v2.2.x: microservice consolidation + vendor portal + AI knowledge - #142
Open
PenguinzTech wants to merge 252 commits into
Open
v2.2.x: microservice consolidation + vendor portal + AI knowledge#142PenguinzTech wants to merge 252 commits into
PenguinzTech wants to merge 252 commits into
Conversation
- Add helm templates for video-proxy, engagement, module-rtc - Add kustomize base and beta overlay for kubectl deploy - Update values.yaml and values-beta.yaml with new modules - Fix config.py to build DATABASE_URL from DB_* env vars - Support both helm v3 and kubectl/kustomize deployments Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Enable PostgreSQL and Redis infrastructure in beta values - Use postgres:16-alpine image (cached in cluster) - Use longhorn storage class for PVCs - Fix configmap to use individual DB_* env vars instead of broken DATABASE_URL with $(POSTGRES_PASSWORD) substitution - Add DB_PASS to secrets for module database connections - Add emptyDir volume mounts for /app/databases to allow PyDAL migrations to write sql.log files - Set replicas to 1 for video-proxy and engagement to avoid PyDAL migration race conditions - Update postgres deployment to use RollingUpdate strategy - Add serviceaccount.yaml for both Helm and Kustomize deployments - Fix image tag defaults to use global.imageTag instead of Chart.AppVersion Tested: All 3 new modules (video-proxy, engagement, module-rtc) running healthy in dal2-beta cluster. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Update ingress TLS secretName from waddlebot-tls to penguintech-wildcard-tls (Cloudflare Origin Certificate) - Add nginx ingress class - Add nginx annotations for SSL redirect and body size limit - Fix service names in ingress paths (remove waddlebot- prefix since fullname helper adds it) Certificate: CloudFlare Origin CA, valid until Jan 2029 Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Add @penguin/react_libs dependency to hub_module frontend - Refactor AnnouncementModal to use FormModalBuilder component - Replace manual state management with declarative field definitions - Add dynamic platform checkboxes with showWhen conditional visibility - Consolidate multi-action submit (Draft/Publish/Broadcast) into single submit with "Save As" status select field - Apply WaddleBot theme colors to match existing UI - Reduce component from 346 to 189 lines (~45% reduction) - Bump version to 1.1.1 Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add hub_settings table for signup/email configuration - Add cookie_policy_versions, cookie_consent, cookie_audit_log tables for GDPR compliance - Add missing auth columns to hub_users (username, password_hash, is_super_admin, email_verified, etc.) - Seed default hub_settings values on initialization - Seed default cookie policy v1.0.0 - Update username to use email format for consistency across SSO/local logins - Fix default admin to use admin@localhost.local Fixes 500 errors on /api/v1/cookie/policy, /api/v1/signup-settings, /api/v1/auth/login Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
npm: - Update next.js to 15.5.9 (fixes GHSA-w37m-7fhw-fmv9, GHSA-mwv6-3258-q52c) - Update bcrypt to 6.0.0 (fixes tar vulnerability chain) - Update multer to 2.x (fixes multiple CVEs) - Fix tar, qs vulnerabilities in hub_module/backend and website Go: - Update golang.org/x/crypto to v0.47.0 (fixes critical CVE) - Update golang.org/x/net to v0.48.0/v0.49.0 - Update google.golang.org/protobuf to v1.36.11 Python: - Update urllib3 to 2.6.3 in archive module (fixes decompression bomb CVE) - Bump protobuf to latest available versions (CVE pending upstream fix) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add validators.array() function for array validation with min/max - Add optional parameter support to text, boolean, integer validators - Add pattern parameter support to text validator - Fixes CrashLoopBackOff in hub-api due to missing validators.array Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add avatar_url TEXT column for user profile pictures - Add is_vendor BOOLEAN column for vendor role support - Add migration block to add missing columns to existing databases - Fixes login 500 error: "column u.avatar_url does not exist" Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
