Commit graph

22 commits

Author SHA1 Message Date
rcourtman
640c414c0c Upgrade frontend ESLint security dependencies 2026-03-26 20:54:42 +00:00
rcourtman
14a149c369 Upgrade frontend lint and test dependencies 2026-03-26 20:33:59 +00:00
rcourtman
cb011f7f14 Fix dependency security vulnerabilities
Some checks are pending
Build and Test / Secret Scan (push) Waiting to run
Build and Test / Frontend & Backend (push) Waiting to run
Core E2E Tests / Playwright Core E2E (push) Waiting to run
2026-03-26 11:57:26 +00:00
rcourtman
64f3bfa922 Bump dompurify to 3.3.2 to fix XSS vulnerability (Dependabot #64)
DOMPurify 3.1.3–3.3.1 has an XSS vulnerability via missing rawtext
element sanitization. Bump to 3.3.2 which includes the fix.
2026-03-07 10:46:12 +00:00
rcourtman
768b6d8b7a fix(frontend): resolve npm audit advisories in lockfile 2026-03-02 23:59:34 +00:00
rcourtman
df0d90fb69 Fix: regenerate package-lock.json for ESLint v9 upgrade 2026-02-02 23:25:21 +00:00
rcourtman
0aa6e94b39 feat(ui): inline guest drawer on row click
- Add onClick handler to GuestRow component
- Toggle GuestDrawer inline below clicked row
- Show metrics history charts within the drawer
- Click row again or close button to collapse
2026-01-22 00:43:10 +00:00
rcourtman
ccc32083ba security: fix seroval vulnerabilities (CVE-2025-*)
Override seroval to ^1.4.1 to fix 8 high-severity vulnerabilities:
- Remote Code Execution via JSON Deserialization
- Prototype Pollution via JSON Deserialization
- Denial of Service via Array/RegExp serialization

seroval is a transitive dependency from solid-js which pins ~1.3.0.
2026-01-21 19:38:29 +00:00
rcourtman
73c5128a87 feat(audit): Add audit log API endpoints and UI with signature verification
- Add GET /api/audit endpoint for listing events with filters
- Add GET /api/audit/:id/verify endpoint for signature verification
- Add AuditLogPanel UI component with filtering and verification
- Update docs with audit API documentation
- Add localStorage utils for persisting UI state
- Update gitignore patterns
2026-01-08 19:19:57 +00:00
rcourtman
cb99673b7c Improve devcontainer configuration
- Simplify Dockerfile: use golang:1.24 base, install Node via features
- Add proper port forwarding for Pulse (7655 frontend, 7656 API)
- Add Vue Volar extension for frontend development
- Add start-pulse-dev.sh helper script for auto-starting dev server
- Add FRONTEND_DEV_HOST to containerEnv for proper binding
- Add .env.devcontainer to .gitignore (local override file)
- Update frontend dependencies

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-01 19:42:01 +00:00
rcourtman
3eedbff6e6 fix(storage): correct column priority types and setup pre-push hook
- Fix Storage.tsx using number priorities instead of string literals
- Move husky configuration to repository root for proper git hook support
- Add package.json/lock.json to root (un-ignore in .gitignore)
- Configure pre-push hook to run type-check before push
2025-12-26 12:21:37 +00:00
rcourtman
4d03319566 ci: add pre-push hook to prevent TypeScript CI failures
Adds husky with a pre-push hook that runs type-check before allowing
pushes. This catches the TypeScript errors locally that were causing
repeated CI failures and email spam.

Skip with: git push --no-verify
2025-12-26 11:37:37 +00:00
rcourtman
67bde72c93 Improve test coverage 2025-12-17 12:00:59 +00:00
rcourtman
2fce9d2e1e chore: update lockfiles 2025-12-13 21:30:57 +00:00
rcourtman
8b077f69ce feat: AI security and policy improvements for 5.0
- Add DOMPurify sanitization for AI chat markdown rendering (XSS fix)
- Configure DOMPurify to add target=_blank and rel=noopener to links
- Update system prompt to align with command approval policy
- Clarify safe vs destructive commands in prompt
- Improve patrol auto-fix mode guidance with safe operation list
- Add verification requirements for auto-fix actions
- Update observe-only mode to be clearer about read-only restrictions
2025-12-12 17:38:55 +00:00
rcourtman
53d7776d6b wip: AI chat integration with multi-provider support
- Add AI service with Anthropic, OpenAI, and Ollama providers
- Add AI chat UI component with streaming responses
- Add AI settings page for configuration
- Add agent exec framework for command execution
- Add API endpoints for AI chat and configuration
2025-12-04 20:16:53 +00:00
rcourtman
51744d22c8 fix: update js-yaml to address CVE-2025-64718 prototype pollution vulnerability 2025-11-18 22:50:07 +00:00
rcourtman
6eb1a10d9b Refactor: Code cleanup and localStorage consolidation
This commit includes comprehensive codebase cleanup and refactoring:

## Code Cleanup
- Remove dead TypeScript code (types/monitoring.ts - 194 lines duplicate)
- Remove unused Go functions (GetClusterNodes, MigratePassword, GetClusterHealthInfo)
- Clean up commented-out code blocks across multiple files
- Remove unused TypeScript exports (helpTextClass, private tag color helpers)
- Delete obsolete test files and components

## localStorage Consolidation
- Centralize all storage keys into STORAGE_KEYS constant
- Update 5 files to use centralized keys:
  * utils/apiClient.ts (AUTH, LEGACY_TOKEN)
  * components/Dashboard/Dashboard.tsx (GUEST_METADATA)
  * components/Docker/DockerHosts.tsx (DOCKER_METADATA)
  * App.tsx (PLATFORMS_SEEN)
  * stores/updates.ts (UPDATES)
- Benefits: Single source of truth, prevents typos, better maintainability

## Previous Work Committed
- Docker monitoring improvements and disk metrics
- Security enhancements and setup fixes
- API refactoring and cleanup
- Documentation updates
- Build system improvements

## Testing
- All frontend tests pass (29 tests)
- All Go tests pass (15 packages)
- Production build successful
- Zero breaking changes

Total: 186 files changed, 5825 insertions(+), 11602 deletions(-)
2025-11-04 21:50:46 +00:00
rcourtman
acedd18c07 fix: upgrade vite to 6.4.1 to resolve CVE-2025-62522
Fixes Dependabot alert #33 - path traversal vulnerability in vite's
server.fs.deny when using backslash on Windows. Upgraded from 6.3.5 to 6.4.1.
2025-10-21 12:41:08 +00:00
rcourtman
bfd5eb79ce fix: upgrade vitest to 3.2.4 2025-10-16 14:43:36 +00:00
rcourtman
4838793677 feat: enhance alerts system with tests and improved thresholds
- Add comprehensive test coverage for alerts package with 285+ new tests
- Implement ThresholdsTable component with metric thresholds display
- Enhance Alerts page UI with improved layout and metric filtering
- Add frontend component tests for Alerts page and ThresholdsTable
- Set up Vitest testing infrastructure for SolidJS components
- Improve config persistence with better validation
- Expand discovery tests with 333+ test cases
- Update API, configuration, and Docker monitoring documentation
2025-10-15 22:25:04 +00:00
rcourtman
f46ff1792b Fix settings security tab navigation 2025-10-11 23:29:47 +00:00