2026-05-11 - 2026-05-14
Overview
30 Pull requests merged by 1 user
Merged
#568 fix(ci): run svelte-kit sync before lint to fix cache-hit tsconfig miss
Merged
#565 ci: restrict push trigger to main — eliminate duplicate CI runs
Merged
#564 fix(ci): run client coverage even when server coverage fails
Merged
#563 fix(tests): use native element clicks in layout dropdown spec
Merged
#561 fix(ci): add IMPORT_HOST_DIR stub to compose-idempotency job
Merged
#558 ci(devops): downgrade upload-artifact v4 → v3 + ADR-014 + grep guard
Merged
#559 chore(coverage): drop client branches threshold 80→75 to unblock CI
Merged
#555 fix(#553): close [birpc] rpc is closed race — sync-factory invariant + duplicate-ID guard + PR #10267 backport
Merged
#552 fix(notification): replace view-all anchor with button to prevent iframe navigation
Merged
#550 fix(pdf-viewer): eliminate real pdfjs-dist loading from browser tests — stop birpc teardown race
Merged
#549 fix(pdf-viewer): remove banned vi.mock('pdfjs-dist') — ADR 012 enforcement (issue #546)
Merged
#548 fix(test): NotificationDropdown iframe navigation crash + Tailwind CI noise
Merged
#547 test: fix flaky browser-mode tests in AnnotationShape and OcrTrainingCard specs
Merged
#536 fix(#535): eliminate vi.mock(pdfjs-dist) birpc teardown race via libLoader injection
Merged
#544 fix(ci): replace iproute2 ip with /proc/net/route for gateway detection
Merged
#540 fix(ci): resolve smoke test host via bridge gateway, not 127.0.0.1
Merged
#537 ci(nightly): reload Caddy before smoke test
Merged
#505 test(coverage): drive browser tests to 80% on all metrics (#496)
Merged
#526 feat(infra): bind-mount /import for backend mass-import endpoint
Merged
#525 fix(infra): frontend healthcheck on 127.0.0.1, not localhost
Merged
#521 fix(security): promote auth_token cookie to Authorization header (#520)
Merged
#519 fix(user): findOrCreate Administrators group instead of blind-INSERT (#518)
Merged
#517 fix(caddy): wrap actuator block in handle so it takes precedence over catch-all (#512)
Merged
#516 fix(user): rename yaml key username→email so admin seed reads APP_ADMIN_USERNAME (#513)
Merged
#515 fix(frontend): disable prerender crawl so protected routes aren't baked to login-bounces (#514)
Merged
#511 fix(compose): mark create-buckets as one-shot for up --wait (#510)
Merged
#509 fix(workflows): match runner label — runs-on ubuntu-latest (#508)
Merged
#507 fix(minio): bake bootstrap.sh into image instead of bind-mounting (#506)
Merged
#504 fix(fail2ban): pin polling backend so jail actually reads Caddy access log (#503)
Merged
#499 feat(infra): production deployment pipeline — Caddy, staging, Gitea Actions (#497)
2 Pull requests proposed by 1 user
Proposed
#567 fix(admin): clear unsaved-changes guard before redirect on groups/new and users/new
Proposed
#569 ui(admin/system): improve mass-import card (loading state, i18n, font size)
22 Issues closed from 1 user
Closed
#531 ci(nightly): post-deploy smoke test for /api/admin/import-status
Closed
#557 ci(devops): downgrade actions/upload-artifact v4 → v3 (re-regression — needs ADR to prevent future re-upgrade)
Closed
#554 audit: factory mocks → prop injection migration (sveltest pattern)
Closed
#556 ci(coverage): drop client-project branches threshold 80 → 70 to unblock CI
Closed
#553 Unit & Component Tests job exits 1 — birpc teardown race resurfaces from async vi.mock factory with dynamic import
Closed
#551 fix(test): NotificationDropdown view-all click navigates iframe — breaks vitest coverage
Closed
#546 test: PdfViewer.svelte.test.ts re-introduces banned vi.mock('pdfjs-dist') factory — restores birpc teardown race
Closed
#545 fix(test): NotificationDropdown "view-all link" test causes iframe navigation crash in CI
Closed
#541 test: fix flaky browser-mode tests in AnnotationShape and OcrTrainingCard specs
Closed
#535 Unit & Component Tests job exits 1 from vitest-browser teardown race — every test green but CI red
Closed
#496 Increase browser component test coverage to ≥ 80% on all metrics (statements, lines, branches, functions)
Closed
#522 tech-debt(auth): replace cookie-promotion glue with a proper session-based auth model
Closed
#520 bug(security): browser-side /api/* requests miss Authorization in production → browser shows Basic-auth popup
Closed
#518 bug(user): UserDataInitializer blind-INSERTs Administrators group; fails on retry (HIGH, prod-blocking)
Closed
#512 bug(caddy): respond @actuator 404 swallowed by catch-all handle; /actuator/health returns 302
Closed
#513 bug(user): admin seed ignores APP_ADMIN_USERNAME / PASSWORD — falls back to defaults (HIGH, prod-blocking)
Closed