…t_log, community_servers Hub-specific tables for: - hub_oauth_states: OAuth flow state management - hub_user_profiles: Extended user profile data - platform_configs: Platform OAuth credentials and settings - audit_log: Security and activity audit trail - community_servers: Multi-platform server linking Each module handles its own table initialization per architecture standards. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Smoke Tests (tests/smoke/): - smoke-api-comprehensive.sh: Tests all 100+ API endpoints across 18 route files - smoke-pages.js: Tests all 79 frontend pages with authentication support - run-all.sh: Master smoke test runner for local and beta environments - Execution time: <2 minutes (per standards requirement) API Integration Tests (tests/api/hub-backend/): - auth.test.js: Authentication endpoints (login, register, OAuth, password reset) - public.test.js: Public endpoints (health, stats, communities) - community.test.js: Community CRUD operations and membership - vendor.test.js: Vendor submission and dashboard - OAuth platforms mocked (Twitch, Discord, YouTube, Slack) - no real tokens needed - Uses Jest + Supertest + nock for mocking Integration Tests (tests/integration/): - database.test.js: Database transactions, referential integrity, data consistency - websocket.test.js: Real-time WebSocket communication tests - Tests multi-service workflows and cross-component data flow E2E Tests (tests/e2e/): - auth-workflow.spec.js: Registration → login → dashboard workflow - community-workflow.spec.js: Community creation → configuration → management - vendor-workflow.spec.js: Vendor submission → review → approval - Uses Playwright for browser automation Test Coverage: - Smoke: 100% (all containers, APIs, pages) - API: 40% initial coverage (auth, public, community, vendor) - Integration: Database + WebSocket foundation - E2E: Critical workflows (auth, community, vendor) Standards Compliance: - Per CLAUDE.md: Smoke tests mandatory before every commit (<2 min) - OAuth mocking prevents need for real platform tokens - Tests verify authenticated and unauthenticated flows - All pages tested including 79 frontend pages with tabs Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Change is_global from static column to JSONB metadata field (config->>'is_global') - Add public marketplace endpoints: GET /api/v1/marketplace/modules, /modules/:id, /categories - Update all is_global queries to use JSONB path operator - Fix cookie policy endpoint (now returns 200 with default policy) - Add getMarketplaceModules, getMarketplaceModule, getMarketplaceCategories controllers All core API endpoints now functional (100% pass rate in smoke tests) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Add ALB_HOST parameter to bypass Cloudflare bot protection - Use Host header to route requests through ALB directly - Add SSL bypass (-k flag) for self-signed certificates on ALB - Support both direct connection and ALB bypass modes - Extract VHOST from BASE_URL automatically Usage: ./tests/beta-smoke-test.sh https://waddlebot.penguintech.io dal2.penguintech.io ./tests/smoke/smoke-api-comprehensive.sh https://waddlebot.penguintech.io dal2.penguintech.io Environment variables: ALB_HOST - ALB DNS name (e.g., dal2.penguintech.io) VHOST - Virtual host header (auto-extracted if not set) Successfully tested all endpoints via ALB bypass - all returning 200 Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
