Commit Graph

  • 8ae2ad5e9f chore(deps-dev): bump vite from 8.0.13 to 8.0.16 (#8367) main latest-commit-build dependabot[bot] 2026-06-16 19:58:45 -04:00
  • 4721a254d7 web: remove the install page (#8350) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-10 10:11:57 -04:00
  • 515f45ae00 web: use a single landing banner for light and dark mode (#8344) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-07 22:30:20 -04:00
  • ab22b87483 chore: update SHA256 checksum link in release issue templates (#8345) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-07 22:28:17 -04:00
  • bcda7c90dd fix: surface 5xx errors in the SPA boot and route loaders (#8343) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-07 22:00:39 -04:00
  • 3ba8aca90e release: update version to 0.14.3 v0.14.3-rc.1 v0.14.3 release/0.14 Joe Chen 2026-06-07 13:48:11 -04:00
  • 0ad23744c2 ci(lint): inline reflect.Ptr and fix gofmt in http.go Joe Chen 2026-06-07 13:45:13 -04:00
  • ad2a1066d7 ci(docker): gate moving image tags on highest-version checks Joe Chen 2026-06-07 13:39:38 -04:00
  • 93f966b030 release: cut CHANGELOG entries for 0.14.3 (#8338) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-07 13:36:42 -04:00
  • 79fdabdc07 security: require token auth for org metadata and team list (#8336) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-06 23:33:30 -04:00
  • a4ad7211d8 security: time out stalled SSH handshakes after 15s (#8335) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-06 23:27:31 -04:00
  • 1a0d398600 compat(0.14): validate org name inline in v1 org API Joe Chen 2026-06-07 10:38:19 -04:00
  • 7b4a87bf60 security: reject path traversal in owner and repository names (#8334) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-06 23:14:42 -04:00
  • 3802c1b8b3 chore: update CHANGELOG for removed custom templates ᴊᴏᴇ ᴄʜᴇɴ 2026-06-07 10:36:28 -04:00
  • e2fae5d045 security: verify content hash on LFS dedupe shortcut (#8333) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-06 23:03:53 -04:00
  • 263bc2467a security: walk full upload path for symlinks (#8332) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-06 22:46:48 -04:00
  • c40d5a41f5 security: harden Git HTTP access checks (#8331) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-06 22:35:04 -04:00
  • f6b8c5847d security: upgrade notebookjs and route ipynb HTML through DOMPurify (#8330) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-06 21:57:09 -04:00
  • e1254061f1 security: enforce RESET_PASSWORD_CODE_LIVES on reset tokens (#8328) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-06 21:32:19 -04:00
  • c9607c0f06 security: require admin for repo settings API endpoints (#8327) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-05 23:21:15 -04:00
  • 81089278c4 security: restrict ipynb sanitizer to safe image data URIs (#8326) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-05 23:15:49 -04:00
  • c352b154fd security: sanitize milestone names in new issue form (#8325) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-05 23:08:00 -04:00
  • 9726ff2353 security: fix argument injection in pull request merge (rebase) (#8301) Jonah Burgess 2026-06-06 03:40:19 +01:00
  • 7f92af906b compat(0.14): map netx import to netutil in internal/database/mirror Joe Chen 2026-06-07 10:30:38 -04:00
  • 700d5a9488 security: close SSRF in repository migration and recurring mirror sync (#8324) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-05 22:13:57 -04:00
  • 2e414337ef database: bound collaboration access mode by min(actor, admin) (#8227) E99p1ant 2026-06-06 09:26:32 +08:00
  • af642675f9 security: harden same-site URL check against redirect bypass (#8322) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-05 09:59:34 -04:00
  • ddc1fec8fe repository: validate remote address on mirror address update (#8225) E99p1ant 2026-06-05 21:03:05 +08:00
  • e1d5715749 security: require POST for org team and member actions (#8321) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-05 08:05:42 -04:00
  • 79d4bad038 security: enforce repo access on attachment download (#8320) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-04 10:39:53 -04:00
  • 67c81d999e security: upgrade marked.js to 4.3.0 (#8319) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-04 10:12:54 -04:00
  • dacda37b51 compat(0.14): restore unknwon/com import in internal/markup Joe Chen 2026-06-07 10:26:47 -04:00
  • a04d1bf064 fix: avoid panic on malformed external issue tracker URL format (#8312) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-02 22:50:20 -04:00
  • 06ca5a316c security: don't follow redirects on webhook delivery (#8263) ᴊᴏᴇ ᴄʜᴇɴ 2026-05-18 21:08:46 -04:00
  • 37dfd5b4a5 auth: trust reverse proxy auth header only from configured proxies (#8264) ᴊᴏᴇ ᴄʜᴇɴ 2026-05-18 13:42:46 -04:00
  • 2ebc0e2706 security: require token auth for org metadata and team list (#8336) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-06 23:33:30 -04:00
  • 7da9cda314 security: time out stalled SSH handshakes after 15s (#8335) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-06 23:27:31 -04:00
  • f6acd46730 security: reject path traversal in owner and repository names (#8334) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-06 23:14:42 -04:00
  • f35a767af7 security: verify content hash on LFS dedupe shortcut (#8333) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-06 23:03:53 -04:00
  • 04cb8afbb0 security: walk full upload path for symlinks (#8332) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-06 22:46:48 -04:00
  • 7c9cf53aca security: harden Git HTTP access checks (#8331) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-06 22:35:04 -04:00
  • 5c9c40af28 security: upgrade notebookjs and route ipynb HTML through DOMPurify (#8330) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-06 21:57:09 -04:00
  • 187e9c5579 security: enforce RESET_PASSWORD_CODE_LIVES on reset tokens (#8328) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-06 21:32:19 -04:00
  • 6283462119 security: require admin for repo settings API endpoints (#8327) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-05 23:21:15 -04:00
  • dd1bd9837a security: restrict ipynb sanitizer to safe image data URIs (#8326) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-05 23:15:49 -04:00
  • 573eacdc65 security: sanitize milestone names in new issue form (#8325) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-05 23:08:00 -04:00
  • a9dbafbfd8 security: fix argument injection in pull request merge (rebase) (#8301) Jonah Burgess 2026-06-06 03:40:19 +01:00
  • b9a0093e9c security: close SSRF in repository migration and recurring mirror sync (#8324) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-05 22:13:57 -04:00
  • 1fdc9cc28e database: bound collaboration access mode by min(actor, admin) (#8227) E99p1ant 2026-06-06 09:26:32 +08:00
  • c5da9631dc security: harden same-site URL check against redirect bypass (#8322) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-05 09:59:34 -04:00
  • 11e19f28b5 repository: validate remote address on mirror address update (#8225) E99p1ant 2026-06-05 21:03:05 +08:00
  • ca4c656be5 chore: update agents matter Joe Chen 2026-06-05 08:15:47 -04:00
  • 070df61ecd security: require POST for org team and member actions (#8321) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-05 08:05:42 -04:00
  • d3ca23f9f3 security: enforce repo access on attachment download (#8320) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-04 10:39:53 -04:00
  • 17b168b11c security: upgrade marked.js to 4.3.0 (#8319) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-04 10:12:54 -04:00
  • e72b267c7f address PR review comments ghsa-8x5h-6c5j-mm8q Joe Chen 2026-06-03 12:18:34 -04:00
  • d375436671 address self-review feedback Joe Chen 2026-06-03 12:00:44 -04:00
  • 345bca132f drop legacy local-copy migration branch Joe Chen 2026-06-03 11:07:48 -04:00
  • 3f5359748f changelog: backfill PR link for GHSA-8x5h-6c5j-mm8q Joe Chen 2026-06-03 10:07:55 -04:00
  • 3a9eab9e77 web_editor: isolate local copy from Git internals on file edits Joe Chen 2026-06-03 10:07:31 -04:00
  • 96c9a6626c web: enable @pierre/diffs worker pool to fix blank flashes on fast diff scroll (#8317) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-03 09:52:43 -04:00
  • 5ed18af9f5 docs: document MariaDB support (#8260) Robert Silén 2026-06-03 06:47:06 +03:00
