[Review] Daily Deep Review — 2026-07-09: 35-day stagnation, CI regressions on nightly+security

[evan-zhang11]

Summary

Last commit: 2026-06-04 (35 days ago)
Last PR merge: #280 (i18next 26.3.0) on 2026-06-04
Open PRs: 6 (3 green and ready to merge, 3 blocked)
Open Issues: 23 (including this review)

CI Status

Workflow	Status	Details
nightly	❌ Failing	docker_smoke (Docker build) + binaries (Windows build)
security	❌ Failing	rust-audit + npm-audit — failing steps

Nightly failures (known):

• ci: Windows binary build and docker_smoke failing on main #267 — Windows binary build + docker_smoke broken since May
• fix(ci): Docker build broken — missing zlib1g-dev for freetype-sys (updates #269) #273 — Docker build missing zlib1g-dev for freetype-sys

Security failures:

• security: npm audit — 2 HIGH severity vulnerabilities (undici + vite) #297 — 2 HIGH npm vulnerabilities (undici + vite)
• ci: cargo audit fails — Cargo.lock has unresolvable num-rational dependency #239 — Cargo audit unresolvable num-rational dependency
• security: npm audit — protocol-buffers-schema prototype pollution (moderate) #272 — protocol-buffers-schema prototype pollution (moderate)

PR Pipeline

PR	Status	Notes
#296 (cargo deps, 17 updates)	❌ Blocked	duckdb version mismatch (#298)
#295 (npm deps, 9 updates)	✅ CI green	Ready to merge
#294 (actions/cache 5→6)	✅ CI green	Ready to merge
#291 (actions/checkout 6→7)	✅ CI green	Ready to merge
#173 (file import, Lucas)	❌ Failing + conflicts	Author needs to rebase
#65 (tower-sessions 0.15)	❌ Failing	Tracked in #68

Issues Created Today (2026-07-09)

1. maintenance: expired sessions never cleaned up — sessions table grows unbounded #301 — Expired sessions never cleaned up, table grows unbounded
2. security: ST_EstimatedExtent uses string interpolation for identifiers in PostGIS bbox query #302 — ST_EstimatedExtent uses string interpolation instead of parameterized queries
3. security: COOKIE_SECURE defaults to false — session cookies can be sent over HTTP #303 — COOKIE_SECURE defaults to false, insecure for production

Code Quality Assessment

Positive

• Auth: Good timing attack mitigation with dummy hash for nonexistent users
• Password: Proper bcrypt with complexity validation
• PostGIS credentials: AES-256-GCM encryption with SHA-256 key derivation
• Identifier validation: validate_identifier() properly restricts to [A-Za-z_][A-Za-z0-9_]*
• SQL injection: DuckDB queries consistently use parameterized queries (duckdb::params!)
• Tests: Good coverage for auth, sessions, password, PostGIS helpers
• Error handling: Consistent error propagation with proper HTTP status codes
• WAL recovery: Robust automatic WAL isolation on corrupted WAL files

Concerns (existing issues)

• code-quality: postgis.rs grown to 1589 lines — PostGIS tile serving and admin logic should be split #284 — postgis.rs at 1589 lines, needs splitting
• code-quality: App.jsx at 2186 lines — map editor integration needs component extraction #271/code-quality: LayerStylePanel.jsx at 1644 lines — map styling logic needs module extraction #276 — Large frontend files (App.jsx 2186 lines, LayerStylePanel.jsx 1644 lines)
• test: no test coverage for map editor CRUD handlers (map_handlers.rs) #277 — No test coverage for map_handlers.rs CRUD
• docs: behaviors.md missing documentation for 14+ implemented API endpoints #285/Documentation Review (2026-05-27): behaviors.md missing significant API endpoints #268 — Significant documentation gaps in behaviors.md
• code-quality: db.rs grown to 1763 lines — connection management, migrations, and utilities should be split into modules #244 — db.rs at 1763 lines

No New Critical Findings

The codebase is well-structured with consistent patterns. The main risks are operational (stagnation, CI regressions) rather than code quality issues.

Recommendations

1. Merge the 3 green PRs (chore(deps): bump the npm-minor-patch group across 1 directory with 9 updates #295, chore(deps): bump actions/cache from 5 to 6 #294, chore(deps): bump actions/checkout from 6 to 7 #291) to reduce PR backlog
2. Address npm vulnerabilities (security: npm audit — 2 HIGH severity vulnerabilities (undici + vite) #297) — update undici + vite
3. Fix duckdb version mismatch (fix(ci): PR #296 blocked — duckdb crate version mismatch between Cargo.lock and Cargo.toml #298) to unblock cargo deps PR chore(deps): bump the cargo-minor-patch group across 1 directory with 17 updates #296
4. Consider session cleanup (maintenance: expired sessions never cleaned up — sessions table grows unbounded #301) for production readiness
5. Harden cookie security (security: COOKIE_SECURE defaults to false — session cookies can be sent over HTTP #303) before wider deployment