Clintchiz and Claude Opus 5
c64434a131
fix(security): close SSRF, credential-leak, and auth bypass findings in 0.8.4
...
Audit of 0.8.4 found the repo's own gates green, so these came from manual
review; each is covered by a new regression test.
security/fetch.ts
- safeFetch re-attached Authorization/Cookie on a same-origin redirect that
followed a cross-origin hop (a -> b -> b), handing credentials to the second
host. Compare against the origin the caller trusted, not the previous hop.
- The private-network guard resolved the host, approved it, then let fetch
resolve again, so a low-TTL record could answer public for the check and
private for the connection. Pin the connection to the validated address,
preserving Host and TLS serverName. Opt out with pinDns: false.
- 0:0:0:0:0:ffff:127.0.0.1, ::ffff:7f00:1 and fec0::1 were not treated as
private. Add uncompressed IPv4-mapped forms, site-local IPv6, 198.18/15
and 192.0.0/24.
security/url.ts
- sanitizeUrl returned "//evil.com" verbatim via the relative-path fast path,
bypassing the host checks it had just run; in an href that navigates
cross-origin. Resolve protocol-relative input instead.
dev-server/gateway.ts
- Malformed base64 in an Authorization header threw out of checkAuth on an
unauthenticated path. Fail closed.
- split(":", 2) truncated passwords at the first colon, so a password
containing ":" could never authenticate.
- The credential compare short-circuited on length mismatch, leaking length
by timing. Extracted as verifyBasicAuth so it is testable.
authz/index.ts
- Namespace wildcards only matched the first segment, so "post:comment:*"
did not grant "post:comment:delete". Match at every depth.
uploader/operations.ts
- Validate transcoder dimensions and bitrate rather than trusting the declared
type, and reject ".." path segments.
package.json
- The brace-expansion override pinned 5.0.8, which is inside the advisory
range >=4.0.0 <5.0.9. Bump to 5.0.9; bun audit is now clean.
Verified: check:production passes (typecheck, lint, 1033 tests, format,
ASVS, public-API baseline, editor checks).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com >
2026-08-04 15:57:22 +05:30
Clintchiz
72e4d3eceb
release: WRNexusJS 0.8.0
Quality / quality (ubuntu-latest) (push) Failing after 12m19s
Quality / quality (windows-latest) (push) Canceled after 0s
2026-08-04 12:19:09 +05:30
Clintchiz
4cebacadfe
release: WRNexusJS 0.8.3
Quality / quality (ubuntu-latest) (push) Failing after 12m9s
Quality / quality (windows-latest) (push) Canceled after 0s
2026-08-03 19:47:30 +05:30
Clintchiz
e8f630f12d
fix: format generated docs before release verification
Quality / quality (ubuntu-latest) (push) Failing after 21s
Quality / quality (windows-latest) (push) Canceled after 0s
2026-08-03 02:32:11 +05:30
Clintchiz
4550a11460
release: WRNexusJS 0.8.2
Quality / quality (ubuntu-latest) (push) Failing after 22s
Quality / quality (windows-latest) (push) Canceled after 0s
