Repository navigation
sync: merge upstream v1.3.1 + Trivy CVE remediation - #4
Merged
Merged
Conversation
…-origin-validation fix: support trusted reverse proxy origins
…blic-metadata chore(release): publish v1.3.0 distribution metadata
…ew-style fix(release): satisfy Homebrew formula style
…ied-homebrew docs(release): record verified v1.3.0 Homebrew upgrade
…ase-archive-names feat(release): use Grimoire archive names after v1.3.0
…hes (goniszewski#238) * fix(security): resolve DNS and block reserved ranges in outbound fetches isPrivateHost now classifies addresses numerically and blocks the remaining reserved IPv4 ranges, NAT64/6to4/Teredo-embedded IPv6, and internal-only hostnames. safe-fetch and media fetching resolve each hop's hostname and reject any private result before connecting. * fix(security): make DNS validation respect the abort signal Race the pre-fetch lookup against the caller's AbortSignal so request timeouts still bound safe-fetch and media fetching when DNS stalls. * fix(security): avoid backtracking regex when normalising hostnames
* fix: theme switch and persist theme selection * feat(theme): follow system color scheme by default (goniszewski#196) Default to the system theme via next-themes and add an e2e check that the theme tracks prefers-color-scheme until the user picks one explicitly. --------- Co-authored-by: Robert Goniszewski <robertgoniszewski@outlook.com>
* feat(ai): add Cheaper Inference provider * refactor(ai): share keyed OpenAI-compatible provider handling Fold deepseek and cheaperinference into one lookup table and helpers for LLM config resolution, redaction, and portable backup settings to bring duplication on new code under the SonarCloud gate. --------- Co-authored-by: Robert Goniszewski <robertgoniszewski@outlook.com>
…65-cvwx-89v3) (goniszewski#234) Co-authored-by: katsugtgz <katsugtgz@users.noreply.github.com>
) * chore(deps): update dependencies and fix audit findings - daemon: update in-range deps (MCP SDK 1.32, hono 4.13.16, aws-sdk, sqlite-vec, zod) and bump pinned overrides that were themselves vulnerable (fast-uri, ip-address, body-parser, qs, @hono/node-server); add proxy-addr 2.0.8 override (critical IP spoofing advisory) - frontend: npm audit fix + in-range updates (vite 6.4.5, react-query, radix, eslint 9.39, typescript 5.9); remove unused zod; pin postcss-selector-parser to 6.1.5 - fix daemon type errors from TS 5.9 Uint8Array<ArrayBufferLike> typing - Tags: call deleteTag explicitly, react-query now passes a second mutationFn argument - tests: await async elements in Settings and TagDetail tests * chore(deps): sync frontend bun.lock with package.json
release: v1.3.1
Grimoire v1.3.1 # Conflicts: # bun.lock # daemon/bun.lock # daemon/package.json # package.json
- lodash override ^4.18.0 (CVE-2026-4800) — upstream v1.3.1 already fixed fast-uri, proxy-addr, source-map-js and @modelcontextprotocol/sdk, so the fork overrides for those are dropped as superseded trivy fs --severity HIGH,CRITICAL --ignore-unfixed now reports 0 findings across bun.lock, daemon/bun.lock and package-lock.json. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merge upstream tag v1.3.1 into main (merge commit, keeps upstream history).
Security: upstream v1.3.1 already remediates fast-uri, proxy-addr, source-map-js and @modelcontextprotocol/sdk (fork overrides dropped as superseded). Re-added root override lodash ^4.18.0 for CVE-2026-4800 (still 4.17.21 in bun.lock).
Local: trivy fs --severity HIGH,CRITICAL --ignore-unfixed → 0 findings (bun.lock, daemon/bun.lock, package-lock.json). lint, frontend type-check, 358 frontend tests, docs:api:check, release metadata, build all pass locally.