Resolves the two open Dependabot alerts for GHSA-r28c-9q8g-f849
(source-map auto-loading path traversal, patched in 8.5.18). postcss
is a build-time dependency, so no shipped runtime code was affected.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Dependabot alert 137 (low). Fixes a CUSTOM_ELEMENT_HANDLING hook-policy
bypass upstream; Pulse does not enable CUSTOM_ELEMENT_HANDLING so the
bump is hygiene, not an active exposure. Verified vite build, bundle
budget, and the AI chat vitest suite that exercises the sanitizer.
Contract-Neutral: Dependabot alert 137 GHSA-c2j3-45gr-mqc4: patch-level dompurify 3.4.11->3.4.12 security bump in frontend-modern; no dev-runtime orchestration, manifest-floor, or build-chunking behavior changed, contract already governs security lockfile bumps generically; dev-runtime proof artifacts are inapplicable to a frontend dependency version pin
Bump vite ^6.4.2 to ^6.4.3 and pin patched transitives via overrides
(@babel/core ^7.29.6, js-yaml ^4.2.0). Clears 4 Dependabot alerts (2 high,
1 medium, 1 low). npm audit reports 0 vulnerabilities; npm ci, vite build,
vitest (6830 tests), and bundlesize all green.
Also gitignore stray pnpm artifacts. npm is canonical here (CI and the
production Dockerfile both use npm ci from package-lock.json); nothing
consumes pnpm. The unused pnpm-lock.yaml and pnpm-workspace.yaml were
removed separately this cycle and only ever produced Dependabot noise (13
alerts). Ignoring them stops the pair creeping back in, as happened after
the earlier cac5be2ca removal.
OpenCode syntax-highlights code in the transcript; Pulse rendered
fenced blocks as flat text. Assistant answers are full of shell
commands, configs, and query output, so add highlight.js with an
infra grammar set (bash, json, yaml, ini, sql, dockerfile, nginx):
- Lazy-loaded into its own vendor-highlight chunk; the entry chunk
stays clean and the chunk only downloads with the rest of the
preloaded app shell.
- Highlighting runs over the sanitized DOM after the turn settles, so
generated spans never pass through DOMPurify, streaming morphs are
never fought, and the class allowlist stays closed to the model. The
single carve-out is marked's fence-language hint, pattern-pinned to
language-x on <code> only.
- Token palette maps hljs classes to theme colors readable on the
dark prose-pre background both app themes share.
Per-block copy is intentionally not added: OpenCode has none, and the
answer-level copy already exists.
Bumps frontend-modern DOMPurify from ^3.4.0 / 3.4.0 to ^3.4.1 / 3.4.1 and PostCSS from ^8.4.0 / 8.5.6 to ^8.5.13 / 8.5.13.
Keeps pulse/v6-release aligned with the default-branch Dependabot fixes for GHSA-39q2-94rc-95cp and GHSA-qx2v-qp2m-jg93.
Verification: npm ci, npm audit --audit-level=moderate, npm run type-check, npm run build, npm run lint, status_audit.py --check, registry_audit.py --check from the canonical workspace. Full npm test remains red on origin/pulse/v6-release with the same targeted baseline failures unrelated to these dependency changes.
The advisory covers an ADD_TAGS form bypass of FORBID_TAGS. Pulse uses
an ALLOWED_TAGS allowlist in frontend-modern/src/components/AI/aiChatUtils.ts
and never combines ADD_TAGS with FORBID_TAGS, so we were not actually
exposed, but staying on the patched line keeps the Dependabot surface
clean.
- Add onClick handler to GuestRow component
- Toggle GuestDrawer inline below clicked row
- Show metrics history charts within the drawer
- Click row again or close button to collapse
Override seroval to ^1.4.1 to fix 8 high-severity vulnerabilities:
- Remote Code Execution via JSON Deserialization
- Prototype Pollution via JSON Deserialization
- Denial of Service via Array/RegExp serialization
seroval is a transitive dependency from solid-js which pins ~1.3.0.
- Add GET /api/audit endpoint for listing events with filters
- Add GET /api/audit/:id/verify endpoint for signature verification
- Add AuditLogPanel UI component with filtering and verification
- Update docs with audit API documentation
- Add localStorage utils for persisting UI state
- Update gitignore patterns
- Simplify Dockerfile: use golang:1.24 base, install Node via features
- Add proper port forwarding for Pulse (7655 frontend, 7656 API)
- Add Vue Volar extension for frontend development
- Add start-pulse-dev.sh helper script for auto-starting dev server
- Add FRONTEND_DEV_HOST to containerEnv for proper binding
- Add .env.devcontainer to .gitignore (local override file)
- Update frontend dependencies
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Fix Storage.tsx using number priorities instead of string literals
- Move husky configuration to repository root for proper git hook support
- Add package.json/lock.json to root (un-ignore in .gitignore)
- Configure pre-push hook to run type-check before push
Adds husky with a pre-push hook that runs type-check before allowing
pushes. This catches the TypeScript errors locally that were causing
repeated CI failures and email spam.
Skip with: git push --no-verify
- Add DOMPurify sanitization for AI chat markdown rendering (XSS fix)
- Configure DOMPurify to add target=_blank and rel=noopener to links
- Update system prompt to align with command approval policy
- Clarify safe vs destructive commands in prompt
- Improve patrol auto-fix mode guidance with safe operation list
- Add verification requirements for auto-fix actions
- Update observe-only mode to be clearer about read-only restrictions
- Add AI service with Anthropic, OpenAI, and Ollama providers
- Add AI chat UI component with streaming responses
- Add AI settings page for configuration
- Add agent exec framework for command execution
- Add API endpoints for AI chat and configuration
- Add comprehensive test coverage for alerts package with 285+ new tests
- Implement ThresholdsTable component with metric thresholds display
- Enhance Alerts page UI with improved layout and metric filtering
- Add frontend component tests for Alerts page and ThresholdsTable
- Set up Vitest testing infrastructure for SolidJS components
- Improve config persistence with better validation
- Expand discovery tests with 333+ test cases
- Update API, configuration, and Docker monitoring documentation
courtmanr@gmail.com