url/homelable
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
765 Commits 17 Branches 42 Tags
main
Commit Graph

5 Commits

Author SHA1 Message Date
Pouzor 7c2417f5a9 fix(security): resolve code scanning alerts 
Add least-privilege 'permissions: contents: read' to quality, security
and docker-ci workflows (actions/missing-workflow-permissions).

Harden markdown table cell escaping in exportMarkdown: escape backslash
before pipe and collapse newlines so untrusted values can't break the
table (js/incomplete-sanitization). Add regression tests.

ha-relevant: maybe
 2026-06-09 17:15:26 +02:00
Pouzor 1811afa749 fix: upgrade fastapi to 0.135.1, fix starlette CVEs, update auth test assertions 
- fastapi 0.115.0 → 0.135.1 pulls starlette 0.52.1 (fixes CVE-2024-47874, CVE-2025-54121)
- pip-audit: ignore CVE-2024-23342 (ecdsa Minerva attack, no fix exists; app uses HS256 only)
- Update auth guard tests: FastAPI 0.135 returns 401 (not 403) when Bearer token is missing
 2026-03-07 15:18:28 +01:00
Pouzor e5262b4b71 fix: replace safety scan with pip-audit (no login required) 
safety scan requires interactive account login, breaking CI.
pip-audit provides equivalent vulnerability scanning without auth.
 2026-03-07 15:11:59 +01:00
Pouzor fccbdad409 fix: patch CVEs — upgrade python-jose 3.3→3.5, python-multipart 0.0.12→0.0.22; use safety scan 2026-03-07 15:08:04 +01:00
Pouzor 4310a5cc2d feat: Phase 1 scaffold — frontend canvas + backend skeleton 
Frontend:
- Vite + React 18 + TypeScript + Tailwind v4 + Shadcn/ui
- React Flow v12 canvas with all 11 node types and 5 edge types
- Dark theme with project design system (cyan, green, orange, purple accents)
- Collapsible sidebar, toolbar, detail panel
- Zustand store for canvas state
- Demo data with 10 nodes and 10 edges

Backend:
- FastAPI + SQLAlchemy async + SQLite (Python 3.13)
- DB models: Node, Edge, CanvasState, PendingDevice, ScanRun
- REST API routes: auth, nodes, edges, canvas, scan, status (WebSocket)
- JWT auth + bcrypt via config.yml
- Pydantic v2 schemas

Infra:
- GitHub Actions quality + security workflows
- .gitignore, .env.example, verify-tooling.sh, security-check.sh
 2026-03-06 23:14:34 +01:00