marvin8/dujiangyan
Watch
1
0
Fork
You've already forked dujiangyan
 0
Code Issues Pull requests Projects Releases 43 Wiki Activity Actions
43 releases 74 tags
  • fenliu-1.2.0 56094183c7

    fenliu-1.2.0 Stable

    marvin8 released this 2026-06-16 08:07:52 +00:00 | 133 commits to main since this release

    Signed by marvin8
    SSH key fingerprint: SHA256:cyGOzvyFNw+A8J/LVjRif8v3KZLo8seQDVZbk/IhNhI

    [fenliu-1.2.0] - 2026-06-16

    Bug Fixes

    • 🐛 fix CSP to allow Tailwind CDN, Font Awesome CDN, and LiveView WebSocket
    • 🐛 add unsafe-inline to script-src; all UI templates use inline scripts
    • 🐛 allow https: in img-src; Fediverse media comes from arbitrary external instances

    CI

    • 👷 add pylock.toml generation to bumpversion hooks
    • 👷 add zaojun license checking with git-cliff ignore
    • 👷 add ty pre-commit hook to package-level configs
    • 👷 remove redundant uv-lock from package prek configs

    Documentation

    • 📝 add MkDocs hook that generates llms.txt and llms-full.txt
    • 📝 mark M4 and M5 resolved in security audit docs
    • 📝 mark M2 and M3 resolved in security audit docs

    Refactoring

    • ♻️ fenliu: update FediverseClient for APClient 2.0 lifecycle

    Security

    • 🔒 replace _HTMLStripper with nh3 (M5)
    • 🔒 sanitize Fediverse post HTML in admin UI (M4)
    • 🔒 add javascript: href test; fix README What's New count
    • 🔒 add SecurityHeadersMiddleware and CORSMiddleware (M2, M3)
    • 🔒 externalize inline JS from dashboard, hashtag-streams, topical-tags
    • 🔒 externalize inline JS from queue-preview and settings; convert inline event handlers
    • 🔒 externalize stats JS via JSON island; add cdn.jsdelivr.net to CSP; drop unsafe-inline from script-src
    • 🔒 fix keydown listener leak in image modal teardown
    • 🔒 add RateLimitMiddleware with sliding-window per-IP rate limiting
    • 🔒 mark M1 resolved in security audit documents
    • 🔒 use exact path membership test for bootstrap rate limit tier
    • 🔒 force starlette>=1.3.1 via workspace override; ignore in pysentry

    Testing

    • ✅ fenliu: update test_fediverse.py for APClient 2.0 lifecycle
    • ✅ add failing tests for security headers and CORS policy (M2, M3)
    • ✅ add 404 security headers test; clarify audit doc middleware ordering
    • ✅ fail test: assert no unsafe-inline in script-src CSP
    Downloads