2026-08-03 02:14:54 +05:30
Clintchiz
3c6b659f36
release: WRNexusJS 0.8.1
Quality / quality (ubuntu-latest) (push) Failing after 13m28s
Quality / quality (windows-latest) (push) Canceled after 0s
2026-08-03 01:34:56 +05:30
Clintchiz
1a1d2e9d08
perf: accelerate production request hot paths
Quality / quality (ubuntu-latest) (push) Failing after 12m23s
Quality / quality (windows-latest) (push) Canceled after 0s
2026-08-03 01:08:43 +05:30
Clintchiz
fed1d5d3f4
perf: omit unused UI CSS and minify final bundles
Quality / quality (ubuntu-latest) (push) Failing after 22s
Quality / quality (windows-latest) (push) Canceled after 0s
2026-08-03 01:03:33 +05:30
Clintchiz
b61020babd
fix: update PWA workers without reloading pages
Quality / quality (ubuntu-latest) (push) Failing after 12m52s
Quality / quality (windows-latest) (push) Canceled after 0s
2026-08-03 00:54:29 +05:30
Clintchiz
379f80cbd0
fix: force PWA worker updates
Quality / quality (ubuntu-latest) (push) Failing after 12m26s
Quality / quality (windows-latest) (push) Canceled after 0s
2026-08-03 00:46:52 +05:30
Clintchiz
649e3d9127
fix: constrain PWA caching and extend font CSP
Quality / quality (ubuntu-latest) (push) Failing after 22s
Quality / quality (windows-latest) (push) Canceled after 0s
2026-08-03 00:38:23 +05:30
Clintchiz
b3e9b99e13
fix: harden generated identifiers and types
Quality / quality (ubuntu-latest) (push) Failing after 12m50s
Quality / quality (windows-latest) (push) Canceled after 0s
2026-08-03 00:02:37 +05:30
Clintchiz
586a6db8ff
release: WRNexusJS 0.8.0
Quality / quality (ubuntu-latest) (push) Failing after 21s
Quality / quality (windows-latest) (push) Canceled after 0s
2026-08-02 23:18:51 +05:30
Clintchiz
87507edf59
release: WRNexusJS 0.7.0
2026-08-01 10:04:42 +05:30
Clintchiz
c54144f2e4
fix(release): format generated UI references before verification
2026-08-01 07:14:45 +05:30
Clintchiz
2b06b00d35
fix(release): format generated UI references before verification
2026-08-01 07:14:16 +05:30
Clintchiz
28d931dfff
docs(ui): refresh component reference
2026-08-01 07:11:54 +05:30
Clintchiz
e2f7bea299
fix(release): stabilize generated UI references
2026-08-01 07:02:22 +05:30
Clintchiz
d5e834bc78
release: WRNexusJS 0.6.0
2026-08-01 06:50:37 +05:30
Clintchiz
687d345882
release: WRNexusJS 0.6.0
2026-08-01 01:09:58 +05:30
Clintchiz
3e565e8d03
Pre Release New Changes
2026-07-31 16:30:13 +05:30
Clintchiz
358a520bc5
release: WRNexusJS 0.5.14
2026-07-30 21:29:25 +05:30
Clintchiz
9dffe83f32
release: WRNexusJS 0.5.13
2026-07-30 20:46:47 +05:30
Clintchiz
d64e899993
release: WRNexusJS 0.5.12
2026-07-30 18:59:01 +05:30
Clintchiz
f37303b22d
release: WRNexusJS 0.5.11
2026-07-30 15:03:52 +05:30
Clintchiz
d1b0c55b53
release: WRNexusJS 0.5.10
2026-07-30 13:36:29 +05:30
Clintchiz
8fc6f15402
feat(wrn): support native structured prop expressions
2026-07-29 16:46:18 +05:30
Clintchiz
6afe32f63f
