2025-08-18 - 2026-08-18
Overview
26 Pull requests merged by 2 users
Merged
#54 Update golangci-lint to v2.12.2 with canonical config
Merged
#55 feat: cache size management and LRU eviction (closes #51)
Merged
#53 feat: validate configuration on startup, fail fast on bad config (closes #52)
Merged
#50 docs: record manual test pass of auth and encrypted URL flows (closes #49)
Merged
#46 refactor: extract signature package from imgcache
Merged
#48 fix: set Secure/HttpOnly/SameSite on session cookies (closes #47)
Merged
#43 refactor: extract httpfetcher package from imgcache
Merged
#45 scripts-to-rule-them-all
Merged
#44 Update TODO.md: standard structure and Workflow section
Merged
#42 refactor: extract magic byte detection into internal/magic package
Merged
#41 refactor: extract whitelist package from internal/imgcache
Merged
#36 Move schema_migrations table creation into 000.sql
Merged
#40 Enforce and document exact-match-only for signature verification
Merged
#34 Consolidate appname to internal/globals as a constant
Merged
#37 Bound imageprocessor.Process input read to prevent unbounded memory use
Merged
#33 feat: parse version prefix from migration filenames
Merged
#25 fix: QA audit fixes for 1.0/MVP readiness
Merged
#23 Split Dockerfile: pre-built golangci-lint stage for faster CI
Merged
#16 fix: Docker build failures on arm64 (closes #15)
Merged
#14 bring repo into compliance with repo policies
Merged
#12 chore: remove local dev config files
Merged
#6 fix: propagate AllowHTTP to SourceURL() scheme selection (closes #1)
Merged
#8 fix: check negative cache in Service.Get() before fetching upstream (closes #3)
Merged
#9 fix: correct Stats() column scanning and HitRate computation (closes #4)
Merged
#7 fix: encode source query in GenerateSignedURL to avoid malformed URLs (closes #2)
Merged
#10 fix: guard against division by zero when fetchBytes is 0 (closes #5)
1 Pull request proposed by 1 user
Proposed
#105 next -> main (1.0.0 milestone)
23 Issues closed from 2 users
Closed
#58 script/lint does not pin the golangci-lint binary version, so local runs can false-green against a stale linter
Closed
#51 P0: implement cache size management and eviction
Closed
#52 P0: validate configuration on startup, fail fast on bad config
Closed
#49 P0: manual test pass of the auth and encrypted URL flows
Closed
#47 Fix remaining gosec lint findings on main
Closed
#29 000.initial.sql should contain migrations table schema
Closed
#27 should not support suffix matching for signatures
Closed
#30 Appname doesn’t need to be in main and internal/globals both
Closed
#31 imageprocessor.Process appears to do unbounded read into memory
Closed
#28 migrations need to parse version out of filename
Closed
#26 should be configured via env vars not yaml
Closed
#24 1.0/mvp
Closed
#18 Split Dockerfile: pre-built golangci-lint stage for faster CI
Closed
#20 Split Dockerfile: pre-built golangci-lint stage for faster CI
Closed
#19 Split Dockerfile: pre-built golangci-lint stage for faster CI
Closed
#21 Split Dockerfile: pre-built golangci-lint stage for faster CI
Closed
#15 Docker build fails on arm64: golangci-lint binary hardcoded as linux-amd64
Closed
#13 Add branch protection to main branch
Closed
#1 Bug: SourceURL() hardcodes https:// breaking AllowHTTP mode
Closed
#3 Bug: Negative cache is never checked - checkNegativeCache is dead code
Closed
#4 Bug: Stats() scans database columns into wrong struct fields
Closed
#2 Bug: GenerateSignedURL produces malformed URL when source has query string
Closed
#5 Bug: Division by zero in processAndStore when source data is empty
74 Issues created by 1 user
Opened
#2 Bug: GenerateSignedURL produces malformed URL when source has query string
Opened
#1 Bug: SourceURL() hardcodes https:// breaking AllowHTTP mode
Opened
#3 Bug: Negative cache is never checked - checkNegativeCache is dead code
Opened
#4 Bug: Stats() scans database columns into wrong struct fields
Opened
#5 Bug: Division by zero in processAndStore when source data is empty
Opened
#13 Add branch protection to main branch
Opened
#15 Docker build fails on arm64: golangci-lint binary hardcoded as linux-amd64
Opened
#17 µPaaS deployment setup
Opened
#18 Split Dockerfile: pre-built golangci-lint stage for faster CI
Opened
#19 Split Dockerfile: pre-built golangci-lint stage for faster CI
Opened
#20 Split Dockerfile: pre-built golangci-lint stage for faster CI
Opened
#21 Split Dockerfile: pre-built golangci-lint stage for faster CI
Opened
#24 1.0/mvp
Opened
#26 should be configured via env vars not yaml
Opened
#27 should not support suffix matching for signatures
Opened
#28 migrations need to parse version out of filename
Opened
#29 000.initial.sql should contain migrations table schema
Opened
#30 Appname doesn’t need to be in main and internal/globals both
Opened
#31 imageprocessor.Process appears to do unbounded read into memory
Opened
#39 Refactor: split internal/imgcache into focused packages
Opened
#47 Fix remaining gosec lint findings on main
Opened
