- make quick/check/mutation from cj/security-baseline (Makefile unchanged,
settings in baseline.mk), pre-commit, gitleaks, Semgrep rules, ESLint
security rules, Forgejo workflow
- tests/security: generic baseline tests plus app config and role tests
against createApp() with an in-memory database
- extract createApp() from src/server/index.ts; LB_DATABASE_PATH for tests
- fix gaps found by the tests: reject unknown fields on project create,
answer malformed JSON with 400 instead of 500, set nosniff on the API
- npm audit fix (next 16.4.1 and others, no high/critical left)
- clear ESLint errors, safeFileName without control-character regex
- per-project ownership stays an open, documented gap (idorGap -> TODO)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
compose.yaml overrode the image's own entrypoint to start "tsx watch" and
"next dev" with CHOKIDAR_USEPOLLING and WATCHPACK_POLLING enabled. The
built dist/ and .next from the image were never used, and the polling
watchers kept both containers busy around the clock whether or not
anyone used the application.
Split the two use cases: compose.yaml now runs node dist/server/index.js
and next start with no source mounts and no watchers, and the watching
setup moves to compose.dev.yaml.
next build writes the rewrite destinations from next.config.mjs into
.next/routes-manifest.json, so next start cannot pick up API_INTERNAL_URL
at runtime the way next dev does. Pass it as a build argument.
Give the web container its own probe. The healthcheck hit "/", which
redirects to "/projects", and fetch follows redirects, so every probe
rendered two pages every five seconds. "/health" could not serve as the
probe because next.config.mjs rewrites it to the API. Add "/web-health"
as a route handler, exclude it from the proxy matcher, and relax both
intervals to 30s.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Node 22 leaves active LTS at the end of October. Move the Docker base
image and the documented local requirement to Node 24.
Pull @types/node from ^25 down to ^24 so the type definitions no longer
describe a newer runtime than the one in use. Types ahead of the runtime
let TypeScript accept APIs that are not there at execution time; the
opposite direction is harmless.
Add an engines field to record the supported version. No .nvmrc, since
the project is not used with a Node version manager.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