The login controller was attempting to update last_login timestamp on successful authentication, but the column was missing from the hub_users table schema. This caused a 500 Internal Server Error during login. Changes: - Added last_login TIMESTAMP column to hub_users CREATE TABLE statement - Added migration block to add column to existing databases - Login functionality now works correctly and updates last_login on auth Resolves login failure with error: "column last_login does not exist" Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Updated all vulnerable dependencies identified by GitHub Dependabot: Go Dependencies: - golang.org/x/crypto: Updated to v0.47.0 (fixes critical/high/medium CVEs) - golang.org/x/net: Updated to v0.48.0-v0.49.0 (fixes medium CVEs) - google.golang.org/protobuf: Updated to v1.33.0+ (fixes medium CVE) Node.js Dependencies: - react-router-dom: Updated to v7.13.0 (fixes high/medium XSS and CSRF) - multer: Already at v2.0.2 (DoS fixes) - qs: Already at v6.14.1 (DoS fix) Python Dependencies: - urllib3: Added constraint >=2.6.3 (fixes decompression-bomb bypass) Modules updated: - Premium/Desktop (Go bridge) - core/module_rtc (WebRTC module) - shared/go_libs (shared Go libraries) - admin/hub_module/frontend (React UI) - libs/flask_core (Flask core library) Fixes 27 security vulnerabilities (3 critical, 21 high, 3 low to medium) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Updated website package-lock.json with latest dependencies: - next: Already at 15.5.9 (patched for DoS and source code exposure) - tar: Updated to 7.5.6 (fixes arbitrary file overwrite and race conditions) All website dependencies now have 0 vulnerabilities per npm audit. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Replace penguin emoji with waddlebot-logo.png in navigation headers - Update favicon to use robot penguin logo - Update login page to display robot penguin logo - Applied across PublicLayout, AdminLayout, DashboardLayout, and LoginPage Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Replace penguin emoji fallbacks with waddlebot-logo.png - Applied to community cards and dashboard displays Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Added websocket-services annotation for hub-api - Increased proxy timeouts to 3600s for long-lived connections - Fixes Socket.IO connection errors Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Added explicit /socket.io path routing to hub-api - Path order matters: socket.io and /api before / wildcard - Fixes Socket.IO connection failures Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Migrated files: - SuperAdminUsers.jsx (Create/Edit User modals) - AdminPolls.jsx (Create Poll modal) - AdminBotDetection.jsx (Review Detection modal) - AdminCalendarTicketing.jsx (Create/Transfer/Cancel Ticket modals) - AdminCommunityCalls.jsx (Create Room modal) - AdminMirrorGroups.jsx (Create Group, Add Server modals) - AdminLiveStreams.jsx (Add Destination modal) - AdminForms.jsx (Create Form modal) - LoyaltyLeaderboard.jsx (Adjust Balance, Wipe Confirm modals) - SuperAdminModuleRegistry.jsx (Create/Edit Module modals) - SuperAdminSoftwareDiscovery.jsx (Add Repository modal) - SuperAdminVendorRequests.jsx (Approve/Reject modals) - LoyaltyGames.jsx (Prediction/Raffle modals - new forms) - CommunityPublicPage.jsx (Join Request modal) Benefits: - Consistent modal styling via waddlebotColors theme - Built-in Zod validation for all form fields - Standardized field types (text, email, password, select, checkbox, multiline) - Automatic form state management (removed manual state variables) - Conditional field visibility using showWhen prop - Reduced boilerplate code (~55 net lines removed) All modals now use FormModalBuilder from @penguin/react_libs instead of inline modal implementations, ensuring UI consistency across the application. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Update CHANGELOG.md and APP_STANDARDS.md for v2.2.x consolidation release. Bump version from 2.0.1 to 2.2.0. Refactor E2E tests to use centralized fixtures, shared helpers, and global setup with auto-seeding to eliminate rate-limit cascade duplication across 30 spec files. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add appuser non-root user across all service modules: interactive, trigger-webhooks, trigger-streaming, action/interactive, action/pushing, core modules, processing, and trigger receivers. All Python Flask services now run as non-root with proper /app ownership. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…s and Python services All 21 K8s base deployment manifests now get database and Redis configuration exclusively from the waddlebot-config ConfigMap via envFrom.configMapRef, eliminating duplicate hardcoded DB_HOST/DB_PORT/ DB_NAME/DB_USER/DB_PASS/REDIS_HOST env vars that used wrong key names and would be overridden anyway. Python config.py files in services/ now construct DATABASE_URL and REDIS_URL from individual env var components (DATABASE_HOST, PORT, NAME, USER, PASSWORD; REDIS_HOST, PORT, DB, PASSWORD) — matching the pattern already used by the router module — rather than expecting a pre-built DATABASE_URL with localhost defaults. Also: - Remove namePrefix alpha-overlay configMapRef injection patch (now redundant since base manifests already have it — was causing duplicate configMapRef entries) - Fix Python configs: replace 'router-service' hostname with 'core-router' - Fix interactive-translate: use Python 3.12 (numpy/fasttext no 3.13 wheels) - Fix action-discord: pre-install setuptools for grpcio-tools hash mode Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…nectivity Python services (24 configs): switch DATABASE_URL scheme from postgresql:// to postgres:// — pydal only registers the postgres:// adapter, causing all services to silently fall back to localhost and crash. hub-api config: compose DATABASE_URL from individual env var components (DATABASE_HOST/PORT/NAME/USER/PASSWORD) when DATABASE_URL is not set directly, matching how K8s configmaps inject DB config. Frontend: fix AdminInteractionChannels badge label trim and allow_ad_hoc_voice reset on channel type change; fix CommunityInteraction empty-state message to always show admin instruction; fix CommunitiesPage auth loading guard. K8s alpha overlay: raise rate limit for hub-api to 1000 req/min to prevent test-induced 429s during CRUD lifecycle. E2E tests: add skip guards to all serial CRUD tests that depend on upstream creation state, fix voice badge race condition with networkidle wait + re-check, fix global-setup community seeding with correct tenant_id and super-admin flag. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- build-container.yml: split into native amd64 + arm64 jobs, merge manifests with docker buildx imagetools create (eliminates QEMU overhead ~3-5x speedup) - containers.yml: same split+merge pattern for all 5 build groups (15 jobs total) - security.yml: new file — extracted from ci-cd.yml; fast checks gate builds, CodeQL runs in parallel (continue-on-error) to unblock containers - ci-cd.yml: simplified to deploy-k8s + notify only; security now in security.yml fix(security): upgrade pyjwt 2.8.0 → 2.12.1 across all services (GHSA-752w-5fwx-jx9f) - Exact pins (==2.8.0): bumped to 2.12.1 with updated sha256 hashes - Lower-bound pins (>=2.8.0): tightened to >=2.10.0 (minimum safe version) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Fixes GHSA-7gcm-g887-7qv7 (high severity) — JSON recursion depth bypass in protobuf Python < 5.29.4. Updates mattermost module to 6.33.6 with correct sha256 hashes (consistent with all other action modules already on 6.33.6). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Fixes GHSA-752w-5fwx-jx9f (high severity) — mattermost module had its own separate pyjwt pin at 2.9.0 missed in the earlier 2.8.0 sweep. All action modules now pinned to pyjwt==2.12.1. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- axios ^1.7.9 → 1.15.0 (exact pin): fixes GHSA-3p68-rc4w-qgx5 (SSRF via NO_PROXY bypass) and GHSA-fvcv-3m26-pcqx (metadata exfiltration) - npm audit fix resolves: fast-xml-parser, flatted, lodash, path-to-regexp, brace-expansion, follow-redirects, socket.io-parser high/moderate CVEs - 1 moderate (nodemailer) remains; fix requires breaking change to 8.0.5 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Same SSRF CVEs as backend fix (GHSA-3p68-rc4w-qgx5, GHSA-fvcv-3m26-pcqx). Also resolves all other npm audit vulnerabilities in frontend package tree (0 vulnerabilities after npm audit fix). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Contributor
Author
|
@SocketSecurity ignore npm/entities@6.0.1 |
