package_id IS NOT NULL")
+		}
+
+		sumQuery = sumQuery.Group("time_bucket").Order("time_bucket ASC")
+
+		if err := sumQuery.Scan(&results).Error; err != nil {
+			return nil, errors.Wrap(err, errors.ErrCodeStorageFailure, "failed to get time series stats from package data")
+		}
+	}
+
+	// Create a map of existing data points
+	dataMap := make(map[time.Time]int64)
 	for _, r := range results {
+		dataMap[r.Timestamp] = r.Value
+	}
+
+	// Generate continuous time series with 0 values for missing periods
+	for t := since; t.Before(now) || t.Equal(now); t = t.Add(bucketDuration) {
+		value := int64(0)
+		if v, exists := dataMap[t]; exists {
+			value = v
+		}
 		stats.DataPoints = append(stats.DataPoints, &metadata.TimeSeriesDataPoint{
-			Timestamp: r.Timestamp,
-			Value:     r.Value,
+			Timestamp: t,
+			Value:     value,
 		})
 	}

@@ -107,11 +107,17 @@ func (s *Scanner) Health(ctx context.Context) error {
 	}
 	defer resp.Body.Close() // #nosec G104 -- Cleanup, error not critical

-	if resp.StatusCode != http.StatusOK {
-		return fmt.Errorf("github api returned status: %d", resp.StatusCode)
+	// Accept any 2xx or 403 (rate limit) as healthy
+	// Rate limits are expected without a GitHub token and shouldn't fail health checks
+	if resp.StatusCode >= 200 && resp.StatusCode < 300 {
+		return nil
+	}
+	if resp.StatusCode == http.StatusForbidden {
+		log.Debug().Msg("GitHub API rate limited (expected without token)")
+		return nil
 	}

-	return nil
+	return fmt.Errorf("github api returned status: %d", resp.StatusCode)
 }

 // mapRegistryToEcosystem maps our registry names to GitHub ecosystem names
@@ -121,13 +121,17 @@ func (s *Scanner) Scan(ctx context.Context, registry, packageName, version strin
 	// Convert registry to OSV ecosystem
 	ecosystem := s.registryToEcosystem(registry)

+	// Clean package name and version for Go modules
+	// Go proxy cache keys include /@v/version.suffix which OSV doesn't understand
+	cleanName, cleanVersion := s.cleanGoModuleName(packageName, version, ecosystem)
+
 	// Build request
 	req := OSVRequest{
 		Package: PackageInfo{
-			Name:      packageName,
+			Name:      cleanName,
 			Ecosystem: ecosystem,
 		},
-		Version: version,
+		Version: cleanVersion,
 	}

 	// Marshal request
@@ -199,6 +203,52 @@ func (s *Scanner) registryToEcosystem(registry string) string {
 	}
 }

+// cleanGoModuleName cleans Go module cache keys to extract the actual module path and version
+// Go proxy cache keys include /@v/version.suffix patterns that need to be cleaned
+// Examples:
+//   - "gorm.io/driver/sqlite/@v/v1.6.0.zip" -> "gorm.io/driver/sqlite", "v1.6.0"
+//   - "github.com/pkg/errors/@v/v0.9.1.mod" -> "github.com/pkg/errors", "v0.9.1"
+//   - "regular-package" -> "regular-package", "version" (unchanged for non-Go)
+func (s *Scanner) cleanGoModuleName(packageName, version, ecosystem string) (string, string) {
+	// Only clean for Go modules
+	if ecosystem != "Go" {
+		return packageName, version
+	}
+
+	// Check if package name contains /@v/ pattern (Go module proxy format)
+	if strings.Contains(packageName, "/@v/") {
+		// Split on /@v/ to get the module path
+		parts := strings.Split(packageName, "/@v/")
+		if len(parts) == 2 {
+			// parts[0] is the clean module path (e.g., "gorm.io/driver/sqlite")
+			// parts[1] might be "v1.6.0.zip" or "v1.6.0.mod" or "v1.6.0.info"
+			cleanName := parts[0]
+
+			// Extract version from the second part if version wasn't already clean
+			// Remove file suffixes like .zip, .mod, .info
+			versionPart := parts[1]
+			versionPart = strings.TrimSuffix(versionPart, ".zip")
+			versionPart = strings.TrimSuffix(versionPart, ".mod")
+			versionPart = strings.TrimSuffix(versionPart, ".info")
+
+			// Use the extracted version if it looks valid, otherwise use the provided version
+			if versionPart != "" && strings.HasPrefix(versionPart, "v") {
+				return cleanName, versionPart
