Repository navigation
Conversation
Aligns SolidPing's renovate config with the shared setup used in the sibling realassets repo: - Weekly schedule (Monday mornings) instead of nightly, to batch noise. - Drop prConcurrentLimit to 1 — only one update PR open at a time. - Group updates by ecosystem (go, npm, github-actions) instead of per package, so the uptrace/bun-specific group is superseded by the broader "go dependencies (non-major)" group. - Explicit rule for major updates: label "deps", no automerge. - Minor/patch: still auto-squash-merged, now labelled "deps" (was "automerge") to match the realassets convention. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Removes the "before 7am on Monday" schedule so renovate opens PRs as soon as updates are detected rather than batching to a weekly window. prConcurrentLimit: 1 still keeps the noise floor low. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
fclairamb
changed the title
1 of 4 tasks
fclairamb
added a commit
that referenced
this pull request
Oct 11, 2026
## What & why Deals with every open alert on the Security tab. **Fixed in this PR** - Dependabot #9: `github.com/moby/go-archive` v0.2.0 → v0.3.0 (tar archive can write outside the extraction dir). - Dependabot #10: `github.com/moby/sys/user` v0.4.0 → v0.4.1 (unbounded parsing DoS). - CodeQL #65 (clear-text logging, grdp `sec.go`): `sendFlagged` logged the plaintext PDU in hex at debug level, and the client info PDU carries the RDP password. It now logs the length only. Also removed the debug logs of the client random and the four NTLM signing/sealing keys (same class of leak, not flagged). - CodeQL #61 (allocation-size overflow, `credentials/secret_fields.go`): map size hint is now `max(a, b)` instead of `a + b`. Same change on `MergePatch`. **Dismissed (no code change)** - #72-#81, #68-#71 (weak crypto / weak hashing in vendored `third_party/grdp`): RC4, MD4, MD5, SHA-1 and DES are mandated by RDP standard security and NTLM. Same reasoning as the VNC DES alerts #94/#95. - #31 (MD5 in `checksip`): SIP digest auth (RFC 3261/2617) is MD5. - #33 (SHA-256 on password, `passwords/bcrypt.go`): pre-hash before bcrypt to bypass the 72-byte limit. bcrypt is the slow hash. - #54 (InsecureSkipVerify, `checkrdp`): leaf-only certificate inspection by design, same as #62/#93. - #47/#48 (cookie Secure, `statuspagelock`): `Secure: httpx.IsTLS(req)`, same as #44/#59. - #39 (request forgery, `jmap/client.go`): the JMAP session URL is set by a super admin (instance operator), and reaching their own mail server, often on the LAN, is the feature. Same as the Freebox alert #35. - #17 (clear-text logging, `slack/commands.go`): map-value taint through the check config, the password never reaches the log. Same as #18. ## How to test - `go build ./...` and `go test ./internal/crypto/credentials/ ./internal/checkers/checkrdp/...` in `server/` - `go test ./...` in `server/third_party/grdp` - `golangci-lint` v2.14.0 on `internal/crypto/...`: 0 issues ## Checklist - [x] `go build`, lint and tests pass on the touched packages (full `make test` left to CI) - [ ] Tests added or updated for the change (log-only and size-hint changes, existing tests cover behaviour) - [ ] Docs updated (not user-visible) - [ ] Schema changes (none) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Aligns SolidPing's renovate config with the shared setup used in the sibling realassets repo, with one local tweak.
go,npm,github-actions) instead of per-package — supersedes the previous bun-specific group.deps, no automerge.deps(wasautomerge) to match the realassets convention.Test plan
deps, grouped by ecosystem, and minor/patch should auto-squash-merge once CI is green.