#49 P0: manual test pass of the auth and encrypted URL flows
Opened
#51 P0: implement cache size management and eviction
Opened
#52 P0: validate configuration on startup, fail fast on bad config
Opened
#56 Cache.Stats reads never-populated output_content/request_cache tables, so TotalItems and TotalSizeBytes are always 0
Opened
#57 Migrate .golangci.yml from deprecated gomodguard to gomodguard_v2
Opened
#58 script/lint does not pin the golangci-lint binary version, so local runs can false-green against a stale linter
Opened
#59 script/test doesn't follow the REPO_POLICIES conditional-verbose-rerun pattern (always runs -v)
Opened
#60 P1 security: q and fit are outside the HMAC signature, allowing 500x cache/transcode amplification from one signed URL
Opened
#61 P1: four config keys documented in README do not exist and now abort startup
Opened
#62 P1: /v1/e/ encrypted URLs bypass dimension and fit-mode validation
Opened
#63 Expiring URLs are served with Cache-Control: max-age=31536000, immutable
Opened
#64 P1: no global cap on concurrent image processing — unbounded memory under load
Opened
#65 No request coalescing: K concurrent misses for the same variant cause K upstream fetches and K transcodes
Opened
#66 P1 security: no rate limiting or lockout on the signing-key login form
Opened
#67 P1: blocked networks config + SSRF gaps (CGNAT, benchmark, NAT64 ranges not blocked)
Opened
#68 Decide on SVG: it is accepted and rendered by libvips, and format=orig silently returns JPEG
Opened
#69 CacheConfig.CacheTTL is configured but never read — cached variants never expire
Opened
#70 Cache.metaCache is dead: every cache hit does open+stat+ReadFile+JSON parse instead of the in-memory lookup README promises
Opened
#71 maintenance_mode is configurable and reported by the healthcheck but does not affect any request
Opened
#72 Silently swallowed errors: unparseable exp yields 401 instead of 400, sidecar write failures logged nowhere
Opened
#73 Remove dead abstractions in imgcache: unimplemented Purge and three interfaces with no implementers
Opened
#74 README describes storage paths, formats, and features that do not match the code
Opened
#75 Document the auth UI, encrypted-URL routes, q/fit parameters, and the undocumented config keys
Opened
#76 internal/handlers has 4 tests: the 401 signature boundary and every error path are untested
Opened
#77 The auth UI and encrypted-URL flows have zero Go tests — only a manual shell script
Opened
#78 httpfetcher: redirect-to-private-IP SSRF and semaphore release are untested
Opened
#79 internal/middleware: CORS, logging, and the metrics auth gate are untested
Opened
#80 No integration test of the end-to-end image proxy flow
Opened
#81 No load test verifying the documented 1k-5k req/s target
Opened
#82 P1 privacy: EXIF and other metadata are not stripped from processed images
Opened
#83 Capture upstream Last-Modified/ETag and support conditional revalidation
Opened
#84 Response header gaps: no Vary, X-Request-ID not returned or propagated, /v1/e/ lacks ETag/HEAD/304
Opened
#85 No pixa-specific Prometheus metrics, and metrics are not collected at all unless credentials are configured
Opened
#86 Shutdown correctness: exit code always 0, two competing signal handlers, Sentry calls os.Exit from a goroutine
Opened
#87 httpfetcher.hostSems grows without bound, and VariantStorage.Delete orphans the .meta sidecar
Opened
#88 Implement format=auto (Accept-header content negotiation)
Opened
#89 Write the deployment guide and an example reverse proxy config
Opened
#90 Implement referer blocklist to prevent hotlinking
Opened
#91 Blocks 1.0: missing HSTS, CSP, and Permissions-Policy security headers
Opened
#92 Blocks 1.0: http.Server missing IdleTimeout and ReadHeaderTimeout (slowloris), no request body size limits
Opened
#93 Blocks 1.0: no CSRF protection on the cookie-authenticated POST / and POST /generate forms
Opened
#94 Blocks 1.0: no trusted-proxy handling — every log line and login record shows the proxy's IP
Opened
#95 Dockerfile duplicates dependency installs inline instead of running script/bootstrap, and omits -trimpath / -s -w
Opened
#96 Migrations are not at the mandated internal/db/migrations/ path or filenames
Opened
#97 Repo layout: non-canonical root files, a confusing scripts/ directory, and a stale reformatted CONVENTIONS.md
Opened
#98 CORS wildcard is applied at the router root, covering the cookie-authenticated routes
Opened
#99 Port is not overridable with the PORT environment variable
Opened
#100 Markdown is never formatted: script/fmt covers only Go, and no prettier config exists
Opened
#101 script/cibuild can report a green it did not earn: docker layer cache can skip make check entirely
Opened
#102 Eviction loop is not context-cancellable; shutdown ignores its deadline
Opened
#103 Tracking: 1.0.0 sequencing and critical path
Opened
#104 Run all linting in Docker via Dockerfile.lint + script/lint
Opened
#106 TODO.md documents a branch-from-main workflow that no longer matches the next branching model