2026-02-17 - 2026-08-17
Overview
1 Release published by 1 user
Published
1.0.0
MVP
31 Pull requests merged by 2 users
Merged
#187 Update golangci-lint to v2.12.2 with canonical config
Merged
#174 scripts-to-rule-them-all
Merged
#173 TODO
Merged
#172 Move schema_migrations table creation into 000.sql with INTEGER version column
Merged
#170 feat: add GitHub and GitLab webhook support
Merged
#165 feat: CPU/memory resource limits per app
Merged
#158 feat: monolithic env var editing with bulk save
Merged
#164 feat: add webhook event history UI page
Merged
#159 fix: add missing Makefile targets (docker, hooks) and test timeout
Merged
#160 fix: pass notification settings from create form to service
Merged
#155 chore: add REPO_POLICIES compliance files
Merged
#154 fix: add COPY --from=lint to builder stage to force lint execution
Merged
#149 fix: change module path to sneak.berlin/go/upaas (closes #143)
Merged
#152 Split Dockerfile into lint + build stages for faster CI feedback
Merged
#148 tidy
Merged
#147 Fix dashboard CSRFField crash (closes #146)
Merged
#131 fix: simplify CI to docker build only (closes #130)
Merged
#126 Fix 1.0 audit bugs (closes #120, closes #121, closes #122, closes #123, closes #124, closes #125)
Merged
#129 Refactor: break up app.js into smaller modules
Merged
#127 fix: use imageID in createAndStartContainer (closes #124)
Merged
#119 fix: pin all external refs to cryptographic identity (closes #118)
Merged
#115 fix: disable API v1 write methods (closes #112)
Merged
#109 fix: resolve 1.0 audit bugs (closes #104, #105, #106, #107, #108)
Merged
#100 ci: add Gitea Actions workflow for make check (closes #96)
Merged
#95 chore: code cleanup and best practices (closes #45)
Merged
#91 fix: validate repo URL format on app creation (closes #88)
Merged
#102 Fix all main branch lint issues (closes #101)
Merged
#99 revert: undo PR #98 (CI + linter config changes)
Merged
#98 feat: add Gitea Actions CI for make check (closes #96)
Merged
#93 fix: clean up orphan resources on deploy cancellation (closes #89)
Merged
#92 fix: restrict CORS to configured origins (closes #40)
71 Issues closed from 2 users
Closed
#176 lint: fix 22 gosec G710 open-redirect findings in internal/handlers/app.go
Closed
#175 lint: fix all 47 noctx findings (httptest.NewRequest without context)
Closed
#171 Move schema_migrations table creation into 000.sql with INTEGER version column
Closed
#79 FEATURE: Backup/restore of app configurations
Closed
#80 FEATURE: Private Docker registry authentication
Closed
#84 FEATURE: Observability improvements (structured logging, metrics, audit log)
Closed
#81 FEATURE: Custom health check commands per app
Closed
#68 FEATURE: GitHub and GitLab webhook support
Closed
#72 FEATURE: CPU/memory resource limits per app
Closed
#161 Run make fmt on JS static files
Closed
#156 getting a 404 trying to change env vars from app page
Closed
#163 Redesign env var editing to use monolithic list approach
Closed
#85 FEATURE: Webhook event history UI
Closed
#136 Makefile missing required targets: fmt-check, docker, hooks
Closed
#137 make test missing 30-second timeout
Closed
#157 bug: app slack/ntfy settings are not saved or properly displayed on edit
Closed
#132 Missing .gitignore file
Closed
#133 Missing .editorconfig file
Closed
#134 Missing REPO_POLICIES.md
Closed
#135 Missing .dockerignore file
Closed
#153 Dockerfile lint stage is skipped by BuildKit (unreferenced stage)
Closed
#151 Split Dockerfile into lint + build stages for faster CI feedback
Closed
#145 POLICY: make fmt uses npx instead of yarn for prettier
Closed
#144 POLICY: make test missing 30-second timeout
Closed
#143 POLICY: Go module path should be sneak.berlin/go/upaas
Closed
#142 POLICY: Makefile missing required targets (fmt-check, docker, hooks)
Closed
#141 POLICY: Missing REPO_POLICIES.md in repo root
Closed
#140 POLICY: Missing .dockerignore
Closed
#139 POLICY: Missing .editorconfig
Closed
#138 POLICY: Missing .gitignore
Closed
#86 FEATURE: Settings page (webhook secret, SSH public key)
Closed
#146 CRITICAL: error in template prevents login
Closed
#130 the gitea action doesn't comply with repo policies.