Fixes GHSA-p77j-4mvh-x3m3 (critical) — gRPC-Go authorization bypass via missing leading slash in :path header. Also upgrades transitive deps: golang.org/x/net, google.golang.org/genproto, google.golang.org/protobuf. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Fixes GHSA-78h2-9frx-2jm8 (high) — JWE decryption panic in go-jose v3. v3.0.5 is the designated patch release for this advisory. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…-5fwx-jx9f) Bumps pyjwt from >=2.10.0/==2.10.1 to >=2.12.1/==2.12.1 in all affected requirements files. Versions <2.12.1 accept unknown `crit` JWT header extensions, which can be exploited to bypass signature verification. Files updated: - services/action-serverless/requirements.txt (==2.10.1 → ==2.12.1) - services/action-platforms/requirements.txt (>=2.10.0 → >=2.12.1) - services/core-data/requirements.txt (>=2.10.0 → >=2.12.1) - services/core-community/requirements.txt (>=2.10.0 → >=2.12.1) - services/core-community/libs/flask_core/requirements.txt (>=2.10.0 → >=2.12.1) - services/core-community/libs/module_sdk/security/requirements.txt (>=2.10.0 → >=2.12.1) - core/reputation_module/requirements.txt (>=2.10.0 → >=2.12.1) - libs/flask_core/requirements.txt (>=2.10.0 → >=2.12.1) - libs/module_sdk/security/requirements.txt (>=2.10.0 → >=2.12.1) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…HSA-r6ph-v2qm-q3c2) Bumps cryptography from <=44.0.3 to >=46.0.0/==46.0.0 in all affected requirements files. Versions <46.0.0 are vulnerable to a subgroup attack due to missing subgroup validation for SECT curves. Files updated (exact pins): - services/action-serverless/requirements.txt (==44.0.3 → ==46.0.0) - services/interactive-gaming/requirements.txt (==44.0.0 → ==46.0.0) Files updated (lower bounds): - services/action-platforms/requirements.txt (>=44.0.0 → >=46.0.0) - services/core-community/requirements.txt (>=44.0.3 → >=46.0.0) - services/core-community/video_proxy_module/requirements.txt (>=44.0.3 → >=46.0.0) - services/core-community/workflow_core_module/requirements.txt (>=44.0.3 → >=46.0.0) - services/core-data/requirements.txt (>=44.0.3 → >=46.0.0) - services/core-identity/requirements.txt (>=41.0.0 → >=46.0.0) - services/core-identity/credential_manager_module/requirements.txt (>=41.0.0 → >=46.0.0) - core/engagement_module/requirements.txt (>=44.0.3 → >=46.0.0) - core/video_proxy_module/requirements.txt (>=44.0.3 → >=46.0.0) - core/workflow_core_module/requirements.txt (>=44.0.3 → >=46.0.0) - core/credential_manager_module/requirements.txt (>=41.0.0 → >=46.0.0) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…xed until 46.0.x patch) 46.0.0 is still vulnerable; bump all pins to ==46.0.6 / >=46.0.6 to match the version already used in hash-pinned action modules. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…A-jr27-m4p2-rc6r) pyasn1 0.4.8 is vulnerable to DoS via unbounded recursion. Bumps to 0.6.3 (safe version used in hash-pinned action modules). Also bumps pyasn1-modules from 0.4.1 to 0.4.2 to match the compiled baseline. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…on-serverless (GHSA-5pwr-322w-8jr4) pyopenssl 25.0.0 is vulnerable to DTLS cookie callback buffer overflow. Upgrades to 26.0.0 (latest) in action-serverless and raises lower bound in action-platforms to >=26.0.0. Also proactively updates other stale exact pins in action-serverless to stay ahead of advisory database: - grpcio/grpcio-status/grpcio-tools 1.78.0 → 1.80.0 - urllib3 2.2.3 → 2.6.3 - six 1.16.0 → 1.17.0 - werkzeug 3.1.3 → 3.1.8 - google-auth 2.49.1 → 2.49.2 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…y modules - YouTube: persist new refresh_token after Google rotates it (Bug 1) - YouTube: treat NULL expires_at as expired — always refresh (Bug 2) - Twitch: add 401-retry in _make_request with force_refresh (Bug 3) - Spotify: guard NULL expires_at before datetime comparison (Bug 4) - YouTube/Twitch: add POST force-reauth endpoints to clear broken tokens and return a fresh OAuth consent URL (Bug 5) Adds regression tests for all bugs: - youtube_action_module/tests/test_oauth_manager.py (7 tests) - twitch_action_module/tests/test_token_manager.py (+4 tests, 10 total) - spotify_interaction_module/tests/test_oauth_service.py (4 tests) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
