public/once-campfire
1
0
Fork 0
mirror of https://github.com/basecamp/once-campfire.git synced 2026-08-28 17:42:50 +09:00
Code Issues Packages Projects Releases Wiki Activity

Commit Graph

  • a001ddd8aa Bound the web-push delivery queue (max_queue, not the ignored queue_size) sec/10080093516-push-ssrf Jeremy Daer 2026-08-26 00:19:29 -07:00
  • 7d5bb50b9b Address push-SSRF review: defer DNS off enqueue path, disable proxy on pinned path, revalidate on re-registration Jeremy Daer 2026-08-26 00:03:15 -07:00
  • fc91855d62 Route push endpoint guarding through RestrictedHTTP::PrivateNetworkGuard Jeremy Daer 2026-08-25 21:21:01 -07:00
  • 262ac6be06 Guard push-subscription endpoints against SSRF Jeremy Daer 2026-08-25 17:42:15 -07:00
  • e63402d60e Merge pull request #259 from basecamp/dependabot/github_actions/github-actions-ed39cb2a14 main Jeremy Daer 2026-08-24 08:39:19 -07:00
  • 6e25ddd92b build(deps): bump the github-actions group across 1 directory with 7 updates dependabot[bot] 2026-08-24 02:19:57 +00:00
  • fbc3fba364 Merge pull request #258 from basecamp/retire-docker-updater-and-unify-ruby Jeremy Daer 2026-08-23 19:18:19 -07:00
  • b827d7ca9b Put every Ruby pin on 3.4.10 Jeremy Daer 2026-08-22 12:30:43 -07:00
  • 22b6d4bdaf Bump ruby/setup-ruby to v1.321.0 Jeremy Daer 2026-08-22 12:30:43 -07:00
  • 431aad8b71 Retire the docker ecosystem from Dependabot Jeremy Daer 2026-08-22 02:21:49 -07:00
  • aa9fe42810 build(deps-dev): bump mocha from 2.7.1 to 3.1.0 dependabot/bundler/mocha-3.1.0 dependabot[bot] 2026-08-22 04:52:14 +00:00
  • 24c21cf112 build(deps): bump turbo-rails from 30cd8fc to 37530c0 dependabot/bundler/turbo-rails-37530c0 dependabot[bot] 2026-08-22 04:52:03 +00:00
  • e442d48444 build(deps-dev): bump selenium-webdriver from 4.35.0 to 4.47.0 dependabot/bundler/selenium-webdriver-4.47.0 dependabot[bot] 2026-08-22 04:51:51 +00:00
  • db5275918f build(deps): bump web-push from 3.0.2 to 3.1.0 dependabot/bundler/web-push-3.1.0 dependabot[bot] 2026-08-22 04:51:22 +00:00
  • ae0472226e build(deps): bump propshaft from e49a9de to 7425819 dependabot/bundler/propshaft-7425819 dependabot[bot] 2026-08-22 04:51:09 +00:00
  • 9310b002d7 Drop the unsupported semver cooldown keys from the docker ecosystem (#251) Jeremy Daer 2026-08-21 21:49:40 -07:00
  • dfd2dd2bca Bump actionlint and zizmor-action to current releases (#250) Jeremy Daer 2026-08-20 03:08:26 -07:00
  • c860b51109 Take the SSRF address policy from surfguard instead of keeping our own copy (#241) Jeremy Daer 2026-08-20 01:59:19 -07:00
  • 487125dc4c Bump brakeman to 8.0.6 and stop --ensure-latest reddening CI (#249) Jeremy Daer 2026-08-19 09:27:49 -07:00
  • e33b7e50c9 Update mail to 2.9.1 for GHSA-mvxr-6m87-mv2q (#248) Jeremy Daer 2026-08-18 16:47:08 -07:00
