chore: sync ryan/dev security updates by Ryson-32 · Pull Request #64 · SubBoost/subboost

Ryson-32 · 2026-07-26T15:09:20Z

Summary

Sync the integrated ryan/dev line into stable main.
Includes the dependency security upgrade from fix(deps): resolve runtime security advisories #63: Prisma 7.9.0, Next.js 16.2.12, js-yaml 4.3.0, PostCSS 8.5.23, sharp 0.35.3, valibot 1.4.2, find-my-way 9.7.0, and fast-uri 3.1.4.
Removes the obsolete Hono overrides and Hono dependency path.

Validation

Public CI passed on fix(deps): resolve runtime security advisories #63.
npm audit --omit=dev: 0 vulnerabilities.
Full npm audit: only the known ESLint-chain brace-expansion advisory remains.
Lint, 1125 public unit tests, 3106 root unit tests, Prisma generation, type checks, Next.js builds, docs build, amd64/arm64 public test deployments, and Local Demo smoke passed.

No version bump, tag, GitHub Release, or Production deployment is included.

fix(deps): resolve runtime security advisories

Copilot

Copilot wasn't able to review this pull request because it exceeds the maximum number of lines (20,000). Try reducing the number of changed lines and requesting a review from Copilot again.

+
+    const win = installWindow("#setup-token=setup-secret");
+    (globalThis as any).fetch = vi.fn(async () => response({ success: true }));
+    const setup = renderLogin({


+
+    const win = installWindow("#setup-token=setup-secret");
+    (globalThis as any).fetch = vi.fn(async () => response({ success: true }));
+    const setup = renderLogin({


fix(security): keep regex validation linear

Copilot

Copilot wasn't able to review this pull request because it exceeds the maximum number of lines (20,000). Try reducing the number of changed lines and requesting a review from Copilot again.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b842fb5b12

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-07-26T15:50:04Z

+}): Promise<boolean> {
+  return prisma.$transaction(async (tx) => {
+    const updated = await tx.subscription.updateMany({
+      where: { id: params.subscriptionId, updatedAt: params.expectedUpdatedAt },


Avoid using updatedAt for refresh conflict detection

When a client fetches /api/subscriptions/:token/config.yaml while a refresh is in progress, generateSubscriptionYaml updates only lastAccessedAt, but Prisma's @updatedAt also bumps Subscription.updatedAt. This new predicate then treats that read/access-log write as a real subscription edit, so manual refresh returns SUBSCRIPTION_CHANGED and the cron path using the same updatedAt guard skips persisting fresh nodes. Use a revision/timestamp that is not touched by access logging, or update lastAccessedAt without changing the conflict field.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-07-26T15:50:04Z

+  read_env_file > "$candidate_env"
+  cp "$candidate_env" "$old_env"


Create update env copies with private permissions

During subboost update, this new rollback-staging path writes the full .env contents into $TMPDIR/subboost-manager.$$/candidate.env and then duplicates it as old.env using the caller's default umask; with the usual 022 umask and a default 0755 temp directory, other local users can read database/JWT/encryption/setup secrets while the update runs. Set a private umask or create/install these temp env copies with mode 600 before writing them.

Useful? React with 👍 / 👎.

Ryson-32 added 30 commits July 13, 2026 19:58

fix: preserve parser and rule configuration contracts

f7e4ef5

fix: strengthen local runtime safeguards

b485967

refactor: clarify public type contracts

58f14a0

test: split oversized public contract suites

e5e36e2

fix: keep internal legacy migrations private

ef47e39

test: detach self-host shell probes from terminals

7857ad9

docs: clarify subscription bearer responsibility

a615bdc

docs: surface subscription owner warning

d82e2b4

fix(copy): keep subscription warnings concise

73f9f72

feat(local): add high-risk source import toggle

a0f6c83

fix(local): keep imports root-typecheck compatible

12425da

fix(local): preserve setup lock with prisma adapter

295f96d

fix: stabilize subscription imports and validation

89c652c

fix: harden local runtime boundaries

a11e2c6

fix: make local updates recoverable

91afc93

docs: document safe setup and update recovery

0846a94

fix: isolate installer registry credentials

0b8333a

fix: protect self-hosted backups

6bb0597

test: preserve jsx runtime semantics

ed76554

docs: keep the project overview concise

46ca2d6

fix: label compact navigation controls

f39b8f3

test: assert expected component failure logs

d510212

build: retry transient dependency downloads

90fba5c

build: cache verified dependency downloads

427fb43

fix: keep shell validation portable

9f299cb

feat(ui): add accessible form control primitives

78c952a

refactor(ui): unify public and local interactions

6b983d1

fix(ui): align form field aria prop types

a9d6437

chore(ui): enforce icon button labels

dbc0eef

fix(ui): restore source and advanced mode styling

5c1ae39

Ryson-32 added 6 commits July 18, 2026 16:54

fix(ui): restore full-row group disclosure

a08c7a3

fix(deps): resolve runtime security advisories

afc28f2

Merge pull request #63 from SubBoost/ryan/dependency-security

f50dd5f

fix(deps): resolve runtime security advisories

feat(core): add persistent node regex filtering

889aa29

feat(ui): add automatic node processing

e4ea0a5

test(ui): cover filter import refresh paths

b842fb5

Copilot AI review requested due to automatic review settings July 26, 2026 15:09

Copilot AI reviewed Jul 26, 2026

github-code-quality Bot found potential problems Jul 26, 2026

View reviewed changes

Comment thread local/src/components/local-login.test.ts

const win = installWindow("#setup-token=setup-secret");

(globalThis as any).fetch = vi.fn(async () => response({ success: true }));

const setup = renderLogin({

github-advanced-security AI found potential problems Jul 26, 2026

View reviewed changes

fix(security): keep regex validation linear

1dd7a73

Ryson-32 mentioned this pull request Jul 26, 2026

fix(security): keep regex validation linear #65

Merged

Merge pull request #65 from SubBoost/ryan/dependency-security-codeql

b130229

fix(security): keep regex validation linear

Copilot AI review requested due to automatic review settings July 26, 2026 15:17

Copilot AI reviewed Jul 26, 2026

Ryson-32 merged commit 669ced2 into main Jul 26, 2026
10 checks passed

This was referenced Jul 26, 2026

chore(deps): bump @hono/node-server and prisma #61

Closed

chore(deps): bump fast-uri from 3.1.2 to 3.1.4 #62

Closed

chatgpt-codex-connector Bot reviewed Jul 26, 2026

View reviewed changes

Ryson-32 mentioned this pull request Jul 27, 2026

节点管理-批量编辑-筛选正则不生效 #59

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore: sync ryan/dev security updates - #64

chore: sync ryan/dev security updates#64
Ryson-32 merged 38 commits into
mainfrom
ryan/dev

Ryson-32 commented Jul 26, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Jul 26, 2026

Uh oh!

chatgpt-codex-connector Bot Jul 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		read_env_file > "$candidate_env"
		cp "$candidate_env" "$old_env"

Uh oh!

Conversation

Ryson-32 commented Jul 26, 2026

Summary

Validation

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jul 26, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Jul 26, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants