-
Require CDN_BASE_URL everywhere so no cover URL can expire
-
Lower the browser upload cap to 2 GiB
-
server: adopt lint block, fix clippy, fmt
-
Bump the tower/axum middleware cluster (server, kberg)
-
Format the tree with rustfmt and add the lint + supply-chain gates
-
server: add multipart upload session endpoints for the CLI
-
Decompose AppState Phase 2: migrate storage to slices
-
Group Config and AppState into cohesive sub-structs
-
server: split public image content into a separate CDN bucket (S1)
-
Scan-then-promote uploads to immutable content keys (C1)
-
Remediate audit Run 21 findings across server
-
audit Run 15 Phase 3: storage fail-open fixes
-
Type the S3 bucket noun and harden multipart/delete (ultra-fuzz Run 11 Storage)
-
Stop cover-image replace from taking published tracks offline
-
server: Tier 0 creator theming + fold in Run 18 storage work
-
server: fold in outstanding working-tree changes
-
server: gallery/carousel, promo-validator, fuzz #11/#12 remediations, embed port, observability
-
launch-eve audit pass: Ultra Fuzz Runs #8-9 + cross-cutting sweeps
-
server: replace global CSRF allowlist with per-route posture helpers
-
server: rewrite scan pipeline (async + dashboard + 5 new layers)
-
Run 27 carry-over: 6 SERIOUS + 6 MEDIUM remediated
-
Ultra Fuzz Run 27: 32 of 33 audit items remediated
-
Convert .map_err Internal(anyhow!) to ResultExt::context, fix variant misuse