Go to issue

Labels Milestones New Issue

0 Open 103 Closed

Label

Show archived labels Use alt + click/enter to exclude labels

All labels No label

critical

merge-ready

needs-checks

needs-decision

needs-rebase

needs-review

needs-rework

Milestone

All milestones No milestones

Open milestones

1.0.0 1.1

Project

All projects No project

Author

All users

Assignee

Assigned to nobody Assigned to anybody

clawbot sneak (Jeffrey Paul)

Sort

Newest Oldest Most recently updated Least recently updated Most commented Least commented Nearest due date Farthest due date

0 Open 103 Closed

Label

Clear labels

critical

merge-ready

needs-checks

needs-decision

needs-rebase

needs-review

needs-rework

Milestone

No milestone

Open milestones

1.0.0

1.1

Projects

Clear projects

Assignee

Clear assignees

clawbot

sneak

A trusted_proxies entry written in the IPv4-mapped form is accepted but never matches

#303

by clawbot was closed 2026-10-19 05:29:06 +02:00

A blocked_networks entry written in the IPv4-mapped form is accepted but refuses nothing

#301

by clawbot was closed 2026-10-19 03:00:44 +02:00

1

The local-use NAT64 range and the operator's blocked_networks list miss IPv4 addresses embedded in IPv6

#299

by clawbot was closed 2026-10-16 06:52:18 +02:00

2

The private-address check misses an IPv4 address embedded in an IPv6 one

#297

by clawbot was closed 2026-10-16 05:31:57 +02:00

2

An IPv6 source host written without a port is refused by the fetcher and answers 500

#295

by clawbot was closed 2026-10-16 05:00:48 +02:00

2

The generator page gives one upstream image several cache keys for host case and an empty path

#293

by clawbot was closed 2026-10-16 04:04:20 +02:00

2

A state_dir holding %, ? or # breaks the database URL pixa derives from it

#290

by clawbot was closed 2026-10-16 04:37:55 +02:00

2

The source URL is built by joining the decoded path and query as text, so some characters reach the upstream wrong

#288

by clawbot was closed 2026-10-16 03:31:16 +02:00

2

A # written into the source path or query gives another unsigned spelling of an allowlisted image

#286

by clawbot was closed 2026-10-16 01:36:58 +02:00

2

A size with one side 0 whose computed side rounds down to 0 comes out square, can ask for tens of GB, or answers 500

#283

by clawbot was closed 2026-10-16 04:18:00 +02:00

2

A thin source requested with fit=cover makes libvips allocate a huge uncropped image

#282

by clawbot was closed 2026-10-16 02:23:19 +02:00

1

May a bug fix change a test that pins exactly the behaviour the bug calls wrong, without asking each time?

#280

by clawbot was closed 2026-10-20 14:25:09 +02:00

3

A ? written into the host segment of an image URL gives another unsigned spelling of an allowlisted source

#275

by clawbot was closed 2026-10-16 01:14:51 +02:00

2

The request metrics label every distinct HTTP method name, so made-up methods grow memory without bound when metrics are on

#274

by clawbot was closed 2026-10-15 21:47:11 +02:00

2

WebP, AVIF and JPEG XL outputs with an alpha channel take longer to encode than the request may wait

#272

by clawbot was closed 2026-10-20 15:19:08 +02:00

1

Logging out does not end the login session

#256

by clawbot was closed 2026-10-15 20:44:45 +02:00

1

The README gives no way to put a source query into a signed image URL, and the in-tree builder makes one that fails

#255

by clawbot was closed 2026-10-16 00:17:34 +02:00

3

The request metrics label every distinct URL path, so unauthenticated requests grow memory without bound when metrics are on

#254

by clawbot was closed 2026-10-15 16:37:21 +02:00

3

A source whose first bytes do not match its Content-Type answers 500 and is fetched again on every request

#253

by clawbot was closed 2026-10-20 14:40:53 +02:00

3

A cached file left empty or partial by a crash is served or re-fetched forever

#252

by clawbot was closed 2026-10-15 19:27:34 +02:00

1