Commits

Commits on Sep 19, 2026

db: forge sqlite URLs rejected by url.Parse
rjarry
committed
63f07d0
lint: version CI tooling in go.tool.mod
rjarry
committed
ff090e8
go: bump all dependencies
rjarry
committed
b684b81
mail: handle multipart without closing boundary

fstachura
authored and
rjarry
committed
98a934c
lint: bump golangci-lint to v2.13.2

fstachura
authored and
rjarry
committed
1c8949a
pw: add db generate command

fstachura
authored and
rjarry
committed
f842a4d
email: add option to disable sending emails

fstachura
authored and
rjarry
committed
10b79b7
ingress: add optional anonymization

fstachura
authored and
rjarry
committed
52f4873

Commits on Sep 4, 2026

pw: add db status command
rjarry
committed
924ca56

Commits on Sep 3, 2026

patchwork: release v4.0.0-rc10
rjarry
committed
3bd7b52
db: enforce unique usernames
rjarry
committed
d161a8e
docs: define the nginx rate limit key per client
rjarry
committed
e66a139
admin: share stdin reader across password prompts
rjarry
committed
b940993
web: avoid username enumeration on login timing
rjarry
committed
67beeaa
db: roll back the request transaction on handler panic
rjarry
committed
9129ebb
mail: reset the content buffer before each part
rjarry
committed
b452b8b
db,web: check crypto/rand failures when generating secrets
rjarry
committed
d2fa2b9
db: compare password hashes in constant time
rjarry
committed
3207cd6
db: create the sqlite file with owner-only permissions
rjarry
committed
8f017f0
events: refuse SMTP AUTH over an unencrypted connection
rjarry
committed
e43bb5c
db: keep existing person name on ingest
rjarry
committed
61da8b2
web: invalidate sessions on password change and reset
rjarry
committed
b7d2816
web: set Secure attribute on the session cookie
rjarry
committed
993d438
web: reject non-local login redirect targets
rjarry
committed
7d0a8f3
http: set request timeouts on the server
rjarry
committed
35d86d5
mail: honor X-Patchwork control headers only from maintainers
rjarry
committed
29aa6ea
db: reject API tokens of inactive users
rjarry
committed
2bcd5d3
ingress: cap accepted message size
rjarry
committed
590e71f
db: generate confirmation tokens from crypto/rand
rjarry
committed
c4c9812
web: validate link scheme for pull and check URLs
rjarry
committed
c793433
events: block SSRF in webhook delivery
rjarry
committed
8e2af95
api: hide non-public bundles from other users
rjarry
committed
09f0a0a
web: restrict patch edits to maintainers and submitters
rjarry
committed
8f54d92
mk: use cache for import reviser
rjarry
committed
5ee1e83

Commits on Aug 31, 2026

smoke: add end-to-end test suite driving the pw binary
rjarry
committed
1e544d0