2026-09-21 - 2026-09-28
Overview
10 Pull requests merged by 1 user
Merged
#127 Resolve real client IP behind trusted proxies (closes #94)
Merged
#124 feat: blocked_networks config and extended SSRF ranges (closes #67)
Merged
#120 Take the image signing key from PIXA_SIGNING_KEY and refuse the example placeholder (closes #110)
Merged
#123 Harden http.Server: slowloris timeouts and form body limit (closes #92)
Merged
#121 feat: add HSTS, CSP, and Permissions-Policy security headers (closes #91)
Merged
#114 docs: update TODO.md Workflow and Status for the next branching model (closes #106)
Merged
#119 test: cover redirect SSRF and semaphore release in httpfetcher (closes #78)
Merged
#115 fix: script/test conditional-verbose-rerun with -cover (closes #59)
Merged
#117 CSRF protection on the login and URL-generator forms (closes #93)
Merged
#105 next -> main (1.0.0 milestone)
4 Pull requests proposed by 1 user
Proposed
#116 feat: include quality and fit in the URL signature (closes #60)
Proposed
#118 next -> main (1.0.0 milestone)
Proposed
#122 build: run all linting in Docker via Dockerfile.lint (closes #104)
Proposed
#126 fix: validate dimensions and fit mode on encrypted URLs (closes #62)
9 Issues closed from 1 user
Closed
#94 Blocks 1.0: no trusted-proxy handling — every log line and login record shows the proxy's IP
Closed
#67 P1: blocked networks config + SSRF gaps (CGNAT, benchmark, NAT64 ranges not blocked)
Closed
#110 Docker image bakes the example config with a placeholder signing key; take the key from the environment and refuse the placeholder
Closed
#92 Blocks 1.0: http.Server missing IdleTimeout and ReadHeaderTimeout (slowloris), no request body size limits
Closed
#91 Blocks 1.0: missing HSTS, CSP, and Permissions-Policy security headers
Closed
#106 TODO.md documents a branch-from-main workflow that no longer matches the next branching model
Closed
#78 httpfetcher: redirect-to-private-IP SSRF and semaphore release are untested
Closed
#59 script/test doesn't follow the REPO_POLICIES conditional-verbose-rerun pattern (always runs -v)
Closed
#93 Blocks 1.0: no CSRF protection on the cookie-authenticated POST / and POST /generate forms
6 Issues created by 1 user
Opened
#109 Review toward 1.0: identify and file all next steps
Opened
#110 Docker image bakes the example config with a placeholder signing key; take the key from the environment and refuse the placeholder
Opened
#111 Prove the Docker image runs: HEALTHCHECK instruction and a make docker-smoke target that starts the image and checks the healthcheck
Opened
#112 Release: tag v1.0.0 on main once the milestone closes
Opened
#113 Delete five stale remote branches
Opened
#125 Remove unsafe-inline from the Content-Security-Policy: move inline handlers and runtime Tailwind styles into served assets
11 Unresolved Conversations
Open
#17
µPaaS deployment setup
Open
#104
Run all linting in Docker via Dockerfile.lint + script/lint
Open
#60
P1 security: q and fit are outside the HMAC signature, allowing 500x cache/transcode amplification from one signed URL
Open
#62
P1: /v1/e/ encrypted URLs bypass dimension and fit-mode validation
Open
#57
Migrate .golangci.yml from deprecated gomodguard to gomodguard_v2
Open
#100
Markdown is never formatted: script/fmt covers only Go, and no prettier config exists
Open
#101
script/cibuild can report a green it did not earn: docker layer cache can skip make check entirely
Open
#103
Tracking: 1.0.0 sequencing and critical path
Open
#68
Decide on SVG: it is accepted and rendered by libvips, and format=orig silently returns JPEG
Open
#89
Write the deployment guide and an example reverse proxy config
Open
#99
Port is not overridable with the PORT environment variable