Martin Vogel 4fdcdd4239 fix(security): close open scanner alerts ...

Dependabot/CodeQL #33 — postcss XSS GHSA-qx2v-qp2m-jg93:
  npm audit fix in graph-ui (8.5.8 -> 8.5.14, above the <8.5.10 vuln range)

CodeQL #39 — TOCTOU race in artifact.c ensure_gitattributes():
  Replace stat() + fopen() with open(O_WRONLY|O_CREAT|O_EXCL).
  Atomic create-only-if-absent closes the check-vs-write window.
  Falls through to merge driver setup if file already exists.

CodeQL #55 — pip install not pinned in release.yml:
  Pin build==1.3.0 and twine==6.2.0. Comment explains why
  --require-hashes is not used (transitive-deps overhead).

Dismissed (won't-fix):
  - #56 contents: write — required for 'gh release edit --draft=false';
    no narrower permission exists.
  - #54-51 Crystal grammar warnings — vendored upstream code.
  - #50-40 Agda grammar warnings — vendored upstream code.

2026-05-05 00:51:52 +02:00

..

@/components/ui

Replace vmem with mimalloc global allocator, add extraction-phase prescan, fix __init__.py QN collision

2026-03-17 22:05:57 +01:00

src

Add multi-galaxy UI layout and cross-repo architecture summary

2026-04-15 23:53:42 +02:00

components.json

Replace vmem with mimalloc global allocator, add extraction-phase prescan, fix __init__.py QN collision

2026-03-17 22:05:57 +01:00

index.html

Replace vmem with mimalloc global allocator, add extraction-phase prescan, fix __init__.py QN collision

2026-03-17 22:05:57 +01:00

package-lock.json

fix(security): close open scanner alerts

2026-05-05 00:51:52 +02:00

package.json

Bump vite to 6.4.2 to fix CVE GHSA-4w7w-66w2-5vf9 and GHSA-p9ff-h696-f583

2026-04-12 19:06:28 +01:00

tsconfig.json

Replace vmem with mimalloc global allocator, add extraction-phase prescan, fix __init__.py QN collision

2026-03-17 22:05:57 +01:00

tsconfig.tsbuildinfo

Replace vmem with mimalloc global allocator, add extraction-phase prescan, fix __init__.py QN collision

2026-03-17 22:05:57 +01:00

vite.config.ts

Replace vmem with mimalloc global allocator, add extraction-phase prescan, fix __init__.py QN collision

2026-03-17 22:05:57 +01:00