Repository navigation
release: v1.3.1 - #241
release: v1.3.1#241
Conversation
…idation fix: support trusted reverse proxy origins
…-names feat(release): use Grimoire archive names after v1.3.0
…hes (#238) * fix(security): resolve DNS and block reserved ranges in outbound fetches isPrivateHost now classifies addresses numerically and blocks the remaining reserved IPv4 ranges, NAT64/6to4/Teredo-embedded IPv6, and internal-only hostnames. safe-fetch and media fetching resolve each hop's hostname and reject any private result before connecting. * fix(security): make DNS validation respect the abort signal Race the pre-fetch lookup against the caller's AbortSignal so request timeouts still bound safe-fetch and media fetching when DNS stalls. * fix(security): avoid backtracking regex when normalising hostnames
* fix: theme switch and persist theme selection * feat(theme): follow system color scheme by default (#196) Default to the system theme via next-themes and add an e2e check that the theme tracks prefers-color-scheme until the user picks one explicitly. --------- Co-authored-by: Robert Goniszewski <robertgoniszewski@outlook.com>
* feat(ai): add Cheaper Inference provider * refactor(ai): share keyed OpenAI-compatible provider handling Fold deepseek and cheaperinference into one lookup table and helpers for LLM config resolution, redaction, and portable backup settings to bring duplication on new code under the SonarCloud gate. --------- Co-authored-by: Robert Goniszewski <robertgoniszewski@outlook.com>
…65-cvwx-89v3) (#234) Co-authored-by: katsugtgz <katsugtgz@users.noreply.github.com>
* chore(deps): update dependencies and fix audit findings - daemon: update in-range deps (MCP SDK 1.32, hono 4.13.16, aws-sdk, sqlite-vec, zod) and bump pinned overrides that were themselves vulnerable (fast-uri, ip-address, body-parser, qs, @hono/node-server); add proxy-addr 2.0.8 override (critical IP spoofing advisory) - frontend: npm audit fix + in-range updates (vite 6.4.5, react-query, radix, eslint 9.39, typescript 5.9); remove unused zod; pin postcss-selector-parser to 6.1.5 - fix daemon type errors from TS 5.9 Uint8Array<ArrayBufferLike> typing - Tags: call deleteTag explicitly, react-query now passes a second mutationFn argument - tests: await async elements in Settings and TagDetail tests * chore(deps): sync frontend bun.lock with package.json
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 58004b984d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| export function releaseArchiveName(version: string, platform: ReleasePlatform): string { | ||
| return `${releaseRootDirectoryName(version, platform)}.tar.gz`; | ||
| assertSafeReleaseVersion(version); | ||
| return releaseArchiveFileName(version, platform); |
There was a problem hiding this comment.
When an existing v1.3.0 native installation upgrades to v1.3.1, its installed daemon/src/update/upgrade.ts still constructs little-imp-1.3.1-<platform>.tar.gz in releaseArchiveName() and downloads that exact filename through downloadUpgradeArtifact(). The packager now generates only grimoire-1.3.1-<platform>.tar.gz, leaving those existing updaters requesting an unavailable asset. Updating the downloader in v1.3.1 cannot fix the code running before that upgrade. Generate and publish legacy-named compatibility archives with matching checksum files and detached signatures alongside the renamed assets.
Useful? React with 👍 / 👎.
|
Promotes
developtomainfor v1.3.1.Excludes TASK-146 (migration tool) and TASK-147 (demo mode).