Skip to content

v0.8.0

Pre-release
Pre-release

Choose a tag to compare

View all tags
@SabeeirSharrma SabeeirSharrma released this 28 Jun 09:55
v0.8.0
9f12781

COMBINED WITH PATCHES FOR v0.7.0 (v0.7.1 and v0.7.2)

CPAC v0.8.0 Release Notes

Overview

v0.8.0 completes the Trust DB panel system with a unified Review workflow, connects AI analysis to NVIDIA NIM reasoning models, adds automated weekly email reports, and configures a daily cron trigger. This is the first release with a fully operational advisory pipeline.

Changes

Panel Redesign — Unified Review Workflow

All three panels (volunteer, maintainer, admin) now share a single "Review" tab:

  • Package list — auto-fetched on load, shows packages needing advisories
  • Automated compare — LCS diff runs on package select, highlights suspicious patterns
  • AI analysis — on-demand via NVIDIA NIM, structured response with recommendation, summary, severity, affected/safe versions
  • Layout toggle — Tabs or Side-by-Side, persisted to localStorage
  • Notes system — floating notes button, auto-saved per package, cleared on publish
  • Recompare — re-run with different versions

NVIDIA NIM AI Integration

  • Worker proxies requests to NVIDIA NIM (API key stays server-side)
  • Reasoning model (nemotron-3-super-120b-a12b) for security-focused diff analysis
  • Nano model (nemotron-3-nano-30b-a3b) for weekly report summaries
  • 3-hour cache in Supabase ai_analysis table

Weekly Email Reports via Resend

  • Reports generated daily, sent exactly 7 days after previous report per user
  • Staggered by account creation date (Mon→Mon, Wed→Wed, etc.)
  • HTML table in email body with submissions, approval rate, trust tier
  • Zero activity = no email that week
  • Ephemeral: stored→sent→deleted

Cloudflare Cron Trigger

  • Daily at midnight UTC (0 0 * * *)
  • Calls /reports/generate then /reports/send
  • Worker config migrated to wrangler.jsonc

Account Management

  • Admin panel creates volunteer/maintainer accounts (random password emailed via Resend)
  • No public signups — admin-only account creation
  • POST /accounts/create endpoint on Worker

RLS & Auth Fixes

  • SECURITY DEFINER functions prevent recursive RLS on profiles
  • All panel auth uses currentSession.access_token as Bearer token
  • Panels call Supabase REST API directly (Worker proxy URL unreachable due to missing DNS CNAME — now fixed)

CPAC v0.7.2 Release Notes

Overview

v0.7.2 adds paru preference to help text, fixes donate link trailing slash, and expands suspicious pattern detection for npm/bun pipe-to-shell attacks.

Changes

  • Paru preference in help — cpac --help now mentions Paru is preferred (yay still supported)
  • Donate link trailing slash — Fixed to https://thecinderproject.qd.je/donate/
  • npm/bun pipe-to-shell detection — Pass 2 now catches npm install | sh, bun install | sh, npx | sh, curl | npx, wget | npx patterns
  • Unknown package behavior — Local scoring still runs when package not in trust DB; missing DB data shown as neutral signals (+0), not penalties

CPAC v0.7.1 Release Notes

Overview

v0.7.1 adds a donate link to the help output and continues the multi-session site redesign.

Changes

  • Donate link in help — cpac --help now displays Donate: https://thecinderproject.qd.je/donate

Full Changelog: v0.7.0...v0.8.0

Assets 5
Loading