v1.3.1

Security

This release includes hardening fixes identified during an internal security review:

• Supply-chain integrity — the gitleaks binary auto-installed by the secret-scan hook is now checksum-verified before execution (#457).
• Path/SSRF-adjacent input validation — repository owner/name segments are now validated before being used to construct the upstream URL (#458).

What's Changed

• chore(deps-dev): bump tar from 7.5.16 to 7.5.21 in /fogwall-dashboard/frontend by @dependabot[bot] in #455
• fix(secret-scan): verify gitleaks release checksum before auto-install by @coopernetes in #457
• fix(proxy): validate repository owner/name segments before URL construction by @coopernetes in #458
• fix(deps): pin plugin-classpath Jackson to 2.22.1 by @coopernetes in #459
• docs: refresh README/docs for 1.3.0, restructure for readability by @coopernetes in #460
• docs(demos): restore screenshot sources, re-record push-fail-then-fix demo by @coopernetes in #461
• chore/upgrade react router by @coopernetes in #466
• chore(deps): bump the frontend-npm-dependencies group across 1 directory with 9 updates by @dependabot[bot] in #467
• chore(deps): bump the github-actions group across 1 directory with 3 updates by @dependabot[bot] in #464
• chore(deps): bump the java-dependencies group across 1 directory with 7 updates by @dependabot[bot] in #468
• chore(deps): bump the codeql-actions group across 1 directory with 3 updates by @dependabot[bot] in #462
• fix(proxy): replace raw NUL byte in ParseGitRequestFilter; collapse pre-commit into formatAll by @coopernetes in #470
• fix(cache): key the mirror fetch cooldown by principal, not repository alone by @coopernetes in #471
• fix(approval): fail closed when the approval gate cannot read its push record by @coopernetes in #473
• fix(proxy): make transparent proxy work against private repos, and stop three false rejections by @coopernetes in #472
• fix(cache): stop two providers hosting the same repo path from sharing one mirror by @coopernetes in #480
• chore(deps-dev): bump the frontend-npm-dependencies group in /fogwall-dashboard/frontend with 5 updates by @dependabot[bot] in #482
• chore(deps): bump the java-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #483
• chore(deps): bump the codeql-actions group across 1 directory with 3 updates by @dependabot[bot] in #484
• fix(approval): scope an approved re-push to the repository it was approved for by @coopernetes in #481
• fix(config): let codeberg provider use a configured SSH uri by @coopernetes in #489
• chore: fix Gradle 10 deprecation warning and refresh CLAUDE.md by @coopernetes in #490
• fix(proxy): cap push size and refuse Git LFS uploads by @coopernetes in #491
• chore(deps): bump eclipse-temurin from 3eb81ed to 735baf2 by @dependabot[bot] in #493
• chore(deps): bump the java-dependencies group across 1 directory with 11 updates by @dependabot[bot] in #499
• fix(store-and-forward): challenge fetch/clone for credentials, not just push by @coopernetes in #498
• chore(deps-dev): bump the frontend-npm-dependencies group across 1 directory with 6 updates by @dependabot[bot] in #500
• chore(deps): bump the codeql-actions group across 1 directory with 3 updates by @dependabot[bot] in #497
• chore(deps): bump the github-actions group across 1 directory with 4 updates by @dependabot[bot] in #495
• chore: bump version to 1.3.1 by @coopernetes in #501

Full Changelog: v1.3.0...v1.3.1