Commit history for src/server
- Security: migration 0021 (display name/website cleanup, org settings, invitations, stale follow purge); attachment quotas attributed to guest uploaders plus orphan sweeper and asset nosniff/overwrite cleanup (AZ-A14); advisory open counts and collaborator roster only for managers, collaborators need repo read (AZ-A15); page clamps and browse limits (AZ-A17); profile feed hides deleted private repos, inbox tolerates malformed URLs (AZ-A18); revoked secrets no longer allowlisted, review comment edit/delete UI (AZ-A19)286f978⌁taigrr committed
- Security: camo image proxy for external markdown images (AZ-A20), user-content- id prefix, escaped link attributes, raster-only data: images (AZ-A13); assignees and requested reviewers must be collaborators or org members (AZ-A12)7161ac4⌁taigrr committed
- Security: archived repositories are read-only for all content mutations (AZ-A10); limitWrite on every mutating fn and API handler, star webhook fan-out behind a limiter, fork honours the owner repo cap (AZ-A11)f33239b⌁taigrr committed
- Security: sanitize git idents and profile links, revoke stale follows, org invitations, review permissions3cdfe78⌁taigrr committed
d60578d⌁
- Gate editor containers by plan, and open the editor or a container straight from a branch111516c⌁taigrr committed
- Relay imports ourselves: primary branch first, then backfill refs with an importing badge; token imports for private sources; working delete-and-retry; warm and batch the last-commit walk.7a72469⌁taigrr committed
- Meter editor containers through reserve/commit, fix terminal input, and list running containers34b3271⌁taigrr committed
- Squash the 37 never-deployed migrations into one file per area, producing an identical schema.81f0fc8⌁taigrr committed
- Merge roadmap/tests-pulls825f38e⌁taigrr committed
- Rebuild the /api/v1 router as the union of every test branch's routes, drop duplicate label endpoints, and route org member changes through setOrgMember.30fdc39⌁taigrr committed
- Merge roadmap/tests-ci0b0da6c⌁taigrr committed
- Merge roadmap/tests-platform1eeb5f8⌁taigrr committed
- Merge roadmap/tests-hostingd860f90⌁taigrr committed
- Merge roadmap/tests-orgs75fe096⌁taigrr committed
- Merge roadmap/tests-gitb363225⌁taigrr committed
- Merge roadmap/tests-issuese7ce4d9⌁taigrr committed
- Merge roadmap/tests-auth6334b8b⌁taigrr committed
- Merge roadmap/tests-security1c1dbd4⌁taigrr committed
- Merge roadmap/mcp9cc32b3⌁taigrr committed
- Merge roadmap/notify7417d6f⌁taigrr committed
- Merge roadmap/editor5d253e9⌁taigrr committed
- Merge roadmap/integrations95ebb35⌁taigrr committed
- Merge roadmap/sites7e7a8a7⌁taigrr committed
- Merge roadmap/platformfixa662571⌁taigrr committed
- Merge roadmap/mergefix3e9780b⌁taigrr committed
- Merge roadmap/metering71afa5f⌁taigrr committed
- Extract pull request, review, protection, label, token and org-member writes into shared server modules with token API parity, add org deletion with retired names, and make /api/v1 token-only.8de9b05⌁taigrr committed
- Scope commit signature lookups to the repository, 404 on missing alerts, gate draft release assets, refuse private webhook targets, stop dequeued merges, report workflow compile failures, support git protocol v2 with the default branch as HEAD, and post every password form.20aff54⌁taigrr committed