#514 bug(frontend): SvelteKit prerender-crawl bakes redirect-to-login into static HTML for protected routes (HIGH, prod-blocking)
Closed
#510 bug(compose): up -d --wait treats create-buckets exit(0) as failure
Closed
#508 bug(workflows): deploy workflows use runs-on: self-hosted but runner advertises ubuntu-latest — jobs never picked up
Closed
#506 bug(infra/minio): create-buckets bootstrap.sh bind-mount fails on DooD runner (Is a directory)
Closed
#503 bug(infra/fail2ban): jail defaults to systemd backend on Debian, never inspects Caddy access log
Closed
#497 devops: production deployment — Caddy, staging env, and Gitea Actions CI/CD
38 Issues created by 1 user
Opened
#500 devops: bootstrap Renovate config for production deps (MinIO, mc, Postgres, Node, Caddy, mailpit)
Opened
#501 test(ci): production image smoke-test job — boot frontend + backend images, curl /login
Opened
#502 devops: nightly backup pipeline — pg_dump + mc mirror over Tailscale to heim-nas
Opened
#503 bug(infra/fail2ban): jail defaults to systemd backend on Debian, never inspects Caddy access log
Opened
#506 bug(infra/minio): create-buckets bootstrap.sh bind-mount fails on DooD runner (Is a directory)
Opened
#508 bug(workflows): deploy workflows use runs-on: self-hosted but runner advertises ubuntu-latest — jobs never picked up
Opened
#510 bug(compose): up -d --wait treats create-buckets exit(0) as failure
Opened
#512 bug(caddy): respond @actuator 404 swallowed by catch-all handle; /actuator/health returns 302
Opened
#513 bug(user): admin seed ignores APP_ADMIN_USERNAME / PASSWORD — falls back to defaults (HIGH, prod-blocking)
Opened
#514 bug(frontend): SvelteKit prerender-crawl bakes redirect-to-login into static HTML for protected routes (HIGH, prod-blocking)
Opened
#518 bug(user): UserDataInitializer blind-INSERTs Administrators group; fails on retry (HIGH, prod-blocking)
Opened
#520 bug(security): browser-side /api/* requests miss Authorization in production → browser shows Basic-auth popup
Opened
#522 tech-debt(auth): replace cookie-promotion glue with a proper session-based auth model
Opened
#523 feat(auth): server-side session model replacing Basic-auth cookie promotion
Opened
#524 feat(auth): defense-in-depth — CSRF, session revocation, login rate limit
Opened
#527 "Unsaved changes" banner appears after creating a group/user — users think save failed
Opened
#528 security(import): harden DocumentBuilderFactory against XXE in MassImportService
Opened
#529 security(import): validate PDF magic bytes in MassImportService before S3 upload
Opened
#530 security(import): reject path-traversal filenames from ODS in MassImportService.processRows
Opened
#531 ci(nightly): post-deploy smoke test for /api/admin/import-status
Opened
#532 ci(nightly): assert backend container can read /import after deploy
Opened
#533 ui(admin/system): improve mass-import status card (loading state, i18n, font size)
Opened
#534 spec(import): decide and document mass-import operator policy (3 open questions)
Opened
#535 Unit & Component Tests job exits 1 from vitest-browser teardown race — every test green but CI red
Opened
#538 bug(test): flaky browser-mode test — admin edit-user unsaved-changes guard
Opened
#539 ci: extract Reload Caddy step into a composite action
Opened
#541 test: fix flaky browser-mode tests in AnnotationShape and OcrTrainingCard specs
Opened
#542 test: share fakePdfjs fixture across viewer test files
Opened
#543 UX: PDF viewer has no loading indicator or error state when pdfjs-dist fails to initialise
Opened
#545 fix(test): NotificationDropdown "view-all link" test causes iframe navigation crash in CI
Opened
#546 test: PdfViewer.svelte.test.ts re-introduces banned vi.mock('pdfjs-dist') factory — restores birpc teardown race
Opened
#551 fix(test): NotificationDropdown view-all click navigates iframe — breaks vitest coverage
Opened
#553 Unit & Component Tests job exits 1 — birpc teardown race resurfaces from async vi.mock factory with dynamic import
Opened
#554 audit: factory mocks → prop injection migration (sveltest pattern)
Opened
#556 ci(coverage): drop client-project branches threshold 80 → 70 to unblock CI
Opened
#557 ci(devops): downgrade actions/upload-artifact v4 → v3 (re-regression — needs ADR to prevent future re-upgrade)
Opened
#560 audit report: factory vi.mock → prop-injection / __mocks__ migration (87 call sites, 12 modules)
Opened
#566 feat(admin): assign groups when creating an invite link
2 Unresolved Conversations
Open
#498
devops: production observability stack — Prometheus, Loki, Grafana, Alertmanager
Open
#461
devops(ci): add SAST/SCA/secret-scan/container-scan gates to .gitea/workflows/ci.yml