mirror of
https://github.com/BillyOutlast/drop.git
synced 2026-07-25 16:55:48 -04:00
BillyOutlast
9a251631b5
* fix(deps): upgrade vulnerable transitive dependencies Dependabot audit fixes: - brace-expansion 5.0.7 -> 5.0.8 (CVE-2026-14257, GHSA-mh99-v99m-4gvg) High severity: DoS via unbounded expansion length causing OOM crash - valibot 1.2.0/1.4.1 -> 1.4.2 (CVE-2026-59952) Medium: record() issue paths can make flatten() throw - node-tar 7.5.x -> 7.5.21+ (GHSA-r292-9mhp-454m) Medium: Uncontrolled recursion in mapHas/filesFilter - astro 6.4.8 -> 7.1.0 (CVE-2026-59729, CVE-2026-59727) Medium/Low: XSS via unescaped spread attributes / transition directives - quinn-proto 0.11.13 -> 0.11.15 (GHSA-4w2j-m93h-cj5j) High: Remote memory exhaustion in quinn-proto Not addressed (no upstream fix): - failure 0.1.8 (CRITICAL, 2 alerts) - deprecated Rust crate, used transitively GHSA-jq66-xq47-j9f3, GHSA-r98r-j25q-rmpr * fix(ci): dependabot auto-merge waits for CI, fix unscoped filter (#27) CRITICAL: previously auto-merge ran on PR open with no CI check. .github/workflows/dependabot-auto-merge.yml called pulls.merge directly, merging dependabot PRs before typecheck/lint/test ran. Combined with develop having zero branch protection, broken dep PRs could land on the default branch. Two fixes: 1. Filter on ecosystem via PR label (npm vs cargo), not the bogus 'contains(@)' check that excluded unscoped packages. 2. Pre-check getCombinedStatusForRef before merging. Skips with info log if state is not 'success'; will retry on next push (synchronize event). Cargo updates now always require human review (was the original intent, but broken by the @ filter). PR titles without a parseable 'semver-from-to' line are treated as major and skipped. Refs plan at .opencode/plans/hyperplan-dep-tdd-coverage.md PR1. Co-authored-by: bot <ci@local> * chore(deps,ci): dependabot desktop/main + .codecov.yml + CI merge + MSW error + coverage scope (#28) * chore(deps): add dependabot desktop/main entry + .codecov.yml desktop/main/ has its own pnpm-workspace.yaml and pnpm-lock.yaml, so the root npm entry at / does not cover it. All 30+ deps in the Nuxt 4 desktop app (tauri plugins, koa, etc.) were invisible to Dependabot. .codecov.yml added with: - project status OFF (1.17% baseline, target: auto would block every PR per AGENTS.md) - patch status informational at 50% (new code should be tested but not block) - server flag target 80% informational - PR comments disabled (solo dev, low signal at 32 tests) - ignore patterns for .nuxt/, prisma/client/, proto/, test/ Refs plan at .opencode/plans/hyperplan-dep-tdd-coverage.md PR2. * chore(ci): merge test+coverage jobs, MSW error, scope coverage to backend Three changes: 1. ci.yml: delete the separate coverage job (duplicate setup vs test job — 14 CI-min wasted per push). Add coverage step to test job so vitest run --coverage happens once. Codecov upload moves to test job. 2. server/test/mocks/index.ts: onUnhandledRequest: 'warn' → 'error'. Unmocked HTTP calls now fail the test instead of producing stderr noise. Forces explicit handler registration. Escape hatch: resetTestMocks([...unmockedHandlers]) for intentional bypass. 3. server/vitest.config.ts: include 'server/**/*.ts' → 'server/server/**/*.ts'. The 1.17% coverage baseline is inflated by ~3-5K LOC of frontend (pages/, components/, composables/) that is untestable outside Playwright E2E. New scope reflects only Nitro backend coverage. Refs plan at .opencode/plans/hyperplan-dep-tdd-coverage.md PR3. --------- Co-authored-by: bot <ci@local> * fix(ts): guard 39 unchecked-indexed sites in auth/metadata/backend (#29) * fix(ts): guard 39 unchecked-indexed sites in auth/metadata/backend AGENTS.md deferred 'noUncheckedIndexedAccess' guard work. 30+ files listed but most had already been fixed during PR #25 (SonarCloud sweep). Remaining 9 backend files with 39 errors fixed in this PR: - auth/mfa/webauthn/finish.post.ts: passkey may be undefined after findIndex; add guard, also fix counter assignment - auth/passkey/finish.post.ts: same pattern as webauthn - admin/import/massversion/index.post.ts: version may be undefined inside for loop - admin/game/image/index.delete.ts: mImageLibraryObjectIds[0] may be undefined after splice, set to null only if a next image exists - auth/totp.ts: uint8array[i] is number | undefined - clients/event-handler.ts: parts[0] may be undefined - metadata/igdb.ts: response[0] may be undefined - metadata/pcgamingwiki.ts: cargoquery[i].title may be undefined - system-data/index.ts: cpus[cpu].times may be undefined - utils/prioritylist.ts: pop() may return undefined; throw on empty list (matches the contract) Not in this PR (follow-up work, ~57 frontend errors): Enabling noUncheckedIndexedAccess in user-facing tsconfig.json surfaces errors in components/, pages/, composables/. These are mostly route.params.id, undefined-check on array access in template helpers, and exactOptionalPropertyTypes mismatches. Per plan risk: bulk-guard with @ts-expect-error OR fix file-by-file. Recommend a follow-up PR per tier. Refs plan at .opencode/plans/hyperplan-dep-tdd-coverage.md PR4. * style: prettier format passkey + webauthn finish.post.ts (#34) Co-authored-by: bot <ci@local> --------- Co-authored-by: bot <ci@local> * test(server): add H3 event stubs and createMockH3Event factory (#30) * test(server): add H3 event stubs and createMockH3Event factory Expanded test/setup.ts with 14 more H3/Nuxt globals: - Request accessors: readFormDataBody, getCookie, getRequestURL, getRequestIP - Response mutators: setHeader, setCookie, deleteCookie, setResponseStatus, setResponseHeaders - Response senders: sendRedirect, sendStream, sendError, sendNoContent - Plugin helpers: defineNitroPlugin, defineNitroErrorHandler Added server/test/utils/h3.ts with createMockH3Event factory. Returns a partial H3Event with vi.fn spies for setHeader/sendError/ setCookie/etc. so handlers can be tested without booting Nuxt. Supports method/url/body/query/headers/cookies/routerParams overrides. Added server/test/unit/h3-factory.test.ts with 2 tests for the factory itself. 28 tests pass (up from 26). Refs plan at .opencode/plans/hyperplan-dep-tdd-coverage.md PR5. * test: prettier format setup.ts + fix await in h3-factory test (#35) Co-authored-by: bot <ci@local> * test: make 'accepts overrides' it() async for await resolves (#37) Co-authored-by: bot <ci@local> --------- Co-authored-by: bot <ci@local> * chore(deps): consolidate tar override entries across workspaces (#31) Root pnpm-workspace.yaml had 4 tar override entries: tar@<7.5.7: '>=7.5.7' tar@<7.5.8: '>=7.5.8' tar@<=7.5.2: '>=7.5.3' tar@<=7.5.3: '>=7.5.4' desktop/main/pnpm-workspace.yaml had 3: tar@<7.5.7: '>=7.5.7' tar@<=7.5.2: '>=7.5.3' tar@<=7.5.3: '>=7.5.4' Drift: root had 7.5.8 ceiling, desktop did not. Consolidate both to single entry: tar@<=7.5.20: '>=7.5.21' Latest tar at time of consolidation is 7.5.21+ (CVE-free). Maintenance burden drops from 7 entries to 2. pnpm audit confirms 14 pre-existing vulns unchanged (no regression). pnpm install + typecheck + test all pass. Refs plan at .opencode/plans/hyperplan-dep-tdd-coverage.md PR6. Co-authored-by: bot <ci@local> * test(server): add pure-function unit tests (array, tuple, colors, utils, prioritylist) (#32) 5 new test files in test/unit/, +31 tests, 57 total pass: - array.test.ts (10 tests): sum() — empty, positive, mixed, single, no-mutation. lastItem() — empty, single, multi, object refs. - tuple.test.ts (2 tests): x/y storage, toString format. - colors.test.ts (6 tests): getBarColor — 0/70/71/90/91/100 boundary cases. - utils.test.ts (5 tests): getPercentage — value/total, 0/total, >100%, div-by-zero (documents current Infinity behavior), fractional. - prioritylist.test.ts (8 tests): PriorityList — empty, insertion order, priority sort, pop, cache invalidation, find. PriorityListIndexed — index by property, remove from index on pop, empty-pop TypeError (pins current behavior; PR4 will add explicit guard). Coverage: - prioritylist.ts: 93.75% lines (was 0%) - utils/ (array/colors/tuple/utils): 94.73% lines - overall: 1.17% → 1.9% lines Refs plan at .opencode/plans/hyperplan-dep-tdd-coverage.md PR7. Co-authored-by: bot <ci@local> * test(server): add security-surface tests (TOTP base64, session memory) (#33) * test(server): add security-surface tests (TOTP base64, session memory) 2 new test files in test/unit/, +19 tests, 45 total pass: - auth-totp.test.ts (9 tests): dropEncodeArrayBase64/dropDecodeArrayBase64 round-trip. ASCII 'Hello' = 'SGVsbG8='. Binary sequences. Empty array. Both directions. - session-memory.test.ts (10 tests): setSession/getSession, update, remove, getNumberActiveSessions, cleanupSessions, findSessions by userId, by data, no-match. Coverage: - auth/totp.ts: 0% → covered (base64 functions) - session/memory.ts: 0% → 80%+ - overall: 1.17% → 2.01% lines Note on the getNumberActiveSessions test: it documents a pre-existing bug where the implementation uses session.expiresAt.getDate() (day of month) instead of Date.now() (timestamp). Test pins current behavior so a future fix is a deliberate change. Refs plan at .opencode/plans/hyperplan-dep-tdd-coverage.md PR8. * test: prettier format auth-totp.test.ts (#36) Co-authored-by: bot <ci@local> --------- Co-authored-by: bot <ci@local> * fix(deps): add @eslint/config-array override for minimatch compat pnpm install on develop re-resolved lockfile to use minimatch@3.1.5 transitively from @eslint/config-array@0.21.2. ESLint 9 calls `expand` on the Minimatch class which doesn't exist in 3.x. `TypeError: expand is not a function` causes Lint to exit 2, breaking ci.yml and server-ci.yml. Add override `@eslint/config-array@<0.21.3: ">=0.21.3"` to force the newer config-array that uses minimatch 10.x. ESLint 9 fully compatible. Also re-ran prettier --write to normalize quote style (matches other entries in pnpm-workspace.yaml after PR31 consolidated overrides).pn Refs PR #26 (dep-audit-fixes). --------- Co-authored-by: John Smith <you@example.com> Co-authored-by: bot <ci@local>
CLI (downpour)
The cli way to access Drop. Used for admin tasks that require local access, like uploading game content.