  • f1aec61336 dep: update sqlite3 to 2.9.6 (#243) Mike Dalessio 2026-08-12 10:03:33 -04:00
  • baeccebd90 Merge pull request #238 from basecamp/dependabot/bundler/json-2.21.2 Stanko Krtalić 2026-08-11 14:41:14 +02:00
  • 7ab769a9f9 Merge pull request #242 from basecamp/feat/bot-boost-update Stanko Krtalić 2026-08-11 14:40:45 +02:00
  • 1e9f681b3a Scope boosts to the current message Stanko Krtalić 2026-08-11 14:33:05 +02:00
  • 656215b186 Allow bots to delete their own boosts Stanko K.R. 2026-08-11 14:12:18 +02:00
  • 39bab76e38 Merge pull request #239 from ronaldlokers/feat/bot-message-update Stanko Krtalić 2026-08-11 13:45:27 +02:00
  • e8251401ce Adjust to match in-house style Stanko K.R. 2026-08-11 13:42:38 +02:00
  • 3ca1dcbf77 Allow bots to update and destroy their own messages Ronald Lokers 2026-08-10 22:06:41 +02:00
  • 766bffae56 Merge pull request #190 from jpshackelford/feature/bot-read-messages Stanko Krtalić 2026-08-11 13:24:19 +02:00
  • 80c9e7fbfe Adjust to the in-house style Stanko K.R. 2026-08-11 13:15:34 +02:00
  • d1376a97ee Serve Trix from the action_text-trix gem instead of a vendored copy trix-from-gem Jeremy Daer 2026-08-10 20:58:41 -07:00
  • d3f22d78e1 Harden message content filtering + bump thruster to 0.1.23 (#237) Jeremy Daer 2026-08-10 15:55:02 -07:00
  • 6ed9331a97 Bump json from 2.20.0 to 2.21.2 dependabot[bot] 2026-08-10 20:17:26 +00:00
  • 84ad886114 Navigate explicitly in custom_styles XSS system test security/xss-campaign-custom-styles Jeremy Daer 2026-08-08 19:42:29 -07:00
  • 465b372935 Tokenize CSP_EXTRA_* semicolons to avoid a per-request 500 security/xss-campaign-campfire-csp-report-only Jeremy Daer 2026-08-08 19:37:53 -07:00
  • 2fd1483e16 Harden custom-styles route: browser XSS proof and higher-resolution cache key Jeremy Daer 2026-08-08 18:35:26 -07:00
  • b11ed1cb6e Make CSP embed directives configurable per install Jeremy Daer 2026-08-08 18:33:58 -07:00
  • 99266973fd Add a session-stable CSP nonce and complete the directive set Jeremy Daer 2026-08-08 17:30:58 -07:00
  • 424219e485 Serve custom styles from a dedicated text/css route Jeremy Daer 2026-08-08 17:24:52 -07:00
  • f09110c14d Add a Report-Only Content-Security-Policy baseline Jeremy Daer 2026-08-08 14:27:51 -07:00
  • 2aa4141077 Port over automatic note generation v1.4.9 Stanko K.R. 2026-08-04 17:13:07 +02:00
  • 27e9257b2a Merge pull request #231 from basecamp/once-backup-hooks Stanko Krtalić 2026-08-04 17:11:19 +02:00
  • dd247a623b Merge pull request #232 from basecamp/security/room-type-scoping v1.4.8 Jeremy Daer 2026-08-03 16:27:38 -07:00
  • 3b509f55ca Scope the unread rooms stream per user Jeremy Daer 2026-08-03 14:55:19 -07:00
  • ee37809220 Authorize the room message stream at subscribe time Jeremy Daer 2026-08-03 14:55:12 -07:00
