fix(security): remediation bundle — AES-256-GCM, DOMPurify, WebSocket auth, 4 CVEs, SonarCloud - #198

Merged

BillyOutlast merged 70 commits into

fix/security-remediation-rebuild

Jul 29, 2026

Commits on Jul 28, 2026

fix(security): remediation bundle — AES-256-GCM, DOMPurify, WebSocket auth, 4 CVEs, SonarCloud
John Smith
committed
6624995
fix(review): address AI scanner findings
John Smith
committed
f08fe6e
fix(review): address second OCR scan findings (#193-#197)
John Smith
committed
957e149
fix(review): collapse redundant if/else in droplet-interface.ts
John Smith
committed
68b49b8
fix(review): address third OCR scan (#191)
John Smith
committed
95c672f
fix(review): address fourth OCR scan — key zeroing, URI regexp, WS hardening
John Smith
committed
ce4404d
fix(review): fix URI regexp regression + WS dead code
John Smith
committed
a88864e
fix(ci): allow sonar-pr-comment to run when quality gate fails
John Smith
committed
5286f72
fix(review): minor cleanup — semver consistency + sanitize error logging
John Smith
committed
8f98e92
fix(review): expose resetHooks() for test/HMR cleanup
John Smith
committed
3e7bf2d
fix(review): DoS timeout, remove ftp from URI regexp, add auth failure log
John Smith
committed
c6790e2
fix(review): address OCR timeout suggestions + fix CI lint + cargo audit
John Smith
committed
773a8f1
chore(hooks): add ocr review to pre-push hook
John Smith
committed
b396cbc
chore(hooks): add non-blocking ocr review to pre-push hook
John Smith
committed
a67ea0b
fix(review): address OCR race condition + hook cleanup findings
John Smith
committed
357606f
fix(review): address 12 OCR findings across 6 files
John Smith
committed
09991f1
fix(hooks): refine base branch detection — skip self-tracking upstream
John Smith
committed
863ca0b
chore: sync pnpm-lock after removing dompurify dep
John Smith
committed
8439c5e
fix(hooks): mktemp template — move XXXXXX to end for macOS compat
John Smith
committed
094f9f7
fix(hooks): make ocr review blocking on push
John Smith
committed
981b638
fix: resolve 7 remediation items from AI scanners (OCR/Sourcery/CodeRabbit)
John Smith
committed
05cbbe8

Commits on Jul 29, 2026

fix: resolve 2 open PR review threads
John Smith
committed
708b123
chore: add fallow-ignore-file to false-positive files
John Smith
committed
e94289f
fix(review): address OCR, CodeRabbit, and manual review findings
John Smith
committed
54d9f73
fix(review): final OCR/CodeRabbit findings — URI regexp + authTimeout cleanup
John Smith
committed
0b7770e
chore: fix CI formatting failures + auto-format Rust on pre-commit
John Smith
committed
4276418
fix(sonarcloud): report coverage gaps even when 0 issues, filter covered lines
John Smith
committed
d6368ed
fix(sonarcloud): handle null new_uncovered_lines in jq filter
John Smith
committed
d842934
fix(review): latest OCR/CodeRabbit findings on new commits
John Smith
committed
65011c5
feat(hooks): pre-push fetches unresolved PR review threads as JSON
John Smith
committed
b66c76f
fix(hooks): use first:100 in PR review thread query, add --repo flag
John Smith
committed
0f6105a
fix(sonarcloud): include 0% coverage files even when uncovered count is 0
John Smith
committed
e447d4d
chore: fix typo in pre-push comment
John Smith
committed
8b73818
docs: add pr-review-cleanup and ci-format-guard skills, update configs
John Smith
committed
dc3f923
test: add buildFilters and AuthManager unit tests
John Smith
committed
d94ccbc
fix(hooks): add fallow audit + full test suite gates to pre-push
John Smith
committed
e386337
chore: fix ws.get.ts prettier formatting
John Smith
committed
13fcf33
fix(ci): read SonarCloud period values for PR coverage
John Smith
committed
d7fc987
fix(hooks): cursor-paginate review threads + preserve partial staging
John Smith
committed
b51771b
fix: resolve fallow pre-commit gate — suppress false positives, remove unused dep
John Smith
committed
1a70685
fix: address 7 OCR review findings across 6 files
John Smith
committed
3c188b1
fix: remaining OCR review findings — sonarcloud script + skill docs
John Smith
committed
e6db1dd
refactor: extract PR review thread logic into /pull-review-comments skill
John Smith
committed
f3036a3
chore: update pnpm-lock.yaml after removing dompurify + @types/dompurify
John Smith
committed
e230477
fix(security): handle rand fill_bytes Result, add zeroize for key material
John Smith
committed
15dfccb
chore: fix bare toBeDefined — use typeof check instead
John Smith
committed
64c798f
chore: remove ocr pre-push hook
John Smith
committed
d22bfcc
fix: revert rand fill_bytes .expect() — ThreadRng returns (), not Result
John Smith
committed
f6d2a89
refactor: extract rejectPeer helper, add drain guard, fix optional chaining
John Smith
committed
5744e9a
Update server/server/api/v1/notifications/ws.get.ts

BillyOutlast
and
github-actions[bot]
authored
1bf1de1
Update server/server/api/v1/notifications/ws.get.ts

BillyOutlast
and
github-actions[bot]
authored
4434134
Update server/server/api/v1/notifications/ws.get.ts

BillyOutlast
and
github-actions[bot]
authored
6195dd4
Update .husky/pre-push

BillyOutlast
and
github-actions[bot]
authored
26eff2c
Update server/server/api/v1/notifications/ws.get.ts

BillyOutlast
and
github-actions[bot]
authored
6398cd3
Update server/server/api/v1/notifications/ws.get.ts

BillyOutlast
and
github-actions[bot]
authored
9ae8225
Update scripts/sonarcloud-pr-comment.sh

BillyOutlast
and
github-actions[bot]
authored
a7af29b
Update server/server/internal/auth/index.ts

BillyOutlast
and
github-actions[bot]
authored
e43cc06
Update scripts/sonarcloud-pr-comment.sh

BillyOutlast
and
github-actions[bot]
authored
18c18d7
Update scripts/sonarcloud-pr-comment.sh

BillyOutlast
and
github-actions[bot]
authored
d19ee96
Update .husky/pre-push

BillyOutlast
and
github-actions[bot]
authored
53421be
Update desktop/src-tauri/database/src/db.rs

BillyOutlast
and
github-actions[bot]
authored
8d84124
Update server/server/api/v1/notifications/ws.get.ts

BillyOutlast
and
github-actions[bot]
authored
3513ee1
Update server/server/api/v1/notifications/ws.get.ts

BillyOutlast
and
github-actions[bot]
authored
6529265
Update .husky/pre-push

BillyOutlast
and
github-actions[bot]
authored
cf9a0a8
Update scripts/sonarcloud-pr-comment.sh

BillyOutlast
and
github-actions[bot]
authored
ea4087a
Update server/server/api/v1/notifications/ws.get.ts

BillyOutlast
and
github-actions[bot]
authored
a25c0b3
Update scripts/sonarcloud-pr-comment.sh

BillyOutlast
and
github-actions[bot]
authored
fe32cb4
Update server/server/api/v1/notifications/ws.get.ts

BillyOutlast
and
github-actions[bot]
authored
9a9696f
fix: address open PR #198 review threads across 5 files
John Smith
committed
d388307
chore: expand pre-commit to whole-repo gates
John Smith
committed
ba7ddee