External/SnapOtter
1
0
Fork 0
mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: release QA hardening across processing, media, security, and CI gates (#649)

Browse Source 
A release-readiness QA pass over the whole product. The commits split into
defects a user would hit and gates that were reporting green while measuring
nothing.

## Fixes that change behaviour

Rate limiting was bypassable on every install: TRUST_PROXY defaulted to true, so
request.ip came from a client-set header and a forged X-Forwarded-For got past
the login limiter. The default is now a private-network trust list.

A transient Postgres outage stranded in-flight jobs, leaving finished output on
disk with no row pointing at it. A reconciler now resolves those rows and adopts
the bytes rather than dropping the work.

A Redis connection that moved to a new address wedged every read-blocked
consumer, so completions stopped signalling while health still answered 200.
Socket timeouts plus subscriber pings recover it.

Installing more than one AI bundle left the shared venv multi-versioned and
silently broke three tools. The installer now reconciles distributions to one
version each.

Converting an image to JXL at quality 1 through 4 returned a 500, because
libjxl 0.7 rejects the distance those values compute. The quality is floored at
what the encoder honours. A missing ffmpeg was also reported to the user as a
corrupt upload; it now says the engine is unavailable.

RAW uploads reached an unpatched LibRaw on arm64, so it is built from source at
0.22.2, and the release scan was split so it can fail on an unfixed critical
instead of hiding it behind ignore-unfixed.

## Gates that could not fail

Two mutation lanes ran zero mutants because Stryker crawled the gitignored docs
build; coverage discarded its whole report on any failing test; the lint gate
skipped root tests, scripts, and two workspaces; and several generated matrices
counted a host missing ffmpeg as a passing tool. Each now measures what it
claims.

Full evidence and the outstanding release items are tracked locally and are not
part of this branch.
This commit is contained in:
SnapOtter
2026-07-27 15:37:30 +08:00
committed by GitHub
parent bc32f86a07
commit d10d0f544f
855 changed files with 54564 additions and 13092 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.trivyignore
+21 -58
View File
@@ -1,58 +1,21 @@
# pnpm 9.x and its bundled dependencies
# These are build-time tool internals, not runtime application code.
# pnpm is only used for dependency installation and process management.
# All require upgrading to pnpm 10.x (major breaking change).
# Tracked: https://github.com/pnpm/pnpm/releases/tag/v10.0.0
# pnpm core
CVE-2025-69262
CVE-2025-69263
# glob (bundled in pnpm 9.x, not our dependency)
CVE-2025-64756
# minimatch (bundled in pnpm 9.x)
CVE-2026-26996
CVE-2026-27903
CVE-2026-27904
# picomatch (bundled in pnpm 9.x)
CVE-2026-33671
# tar (bundled in pnpm 9.x)
CVE-2026-23745
CVE-2026-23950
CVE-2026-24842
CVE-2026-26960
CVE-2026-29786
CVE-2026-31802
# pnpm 9.x core (2026 rescan) -- same build-time-tool rationale as above; every
# one of these is fixed only in pnpm 10.x (10.0.0 / 10.28.1 / 10.28.2), a major
# breaking migration tracked separately. pnpm runs only at install/start time.
CVE-2024-47829
CVE-2026-23888
CVE-2026-23889
CVE-2026-23890
CVE-2026-24056
CVE-2026-24131
# golang.org/x/image bundled in the caire binary (content-aware seam-carving
# resize, one tool). esimov/caire v1.5.0 is the latest release and still pins
# golang.org/x/image v0.18.0; there is no upstream caire build with the fixed
# x/image >=0.38.0. Re-evaluate when caire publishes a new release.
CVE-2026-33809
# brace-expansion: build-toolchain transitive of minimatch/glob. The patched
# instance (5.0.6) is already present; the only flagged copy is the 2.x line
# pulled by glob, whose fix is a major-version bump (5.0.5) the glob ecosystem
# has not adopted. Not reachable from user input.
CVE-2026-33750
# npm bundled sigstore (build-time tool internal, not runtime-reachable).
# CVE-2026-48815: sigstore certificateOIDs verification constraints silently dropped.
# This is the npm CLI vendored copy (node_modules/npm/node_modules/sigstore), used
# only for npm package provenance at build time; SnapOtter never runs npm provenance
# verification at runtime. Same build-tool rationale as the pnpm entries above.
# Re-evaluate when the Node base image ships a fixed npm.
CVE-2026-48815
# Trivy suppressions for the release and bundle scans.
#
# This file is empty on purpose. Every entry it used to hold (21 IDs covering
# pnpm 9.x and its bundled glob/minimatch/picomatch/tar, plus npm's vendored
# sigstore) suppressed something that is not in any shipped artifact: the
# production image purges pnpm and npm before the final layer, so raw and
# policy-filtered scans of both architectures return identical counts. Two of
# the rationales were also wrong on their own terms. A suppression list that
# suppresses nothing still costs review attention and hides the next real one.
#
# Before adding an ID here, check that it fires against a shipped artifact:
#
# trivy image --ignorefile /dev/null <ref>
#
# If it does, the entry needs three things in a comment directly above it: who
# owns getting it fixed, what unblocks the fix, and the date to re-check.
#
# Suppression is for findings that are genuinely absent from what we ship. For
# findings that ARE present and have no upstream fix, do not suppress them. Add
# the ID to .trivy-unfixed-allow instead, so the release scan keeps reporting
# it and a new one still fails the build.