Closed
#125 LOW: applyMigration deferred rollback skipped when Commit() fails
Closed
#123 LOW: GetBuildDir parameter named appID but always called with app.Name
Closed
#120 CRITICAL: docker-compose.yml missing HOST_DATA_DIR — git clone fails in containerized deployment
Closed
#121 HIGH: Template rendering bypass in HandleAppCreate/HandleAppUpdate can produce partial HTML
Closed
#122 HIGH: No size limit on deployment logs stored in SQLite
Closed
#128 Refactor: break up app.js into smaller modules
Closed
#124 LOW: createAndStartContainer has unused imageID parameter
Closed
#118 CRITICAL: rce in docker build
Closed
#112 CRITICAL: API v1 routes use cookie auth without CSRF protection — cross-site request forgery
Closed
#110 CRITICAL: Deployed containers have no security constraints (capabilities, seccomp, resource limits)
Closed
#111 CRITICAL: Volume mounts allow access to any host path (Docker socket, /etc/shadow, etc.)
Closed
#114 CRITICAL: API exposes webhook secret and SSH private key in app detail response
Closed
#113 CRITICAL: Port mappings bind to 0.0.0.0 with no restriction on privileged ports or conflicts
Closed
#108 BUG: SetupRequired middleware blocks /health, /s/*, and /api/* before initial setup
Closed
#107 BUG: HandleVolumeAdd missing path validation — path traversal possible on volume creation
Closed
#106 BUG: API delete endpoint does not stop/remove Docker container — orphaned containers
Closed
#105 BUG: API deploy handler uses request context — deployment cancelled on client disconnect
Closed
#104 BUG: HandleEnvVarDelete uses wrong route parameter name — env var deletion always 404s
Closed
#103 Add branch protection to main branch
Closed
#96 needs actions for code standard checks
Closed
#45 Code cleanup: minor best practice improvements for 1.0
Closed
#88 1.0: Validate repo URL format on app creation
Closed
#87 1.0: API token authentication (bearer token support)
Closed
#101 CRITICAL: main branch build failure
Closed
#89 1.0: Cancelled deployments may leave orphan Docker resources
Closed
#40 SECURITY: CORS allows all origins (*) — review for CSRF implications
Closed
#82 FEATURE: Multi-user support with roles
Closed
#83 FEATURE: Scheduled deployments
Closed
#90 1.0: Improve test coverage for HTTP handlers
Closed
#64 Observability improvements (structured logging, metrics, audit log)
Closed
#63 Multi-user support with roles
Closed
#61 GitHub/GitLab webhook support
Closed
#60 Webhook event history UI
Closed
#59 Resource limits - CPU/memory (Phase 4.2)
Closed
#62 Real-time deployment log streaming (WebSocket/SSE)
Closed
#58 Deployment rollback (Phase 3.2)
Closed
#57 Edit existing env vars, labels, and volumes (Phase 3.1)
Closed
#56 JSON API (Phase 4.1)
59 Issues created by 1 user
Opened
#87 1.0: API token authentication (bearer token support)
Opened
#88 1.0: Validate repo URL format on app creation
Opened
#90 1.0: Improve test coverage for HTTP handlers
Opened
#89 1.0: Cancelled deployments may leave orphan Docker resources
Opened
#96 needs actions for code standard checks
Opened
#101 CRITICAL: main branch build failure
Opened
#103 Add branch protection to main branch
Opened
#104 BUG: HandleEnvVarDelete uses wrong route parameter name — env var deletion always 404s
Opened
#105 BUG: API deploy handler uses request context — deployment cancelled on client disconnect
Opened
#106 BUG: API delete endpoint does not stop/remove Docker container — orphaned containers
Opened
#107 BUG: HandleVolumeAdd missing path validation — path traversal possible on volume creation
Opened
#108 BUG: SetupRequired middleware blocks /health, /s/*, and /api/* before initial setup
Opened
#110 CRITICAL: Deployed containers have no security constraints (capabilities, seccomp, resource limits)
Opened
#111 CRITICAL: Volume mounts allow access to any host path (Docker socket, /etc/shadow, etc.)