+			}
+
+			return cleanName, version
+		}
+	}
+
+	// Also clean version of any file suffixes
+	cleanVersion := version
+	cleanVersion = strings.TrimSuffix(cleanVersion, ".zip")
+	cleanVersion = strings.TrimSuffix(cleanVersion, ".mod")
+	cleanVersion = strings.TrimSuffix(cleanVersion, ".info")
+
+	return packageName, cleanVersion
+}
+
 // convertOSVResult converts OSV response to metadata.ScanResult
 func (s *Scanner) convertOSVResult(osvResp *OSVResponse, registry, packageName, version string) *metadata.ScanResult {
 	vulnerabilities := make([]metadata.Vulnerability, 0, len(osvResp.Vulns))
Author	SHA1	Message	Date
lukaszraczyloandGitHub	140f19ed6f	Update go.mod and go.sum (#41 )	2026-03-24 03:53:06 +00:00
lukaszraczyloandGitHub	1e9ac2a9f2	Update go.mod and go.sum (#40 )	2026-03-23 03:58:55 +00:00
lukaszraczyloandGitHub	aeb67f7dd9	Update go.mod and go.sum (#39 )	2026-03-22 03:54:22 +00:00
lukaszraczyloandGitHub	afc0ece8d0	Update go.mod and go.sum (#38 )	2026-03-21 03:48:43 +00:00
lukaszraczyloandGitHub	170d5a9f08	Update go.mod and go.sum (#37 )	2026-03-19 03:56:15 +00:00
lukaszraczyloandGitHub	6e351f1a25	Update go.mod and go.sum (#35 )	2026-03-17 03:53:16 +00:00
lukaszraczyloandGitHub	d67cc0bf8e	Update go.mod and go.sum (#34 )	2026-03-14 03:51:56 +00:00
lukaszraczyloandGitHub	239b7e1f75	Update go.mod and go.sum (#33 )	2026-03-13 03:51:41 +00:00
lukaszraczyloandGitHub	9f1d134d7d	Update go.mod and go.sum (#32 )	2026-03-12 03:52:18 +00:00
lukaszraczyloandGitHub	2dfad4f4e3	Update go.mod and go.sum (#31 )	2026-03-09 03:52:49 +00:00
lukaszraczyloandGitHub	defa86573e	Update go.mod and go.sum (#30 )	2026-03-08 03:51:16 +00:00
lukaszraczyloandGitHub	0880cc45f7	Update go.mod and go.sum (#29 )	2026-03-07 03:45:21 +00:00
lukaszraczyloandGitHub	0c2dc0795a	Update go.mod and go.sum (#28 )	2026-03-06 03:51:06 +00:00
lukaszraczyloandGitHub	af81f6c99b	Update go.mod and go.sum (#27 )	2026-03-04 03:51:01 +00:00
lukaszraczyloandGitHub	a46af4b645	Update go.mod and go.sum (#26 )	2026-03-01 03:56:38 +00:00
lukaszraczyloandGitHub	fe3c0ebb63	Update go.mod and go.sum (#25 )	2026-02-28 03:41:31 +00:00
lukaszraczyloandGitHub	b3e15180af	Update go.mod and go.sum (#24 )	2026-02-27 03:51:56 +00:00
lukaszraczyloandGitHub	6735ed2071	Update go.mod and go.sum (#23 )	2026-02-26 03:53:37 +00:00
lukaszraczyloandGitHub	2f379efc83	Update go.mod and go.sum (#22 )	2026-02-25 03:53:35 +00:00
lukaszraczyloandGitHub	5f8e3b4dee	Update go.mod and go.sum (#20 )	2026-02-24 03:53:21 +00:00
lukaszraczyloandGitHub	0704a3b7c8	Update go.mod and go.sum (#19 )	2026-02-21 03:49:36 +00:00
lukaszraczyloandGitHub	b22129fcba	Update go.mod and go.sum (#18 )	2026-02-19 03:54:06 +00:00
lukaszraczyloandGitHub	210602566e	Update go.mod and go.sum (#17 )	2026-02-18 03:54:48 +00:00
lukaszraczyloandGitHub	1e39f9f2f4	Update go.mod and go.sum (#16 )	2026-02-17 03:52:41 +00:00
lukaszraczyloandGitHub	a98ee60d8b	Update go.mod and go.sum (#15 )	2026-02-11 04:01:31 +00:00
lukaszraczyloandGitHub	1293ca4f9d	Update go.mod and go.sum (#13 )	2026-02-10 04:03:22 +00:00
lukaszraczyloandGitHub	2e95518d48	Update go.mod and go.sum (#12 )	2026-02-09 03:59:00 +00:00
lukaszraczyloandGitHub	0388d99d9e	Update go.mod and go.sum (#11 )	2026-02-02 03:56:15 +00:00
lukaszraczyloandGitHub	113564b497	Update go.mod and go.sum (#10 )	2026-02-01 04:02:13 +00:00
lukaszraczyloandGitHub	b78e6e79e3	Update go.mod and go.sum (#9 )	2026-01-30 03:50:54 +00:00
lukaszraczyloandGitHub	3b26752e3c	Update go.mod and go.sum (#8 )	2026-01-29 03:51:11 +00:00
lukaszraczyloandGitHub	ec3312d836	Update go.mod and go.sum (#7 )	2026-01-25 03:40:38 +00:00
lukaszraczyloandGitHub	f1913087e4	Update go.mod and go.sum (#6 )	2026-01-19 03:40:28 +00:00
lukaszraczyloandGitHub	eae3e33e7e	Update go.mod and go.sum (#5 )	2026-01-17 03:35:25 +00:00
lukaszraczyloandGitHub	2e8baad645	Update go.mod and go.sum (#4 )	2026-01-13 03:37:10 +00:00
