Commit Graph

Select branches

Hide Pull Requests

ci/add-check-action

docker-compose

feature/api-token-auth

feature/backup-restore-config

feature/custom-healthcheck-command

feature/deployment-rollback-tests

feature/edit-entities

feature/observability-improvements

feature/prettierrc

feature/private-registry-auth

fix-gosec-g710

fix-noctx-lint

fix/js-formatting

fix/module-path

main

next

#10

#100

#102

#109

#115

#116

#117

#119

#126

#127

#129

#131

#14

#147

#148

#149

#15

#150

#152

#154

#155

#158

#159

#16

#160

#162

#164

#165

#166

#167

#168

#169

#170

#172

#173

#174

#183

#186

#187

#193

#194

#195

#196

#199

#200

#201

#202

#204

#207

#209

#210

#212

#217

#218

#219

#221

#222

#225

#226

#227

#228

#231

#232

#233

#241

#242

#243

#244

#245

#247

#250

#252

#254

#256

#257

#258

#263

#265

#267

#268

#27

#270

#271

#273

#275

#276

#28

#29

#30

#31

#33

#34

#46

#47

#48

#49

#50

#51

#52

#53

#55

#6

#65

#7

#73

#74

#75

#76

#77

#78

#8

#9

#91

#92

#93

#94

#95

#97

#98

#99

1.0.0

Mono Color

• ab7c43b887 fix: disable API v1 write methods (closes #112) user 2026-02-20 05:33:07 -08:00
• 4217e62f27 Merge pull request 'fix: resolve 1.0 audit bugs (closes #104, #105, #106, #107, #108)' (#109) from fix/1.0-audit-bugs into main sneak 2026-02-20 13:47:12 +01:00
• 327d7fb982 fix: resolve lint issues in handlers and middleware clawbot 2026-02-20 03:35:44 -08:00
• 6cfd5023f9 fix: SetupRequired middleware exempts health, static, and API routes (closes #108) clawbot 2026-02-20 03:33:34 -08:00
• efd3500dac fix: HandleVolumeAdd validates host and container paths (closes #107) clawbot 2026-02-20 03:33:19 -08:00
• ec87915234 fix: API delete endpoint cleans up Docker container before DB deletion (closes #106) clawbot 2026-02-20 03:33:04 -08:00
• cd0354e86c fix: API deploy handler uses detached context to prevent cancellation (closes #105) clawbot 2026-02-20 03:32:42 -08:00
• 7d1849c8df fix: HandleEnvVarDelete uses correct varID route param (closes #104) clawbot 2026-02-20 03:32:20 -08:00
• 4a73a5575f Merge pull request 'ci: add Gitea Actions workflow for make check (closes #96)' (#100) from ci/check-workflow-only into main sneak 2026-02-20 12:19:29 +01:00
• a5d703a670 Merge branch 'main' into ci/check-workflow-only sneak 2026-02-20 12:00:02 +01:00
• c8a8f88cd0 Merge pull request 'chore: code cleanup and best practices (closes #45)' (#95) from chore/code-cleanup into main sneak 2026-02-20 11:59:31 +01:00
• aab2375cfa Merge branch 'main' into chore/code-cleanup sneak 2026-02-20 11:59:06 +01:00
• 2ba47d6ddd Merge pull request 'fix: validate repo URL format on app creation (closes #88)' (#91) from fix/repo-url-validation into main sneak 2026-02-20 11:58:48 +01:00
• 0bb59bf9c2 feat: sanitize container log output beyond Content-Type user 2026-02-19 20:36:13 -08:00
• dcff249fe5 fix: sanitize container log output and fix lint issues clawbot 2026-02-19 20:30:11 -08:00
• a2087f4898 fix: restrict SCP-like URLs to git user only and reject path traversal clawbot 2026-02-19 20:17:25 -08:00
• a2fb42520d fix: validate repo URL format on app creation (closes #88) clawbot 2026-02-19 13:44:08 -08:00
• 6d600010b7 ci: add Gitea Actions workflow for make check (closes #96) clawbot 2026-02-20 02:46:00 -08:00
• 8ad2c6e42c Merge pull request 'Fix all main branch lint issues (closes #101)' (#102) from fix/main-lint-issues into main sneak 2026-02-20 11:42:34 +01:00
• 0fcf12d2cc fix: resolve all lint issues on main branch clawbot 2026-02-20 02:39:18 -08:00
