chore(deps): bump actions/upload-pages-artifact from 3 to 5 - #9
Closed
dependabot[bot] wants to merge 400 commits into
Closed
dependabot[bot] wants to merge 400 commits into
dependabot[bot] wants to merge 400 commits into
Conversation
…s (Disk, Network) and associated unit tests. Added robust data transformation logic for all metrics (CPU, Memory, Disk, Network). Updated README with detailed Data Processing Pipeline architecture.
…ng rendering errors
… and enable dynamic scrape updates
…onal monitoring aesthetics
…bcommand - First install (no admin user) generates a password, sets it and prints admin/password right in the console; re-installs PRESERVE credentials - PYMON_ADMIN_PASSWORD forces a reset on any install - new 'pymon has-admin' subcommand so the installer can detect whether an admin exists (DB may exist from a broken attempt with no admin)
- Same command installs (first run) or safely updates (subsequent runs) - Update preserves config, database, users and admin password; replaces only the binary; keeps previous binary as /opt/pymon/pymon.old for rollback - PYMON_ADMIN_PASSWORD forces an admin password reset on any run - README: full install/update comparison table, rollback, version pinning, firewall/port notes, first-login flow
handleMustChangePassword was invoked from both page load and every 403 API response, spawning overlapping prompt() dialogs, and it recursed on failure (so a wrong current password or a weak new password looped forever). - add a mustChangeActive guard so only one flow runs at a time - validate new-password policy in the browser before sending - stop auto-re-prompting on failure (reload the page to retry)
Go marshals nil slices to JSON null, which broke the frontend (Cannot read properties of null for .forEach/.map in populateGroupFilter/loadAlertRules). - ListServers/ListServices/ListAlerts/ListUsers/ListAPIKeys/ListAudit/Metrics/ backups now return empty slices instead of nil - /servers/history emits [] for servers without points - regression test TestEmptyListsAreArrays
- SMTP: fall back to AUTH LOGIN when the server advertises it (Exchange only supports LOGIN/NTLM and hangs on PLAIN); bound the whole SMTP conversation with a 30s deadline so a stalled server can't block the request forever. - Telegram: escape title/message HTML entities so special chars in server names or messages can't break the markup. - Email: escape HTML entities in the HTML body. - Add tests for LOGIN/PLAIN auth and Telegram escaping.
Security: - WebSocket CheckOrigin rejects cross-site origins (CSWSH); same-origin and PYMON_ALLOWED_ORIGINS pass (non-browser clients with no Origin allowed) - SPA session moved from localStorage JWT to an HttpOnly SameSite=Strict cookie; API clients still use Bearer/API-key; WebSocket accepts the cookie - Notification secrets (SMTP password, bot tokens, webhook URLs) are encrypted at rest with a key derived from the JWT secret; legacy rows read fine, wrong key fails loudly - Content-Security-Policy header added (script-src 'self', connect-src ws) - Rate limiting extended to change-password and API-key creation (30/min/IP) - IP rate limiter now prunes stale entries (unbounded map growth under DDoS) Reliability: - Fix TOCTOU race in alert-rule evaluation (state mutated under lock) - Service flapping detection: >=5 transitions/10min suppresses alert spam and emits one combined notice - VACUUM runs weekly regardless of wall-clock hour (was: only at 3 AM) - DNS lookups for SSRF checks are cached (5 min TTL) - parseDurationSeconds rejects malformed values like "5xyzs" - RestoreFrom streams the backup and swaps it in atomically instead of loading it fully into memory Cleanup: - Generated one-time admin_password.txt is deleted after first login - Docs (ARCHITECTURE/TROUBLESHOOTING) updated from Python/FastAPI to Go Tests: cookie session, WS origin check, strict duration parsing, notification encryption round-trip (all passing under -race).
The CMD runs 'pymon server --config /config/config.yml' but the image only contained config.example.yml, so every container exited immediately (log.Fatalf on missing config). This had broken the CI docker smoke test for several commits; copy the example as the default config.
…ction, rate-limit, timestamps - CSP: allow-list Chart.js/Lucide/fonts CDNs so the dashboard renders again - report page: per-response nonce CSP so the inline chart script works - config export: deep-copy before redaction (no longer kills live notifications) and redact webhook URLs - /metrics: validate push metric names/help/labels and cap registry at 5000 series (prometheus injection + DoS) - rate limit: ignore spoofed X-Forwarded-For from non-local peers; per-app limiters - SQLite: compare cutoffs in the stored T-separated format (fixes history/retention day-boundary bug) - services: strip URL userinfo before SSRF host check - PUT /servers: safe type assertions + validation (no panics) - version 3.0.3; bump Dockerfile/compose/README/sw cache; remove dead code - regression tests for all of the above
- install.sh: Ubuntu/Debian only (remove darwin) - remove Windows scripts (install.ps1, install_exporter.ps1, run.bat) - ci(release): build linux amd64/arm64 only - Dockerfile: switch base to ubuntu:24.04 - README/docs: document Ubuntu as target platform
…telegraf volume; sync version to 3.0.4
…does not exist); bump to 3.0.5
…eck/golangci-lint/Dependabot in CI; bump to 3.0.6
…(3.1.0) - Add install.ps1 (idempotent install/update, checksum-verified download, Windows Service registration, health-check) alongside install.sh, matching the Ubuntu installer's install/update UX. - Add pymon "service" subcommand (cmd/pymon/service_windows.go) implementing the SCM protocol via golang.org/x/sys/windows/svc so New-Service/sc.exe can manage the process like a systemd unit; no-op alias on other platforms (service_other.go). Refactor runServer into a shared startApp helper reused by both entry points. - release.yml now builds and publishes pymon-windows-amd64.exe/arm64.exe alongside the Linux binaries. - Bump Version 3.0.7 -> 3.1.0 (code was behind the already-published v3.0.8 tag) and document the Windows installer in README.md/CHANGELOG.md. - README: drop the stale "source repo" banner (Monitoring-source is just the old name of this same repository, per GitHub's rename redirect) and point the CI badge directly at ajjs1ajjs/Monitoring.
…older commit) v3.1.0 was already tagged historically (pointing at the pre-Ubuntu-only Windows removal commit), so reusing it would require moving/deleting an existing tag, which is not allowed. Use the next free version, 3.1.1, everywhere instead.
Bumps [actions/upload-pages-artifact](https://github.com/actions/upload-pages-artifact) from 3 to 5. - [Release notes](https://github.com/actions/upload-pages-artifact/releases) - [Commits](actions/upload-pages-artifact@v3...v5) --- updated-dependencies: - dependency-name: actions/upload-pages-artifact dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
dependabot
Bot
deleted the
dependabot/github_actions/actions/upload-pages-artifact-5
branch
September 5, 2026 11:10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps actions/upload-pages-artifact from 3 to 5.
Release notes
Sourced from actions/upload-pages-artifact's releases.
Commits
fc324d3Merge pull request #139 from Tom-van-Woudenberg/patch-1fe9d4b7Merge branch 'main' into patch-10ca1617Merge pull request #137 from jonchurch/include-hidden-files57f0e84Update action.yml4a90348v7 --> hash56f665aUpdate upload-artifact action to version 7f7615f5Addinclude-hidden-filesinput7b1f4a7Merge pull request #127 from heavymachinery/pin-sha4cc19c7Pinactions/upload-artifactto SHA2d163beMerge pull request #107 from KittyChiu/mainDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)