release: WRNexusJS 0.5.0
2026-07-29 12:51:10 +05:30
Clintchiz
76c768099d
release: WRNexusJS 0.4.0
2026-07-27 12:54:43 +05:30
Clintchiz
30e5721e84
release: WRNexusJS 0.4.0
2026-07-27 12:42:18 +05:30
Clintchiz
8b728a3e5d
New Captcha Package added
2026-07-25 13:38:18 +05:30
Clintchiz
d0aded0392
release: WRNexusJS 0.3.6
2026-07-24 15:30:48 +05:30
Clintchiz
c81dedff17
release: WRNexusJS 0.3.5
2026-07-24 12:46:44 +05:30
Clintchiz
44ba847210
release: WRNexusJS 0.3.4
2026-07-22 21:48:39 +05:30
Clintchiz
798f06d4c0
release: WRNexusJS 0.3.4
2026-07-22 21:44:57 +05:30
Clintchiz
173e230d7f
release: WRNexusJS 0.3.4
2026-07-22 21:40:38 +05:30
Clintchiz
bbec4cc7bb
docs(ui): refresh component reference
2026-07-22 21:38:20 +05:30
Clintchiz
504bd4358f
release: WRNexusJS 0.3.4
2026-07-22 21:37:23 +05:30
Clintchiz
e543fd026d
release: WRNexusJS 0.3.4
2026-07-22 21:30:37 +05:30
Clintchiz
d51662826d
release: WRNexusJS 0.3.4
2026-07-22 21:25:53 +05:30
Clintchiz
e2d9ea1ece
release: WRNexusJS 0.3.3
2026-07-22 20:37:59 +05:30
Clintchiz
58ba2f2046
release: WRNexusJS 0.3.2
2026-07-22 20:10:44 +05:30
Clintchiz
304819dfe9
release: WRNexusJS 0.3.1
2026-07-22 18:42:20 +05:30
Clintchiz
07d8fb59d6
release: WRNexusJS 0.3.0
2026-07-22 17:29:08 +05:30
Clintchiz
13dfa31d19
release: WRNexusJS 0.2.79
2026-07-22 12:56:07 +05:30
Clintchiz
c6fc0f1f63
release: WRNexusJS 0.2.78
2026-07-22 01:53:18 +05:30
Clintchiz
7ff5b3e8c5
release: WRNexusJS 0.2.77
2026-07-22 01:26:10 +05:30
Clintchiz
569365143b
release: WRNexusJS 0.2.76
2026-07-21 13:09:09 +05:30
Clintchiz
69b6cd431f
release: WRNexusJS 0.2.75
2026-07-21 12:30:46 +05:30
Clintchiz
2ca2d02b22
feat: support WRN imports and dynamic public shell
2026-07-21 11:15:06 +05:30
Clintchiz
0013c0771d
chore(release): prepare WRNexusJS 0.2.73
2026-07-20 16:34:20 +05:30
Clintchiz
0b8856b3b5
chore(release): prepare WRNexusJS 0.2.72
2026-07-20 16:15:03 +05:30
Clintchiz
45e6fd3cb9
fix(dev-server): invalidate WRN cache by content
2026-07-20 16:07:38 +05:30
Clintchiz
54f5309fca
fix(ui): render polished SSR-safe component variants
2026-07-20 15:55:38 +05:30
Clintchiz
944f83d3f4
fix: use public origins for SSO redirects
2026-07-20 15:04:20 +05:30
Clintchiz
a75779fa4d
fix: pin production runtime in applications
2026-07-20 14:45:56 +05:30
Clintchiz
2b4083c6db
fix: surface app errors in gateway logs
2026-07-20 14:26:27 +05:30
Clintchiz
aa2595ec01
fix: log production request failures
2026-07-20 13:48:47 +05:30
Clintchiz
b3e5e5b999
feat: configure workspace environment runtimes
2026-07-20 09:22:26 +05:30
Clintchiz
3888453e0d
build: stage private packages for 0.2.66
2026-07-20 00:10:16 +05:30
Clintchiz
b95bdc6e77
release: prepare WRNexusJS 0.2.66
2026-07-20 00:10:04 +05:30
Clintchiz
1745d8d676
feat: add reusable public chrome and named environments
2026-07-20 00:03:35 +05:30
Clintchiz
f72aec7c8c
feat(ui): add professional visual fallbacks
2026-07-19 23:09:56 +05:30
Clintchiz
33730c68ab