• e73409b567 fix: resolve lint issues for make check compliance feature/api-token-auth clawbot 2026-02-19 23:43:41 -08:00
• a891fb2489 fix: increase API token entropy from 128 to 256 bits clawbot 2026-02-19 20:16:32 -08:00
• 96eea71c54 fix: set authenticated user on request context in bearer token auth clawbot 2026-02-19 13:54:09 -08:00
• 7387ba6b5c feat: add API token authentication (closes #87) clawbot 2026-02-19 13:47:39 -08:00
• 3a4e999382 Merge pull request 'revert: undo PR #98 (CI + linter config changes)' (#99) from revert/pr-98 into main sneak 2026-02-20 05:37:49 +01:00
• 728b29ef16 Revert "Merge pull request 'feat: add Gitea Actions CI for make check (closes #96)' (#98) from feat/ci-make-check into main" clawbot 2026-02-19 20:36:22 -08:00
• f61d4d0f91 Merge pull request 'feat: add Gitea Actions CI for make check (closes #96)' (#98) from feat/ci-make-check into main sneak 2026-02-20 05:33:24 +01:00
• 8ec04fdadb feat: add Gitea Actions CI for make check (closes #96) clawbot 2026-02-19 20:29:21 -08:00
• 5d87d386c3 ci: pin actions to commit SHAs to prevent RCE ci/add-check-action user 2026-02-19 20:25:23 -08:00
• f65e3887b2 ci: add Gitea Actions workflow for make check (fixes #96) user 2026-02-19 20:22:45 -08:00
• 06e8e66443 Merge pull request 'fix: clean up orphan resources on deploy cancellation (closes #89)' (#93) from fix/deploy-cancel-cleanup into main sneak 2026-02-20 05:22:58 +01:00
• 95a690e805 fix: use strings.HasPrefix instead of manual slice comparison clawbot 2026-02-19 20:17:27 -08:00
• 802518b917 fix: clean up orphan resources on deploy cancellation (closes #89) clawbot 2026-02-19 13:47:07 -08:00
• b47f871412 Merge pull request 'fix: restrict CORS to configured origins (closes #40)' (#92) from fix/cors-wildcard into main sneak 2026-02-20 05:11:33 +01:00
• 02847eea92 fix: restrict CORS to configured origins (closes #40) clawbot 2026-02-19 13:45:18 -08:00
• 506c795f16 test: add CORS middleware tests (failing - TDD) clawbot 2026-02-19 13:43:33 -08:00
• 38a744b489 Merge pull request 'feat: add JSON API with token auth (closes #69)' (#74) from feature/json-api into main sneak 2026-02-16 09:51:48 +01:00
• 11314629b6 Merge branch 'main' into feature/json-api sneak 2026-02-16 09:51:36 +01:00
• bc3ee2bfc5 Merge pull request 'chore: remove TODO.md — all items tracked as Gitea issues' (#65) from chore/update-todo into main sneak 2026-02-16 09:51:14 +01:00
• e09cf11c06 chore: remove TODO.md — all items tracked as Gitea issues user 2026-02-16 00:35:23 -08:00
• 8d68a31366 fix: remove undeployed api_tokens migrations (006 + 007) user 2026-02-16 00:34:02 -08:00
• b83e68fafd Merge pull request 'feat: edit existing env vars, labels, and volume mounts (closes #67)' (#77) from feature/edit-config-entities into main sneak 2026-02-16 09:33:46 +01:00
• f743837d49 Merge branch 'main' into feature/json-api sneak 2026-02-16 09:33:09 +01:00
• 9ac1d25788 refactor: switch API from token auth to cookie-based session auth user 2026-02-16 00:31:10 -08:00
• 0c8dcc2eb1 Merge branch 'main' into feature/edit-config-entities sneak 2026-02-16 09:28:30 +01:00
• 3c1525d59e test: add rollback error condition tests feature/deployment-rollback-tests clawbot 2026-02-16 00:27:46 -08:00
• d0375555af Merge pull request 'Update TODO.md with current status (closes #54)' (#55) from update-todo-md into main sneak 2026-02-16 09:26:15 +01:00
• e9d284698a feat: edit existing env vars, labels, and volume mounts clawbot 2026-02-16 00:26:07 -08:00
• 96a91b09ca Merge branch 'main' into update-todo-md sneak 2026-02-16 09:26:01 +01:00
