Pin build inputs and fix admin detail and download handling - #17
Conversation
Keep the tested Python dependency versions in a universal SHA-256 lock, with requirements.in as the direct input list. Require verified binary wheels in local guidance, CI and runtime images, and pin the Dockerfile frontend plus Node/Python multi-platform image digests. Document reviewed refreshes and fail-closed installation. Verified a fresh Python 3.12 install, dependency compatibility, 49 runtime endpoint tests, 3 lock contracts, offline deployment/documentation checks and byte-identical lock regeneration.
Pin react-router 7.18.2 to cover the reported RSC redirect vulnerability and subsequent 7.x security advisories without adopting version 8 or changing other dependencies. The application remains a declarative BrowserRouter SPA. Verified the installed version, format/lint/type checks, 28 frontend tests, the production build, and an unmuted package audit with zero advisories.
Abort pending detail loads on close, replacement, log-kind changes and unmount. Guard success, error and finalization updates against the active request so old responses cannot reopen a drawer, replace newer details or clear newer loading state. Preserve current-request errors and reset loading when closing. Verified six deferred-response component regressions plus format/lint/type checks; synchronized the WebUI guides.
Prefer decoded UTF-8 filename* over legacy Content-Disposition names, including optional language tags and quoted parameters. Reject ambiguous, malformed or unsafe names and keep the existing single-file/ZIP fallbacks. Preserve plaintext export confirmation. Verified 40 filename/import unit cases, format/lint/type checks and the credential browser flow with both ASCII and Unicode attachment names; synchronized the WebUI guides.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Keep the colon-containing wheel policy inside a YAML string so both dependency installation steps are executable. Add a workflow parsing regression that verifies the exact shell arguments for both jobs. All four build-lock tests pass; the batch full suite was not repeated.
|
@codex review Please review the current head 6a67eb5. It includes the dependency/image locks, the patched React Router 7.x release for issue #16, log-detail cancellation, and safe UTF-8 attachment names. The latest commit quotes the colon-containing pip flags in the workflow and adds YAML parsing plus exact install-argument regressions. Local verification: one Python full-suite run (674 tests and 2423 subtests), four targeted build-lock tests after the workflow correction, 70 frontend tests, format/lint/type checks, production build, both browser flows, and an unmuted dependency audit with zero advisories. The PR remains open pending current-head CI, independent CodeQL verification and review completion. |
|
Codex Review: Didn't find any major issues. Breezy! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
1 participant
Summary
BrowserRouterSPA, not an unstable RSC application.filename*attachment names, retain legacyfilenamesupport, and use safe single-file/ZIP defaults for invalid names. Keep plaintext export confirmation.Closes #16.
Verification
vp pm audit --json: 0 advisories, no muted advisories. React Router 7.18.2 covers the follow-up fixes required by GHSA-qwww-vcr4-c8h2, not only CVE-2026-33245.Merge only after the current head's test/web/image CI, independent CodeQL analysis/alert verification, and Codex review have completed and any feedback is handled.