lukaszraczyloandGitHub	e6f127cf9e	Update go.mod and go.sum (#3 )	2026-01-10 03:35:57 +00:00
lukaszraczyloandGitHub	a1e16c989b	Update go.mod and go.sum (#2 )	2026-01-09 03:37:04 +00:00
lukaszraczyloandGitHub	955250650e	Update go.mod and go.sum (#1 )	2026-01-06 03:36:44 +00:00
lukaszraczylo	85c76150f5	fixup! fix: remove missing logo reference from Helm chart	2026-01-04 14:47:27 +00:00
lukaszraczylo	1baf0993de	fix: remove missing logo reference from Helm chart The referenced logo file (docs/logo.png) doesn't exist, causing Artifact Hub to fail with 404 errors when indexing the chart. Commented out the icon line until a logo is created. Resolves: "error getting logo image https://raw.githubusercontent.com/ lukaszraczylo/gohoarder/main/docs/logo.png: unexpected status code received: 404"	2026-01-04 14:25:57 +00:00
lukaszraczylo	434a15076e	fix: generate continuous time series data with zero-filled gaps for charts Issues fixed: 1. Charts not rendering correctly due to sparse data (missing time buckets) 2. Period "1h" returning empty data when aggregate stats not yet available Changes: - Generate continuous time series with 0 values for all time buckets - Truncate start time to hour/day boundaries for consistent bucketing - Fallback to package-level stats aggregation when registry totals unavailable - Add proper time range filtering (since <= time_bucket <= now) Behavior now: - All time periods (1h, 1day, 7day, 30day) return complete data sets - Missing hours/days are filled with value: 0 - Chart libraries can render continuous lines/bars correctly - No more empty data for "1h" period Example output (1 hour period): Before: [{"timestamp":"14:00","value":5}, {"timestamp":"15:00","value":3}] After: [{"timestamp":"13:00","value":0}, {"timestamp":"14:00","value":5}, {"timestamp":"15:00","value":3}, {"timestamp":"16:00","value":0}] Resolves: "Chart doesn't generate correctly - it should automatically fill 0 for the empty periods to render correctly"	2026-01-04 14:23:08 +00:00
lukaszraczylo	4e7350363d	feat: track download counts for both cache hits and cache misses Previously, download counts only incremented on cache hits (when package was served from cache). First-time downloads (cache misses) were not counted. Changes: - Add UpdateDownloadCount() call when serving newly cached packages - This ensures every download through the proxy increments the counter - Analytics tracking also added for cache misses Behavior now: - First download (cache miss): counter = 1 - Second download (cache hit): counter = 2 - Third download (cache hit): counter = 3 - etc. Updated all relevant tests to expect the additional UpdateDownloadCount call. Resolves user requirement: "I want the counters to increase whenever package is downloaded via proxy - regardless of it being new download or cached download"	2026-01-04 13:50:42 +00:00
lukaszraczylo	38edd735b6	fix: improve download statistics tracking resilience Problem: - Download counts were not incrementing when packages existed in storage but not in the database (e.g., after database migration/reset) - UpdateDownloadCount() was failing silently when package didn't exist in DB - Error was completely ignored despite comment claiming "error logged" Changes: 1. Log errors when UpdateDownloadCount() fails instead of silently ignoring 2. Auto-save package to database if UpdateDownloadCount() fails 3. Retry download count update after saving package 4. Provide detailed error logging for troubleshooting This fixes the issue where: - Database is migrated but storage still has cached packages - Cache hits occur but download events aren't recorded - Statistics show zero downloads despite actual usage Resolves user report: "I cleaned go mod which redownloaded the modules through the proxy but counters did not increased"	2026-01-04 13:44:36 +00:00
