2026-07-18 - 2026-08-18
Overview
7 Pull requests merged by 1 user
Merged
#54 Update golangci-lint to v2.12.2 with canonical config
Merged
#55 feat: cache size management and LRU eviction (closes #51)
Merged
#53 feat: validate configuration on startup, fail fast on bad config (closes #52)
Merged
#50 docs: record manual test pass of auth and encrypted URL flows (closes #49)
Merged
#46 refactor: extract signature package from imgcache
Merged
#48 fix: set Secure/HttpOnly/SameSite on session cookies (closes #47)
Merged
#43 refactor: extract httpfetcher package from imgcache
1 Pull request proposed by 1 user
Proposed
#105 next -> main (1.0.0 milestone)
5 Issues closed from 1 user
Closed
#58 script/lint does not pin the golangci-lint binary version, so local runs can false-green against a stale linter
Closed
#51 P0: implement cache size management and eviction
Closed
#52 P0: validate configuration on startup, fail fast on bad config
Closed
#49 P0: manual test pass of the auth and encrypted URL flows
Closed
#47 Fix remaining gosec lint findings on main
54 Issues created by 1 user
Opened
#47 Fix remaining gosec lint findings on main
Opened
#49 P0: manual test pass of the auth and encrypted URL flows
Opened
#51 P0: implement cache size management and eviction
Opened
#52 P0: validate configuration on startup, fail fast on bad config
Opened
#56 Cache.Stats reads never-populated output_content/request_cache tables, so TotalItems and TotalSizeBytes are always 0
Opened
#57 Migrate .golangci.yml from deprecated gomodguard to gomodguard_v2
Opened
#58 script/lint does not pin the golangci-lint binary version, so local runs can false-green against a stale linter
Opened
#59 script/test doesn't follow the REPO_POLICIES conditional-verbose-rerun pattern (always runs -v)
Opened
#60 P1 security: q and fit are outside the HMAC signature, allowing 500x cache/transcode amplification from one signed URL
Opened
#61 P1: four config keys documented in README do not exist and now abort startup
Opened
#62 P1: /v1/e/ encrypted URLs bypass dimension and fit-mode validation
Opened
#63 Expiring URLs are served with Cache-Control: max-age=31536000, immutable
Opened
#64 P1: no global cap on concurrent image processing — unbounded memory under load
Opened
#65 No request coalescing: K concurrent misses for the same variant cause K upstream fetches and K transcodes
Opened
#66 P1 security: no rate limiting or lockout on the signing-key login form
Opened
#67 P1: blocked networks config + SSRF gaps (CGNAT, benchmark, NAT64 ranges not blocked)
Opened
#68 Decide on SVG: it is accepted and rendered by libvips, and format=orig silently returns JPEG
Opened
#69 CacheConfig.CacheTTL is configured but never read — cached variants never expire
Opened
#70 Cache.metaCache is dead: every cache hit does open+stat+ReadFile+JSON parse instead of the in-memory lookup README promises
Opened
#71 maintenance_mode is configurable and reported by the healthcheck but does not affect any request
Opened
#72 Silently swallowed errors: unparseable exp yields 401 instead of 400, sidecar write failures logged nowhere
Opened
#73 Remove dead abstractions in imgcache: unimplemented Purge and three interfaces with no implementers
Opened
#74 README describes storage paths, formats, and features that do not match the code
Opened
#75 Document the auth UI, encrypted-URL routes, q/fit parameters, and the undocumented config keys
Opened
#76 internal/handlers has 4 tests: the 401 signature boundary and every error path are untested
Opened
#77 The auth UI and encrypted-URL flows have zero Go tests — only a manual shell script
Opened
#78 httpfetcher: redirect-to-private-IP SSRF and semaphore release are untested
Opened
#79 internal/middleware: CORS, logging, and the metrics auth gate are untested
Opened
#80 No integration test of the end-to-end image proxy flow
Opened
#81 No load test verifying the documented 1k-5k req/s target
Opened
#82 P1 privacy: EXIF and other metadata are not stripped from processed images
Opened
#83 Capture upstream Last-Modified/ETag and support conditional revalidation
Opened
#84 Response header gaps: no Vary, X-Request-ID not returned or propagated, /v1/e/ lacks ETag/HEAD/304
Opened
#85 No pixa-specific Prometheus metrics, and metrics are not collected at all unless credentials are configured
Opened
#86 Shutdown correctness: exit code always 0, two competing signal handlers, Sentry calls os.Exit from a goroutine
Opened
#87 httpfetcher.hostSems grows without bound, and VariantStorage.Delete orphans the .meta sidecar
Opened
#88 Implement format=auto (Accept-header content negotiation)
Opened
#89 Write the deployment guide and an example reverse proxy config
Opened
#90 Implement referer blocklist to prevent hotlinking
Opened
#91 Blocks 1.0: missing HSTS, CSP, and Permissions-Policy security headers
Opened
#92 Blocks 1.0: http.Server missing IdleTimeout and ReadHeaderTimeout (slowloris), no request body size limits
Opened
#93 Blocks 1.0: no CSRF protection on the cookie-authenticated POST / and POST /generate forms
Opened
#94 Blocks 1.0: no trusted-proxy handling — every log line and login record shows the proxy's IP
Opened
#95 Dockerfile duplicates dependency installs inline instead of running script/bootstrap, and omits -trimpath / -s -w
Opened
#96 Migrations are not at the mandated internal/db/migrations/ path or filenames
Opened
#97 Repo layout: non-canonical root files, a confusing scripts/ directory, and a stale reformatted CONVENTIONS.md
Opened
#98 CORS wildcard is applied at the router root, covering the cookie-authenticated routes
Opened
#99 Port is not overridable with the PORT environment variable
Opened
#100 Markdown is never formatted: script/fmt covers only Go, and no prettier config exists
Opened
#101 script/cibuild can report a green it did not earn: docker layer cache can skip make check entirely
Opened
#102 Eviction loop is not context-cancellable; shutdown ignores its deadline
Opened
#103 Tracking: 1.0.0 sequencing and critical path
Opened
#104 Run all linting in Docker via Dockerfile.lint + script/lint
Opened
#106 TODO.md documents a branch-from-main workflow that no longer matches the next branching model
2 Unresolved Conversations
Open
#17
µPaaS deployment setup
Open
#39
Refactor: split internal/imgcache into focused packages