  • 5c5c82b27a Scope room lookup to the type each controller administers Jeremy Daer 2026-08-03 14:55:04 -07:00
  • 2d749057f9 Add ONCE backup and restore hooks Kevin McConnell 2026-08-03 12:16:08 +01:00
  • c1d304999d Add ONCE backup and restore hooks faster-once-backups Kevin McConnell 2026-08-03 12:16:08 +01:00
  • d28ab55bf4 Document the self-hosted trust model in SECURITY.md (#230) Mike Dalessio 2026-07-31 13:09:59 -04:00
  • 50f25cea80 Merge pull request #229 from basecamp/fix-version-number v1.4.7 Stanko Krtalić 2026-07-30 18:51:01 +02:00
  • d79225ecd1 Fix version number for CI built images Stanko K.R. 2026-07-30 18:34:54 +02:00
  • b065b40a34 Disable libvips unfuzzed operations (#226) v1.4.6 Mike Dalessio 2026-07-28 11:57:57 -04:00
  • 69e8cd7885 Merge pull request #225 from basecamp/security/ssrf-ipv6-transition-guard v1.4.5 Donal McBreen 2026-07-21 12:34:38 +01:00
  • c0cade51a1 Address Copilot review: require ipaddr and re-assert the socket port Donal McBreen 2026-07-21 11:53:37 +01:00
  • 80fdd44622 Remove IPv4 ranges the IPAddr predicates already cover Donal McBreen 2026-07-21 11:37:17 +01:00
  • 094ef7b462 Replace Redis with the Solid trifecta solid-trifecta Stanko K.R. 2026-07-21 11:42:37 +02:00
  • 54a507a852 Fix Codex's code review comments replace-trix-with-lexxy Stanko K.R. 2026-07-20 18:37:43 +02:00
  • 4cfcc2a370 Re-check the IPv4 embedded in local-use NAT64 instead of blocking outright Donal McBreen 2026-07-20 17:13:18 +01:00
  • bfb57a23f9 Ensure backwards compatibility with Trix Stanko K.R. 2026-07-20 17:56:05 +02:00
  • 9085adcbb3 Block local-use NAT64 and IPv6 benchmarking ranges Donal McBreen 2026-07-20 16:49:40 +01:00
  • 0de302c977 Fix unfurl rebinding tests for newer Ruby Donal McBreen 2026-07-20 16:20:15 +01:00
  • 9fb419e469 Block IPv6 addresses that reach internal IPs in the unfurl guard Donal McBreen 2026-07-20 16:20:15 +01:00
  • a3d2939569 Polish Stanko K.R. 2026-07-20 15:35:13 +02:00
  • 797efa54fd Replace Trix with Lexxy Stanko K.R. 2026-07-20 15:10:54 +02:00
  • ae7a34113f Block IPv6 encapsulation and CGNAT ranges in SSRF guard security/ssrf-ipv6-encapsulation-ranges Jeremy Daer 2026-07-20 02:17:12 -07:00
  • df5ed25e14 Recommend the latest tag over main Stanko K.R. 2026-07-16 21:17:10 +02:00
  • 048ef90ae7 Add the missing development guide Stanko K.R. 2026-07-16 18:00:39 +02:00
  • ea994053ea Bump sqlite3 to 2.9.5 (#222) Mike Dalessio 2026-07-16 02:13:05 -04:00
  • 018a0b5dd9 Bump websocket-driver to 0.8.2 Mike Dalessio 2026-07-16 01:52:48 -04:00
  • 38741c53f1 Upgrade loofah to 2.25.2 and rails-html-sanitizer to 1.7.1 (#221) Mike Dalessio 2026-07-16 00:51:35 -04:00
  • cf0a67fcaf Add a development guide Stanko K.R. 2026-07-15 13:43:14 +02:00