fix(gateway): keep production app ports private
2026-07-19 22:24:28 +05:30
Clintchiz
5ce45b4973
feat(cli): add production workspace command
2026-07-19 21:57:55 +05:30
Clintchiz
dcdb5e766d
fix(ui): polish linked catalog cards
2026-07-19 21:29:25 +05:30
Clintchiz
a3e21163c1
feat(ui): expose app theme contract and public components
2026-07-19 20:23:20 +05:30
Clintchiz
c5326f7622
fix: normalize component boundary spacing
2026-07-19 20:08:14 +05:30
Clintchiz
eaea2c5f72
fix: keep page shells transparent
2026-07-19 19:52:14 +05:30
Clintchiz
ca8f746f41
chore: ignore packaged VS Code extensions
2026-07-19 18:58:31 +05:30
Clintchiz
94ae40d8bd
feat: add typed WRN declarations
2026-07-19 18:44:27 +05:30
Clintchiz
0d3ec79ee4
release: complete UI component catalog 0.2.58
2026-07-19 18:14:06 +05:30
Clintchiz
c0c09426ff
release: WRNexusJS 0.2.57
2026-07-19 17:45:13 +05:30
Clintchiz
14e2878417
fix: tolerate autocrlf publish staging
2026-07-19 17:29:03 +05:30
Clintchiz
180239ef4c
release: WRNexusJS 0.2.56
2026-07-19 17:25:37 +05:30
Clintchiz
12beb6f4ba
release: WRNexusJS 0.2.55
2026-07-19 17:14:12 +05:30
Clintchiz
6dbc75c370
release: WRNexusJS 0.2.54
2026-07-19 15:51:27 +05:30
Clintchiz
7cee13526e
release: WRNexusJS 0.2.53
2026-07-19 14:40:06 +05:30
Clintchiz
3bb096057e
release: WRNexusJS 0.2.52
2026-07-19 14:23:10 +05:30
Clintchiz
646d16f83d
fix(vscode): repair WRN language diagnostics and activation
2026-07-19 14:02:17 +05:30
Clintchiz
df4c1d3e7d
release: WRNexusJS 0.2.51
2026-07-19 13:38:23 +05:30
Clintchiz
17dc7c1a06
release: WRNexusJS 0.2.50
2026-07-19 13:08:49 +05:30
Clintchiz
c72cbbd780
release: WRNexusJS 0.2.49
2026-07-19 12:29:13 +05:30
Clintchiz
1cda2a01b3
release: WRNexusJS 0.2.49
2026-07-19 12:03:49 +05:30
Clintchiz
9ca1cc6b0f
release: WRNexusJS 0.2.49
2026-07-18 19:33:57 +05:30
Clintchiz
aa6badbd31
release: WRNexusJS 0.2.48
2026-07-18 19:11:00 +05:30
Clintchiz
4a3ee3baa7
release: WRNexusJS 0.2.48
2026-07-18 19:07:23 +05:30
Clintchiz
95ca1c0625
New UI Components
2026-07-18 16:00:13 +05:30
Clintchiz
d22824fa62
release: WRNexusJS 0.2.47
2026-07-18 13:12:16 +05:30
Clintchiz
973d580bc5
release: WRNexusJS 0.2.46
2026-07-15 20:09:47 +05:30
Clintchiz
8a8328a308
release: WRNexusJS 0.2.44
2026-07-15 19:41:42 +05:30
Clintchiz
0f915c3c98
release: WRNexusJS 0.2.44
2026-07-15 18:54:29 +05:30
Clintchiz
9aa13fb4db
release: WRNexusJS 0.2.43
2026-07-15 18:41:55 +05:30
Clintchiz
9070a1ef9c
release: WRNexusJS 0.2.42
2026-07-15 18:15:22 +05:30
Clintchiz
4230de7065
release: WRNexusJS 0.2.41
2026-07-15 14:52:56 +05:30
Clintchiz
0006aef2c4
release: WRNexusJS 0.2.40
2026-07-15 14:02:27 +05:30
Clintchiz
7dfca4a190
release: WRNexusJS 0.2.40
2026-07-15 13:42:18 +05:30
Clintchiz
29bbeefe92
release: WRNexusJS 0.2.39
2026-07-15 13:22:20 +05:30
Clintchiz
98445c2ec7
release: WRNexusJS 0.2.38
2026-07-15 10:26:24 +05:30
Clintchiz
17a535d4dc
release: WRNexusJS 0.2.36
2026-07-15 10:04:14 +05:30
ClintchizandClaude Opus 5