2026-08-09 - 2026-09-09
Overview
2 Pull requests merged by 1 user
Merged
#54 Update golangci-lint to v2.12.2 with canonical config
Merged
#55 feat: cache size management and LRU eviction (closes #51)
1 Pull request proposed by 1 user
Proposed
#105 next -> main (1.0.0 milestone)
4 Issues closed from 1 user
Closed
#107 Add hash-pinned Dockerfile.lint and make script/lint Docker-only
Closed
#108 Prove the Docker lint gate actually lints: defeat layer cache + negative control
Closed
#58 script/lint does not pin the golangci-lint binary version, so local runs can false-green against a stale linter
Closed
#51 P0: implement cache size management and eviction
6 Issues created by 1 user
Opened
#102 Eviction loop is not context-cancellable; shutdown ignores its deadline
Opened
#103 Tracking: 1.0.0 sequencing and critical path
Opened
#104 Run all linting in Docker via Dockerfile.lint + script/lint
Opened
#106 TODO.md documents a branch-from-main workflow that no longer matches the next branching model
Opened
#107 Add hash-pinned Dockerfile.lint and make script/lint Docker-only
Opened
#108 Prove the Docker lint gate actually lints: defeat layer cache + negative control
46 Unresolved Conversations
Open
#101
script/cibuild can report a green it did not earn: docker layer cache can skip make check entirely
Open
#100
Markdown is never formatted: script/fmt covers only Go, and no prettier config exists
Open
#57
Migrate .golangci.yml from deprecated gomodguard to gomodguard_v2
Open
#79
internal/middleware: CORS, logging, and the metrics auth gate are untested
Open
#78
httpfetcher: redirect-to-private-IP SSRF and semaphore release are untested
Open
#80
No integration test of the end-to-end image proxy flow
Open
#81
No load test verifying the documented 1k-5k req/s target
Open
#82
P1 privacy: EXIF and other metadata are not stripped from processed images
Open
#83
Capture upstream Last-Modified/ETag and support conditional revalidation
Open
#84
Response header gaps: no Vary, X-Request-ID not returned or propagated, /v1/e/ lacks ETag/HEAD/304
Open
#85
No pixa-specific Prometheus metrics, and metrics are not collected at all unless credentials are configured
Open
#86
Shutdown correctness: exit code always 0, two competing signal handlers, Sentry calls os.Exit from a goroutine
Open
#87
httpfetcher.hostSems grows without bound, and VariantStorage.Delete orphans the .meta sidecar
Open
#88
Implement format=auto (Accept-header content negotiation)
Open
#89
Write the deployment guide and an example reverse proxy config
Open
#90
Implement referer blocklist to prevent hotlinking
Open
#91
Blocks 1.0: missing HSTS, CSP, and Permissions-Policy security headers
Open
#92
Blocks 1.0: http.Server missing IdleTimeout and ReadHeaderTimeout (slowloris), no request body size limits
Open
#93
Blocks 1.0: no CSRF protection on the cookie-authenticated POST / and POST /generate forms
Open
#94
Blocks 1.0: no trusted-proxy handling — every log line and login record shows the proxy's IP
Open
#96
Migrations are not at the mandated internal/db/migrations/ path or filenames
Open
#97
Repo layout: non-canonical root files, a confusing scripts/ directory, and a stale reformatted CONVENTIONS.md
Open
#98
CORS wildcard is applied at the router root, covering the cookie-authenticated routes
Open
#99
Port is not overridable with the PORT environment variable
Open
#67
P1: blocked networks config + SSRF gaps (CGNAT, benchmark, NAT64 ranges not blocked)
Open
#39
Refactor: split internal/imgcache into focused packages
Open
#56
Cache.Stats reads never-populated output_content/request_cache tables, so TotalItems and TotalSizeBytes are always 0
Open
#59
script/test doesn't follow the REPO_POLICIES conditional-verbose-rerun pattern (always runs -v)
Open
#60
P1 security: q and fit are outside the HMAC signature, allowing 500x cache/transcode amplification from one signed URL
Open
#61
P1: four config keys documented in README do not exist and now abort startup
Open
#62
P1: /v1/e/ encrypted URLs bypass dimension and fit-mode validation
Open
#63
Expiring URLs are served with Cache-Control: max-age=31536000, immutable
Open
#64
P1: no global cap on concurrent image processing — unbounded memory under load
Open
#65
No request coalescing: K concurrent misses for the same variant cause K upstream fetches and K transcodes
Open
#66
P1 security: no rate limiting or lockout on the signing-key login form
Open
#17
µPaaS deployment setup
Open
#68
Decide on SVG: it is accepted and rendered by libvips, and format=orig silently returns JPEG
Open
#69
CacheConfig.CacheTTL is configured but never read — cached variants never expire
Open
#70
Cache.metaCache is dead: every cache hit does open+stat+ReadFile+JSON parse instead of the in-memory lookup README promises
Open
#71
maintenance_mode is configurable and reported by the healthcheck but does not affect any request
Open
#72
Silently swallowed errors: unparseable exp yields 401 instead of 400, sidecar write failures logged nowhere
Open
#73
Remove dead abstractions in imgcache: unimplemented Purge and three interfaces with no implementers
Open
#74
README describes storage paths, formats, and features that do not match the code
Open
#75
Document the auth UI, encrypted-URL routes, q/fit parameters, and the undocumented config keys
Open
#76
internal/handlers has 4 tests: the 401 signature boundary and every error path are untested
Open
#77
The auth UI and encrypted-URL flows have zero Go tests — only a manual shell script