  • e945d4217b Explain how we tag docker images Stanko K.R. 2026-07-15 13:39:42 +02:00
  • cccfb8f774 Add backup and restore instructions Stanko K.R. 2026-07-15 13:34:09 +02:00
  • 55fbf16629 Improve self-hosting instructions Stanko K.R. 2026-07-15 13:29:13 +02:00
  • 9ebc47a8f0 Bump json to 2.20.0 (CVE-2026-54696) v1.4.4 Rosa Gutierrez 2026-07-06 10:02:49 +02:00
  • 962c48af13 Update brakeman Rosa Gutierrez 2026-06-29 13:33:15 +02:00
  • 0920ceab6b Upgrade crass to 1.0.7 Rosa Gutierrez 2026-06-29 12:09:34 +02:00
  • 12bb943af8 Bump concurrent-ruby from 1.3.5 to 1.3.7 dependabot[bot] 2026-06-29 10:37:53 +00:00
  • e4f88b425a Bump nokogiri from 1.19.3 to 1.19.4 dependabot[bot] 2026-06-29 10:37:54 +00:00
  • bfa9f66633 Bump net-imap from 0.6.4 to 0.6.4.1 dependabot[bot] 2026-06-29 10:38:02 +00:00
  • 0141eae018 Address review: assert uploaded bytes in disk update test harden-active-storage-write-auth Jeremy Daer 2026-06-15 13:24:38 -07:00
  • c49c41a0d7 Address review: cover DiskController#update in tests Jeremy Daer 2026-06-15 13:18:40 -07:00
  • 49f06d0b22 Address review: keep disk PUT CSRF-exempt, use intent helpers Jeremy Daer 2026-06-15 13:10:59 -07:00
  • ed5a172871 Require authentication for ActiveStorage direct-upload write endpoints Jeremy Daer 2026-06-15 13:00:29 -07:00
  • 8d3c2bbd2b Merge pull request #211 from basecamp/clean-202606 Mike Dalessio 2026-06-09 12:47:49 -04:00
  • 03fa883f98 dep: update puma 6.6.1 → 7.2.1 (major) Mike Dalessio 2026-06-09 12:20:14 -04:00
  • 8e0aa7d636 dep: update nokogiri 1.18.10 → 1.19.3 Mike Dalessio 2026-06-09 12:10:31 -04:00
  • efaae642b0 dep: update rack 3.2.4 → 3.2.6 Mike Dalessio 2026-06-09 12:01:20 -04:00
  • 28525bec5d dep: update sinatra 4.1.1 → 4.2.1 Mike Dalessio 2026-06-09 11:51:42 -04:00
  • 52ccd24efa dep: update action_text-trix 2.1.15 → 2.1.19 Mike Dalessio 2026-06-09 11:48:08 -04:00
  • c189ddea41 dep: update net-imap 0.5.12 → 0.6.4 Mike Dalessio 2026-06-09 11:38:20 -04:00
  • 7ffb043cf3 dep: update erb 6.0.0 → 6.0.4 Mike Dalessio 2026-06-09 11:32:02 -04:00
  • 17f81d4fa0 dep: update jwt 3.1.2 → 3.2.0 Mike Dalessio 2026-06-09 11:29:42 -04:00
  • 905165b7e2 dep: update bcrypt 3.1.20 → 3.1.22 Mike Dalessio 2026-06-09 11:25:39 -04:00
  • ce62fd0814 dep: update addressable 2.8.7 → 2.9.0 Mike Dalessio 2026-06-09 11:22:40 -04:00
  • 47cdbb2a0f dep: update rexml 3.4.1 → 3.4.4 Mike Dalessio 2026-06-09 11:17:07 -04:00
  • 6ec04cbc28 dep: update rack-session 2.1.1 → 2.1.2 Mike Dalessio 2026-06-09 11:01:36 -04:00
  • e74d192aec dep: explicitly add bundler-audit Mike Dalessio 2026-06-09 10:50:21 -04:00
  • 67ca61da1f fix(docker): install libssl-dev to build the openssl gem Mike Dalessio 2026-06-09 12:41:14 -04:00
  • 0febc9f415 dep: update to bundler 4 Mike Dalessio 2026-06-09 10:36:06 -04:00