  • 25b8874423 chore: delete digitalocean_gc workflow (#8315) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-02 23:37:12 -04:00
  • 5a174587d5 chore: commit agent skills (#8314) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-02 23:08:19 -04:00
  • 3087fbeadf ssh: remove support for DSA public keys (#8313) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-02 23:02:59 -04:00
  • 0529d95fc3 fix: avoid panic on malformed external issue tracker URL format (#8312) ᴊᴏᴇ ᴄʜᴇɴ 2026-06-02 22:50:20 -04:00
  • 401d1c68a6 mod: bump gopkg.in/ini.v1 from 1.67.1 to 1.67.2 (#8308) dependabot[bot] 2026-06-02 08:19:25 -04:00
  • 0471cb317e chore: delete dependabot.yml ᴊᴏᴇ ᴄʜᴇɴ 2026-06-02 08:18:17 -04:00
  • 2eeafde472 mod: bump github.com/urfave/cli/v3 from 3.8.0 to 3.9.0 (#8311) dependabot[bot] 2026-06-02 08:17:20 -04:00
  • 10169e8890 chore: remove use of ; spit by LLM ᴊᴏᴇ ᴄʜᴇɴ 2026-05-31 20:31:46 -04:00
  • 7cf754b98b chore: split server task from moon dev and prod orchestrators (#8307) ᴊᴏᴇ ᴄʜᴇɴ 2026-05-31 13:17:08 -04:00
  • 2c46f019a2 web: align components with React 19 and fix accessibility findings (#8306) ᴊᴏᴇ ᴄʜᴇɴ 2026-05-31 11:06:22 -04:00
  • d4832b8ae7 mod: bump github.com/urfave/cli/v3 from 3.6.2 to 3.8.0 (#8223) dependabot[bot] 2026-05-30 18:12:27 -04:00
  • f73c667168 mod: bump github.com/go-ldap/ldap/v3 from 3.4.12 to 3.4.13 (#8224) dependabot[bot] 2026-05-30 18:11:59 -04:00
  • 54e460f544 mod: bump golang.org/x/image from 0.38.0 to 0.39.0 (#8246) dependabot[bot] 2026-05-30 18:11:30 -04:00
  • 9fd867f013 refactor: drop the use of CSRF token entirely (#8300) ᴊᴏᴇ ᴄʜᴇɴ 2026-05-29 10:35:10 -04:00
  • 3c4b543f51 web: migrate /robots.txt to Flamego handler (#8299) ᴊᴏᴇ ᴄʜᴇɴ 2026-05-29 09:22:21 -04:00
  • b7814de020 web: disable Geist Mono ligatures on code surfaces (#8302) ᴊᴏᴇ ᴄʜᴇɴ 2026-05-29 09:04:21 -04:00
  • d61caa3676 chore: fix up repoWatchAction inverted authz check Joe Chen 2026-05-29 08:48:31 -04:00
  • 4b5eda4a23 web: migrate commit page with @pierre/diffs and @pierre/trees (#8295) ᴊᴏᴇ ᴄʜᴇɴ 2026-05-29 00:30:26 -04:00
  • 878caa7378 ci: notarize macOS release archives (#8297) ᴊᴏᴇ ᴄʜᴇɴ 2026-05-24 23:08:45 -04:00
  • 3eb9328485 Merge 3ce42c4b5a into adea243ee8 release-archive-testing ᴊᴏᴇ ᴄʜᴇɴ 2026-05-24 22:46:34 -04:00
  • 3ce42c4b5a ci: notarize macOS release archives unknwon 2026-05-24 22:46:12 -04:00
  • adea243ee8 feat(web): migrate account activation page to React (#8296) ᴊᴏᴇ ᴄʜᴇɴ 2026-05-24 22:35:41 -04:00
  • 44f0222a71 web: migrate /user/sign-out to Flamego (#8294) ᴊᴏᴇ ᴄʜᴇɴ 2026-05-24 11:16:57 -04:00
  • 26483c41c6 feat(web): add React sign-up page with Flamego captcha (#8291) ᴊᴏᴇ ᴄʜᴇɴ 2026-05-23 23:33:41 -04:00
  • 403db931cf mod: bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 (#8292) dependabot[bot] 2026-05-23 22:25:56 -04:00
  • cd2f94a85b mod: bump github.com/redis/go-redis/v9 from 9.5.1 to 9.5.5 (#8293) dependabot[bot] 2026-05-23 22:25:41 -04:00
  • 4935e7a63b web: move password reset to React (#8290) ᴊᴏᴇ ᴄʜᴇɴ 2026-05-23 21:55:22 -04:00
  • 71dfd3c7ac chore: fix up README image positions ᴊᴏᴇ ᴄʜᴇɴ 2026-05-22 16:31:17 -04:00
  • ecb04beadd chore: align-center README images ᴊᴏᴇ ᴄʜᴇɴ 2026-05-22 16:28:22 -04:00
  • 83a48c286d fix: remove forgeable remember-me cookie, persist sessions by default (#8289) ᴊᴏᴇ ᴄʜᴇɴ 2026-05-22 16:24:39 -04:00
  • f739682e9a Move sign-in MFA step to React with /api/web/user/mfa (#8288) ᴊᴏᴇ ᴄʜᴇɴ 2026-05-22 15:33:06 -04:00
  • d54f98f5a4 feat(web): adopt Pierre theme palette and reorder sign-in tab stops (#8287) ᴊᴏᴇ ᴄʜᴇɴ 2026-05-22 11:19:38 -04:00
  • e7d0cb646d Update README banner for dark mode (#8286) ᴊᴏᴇ ᴄʜᴇɴ 2026-05-22 00:56:13 -04:00
  • dd6be39208 feat: React-based sign-in page with /api/web/user/sign-in (#8285) ᴊᴏᴇ ᴄʜᴇɴ 2026-05-22 00:28:27 -04:00
  • c93373baec feat: add /api/web/user/sign-out and nest user info under /user/info (#8284) ᴊᴏᴇ ᴄʜᴇɴ 2026-05-21 15:05:19 -04:00
  • 90790b2966 Embed WebContext and add /api/web/user-info endpoint (#8282) ᴊᴏᴇ ᴄʜᴇɴ 2026-05-21 14:43:09 -04:00
  • e9310ea08f chore: remove Packager.io build support (#8281) ᴊᴏᴇ ᴄʜᴇɴ 2026-05-20 22:55:08 -04:00
  • 75f99c9435 chore: remove Taskfile usage (#8280) ᴊᴏᴇ ᴄʜᴇɴ 2026-05-20 19:22:50 -04:00