marvin8/dujiangyan
Watch
1
0
Fork
You've already forked dujiangyan
 0
Code Issues Pull requests Projects Releases 43 Wiki Activity Actions
43 releases 74 tags
  • fenliu-1.1.2 950470321b

    fenliu-1.1.2 Stable

    marvin8 released this 2026-06-22 09:54:22 +00:00 | 121 commits to main since this release

    Signed by marvin8
    SSH key fingerprint: SHA256:cyGOzvyFNw+A8J/LVjRif8v3KZLo8seQDVZbk/IhNhI

    [fenliu-1.1.2] - 2026-06-22

    Documentation

    • 📝 accept L4 audit finding: bootstrap key not exposed via stdout
    • 📝 clarify L1 audit annotation to distinguish permission fix from exc_info retention
    Downloads
  • fenliu-1.2.0 56094183c7

    fenliu-1.2.0 Stable

    marvin8 released this 2026-06-16 08:07:52 +00:00 | 133 commits to main since this release

    Signed by marvin8
    SSH key fingerprint: SHA256:cyGOzvyFNw+A8J/LVjRif8v3KZLo8seQDVZbk/IhNhI

    [fenliu-1.2.0] - 2026-06-16

    Bug Fixes

    • 🐛 fix CSP to allow Tailwind CDN, Font Awesome CDN, and LiveView WebSocket
    • 🐛 add unsafe-inline to script-src; all UI templates use inline scripts
    • 🐛 allow https: in img-src; Fediverse media comes from arbitrary external instances

    CI

    • 👷 add pylock.toml generation to bumpversion hooks
    • 👷 add zaojun license checking with git-cliff ignore
    • 👷 add ty pre-commit hook to package-level configs
    • 👷 remove redundant uv-lock from package prek configs

    Documentation

    • 📝 add MkDocs hook that generates llms.txt and llms-full.txt
    • 📝 mark M4 and M5 resolved in security audit docs
    • 📝 mark M2 and M3 resolved in security audit docs

    Refactoring

    • ♻️ fenliu: update FediverseClient for APClient 2.0 lifecycle

    Security

    • 🔒 replace _HTMLStripper with nh3 (M5)
    • 🔒 sanitize Fediverse post HTML in admin UI (M4)
    • 🔒 add javascript: href test; fix README What's New count
    • 🔒 add SecurityHeadersMiddleware and CORSMiddleware (M2, M3)
    • 🔒 externalize inline JS from dashboard, hashtag-streams, topical-tags
    • 🔒 externalize inline JS from queue-preview and settings; convert inline event handlers
    • 🔒 externalize stats JS via JSON island; add cdn.jsdelivr.net to CSP; drop unsafe-inline from script-src
    • 🔒 fix keydown listener leak in image modal teardown
    • 🔒 add RateLimitMiddleware with sliding-window per-IP rate limiting
    • 🔒 mark M1 resolved in security audit documents
    • 🔒 use exact path membership test for bootstrap rate limit tier
    • 🔒 force starlette>=1.3.1 via workspace override; ignore in pysentry

    Testing

    • ✅ fenliu: update test_fediverse.py for APClient 2.0 lifecycle
    • ✅ add failing tests for security headers and CORS policy (M2, M3)
    • ✅ add 404 security headers test; clarify audit doc middleware ordering
    • ✅ fail test: assert no unsafe-inline in script-src CSP
    Downloads
  • fenliu-1.1.1 ca7f40f331

    fenliu-1.1.1 Stable

    marvin8 released this 2026-06-04 06:32:40 +00:00 | 187 commits to main since this release

    Signed by marvin8
    SSH key fingerprint: SHA256:cyGOzvyFNw+A8J/LVjRif8v3KZLo8seQDVZbk/IhNhI

    [fenliu-1.1.1] - 2026-06-04

    Bug Fixes

    • 🐛 fenliu: fix UI_AUTH_ENABLED env guard in test_ui_auth.py

    Documentation

    • 📝 fenliu: mark H3 and H4 resolved in security audit; add resolution notes

    Security

    • 🔒 fenliu: H3 - return static messages for API errors, log exception server-side
    • 🔒 fenliu: H4 - chown /app/data to fenliu before chmod, set mode 0o750

    Testing

    • ✅ fenliu: add tests for H3 exception detail leak
    • ✅ fenliu: add tests for H4 container data dir permissions
    Downloads
  • zhongli-2026.6.4 6e9c93650a

    zhongli-2026.6.4 Stable

    marvin8 released this 2026-06-04 02:15:47 +00:00 | 195 commits to main since this release

    Signed by marvin8
    SSH key fingerprint: SHA256:cyGOzvyFNw+A8J/LVjRif8v3KZLo8seQDVZbk/IhNhI

