11 Commits

Author SHA1 Message Date
Andrey Antukh
279231240d
🐛 Harden outbound HTTP requests against SSRF and restrict assets handlers (#9390)
* ⬆️ Update root deps

* 🐛 Harden outbound HTTP requests against SSRF and restrict unauthenticated asset access

- Add app.util.ssrf URL/host validator that resolves hostnames and blocks
  loopback, link-local, site-local, cloud metadata, and operator-supplied CIDRs
- Add app.media.sanitize image EOF truncator that strips trailing data after
  PNG IEND, JPEG EOI, GIF trailer, and WebP RIFF markers
- Disable HTTP client auto-redirect; add req-with-redirects! helper that
  revalidates every redirect hop against the SSRF blocklist
- Wire SSRF validation and EOF sanitization into media/download-image
- Validate webhook URLs and OIDC profile picture URLs against SSRF
- Restrict /assets/by-id to require authentication for non-public buckets
  (profile) while keeping public access for file-media-object,
  file-object-thumbnail, team-font-variant, and file-data-fragment
- Add config knobs: ssrf-protection-enabled, ssrf-allowed-hosts,
  ssrf-extra-blocked-cidrs

Signed-off-by: Andrey Antukh <niwi@niwi.nz>

---------

Signed-off-by: Andrey Antukh <niwi@niwi.nz>
2026-05-08 09:18:22 +02:00
Andrey Antukh
a58dbec8f2 ⬆️ Update root repo deps 2026-04-27 20:35:46 +02:00
Andrey Antukh
2d5e50f352 ⬆️ Update root repo deps 2026-04-24 08:17:32 +02:00
Andrey Antukh
eeeb698d91 ⬆️ Bump opencode-ai dev dependency 1.4.3 -> 1.14.19
Signed-off-by: Andrey Antukh <niwi@niwi.nz>
2026-04-20 20:13:15 +02:00
Andrey Antukh
0fc2050526 ⬆️ Update deps on root package.json 2026-04-13 15:00:47 +02:00
Andrey Antukh
dfa45ec8d8 ⬆️ Update deps on root package.json 2026-04-09 09:10:44 +02:00
Andrey Antukh
9a0ae32488 ⬆️ Update opencode dependency on repo root 2026-04-07 16:33:40 +02:00
Andrey Antukh
e7e98255d9 Add scroll and zoom raf throttling (#8812)
* ⬆️ Update opencode and copilot deps

* 🐛 Decouple workspace-content from workspace-local to reduce scroll re-renders

Move workspace-local subscription from workspace-content* (parent) into
viewport* and viewport-classic* (children). workspace-content* now only
subscribes to the new workspace-vport derived atom, which changes only on
window resize — not on every scroll event. This prevents the sidebar,
palette and other workspace-content children from re-rendering on scroll.

* 🐛 Throttle wheel events to one state update per animation frame

Accumulate wheel event deltas in a mutable ref and flush them via
requestAnimationFrame, so that multiple wheel events between frames
produce a single state mutation instead of one per event. This prevents
the cascade of synchronous React re-renders (via useSyncExternalStore)
that can exceed the maximum update depth on rapid scrolling.

Both panning (scroll) and zoom (ctrl/mod+wheel) are throttled. Scroll
deltas are summed additively; zoom scales are compounded multiplicatively
with the latest cursor point used as the zoom center.

* ♻️ Extract schedule-zoom! and schedule-scroll! from on-mouse-wheel

* ♻️ Avoid zoom dep on on-mouse-wheel by using a ref
2026-03-30 12:06:56 +02:00
Penpot Dev
2ba3605f11 ⬆️ Update root repo deps 2026-03-26 13:09:31 +01:00
Andrey Antukh
8729fed724 📎 Add opencode and copilot deps on root package.json 2026-03-24 12:52:56 +01:00
Andrey Antukh
32cf95265a 📚 Add GitHub Copilot instructions (#8548) 2026-03-10 13:12:15 +01:00