lukaszraczylo	c207aa72e9	fix: accept GitHub API rate limits in GHSA health check - Rate limits (403) are now accepted as healthy - Rate limiting is expected without a GitHub token - Only real errors (network failures, 500s) fail the health check - Prevents health check failures due to unauthenticated API usage Related: GHSA scanner health checks	2026-01-04 13:33:49 +00:00
lukaszraczylo	bf0925a4fc	fix: return degraded status for scanner health check failures - Scanner failures (e.g., GitHub API rate limits) no longer mark server as unhealthy - Server can still serve cached packages when scanners are unavailable - Readiness probes will now pass with degraded scanner status - Prevents unnecessary pod restarts due to external API issues Fixes: Readiness probes failing with 503 due to GHSA rate limiting	2026-01-04 13:33:10 +00:00
lukaszraczylo	bc854aa183	perf: remove nginx rate limiting for internal package proxy - Removed rate limiting zones (10r/s for API, 5r/s for downloads) - Internal package proxy doesn't need rate limiting - During builds, package managers make hundreds of concurrent requests - Rate limiting was causing unnecessary delays and potential 429 errors This improves build performance significantly for CI/CD pipelines	2026-01-04 13:09:18 +00:00
lukaszraczylo	c4bb2f6e3a	fix: clean Go module paths before calling OSV API - OSV API expects clean module paths like 'gorm.io/driver/sqlite' - Cache keys include Go proxy format like 'gorm.io/driver/sqlite/@v/v1.6.0.zip' - Added cleanGoModuleName() to extract module path and version - Strips /@v/ prefix and .zip/.mod/.info suffixes - Fixes 404 errors when scanning Go modules Resolves: OSV API returning 404 for Go module scans	2026-01-04 13:07:31 +00:00
lukaszraczylo	8848656193	fix: preserve /api prefix in nginx reverse proxy - Changed proxy_pass from http://backend/ to http://backend - Trailing slash was stripping /api prefix causing 404 errors - Backend expects /api/stats not /stats	2026-01-04 03:55:40 +00:00
lukaszraczylo	3ecff61114	fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! perf: build frontend once on runner instead of in Docker	2026-01-04 03:18:49 +00:00
lukaszraczylo	f86943b884	fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! perf: build frontend once on runner instead of in Docker	2026-01-04 02:48:28 +00:00
lukaszraczylo	448bb70ac8	fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! perf: build frontend once on runner instead of in Docker	2026-01-04 02:17:11 +00:00
lukaszraczylo	d63ae21133	fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! perf: build frontend once on runner instead of in Docker	2026-01-04 02:01:24 +00:00
lukaszraczylo	f71414bbb1	fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! perf: build frontend once on runner instead of in Docker	2026-01-04 01:37:57 +00:00
lukaszraczylo	bdcacfc8db	fixup! fixup! fixup! fixup! fixup! fixup! fixup! fixup! perf: build frontend once on runner instead of in Docker	2026-01-04 01:32:12 +00:00
lukaszraczylo	a36080c6de	fixup! fixup! fixup! fixup! fixup! fixup! fixup! perf: build frontend once on runner instead of in Docker	2026-01-04 01:24:14 +00:00
lukaszraczylo	0e6510636d	fixup! fixup! fixup! fixup! fixup! fixup! perf: build frontend once on runner instead of in Docker	2026-01-04 01:20:27 +00:00
lukaszraczylo	276d406fb6	fixup! fixup! fixup! fixup! fixup! perf: build frontend once on runner instead of in Docker	2026-01-04 01:16:13 +00:00
lukaszraczylo	fb79d82072	fixup! fixup! fixup! fixup! perf: build frontend once on runner instead of in Docker	2026-01-04 01:13:41 +00:00
lukaszraczylo	bbcbeeaf88	fixup! fixup! fixup! perf: build frontend once on runner instead of in Docker	2026-01-04 01:11:26 +00:00
lukaszraczylo	9f4d8fc777	fixup! fixup! perf: build frontend once on runner instead of in Docker	2026-01-04 01:08:55 +00:00
lukaszraczylo	1f781f6620	fixup! perf: build frontend once on runner instead of in Docker	2026-01-04 01:01:53 +00:00
lukaszraczylo	8a9d786b1a	perf: build frontend once on runner instead of in Docker - [x] Remove Docker compilation from server, scanner, migrate Dockerfiles - [x] Use pre-built binaries injected by GoReleaser instead - [x] Delete separate gateway container and merge into frontend - [x] Update .goreleaser.yaml to reference pre-built binaries - [x] Simplify Kubernetes deployment to remove gateway service - [x] Simplify docker-compose to remove gateway container - [x] Add backend proxy configuration to frontend	2026-01-04 00:53:44 +00:00
lukaszraczylo	e1a02a6d69	perf: build frontend once on runner instead of in Docker MAJOR PERFORMANCE IMPROVEMENT: Reduced frontend Docker build time from ~20 minutes to ~30 seconds by building the SPA once on the runner instead of twice (amd64 + arm64) in Docker. Changes: 1. Release workflow now builds frontend on CI runner (native, fast) 2. Frontend artifact uploaded and downloaded in release job 3. Dockerfile.frontend simplified to just copy pre-built files 4. Multi-arch Docker build is now just copying files into nginx Before: - Docker builds frontend 2x (amd64 + arm64 with QEMU emulation) - Each: pnpm install + pnpm build = ~10 min per arch - Total: ~20 minutes for frontend image After: - Build frontend 1x on runner = ~2 min (native) - Docker just copies files = ~30 sec (both architectures) - Total: ~2.5 minutes for frontend image Impact: - 8x faster frontend builds - Total release time reduced from ~25 min to ~7 min - Lower resource usage (no QEMU emulation) Files changed: - .github/workflows/release.yaml: Enable node build - Dockerfile.frontend: Remove build stage, expect pre-built files - .goreleaser.yaml: Copy frontend/dist instead of full source	2026-01-04 00:33:47 +00:00
lukaszraczylo	5c8565367c	refactor: merge gateway functionality into frontend container Eliminated duplicate nginx containers by merging gateway reverse proxy functionality into the frontend container. This simplifies deployment and reduces resource usage. Architecture changes: - Frontend now serves both static files AND reverse proxies to backend - Single nginx container handles all HTTP routing - Gateway container removed from builds and Helm chart Dockerfile.frontend changes: - Added upstream backend configuration - Added proxy locations for /api, /health, /metrics, /npm, /pypi, /go, /ws - Added rate limiting for API and downloads - Added WebSocket support - Configurable via BACKEND_HOST and BACKEND_PORT env vars Helm chart changes: - Updated frontend deployment to configure backend connection - Simplified ingress to single route (all traffic → frontend) - Frontend proxies backend requests internally - Removed separate frontend/api ingress configurations GoReleaser changes: - Removed gohoarder-gateway Docker build - Now builds: server, scanner, migrate, frontend (4 images) Benefits: - Fewer containers to manage - Reduced complexity in Docker Compose and Kubernetes - Single point of configuration for routing - Better resource utilization	2026-01-04 00:30:20 +00:00
lukaszraczylo	9db929ed8b	fix: remove hardcoded platform args causing wrong architecture builds CRITICAL FIX: arm64 images were getting amd64 binaries causing "exec format error" when running on ARM platforms. Root cause: - Dockerfiles had ARG TARGETOS=linux and ARG TARGETARCH=amd64 - FROM --platform=$TARGETOS/$TARGETARCH used these defaults - buildx couldn't override them, so all builds used amd64 Solution: - Removed --platform from FROM statement - Let buildx automatically handle platform selection - Declared ARGs AFTER FROM to receive buildx values - buildx automatically sets TARGETPLATFORM, TARGETOS, TARGETARCH Now each platform builds native binaries: - linux/amd64 → amd64 binary - linux/arm64 → arm64 binary This fixes: exec /usr/local/bin/migrate: exec format error	2026-01-04 00:05:08 +00:00