    [zhongli-2026.6.4] - 2026-06-04

    Documentation

    • 📝 zhongli: document federation side-channel in README (L1)
    • 📝 zhongli: mark L1 and L3 resolved in Security-Audit files
    • 📝 zhongli: fix Security-Audit status markers and executive summary

    Security

    • 🔒 zhongli: try resolve=False before federating in find_status_by_url (L1)
    • 🔒 zhongli: redact attachment URL paths from debug log (L3)
    • 🔒 zhongli: remove _url_origin; remove or reword debug logs per review (L3)

    Testing

    • ✅ zhongli: test two-phase resolve search behaviour (L1)
    • ✅ zhongli: test _url_origin strips path from attachment URL (L3)
    Downloads
  • fenliu-1.1.0 8ff5476815

    fenliu-1.1.0 Stable

    marvin8 released this 2026-05-25 20:54:54 +00:00 | 210 commits to main since this release

    Signed by marvin8
    SSH key fingerprint: SHA256:cyGOzvyFNw+A8J/LVjRif8v3KZLo8seQDVZbk/IhNhI

    [fenliu-1.1.0] - 2026-05-25

    Documentation

    • 📝 replace stale pytest references with tryke in CLAUDE.md files
    • 📝 fenliu: update docs for error_details and stats error detail section
    • 📝 fenliu: rewrite testing guide for tryke (closes #24)

    Features

    • ✨ fenliu: add error_details to Post, ErrorHistory, schema, and curated error endpoint
    • ✨ fenliu: show duplicate-attachment image comparison on stats page
    Downloads
  • zhongli-2026.5.26 307541c90f

    zhongli-2026.5.26 Stable

    marvin8 released this 2026-05-25 20:52:43 +00:00 | 212 commits to main since this release

    Signed by marvin8
    SSH key fingerprint: SHA256:cyGOzvyFNw+A8J/LVjRif8v3KZLo8seQDVZbk/IhNhI

    [zhongli-2026.5.26] - 2026-05-25

    Documentation

    • 📝 zhongli: mark M3 resolved in security audit docs
    • 📝 replace stale pytest references with tryke in CLAUDE.md files

    Features

    • ✨ zhongli: emit structured error_details for duplicate-attachment errors

    Testing

    • ✅ zhongli: add failing tests for streaming timeout (M3)
    Downloads
  • zhongli-2026.5.23 9e31dfe2ab

    zhongli-2026.5.23 Stable

    marvin8 released this 2026-05-23 07:24:07 +00:00 | 226 commits to main since this release

    Signed by marvin8
    SSH key fingerprint: SHA256:cyGOzvyFNw+A8J/LVjRif8v3KZLo8seQDVZbk/IhNhI

    [zhongli-2026.5.23] - 2026-05-23

    Bug Fixes

    • 🐛 zhongli: fix ty invalid-return-type in _resolve_host

    Security

    • 🔒 zhongli: reject posts with missing or non-https post_url (M2)
    Downloads
  • fenliu-1.0.2 10a8a5635d

    fenliu-1.0.2 Stable

    marvin8 released this 2026-05-23 07:23:14 +00:00 | 228 commits to main since this release

    Signed by marvin8
    SSH key fingerprint: SHA256:cyGOzvyFNw+A8J/LVjRif8v3KZLo8seQDVZbk/IhNhI

    [fenliu-1.0.2] - 2026-05-23

    Bug Fixes

    • 🐛 fenliu: fix ty invalid-return-type in _extract_media_attachments

    Security

    • 🔒 fenliu: suppress PYSEC-2026-161 (starlette, blocked by pyview-web constraint)
    Downloads
  • fenliu-1.0.1 b0d0f3d67f

    fenliu-1.0.1 Stable

    marvin8 released this 2026-05-21 08:14:52 +00:00 | 238 commits to main since this release

    Signed by marvin8
    SSH key fingerprint: SHA256:cyGOzvyFNw+A8J/LVjRif8v3KZLo8seQDVZbk/IhNhI

    [fenliu-1.0.1] - 2026-05-21

    Security

    • 🔒 fenliu: suppress PYSEC-2024-277 (joblib, no fix available)
    • 🔒 fenliu: suppress PYSEC-2024-277 in zaojun vuln-ignore
    Downloads
  • zhongli-2026.5.21 ca957aa0f4

    zhongli-2026.5.21 Stable

    marvin8 released this 2026-05-21 07:10:38 +00:00 | 244 commits to main since this release

    Signed by marvin8
    SSH key fingerprint: SHA256:cyGOzvyFNw+A8J/LVjRif8v3KZLo8seQDVZbk/IhNhI

    [zhongli-2026.5.21] - 2026-05-21

    Bug Fixes

    • 🐛 zhongli: fix $NEXT typo in release justfile

    Documentation

    • 📝 zhongli: add container deployment section to README

    Features

    • ✨ zhongli: add Containerfile, entrypoint, and CI container pipeline
    • ✨ zhongli: add healthcheck and Quadlet docs
    Downloads