Commit graph

15 commits

Author SHA1 Message Date
rcourtman
640c414c0c Upgrade frontend ESLint security dependencies 2026-03-26 20:54:42 +00:00
rcourtman
14a149c369 Upgrade frontend lint and test dependencies 2026-03-26 20:33:59 +00:00
rcourtman
64f3bfa922 Bump dompurify to 3.3.2 to fix XSS vulnerability (Dependabot #64)
DOMPurify 3.1.3–3.3.1 has an XSS vulnerability via missing rawtext
element sanitization. Bump to 3.3.2 which includes the fix.
2026-03-07 10:46:12 +00:00
rcourtman
347a2572da chore: upgrade eslint to v9 to fix security vulnerability
- Updates eslint to v9.20.0 to resolve Dependabot alert #50
- Migrates config to flat format (eslint.config.js)
- Updates typescript-eslint and eslint-plugin-solid
- Fixes lint error in UnifiedBackups.tsx
2026-02-02 14:17:53 +00:00
rcourtman
ccc32083ba security: fix seroval vulnerabilities (CVE-2025-*)
Override seroval to ^1.4.1 to fix 8 high-severity vulnerabilities:
- Remote Code Execution via JSON Deserialization
- Prototype Pollution via JSON Deserialization
- Denial of Service via Array/RegExp serialization

seroval is a transitive dependency from solid-js which pins ~1.3.0.
2026-01-21 19:38:29 +00:00
rcourtman
3eedbff6e6 fix(storage): correct column priority types and setup pre-push hook
- Fix Storage.tsx using number priorities instead of string literals
- Move husky configuration to repository root for proper git hook support
- Add package.json/lock.json to root (un-ignore in .gitignore)
- Configure pre-push hook to run type-check before push
2025-12-26 12:21:37 +00:00
rcourtman
4d03319566 ci: add pre-push hook to prevent TypeScript CI failures
Adds husky with a pre-push hook that runs type-check before allowing
pushes. This catches the TypeScript errors locally that were causing
repeated CI failures and email spam.

Skip with: git push --no-verify
2025-12-26 11:37:37 +00:00
rcourtman
67bde72c93 Improve test coverage 2025-12-17 12:00:59 +00:00
rcourtman
8b077f69ce feat: AI security and policy improvements for 5.0
- Add DOMPurify sanitization for AI chat markdown rendering (XSS fix)
- Configure DOMPurify to add target=_blank and rel=noopener to links
- Update system prompt to align with command approval policy
- Clarify safe vs destructive commands in prompt
- Improve patrol auto-fix mode guidance with safe operation list
- Add verification requirements for auto-fix actions
- Update observe-only mode to be clearer about read-only restrictions
2025-12-12 17:38:55 +00:00
rcourtman
53d7776d6b wip: AI chat integration with multi-provider support
- Add AI service with Anthropic, OpenAI, and Ollama providers
- Add AI chat UI component with streaming responses
- Add AI settings page for configuration
- Add agent exec framework for command execution
- Add API endpoints for AI chat and configuration
2025-12-04 20:16:53 +00:00
rcourtman
6eb1a10d9b Refactor: Code cleanup and localStorage consolidation
This commit includes comprehensive codebase cleanup and refactoring:

## Code Cleanup
- Remove dead TypeScript code (types/monitoring.ts - 194 lines duplicate)
- Remove unused Go functions (GetClusterNodes, MigratePassword, GetClusterHealthInfo)
- Clean up commented-out code blocks across multiple files
- Remove unused TypeScript exports (helpTextClass, private tag color helpers)
- Delete obsolete test files and components

## localStorage Consolidation
- Centralize all storage keys into STORAGE_KEYS constant
- Update 5 files to use centralized keys:
  * utils/apiClient.ts (AUTH, LEGACY_TOKEN)
  * components/Dashboard/Dashboard.tsx (GUEST_METADATA)
  * components/Docker/DockerHosts.tsx (DOCKER_METADATA)
  * App.tsx (PLATFORMS_SEEN)
  * stores/updates.ts (UPDATES)
- Benefits: Single source of truth, prevents typos, better maintainability

## Previous Work Committed
- Docker monitoring improvements and disk metrics
- Security enhancements and setup fixes
- API refactoring and cleanup
- Documentation updates
- Build system improvements

## Testing
- All frontend tests pass (29 tests)
- All Go tests pass (15 packages)
- Production build successful
- Zero breaking changes

Total: 186 files changed, 5825 insertions(+), 11602 deletions(-)
2025-11-04 21:50:46 +00:00
rcourtman
acedd18c07 fix: upgrade vite to 6.4.1 to resolve CVE-2025-62522
Fixes Dependabot alert #33 - path traversal vulnerability in vite's
server.fs.deny when using backslash on Windows. Upgraded from 6.3.5 to 6.4.1.
2025-10-21 12:41:08 +00:00
rcourtman
bfd5eb79ce fix: upgrade vitest to 3.2.4 2025-10-16 14:43:36 +00:00
rcourtman
4838793677 feat: enhance alerts system with tests and improved thresholds
- Add comprehensive test coverage for alerts package with 285+ new tests
- Implement ThresholdsTable component with metric thresholds display
- Enhance Alerts page UI with improved layout and metric filtering
- Add frontend component tests for Alerts page and ThresholdsTable
- Set up Vitest testing infrastructure for SolidJS components
- Improve config persistence with better validation
- Expand discovery tests with 333+ test cases
- Update API, configuration, and Docker monitoring documentation
2025-10-15 22:25:04 +00:00
rcourtman
f46ff1792b Fix settings security tab navigation 2025-10-11 23:29:47 +00:00