pip (action modules — pip-compile regenerated): - aiohttp 3.10.x → 3.13.5 (GHSA-c427-h43c-vf67 and others) - PyJWT ==2.8.0 → >=2.12.0 in all .in files (GHSA-752w-5fwx-jx9f) - flask >=3.0.0,<3.1.0 → >=3.1.3 in discord (GHSA-68rp-wp8r-4726) - cryptography >=44.0.3 → >=46.0.6 in twitch (GHSA-r6ph-v2qm-q3c2) - protobuf >=5.29.5 → >=5.29.6 in twitch (GHSA-7gcm-g887-7qv7) - pytest ==7.4.3 → >=9.0.3 in twitch (GHSA-6w46-j5rx-g56g) - requests >=2.32.4 → >=2.33.0 in youtube (GHSA-gc5v-m9x4-r6x2) - quart >=0.19.4 → >=0.20.0 in slack (GHSA-q34m-jh98-gwm2) pip (core modules — constraint lower-bounds bumped): - aiohttp >=3.11.18 → >=3.13.4 in video_proxy, engagement - aiohttp >=3.10.0 → >=3.13.4 in workflow_core - protobuf >=5.29.4 → >=5.29.6 in video_proxy, engagement, flask_core - pytest ==7.4.x/>=7.4.0 → >=9.0.3 in all four core modules npm: - nodemailer 7.0.13 → 8.0.5 in admin/hub_module/backend (GHSA-vvjj-xcjg-gr5g) - next 15.5.10 → 15.5.15 in website (GHSA-q4gf-8mx6-v5v3) Dismissed 39 stale alerts: archive/ directory (not_used), Go modules already at compliant versions, npm lockfile already at patched versions, GitHub Actions already pinned to trivy-action v0.35.0, pion/dtls no_fix. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…-j8vq-pqhj) Bumps from >=3.4.0 to >=3.5.0 (latest, fully patched) so Dependabot can unambiguously close GHSA-6c5p-j8vq-pqhj and GHSA-cjwg-qfpm-7377. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This reverts commit d5771db.
- @aws-sdk/client-s3: ^3.700.0 → ^3.1051.0 (backend) - axios: 1.15.0 → ^1.15.2 (backend + frontend) - uuid: ^11.0.3 → ^14.0.0 (backend; v4 API unchanged) - nodemailer: already at 8.0.5, pinned with caret - postcss: ^8.4.49 → ^8.5.15 (frontend devDep) - next: 15.5.15 → ^15.5.18 (website) - Fixed ws moderate vuln (GHSA-58qx-3vcg-4xpx) via audit fix - Known: postcss moderate vuln inside next bundled deps (upstream, no safe fix) - Note: frontend lock file pending penguin-libs auth fix (separate branch) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
… auth - Bump @penguintechinc/react-libs: ^1.2.0 → ^1.3.5 (latest published) - Add admin/hub_module/frontend/.npmrc scoping @penguintechinc to npm.pkg.github.com; uses ${NODE_AUTH_TOKEN} env var (no token committed) - Add NPM_TOKEN build arg to hub-api in docker-compose.yml so local docker compose up --build resolves the private package - CI already passes NPM_TOKEN=${{ secrets.GITHUB_TOKEN }} for Docker builds - Frontend package-lock.json will be regenerated by CI (requires read:packages token not available in local gh auth scope) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
fix(deps): apply dependabot security updates for v2.2.x
Replace nginx Ingress with 3 Gateway API HTTPRoutes (Gateway API limits 16 rules/route; waddlebot has 33 paths). Split into: - httproute-hub: hub-api routes + router + core modules + interactive-ai - httproute-modules: interactive modules + marketplace paths - httproute-misc: marketplace catch-all + collectors + webui Disable helm template httproute generation (single route exceeds limit). Part of dal2-beta nginx-ingress EOL. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…nc/await patterns Updated 12 workflow files to streamline CI/CD, consolidate container builds, and improve action references. Updated 3 Flask interaction modules (inventory, lfg, server_status) to support async operation. Updated Helm values for k8s deployment. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR represents the v2.2.x release — microservice consolidation, vendor portal, AI knowledge base, plus the following stability fixes landed in this branch:
Stability Fixes (latest commit ae9a39b)
DATABASE_URLscheme frompostgresql://topostgres://— pydal only registers thepostgres://adapter; services were silently falling back to localhostDATABASE_URLfrom individual env var components when not set directly (matches K8s configmap injection pattern)AdminInteractionChannelsbadge label trim +allow_ad_hoc_voicereset on type switch;CommunityInteractionempty-state;CommunitiesPageauth loading guardTest plan
networkidlewait + re-check🤖 Generated with Claude Code