bvandeusenandClaude Opus 5.5 3217e10168 fix(deps): clear known vulnerabilities in what ships; build on the Go line CI tests (M462 #4984) ...

- golang.org/x/text v0.37.0 -> v0.39.0 (GO-2026-5970, infinite loop on
  invalid input, reachable from pgxpool). x/sync follows to v0.21.0.
- web lockfile: in-range updates from `npm audit fix` for devalue (high)
  and svelte (moderate), both of which ship in the browser bundle.
  package.json is unchanged.
- Dockerfile builder golang:1.25 -> golang:1.26. CI has tested on 1.26
  since the ci-go migration while the image was still compiled with 1.25,
  left over from the April skeleton; the shipped binary now uses the
  toolchain the tests ran on. govulncheck under golang:1.26-bookworm
  (go1.26.8) reports 0 vulnerabilities reachable from our code.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-06 09:51:37 -04:00

..

build

feat(web): scaffold SvelteKit SPA with Tailwind + adapter-static

2026-04-22 09:26:36 -04:00

scripts

test(web/m7-362): tokens-to-css generator unit test

2026-05-03 13:52:13 -04:00

src

feat(auth): store Subsonic API keys hashed; a new key is shown once (M462 #4983)

2026-10-06 09:42:35 -04:00

static

fix(web): vendor the web fonts instead of loading them from Google

2026-09-09 13:49:47 -04:00

.gitignore

refactor(web): extract design tokens to tokens.json source of truth

2026-05-02 14:55:46 -04:00

csp_test.go

feat(server): security headers and a hash-based CSP for the web app (M462 #4980)

2026-10-06 09:29:26 -04:00

csp.go

feat(server): security headers and a hash-based CSP for the web app (M462 #4980)

2026-10-06 09:29:26 -04:00

embed_test.go

fix(server,web): update test fixtures for new New/Handler signatures

2026-05-03 18:44:34 -04:00

embed.go

feat(server): security headers and a hash-based CSP for the web app (M462 #4980)

2026-10-06 09:29:26 -04:00

package-lock.json

fix(deps): clear known vulnerabilities in what ships; build on the Go line CI tests (M462 #4984)

2026-10-06 09:51:37 -04:00

package.json

chore(deps): Tier A cross-ecosystem patch/minor sweep

2026-05-20 12:58:24 -04:00

postcss.config.cjs

feat(web): scaffold SvelteKit SPA with Tailwind + adapter-static

2026-04-22 09:26:36 -04:00

svelte.config.js

refactor(web): sweep 8 test files to use pageUrlModule() (#375)

2026-05-10 15:39:25 -04:00

tailwind.config.js

feat(web/m7-362): add Tailwind text-action-fg alias for non-flipping label color

2026-05-03 13:40:20 -04:00

template_test.go

test(server/m7-363): script-context XSS test asserts </script> count

2026-05-03 17:24:42 -04:00

template.go

feat(server/m7-363): branding-aware index handler with html/template

2026-05-03 17:21:30 -04:00

tsconfig.json

feat(web): add Shell component with header, sidebar, and user menu

2026-04-22 22:20:18 -04:00

vite.config.ts

refactor(web): drive vite-injected theme-color from tokens.json (#375)

2026-05-10 15:29:48 -04:00

vitest.config.ts

test(web): un-skip discover/requests route tests — mock $app (#374)

2026-05-19 15:42:11 -04:00

vitest.setup.ts

test(web): no-op scrollIntoView in vitest setup (jsdom lacks it) — #1931

2026-07-22 21:27:35 -04:00