-
Enforce the per-item license-key cap atomically under an item-row lock
-
Scope discover tag-count and follow-membership lookups to the rendered tags
-
Bound scan CPU layers + advertise-refs by wall clock; scope project purchase lookup
-
Enforce git disk quota on the HTTP push path; validate internal repo_name
-
Add copy_object and content-addressed key foundations for scan-then-promote
-
Treat ClamAV as a full-file scan backstop only up to declared coverage
-
Fix OTA quarantine deleting from the wrong S3 bucket
-
server: set wizard upload error text via textContent, not innerHTML
-
server: correct enum VARIANTS doc to match drift-test coverage
-
server: cap buffered scan download to recorded size + slack
-
server: drain scheduler + bg pool concurrently within one shutdown budget
-
server: trace custom-page CSS rejections; fix scheduler lock-id comment
-
server: surface export_projects serialize failure as 500
-
server: badge library purchases Free by amount paid, not current price
-
server: attach per-IP rate limit to guest download route
-
server: type-gate CDN cover behind visible_cover_url + build seal
-
server: clear clippy gate (from_db_str rename, create_item allow)
-
server: non-blocking per-event webhook lock (try_lock_event)
-
server: guard concurrent-index migration hygiene
-
server: add cargo-deny supply-chain gate
-
server: bump plist to clear quick-xml RUSTSEC-2026-0194/0195
-
perf(search): index-serve the fuzzy title branch; add request timeout
-
Remediate audit findings: SSRF userinfo bypass, guest role, C1 scope gaps
-
Remediate audit Run 22 fix-first findings; bump to 0.10.8
-
wam: replace priority enum with computed painhours score
-
Remediate audit Run 21 findings across server
-
observability: scan verdict, duration, and queue-depth metrics (audit Run 20 Phase 8)
-
perf: cap project-metadata export and break zip walk early (audit Run 20 Phase 7)
-
frontend: fix CSP-dead modal close buttons, consolidate escapeHtml (audit Run 20 Phase 6)
-
cleanups: drop the last db .expect, fix csrf phantom race comment, instrument custom-page write (audit Run 20 Phase 5)