• 8156305705 feat: add edit support for env vars, labels, and volumes feature/edit-entities user 2026-02-16 00:25:34 -08:00
• 046cccf31f Merge pull request 'feat: deployment rollback to previous image (closes #71)' (#75) from feature/deployment-rollback into main sneak 2026-02-16 09:25:33 +01:00
• 0536f57ec2 feat: add JSON API with token auth (closes #69) user 2026-02-16 00:20:41 -08:00
• 2be6a748b7 feat: deployment rollback to previous image user 2026-02-16 00:23:11 -08:00
• e31666ab5c Merge pull request 'feat: add user-facing deployment cancel endpoint (closes #66)' (#73) from feature/deploy-cancel into main sneak 2026-02-16 09:18:59 +01:00
• c5f957477f feat: add user-facing deployment cancel endpoint user 2026-02-16 00:15:24 -08:00
• 6696db957d Update TODO.md: check off deployment cancellation clawbot 2026-02-16 09:12:08 +01:00
• ebcae55302 Merge pull request 'fix: cancel in-progress deploy when webhook triggers new deploy (closes #38)' (#52) from clawbot/upaas:fix/deploy-race-condition-38 into main sneak 2026-02-16 09:06:40 +01:00
• e2ad42f0ac Merge pull request 'Fix all golangci-lint issues (closes #32)' (#51) from clawbot/upaas:fix/lint-cleanup into main sneak 2026-02-16 09:06:09 +01:00
• a80b7ac0a6 refactor: export SanitizeTail and DefaultLogTail directly instead of wrapping user 2026-02-15 22:14:12 -08:00
• 69a5a8c298 fix: resolve all golangci-lint issues (fixes #32) clawbot 2026-02-15 22:09:59 -08:00
• 3f499163a7 fix: cancel in-progress deploy when webhook triggers new deploy (closes #38) clawbot 2026-02-15 22:12:03 -08:00
• 07ac71974c Merge pull request 'fix: set DestroySession MaxAge to -1 instead of -1*time.Second (closes #39)' (#50) from clawbot/upaas:fix/destroy-session-maxage into main sneak 2026-02-16 07:09:25 +01:00
• cdd7e3fd3a fix: set DestroySession MaxAge to -1 instead of -1*time.Second (closes #39) clawbot 2026-02-15 22:07:57 -08:00
• f596990d9d Merge pull request 'Add server-side app name validation (closes #37)' (#49) from clawbot/upaas:fix/server-side-app-name-validation into main sneak 2026-02-16 07:07:48 +01:00
• 4f1f3e2494 Merge branch 'main' into fix/server-side-app-name-validation sneak 2026-02-16 07:07:28 +01:00
• d27adc040d Add server-side app name validation (closes #37) user 2026-02-15 22:06:08 -08:00
• 9a284d40fd Merge pull request 'fix: buffer template execution to prevent corrupt HTML responses (closes #42)' (#48) from clawbot/upaas:fix/template-execution-buffering into main sneak 2026-02-16 07:05:45 +01:00
• 448879b4ef Merge branch 'main' into fix/template-execution-buffering sneak 2026-02-16 07:05:36 +01:00
• af9ffddf84 fix: buffer template execution to prevent corrupt HTML responses (closes #42) user 2026-02-15 22:04:09 -08:00
• 8194a02ac4 Merge pull request 'perf: adaptive frontend polling intervals (closes #43)' (#46) from clawbot/upaas:fix/adaptive-polling-issue-43 into main sneak 2026-02-16 07:03:47 +01:00
• c4c62c9aba Merge pull request 'fix: only trust proxy headers from RFC1918/loopback sources (closes #44)' (#47) from clawbot/upaas:fix/realip-trusted-proxy into main sneak 2026-02-16 07:03:22 +01:00
• b1a6fd5fca fix: only trust proxy headers from RFC1918/loopback sources (closes #44) clawbot 2026-02-15 22:01:54 -08:00
• 3a18221eea perf: adaptive polling intervals for frontend (closes #43) user 2026-02-15 22:00:10 -08:00
• e9bf63d18b Merge pull request 'Fix all golangci-lint issues (closes #32)' (#34) from clawbot/upaas:fix/lint-cleanup into main sneak 2026-02-16 06:57:19 +01:00
• 559bfa4131 fix: resolve all golangci-lint issues clawbot 2026-02-15 21:55:08 -08:00
• e30a7568cf Merge pull request 'fix: validate and clamp container log tail parameter (closes #24)' (#33) from clawbot/upaas:fix/validate-tail-parameter into main sneak 2026-02-16 06:51:34 +01:00
• 300de44853 fix: validate and clamp container log tail parameter (closes #24) user 2026-02-15 21:50:00 -08:00
• 297f6e64f4 Merge pull request 'fix: prevent setup endpoint race condition (closes #26)' (#31) from clawbot/upaas:fix/setup-race-condition-closes-26 into main sneak 2026-02-16 06:45:02 +01:00
• 03b0dbeb04 Merge branch 'main' into fix/setup-race-condition-closes-26 sneak 2026-02-16 06:44:40 +01:00
• e42f80814c fix: address noinlineerr lint warning user 2026-02-15 21:43:00 -08:00
• 97a5aae2f7 simplify: replace mutex + ON CONFLICT with a single DB transaction user 2026-02-15 21:41:52 -08:00
• ef271d2da9 Merge pull request 'Fix command injection in git clone arguments (closes #18)' (#29) from clawbot/upaas:fix/command-injection-git-clone into main sneak 2026-02-16 06:38:29 +01:00
• e0d74f04dc Merge pull request 'fix: validate port range 1-65535 in parsePortValues (closes #25)' (#30) from clawbot/upaas:fix/port-validation-upper-bound into main sneak 2026-02-16 06:36:44 +01:00
• 763e722607 fix: prevent setup endpoint race condition (closes #26) clawbot 2026-02-15 21:35:16 -08:00
• 35ef6c8fea fix: validate port range 1-65535 in parsePortValues (closes #25) user 2026-02-15 21:34:50 -08:00
• 7c0278439d fix: prevent command injection in git clone arguments (closes #18) clawbot 2026-02-15 21:33:02 -08:00
• 97ee1e212f Merge pull request 'Wait for final log flush before closing deploymentLogWriter (closes #4)' (#9) from clawbot/upaas:fix/issue-4 into main sneak 2026-02-16 06:29:18 +01:00
• 3e8f424129 Merge pull request 'Add rate limiting to login endpoint to prevent brute force (closes #12)' (#14) from clawbot/upaas:fix/issue-12 into main sneak 2026-02-16 06:15:48 +01:00
• ef0786c4b4 fix: extract real client IP from proxy headers (X-Real-IP / X-Forwarded-For) clawbot 2026-02-15 21:14:12 -08:00
• dcdecafc61 Merge pull request 'Add ownership verification on resource deletion (closes #19)' (#28) from clawbot/upaas:fix/ownership-verification-on-delete into main sneak 2026-02-16 06:12:52 +01:00
• 867cdf01ab fix: add ownership verification on env var, label, volume, and port deletion clawbot 2026-02-15 20:52:59 -08:00
• a1b06219e7 fix: add eviction for stale IP rate limiter entries and Retry-After header user 2026-02-15 14:18:07 -08:00
• 66661d1b1d Add rate limiting to login endpoint to prevent brute force clawbot 2026-02-15 14:04:52 -08:00
• 6475389280 test: add IDOR tests for resource deletion ownership verification clawbot 2026-02-15 20:52:19 -08:00
• 3a2bd0e51d Merge pull request 'Set Secure flag on session cookie in production mode (closes #5)' (#10) from clawbot/upaas:fix/issue-5 into main sneak 2026-02-16 05:58:22 +01:00
• 79a3165f90 Merge pull request 'Clean up Docker container when deleting an app (closes #2)' (#7) from clawbot/upaas:fix/issue-2 into main sneak 2026-02-16 05:56:56 +01:00
• 86491b1367 Merge pull request 'Limit webhook request body size to 1MB to prevent DoS (closes #1)' (#6) from clawbot/upaas:fix/issue-1 into main sneak 2026-02-16 05:56:14 +01:00
• 98b8403e8b Merge branch 'main' into fix/issue-1 sneak 2026-02-16 05:56:06 +01:00
• 076442923c Merge pull request 'Use hashed webhook secrets for constant-time comparison (closes #13)' (#15) from clawbot/upaas:fix/issue-13 into main sneak 2026-02-16 05:55:46 +01:00
• 57ea724419 Merge branch 'main' into fix/issue-13 sneak 2026-02-16 05:55:17 +01:00