lukaszraczylo	0a2c5f6c2c	fix: update Dockerfiles to use Go 1.25 to match go.mod requirement go.mod requires go >= 1.25.5 but Dockerfiles were using golang:1.23-alpine. Updated all Go-based Dockerfiles to use golang:1.25-alpine. Affected files: - Dockerfile.server - Dockerfile.scanner - Dockerfile.migrate This fixes the build error: "go: go.mod requires go >= 1.25.5 (running go 1.23.12; GOTOOLCHAIN=local)"	2026-01-03 23:50:55 +00:00
lukaszraczylo	ae632a3dd7	fix: add extra_files to copy source directories into Docker build context GoReleaser creates a temporary build context with only binaries, but our Dockerfiles are multi-stage builds that need the full source code to compile. Added extra_files to copy necessary directories. Files copied per image: - gohoarder-server: go.mod, go.sum, cmd, pkg, internal, config - gohoarder-scanner: go.mod, go.sum, cmd, pkg, internal, config - gohoarder-migrate: go.mod, go.sum, cmd, pkg, internal, migrations - gohoarder-frontend: frontend/ directory (Node.js source) - gohoarder-gateway: no extra files needed (static config) This fixes the build context error: "Seems like you tried to copy a file that is not available in the build context."	2026-01-03 23:41:13 +00:00
lukaszraczylo	c212077478	refactor: rebuild GoReleaser configuration with dockers_v2 Completely rebuilt GoReleaser Pro configuration using modern dockers_v2 syntax to fix Docker build issues. All Dockerfiles are self-contained multi-stage builds that compile their own binaries. Key changes: - Migrated from deprecated 'dockers' to 'dockers_v2' - Removed 'use: buildx' (implicit in dockers_v2) - Changed 'image_templates' to 'images' + 'tags' structure - Replaced 'build_flag_templates' with 'build_args' + 'flags' - Removed incorrect 'extra_files' that caused build context errors - Added 'platforms' for multi-arch support (linux/amd64, linux/arm64) Binary builds: - gohoarder: darwin/arm64, linux/amd64 (CGO enabled) - migrate: darwin/arm64, linux/amd64 (CGO enabled) - linux/arm64 binaries skipped (Docker provides multi-arch) Docker images (all self-building): - gohoarder-server (Go multi-stage build) - gohoarder-scanner (Go multi-stage build) - gohoarder-migrate (Go multi-stage build) - gohoarder-frontend (Node.js multi-stage build) - gohoarder-gateway (Nginx static config)	2026-01-03 23:34:10 +00:00
lukaszraczylo	af5e08a864	fix: disable SBOM attestations for Docker builds Docker SBOM attestations require docker-container driver which is not available in the default Docker driver used by GoReleaser. Disabled SBOM generation for all Docker images to prevent build failures. Error fixed: - "Attestation is not supported for the docker driver" Applied to all Docker images: - gohoarder-server - gohoarder-frontend - gohoarder-scanner - gohoarder-gateway - gohoarder-migrate	2026-01-03 23:14:27 +00:00
lukaszraczylo	adc7388ee1	fix: revert to using shared workflow (now fixed upstream) Removed local workflow copy and reverted to using the shared workflow from lukaszraczylo/shared-actions@main, which now has the proper if condition to prevent the release job from being skipped.	2026-01-03 23:00:08 +00:00
lukaszraczylo	116ba9b006	fix: add missing condition to release job to prevent skipping Problem: - Release job (merge phase) was being skipped even though all builds succeeded - The shared workflow's release job has `needs: [version, build]` but no `if` condition - Without `if: always()`, GitHub Actions skips the job if dependencies have non-success status - Frontend job being skipped caused downstream effects Solution: - Created local copy of go-release-cgo.yaml workflow - Added explicit condition to release job: if: \| always() && needs.version.result == 'success' && needs.build.result == 'success' - Updated release.yaml to use local workflow instead of remote This ensures the release/merge phase runs as long as version and build jobs succeed, regardless of optional jobs like frontend being skipped. Note: This is a workaround until the fix is merged upstream in shared-actions repo.	2026-01-03 22:57:21 +00:00