mirror of
https://github.com/PerpetualSoftware/pad.git
synced 2026-09-24 19:32:10 +00:00
xarmian
d6c6dfe682
BUG-2084. Two parts. RAM fix: `make vuln` and CI's Go job now run govulncheck in BINARY mode (`-mode binary` against a freshly-built pad binary) instead of source mode (`govulncheck ./...`). Source mode builds an SSA call-graph over the whole dependency tree (BigQuery/OTel/gRPC/Cloud) and balloons to multiple GB of RAM, which was locking up a memory-constrained host. Binary mode reads the binary's symbol table — ~99 MB peak here — while staying call-graph-precise and still detecting stdlib vulns from the Go version stamped in the binary. The scan binary is written to the repo root (real disk, gitignored), never /tmp, since some hosts mount /tmp as a small RAM-backed tmpfs where a large embedded binary can hit "no space left" and consume the RAM we're sparing. Vuln fix (govulncheck binary mode: 0 vulnerabilities after): - go 1.26.4 -> 1.26.5: clears the only CALLED vuln GO-2026-5856 (crypto/tls) plus not-called os GO-2026-4970. - golang.org/x/crypto v0.51.0 -> v0.52.0: clears 13 not-called advisories. - google.golang.org/grpc v1.59.0 -> v1.79.3: clears GO-2026-4762 (gRPC authorization bypass). pad runs no gRPC server, but grpc.Server.Serve ships transitively (OTel/ory/grpc-gateway) so binary mode flags the symbol. Contained 12-line go.mod bump (genproto/protobuf/oauth2 family), no cascade. Remaining not-called advisories deferred to a follow-up dependency sweep: GO-2026-4985 (otel otlptracehttp) and GO-2026-5932 (x/crypto, Fixed in: N/A).
60 lines
689 B
Plaintext
60 lines
689 B
Plaintext
# Binary
|
|
/pad
|
|
/pad.exe
|
|
/loadtest-collab
|
|
/pad-vulnscan
|
|
|
|
# Web build output
|
|
web/build/
|
|
web/node_modules/
|
|
web/.svelte-kit/
|
|
|
|
# Pad workspace data (local to each user)
|
|
.pad/
|
|
.pad.toml
|
|
|
|
# Legacy planning docs (not for public repo)
|
|
v1-archive/
|
|
|
|
# Environment & secrets
|
|
.env
|
|
.env.*
|
|
!.env.example
|
|
|
|
# Database files
|
|
*.db
|
|
*.sqlite
|
|
*.sqlite3
|
|
|
|
# OS
|
|
.DS_Store
|
|
Thumbs.db
|
|
|
|
# Editor
|
|
.vscode/
|
|
.idea/
|
|
*.swp
|
|
*.swo
|
|
*~
|
|
.agents/
|
|
.claude/
|
|
.codex
|
|
.codex/
|
|
|
|
# Agent tool local configs (not for public repo)
|
|
AGENTS.md
|
|
|
|
# Go
|
|
*.test
|
|
*.out
|
|
coverage.txt
|
|
|
|
# Distribution
|
|
dist/
|
|
|
|
# Playwright e2e artifacts (scoped to the test fixture, never the
|
|
# developer's real ~/.pad)
|
|
.pad-e2e/
|
|
web/playwright-report/
|
|
web/test-results/
|