Opened
#112 CRITICAL: API v1 routes use cookie auth without CSRF protection — cross-site request forgery
Opened
#113 CRITICAL: Port mappings bind to 0.0.0.0 with no restriction on privileged ports or conflicts
Opened
#114 CRITICAL: API exposes webhook secret and SSH private key in app detail response
Opened
#118 CRITICAL: rce in docker build
Opened
#120 CRITICAL: docker-compose.yml missing HOST_DATA_DIR — git clone fails in containerized deployment
Opened
#121 HIGH: Template rendering bypass in HandleAppCreate/HandleAppUpdate can produce partial HTML
Opened
#122 HIGH: No size limit on deployment logs stored in SQLite
Opened
#123 LOW: GetBuildDir parameter named appID but always called with app.Name
Opened
#124 LOW: createAndStartContainer has unused imageID parameter
Opened
#125 LOW: applyMigration deferred rollback skipped when Commit() fails
Opened
#128 Refactor: break up app.js into smaller modules
Opened
#130 the gitea action doesn't comply with repo policies.
Opened
#132 Missing .gitignore file
Opened
#133 Missing .editorconfig file
Opened
#134 Missing REPO_POLICIES.md
Opened
#135 Missing .dockerignore file
Opened
#136 Makefile missing required targets: fmt-check, docker, hooks
Opened
#137 make test missing 30-second timeout
Opened
#138 POLICY: Missing .gitignore
Opened
#139 POLICY: Missing .editorconfig
Opened
#140 POLICY: Missing .dockerignore
Opened
#141 POLICY: Missing REPO_POLICIES.md in repo root
Opened
#142 POLICY: Makefile missing required targets (fmt-check, docker, hooks)
Opened
#143 POLICY: Go module path should be sneak.berlin/go/upaas
Opened
#144 POLICY: make test missing 30-second timeout
Opened
#145 POLICY: make fmt uses npx instead of yarn for prettier
Opened
#146 CRITICAL: error in template prevents login
Opened
#151 Split Dockerfile into lint + build stages for faster CI feedback
Opened
#153 Dockerfile lint stage is skipped by BuildKit (unreferenced stage)
Opened
#156 getting a 404 trying to change env vars from app page
Opened
#157 bug: app slack/ntfy settings are not saved or properly displayed on edit
Opened
#161 Run make fmt on JS static files
Opened
#163 Redesign env var editing to use monolithic list approach
Opened
#171 Move schema_migrations table creation into 000.sql with INTEGER version column
Opened
#175 lint: fix all 47 noctx findings (httptest.NewRequest without context)
Opened
#176 lint: fix 22 gosec G710 open-redirect findings in internal/handlers/app.go
Opened
#177 lint: fix gosec G703 path traversal finding in deploy log download handler
Opened
#178 lint: fix all 24 goconst findings (repeated string literals)
Opened
#179 Bump Dockerfile lint stage golangci-lint pin from v2.10.1 to current v2.12.x
Opened
#180 Verify branch protection on main requires the Check workflow before merge
Opened
#181 Deploy µPaaS to fsn1app1 and verify end-to-end
Opened
#182 Tag and publish release 1.1.0
Opened
#184 script/bootstrap does not install goimports, which script/fmt requires
Opened
#185 make fmt rewrites vendored static/js/alpine.min.js (missing .prettierignore)
Opened
#188 Run all linting in Docker via Dockerfile.lint + script/lint