Removes the CrowdSec decision feed, as sneak ruled on #315 (closes#315).
What goes:
the heuristic crowdsec in internal/waf;
the decision list's fetch, parse and stricter refresh in internal/reputation;
the ban cause crowdsec, its earlier_bans count and BanForCrowdSec in internal/bans;
the tag crowdsec and its special refusal in SWW_WAF_TAG_DENY and SWW_WAF_TAG_LIMIT_PERCENT;
the settings SWW_WAF_CROWDSEC_LAPI_URL and SWW_WAF_CROWDSEC_LAPI_KEY (the issue names them by their names before the rename in #234);
their tests, and every mention in README.md, SPEC.md and docs/.
EVALUATION.md keeps its comparison of tools, as the ruling allows.
Worth knowing:
The feed reached further than internal/bans: internal/config, internal/state, internal/metrics, internal/alerts and internal/requestlog change too.
The ledger's private ban function loses its expires parameter, which only CrowdSec bans used. Ban lengths for limits and attacks are unchanged.
bans.json with the cause crowdsec now stops the start, like any unknown cause.
crowdsec in SWW_WAF_TAG_DENY is now refused as a tag no request can get, unless a list in SWW_WAF_TAG_LISTS has that name.
Model: opus-5-5
Removes the CrowdSec decision feed, as sneak ruled on https://git.eeqj.de/sneak/smallwebwaf/issues/315 (closes #315).
What goes:
- the heuristic `crowdsec` in `internal/waf`;
- the decision list's fetch, parse and stricter refresh in `internal/reputation`;
- the ban cause `crowdsec`, its `earlier_bans` count and `BanForCrowdSec` in `internal/bans`;
- the tag `crowdsec` and its special refusal in `SWW_WAF_TAG_DENY` and `SWW_WAF_TAG_LIMIT_PERCENT`;
- the settings `SWW_WAF_CROWDSEC_LAPI_URL` and `SWW_WAF_CROWDSEC_LAPI_KEY` (the issue names them by their names before the rename in https://git.eeqj.de/sneak/smallwebwaf/issues/234);
- their tests, and every mention in `README.md`, `SPEC.md` and `docs/`.
`EVALUATION.md` keeps its comparison of tools, as the ruling allows.
Worth knowing:
- The feed reached further than `internal/bans`: `internal/config`, `internal/state`, `internal/metrics`, `internal/alerts` and `internal/requestlog` change too.
- The ledger's private `ban` function loses its `expires` parameter, which only CrowdSec bans used. Ban lengths for limits and attacks are unchanged.
- `bans.json` with the cause `crowdsec` now stops the start, like any unknown cause.
- `crowdsec` in `SWW_WAF_TAG_DENY` is now refused as a tag no request can get, unless a list in `SWW_WAF_TAG_LISTS` has that name.
Model: opus-5-5
sneak ruled to remove it. Gone: the heuristic crowdsec, the ban cause
crowdsec and its earlier_bans count, the tag crowdsec, the settings
SWW_WAF_CROWDSEC_LAPI_URL and SWW_WAF_CROWDSEC_LAPI_KEY, the decision
list fetch and parse in internal/reputation, their tests, and every
mention in the README, SPEC.md and docs/. EVALUATION.md keeps its
comparison of tools.
The ban ledger's internal ban function loses its expires parameter,
which only CrowdSec bans used.
Model: opus-5-5
The CrowdSec decision feed is gone from the code, the settings, the tests and every document the ruling on #315 names, and EVALUATION.md keeps its comparison as that ruling allows.
Model: opus-5-5
Verdict: PASS
Head: 478c3affad4f3ecf15dfafccdb22fa0c2f393e34
The CrowdSec decision feed is gone from the code, the settings, the tests and every document the ruling on https://git.eeqj.de/sneak/smallwebwaf/issues/315 names, and `EVALUATION.md` keeps its comparison as that ruling allows.
Model: opus-5-5
clawbot
merged commit 2bea6516a8 into next2026-11-13 20:43:06 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Removes the CrowdSec decision feed, as sneak ruled on #315 (closes #315).
What goes:
crowdsecininternal/waf;internal/reputation;crowdsec, itsearlier_banscount andBanForCrowdSecininternal/bans;crowdsecand its special refusal inSWW_WAF_TAG_DENYandSWW_WAF_TAG_LIMIT_PERCENT;SWW_WAF_CROWDSEC_LAPI_URLandSWW_WAF_CROWDSEC_LAPI_KEY(the issue names them by their names before the rename in #234);README.md,SPEC.mdanddocs/.EVALUATION.mdkeeps its comparison of tools, as the ruling allows.Worth knowing:
internal/bans:internal/config,internal/state,internal/metrics,internal/alertsandinternal/requestlogchange too.banfunction loses itsexpiresparameter, which only CrowdSec bans used. Ban lengths for limits and attacks are unchanged.bans.jsonwith the causecrowdsecnow stops the start, like any unknown cause.crowdsecinSWW_WAF_TAG_DENYis now refused as a tag no request can get, unless a list inSWW_WAF_TAG_LISTShas that name.Model: opus-5-5
Verdict: PASS
Head:
478c3affadThe CrowdSec decision feed is gone from the code, the settings, the tests and every document the ruling on #315 names, and
EVALUATION.mdkeeps its comparison as that ruling allows.Model: opus-5-5