Upgrade dependencies and harden multi-user security

[bifrost0x]

Summary

• upgrade and reproducibly lock the Python dependency stack, including Paramiko 5, Cryptography 49, Gunicorn 26, Redis 8, and bcrypt 5
• remove Eventlet and move Socket.IO and background execution to native threads while preserving the single-worker in-memory runtime model
• harden atomic storage, schema validation, corruption handling, migrations, per-user SSH host trust, DNS/address pinning, resource quotas, and transfer cancellation
• add bounded transfer routes, readiness checks, audit retention/export, verified backups, secret rotation, and explicit production deployment safeguards
• add username-less discoverable passkeys, OIDC identity flows, recovery controls, security management views, and administrator bootstrap behavior
• localize all PR-introduced account, security, audit, host-trust, recovery, OIDC, passkey, transfer, and reconnect UI across English, Vietnamese, German, French, Spanish, and Chinese
• make the first registered account on a fresh installation an administrator; preserve all existing administrators and repair only installations that have users but no administrator
• rate-limit and timing-harden recovery login, prune expired WebAuthn challenges, and remove SQLAlchemy legacy API use
• pin CI actions and container inputs and add supply-chain, JavaScript unit, and vulnerability gates
• validate SFTP preview inputs and bound Paramiko channel, shell, SFTP, and command-completion waits
• close temporary server-to-server transfer clients reliably, complete OIDC identity administration, and serialize WebAuthn registration limits
• scope asynchronous administrator security actions to immutable modal contexts and prevent overlapping recovery-code rotations
• isolate maintenance commands from OIDC runtime initialization while preserving normal startup validation
• propagate midstream download failures and safely handle leading-dash folder names in remote ZIP commands

Why

The previous runtime and dependency set constrained security updates and relied on Eventlet-specific behavior. Several persistence, host-key, transfer, lifecycle, identity, audit, deployment, and account-recovery paths also needed stronger failure handling and clearer security boundaries before the dependency stack could be upgraded safely.

Impact

This is a broad runtime and security upgrade. Deployments gain current dependencies, reproducible installation, stronger per-user isolation, bounded operations, modern identity options, and safer recovery and administration behavior. Existing administrator roles are retained. A fresh homelab opens a one-time browser bootstrap that creates exactly one initial administrator and then closes atomically. Existing installations preserve their administrators. The production overlay rejects browser bootstrap and open registration.

Passkey sign-in is username-less to prevent account enumeration. Existing non-discoverable credentials can be replaced from the authenticated Security page through the current-password-protected replacement flow. Audit exports carry explicit completeness metadata and warn when the bounded scan limit is reached.

Recovery login now shares the login rate-limit policy and uses fixed verification work for missing, locked, and existing accounts. Expired WebAuthn challenges are pruned during challenge creation.

Deployment documentation and environment-variable guidance have been updated for the new runtime, security profile, identity providers, backup and rotation workflow, and operational checks.

Validation

• installed requirements.txt and requirements-test.txt in a clean Python 3.11 environment with uv pip install --require-hashes
• final GitHub Python regression: 1247 passed, 28 skipped
• local full Python regression: 1241 passed, 33 skipped
• JavaScript unit suite: 60 passed
• browser E2E suite: 21 passed
• npm audit --omit=dev: 0 vulnerabilities
• CodeQL, Dependabot, secret scanning, multi-architecture image builds, Trivy image scans, Redis 7/8, SSH integration, and container threading checks passed
• regression coverage confirms OIDC-independent maintenance commands, rejects maintenance-command names used only as server option values, propagates midstream I/O and transfer-limit failures, and treats leading-dash ZIP members as paths
• Python bytecode compilation, Graphify refresh, Docker Compose validation, final Docker image build and health check, persisted-secret CLI execution, and git diff --check passed
• independent full-diff and bounded final-delta reviews found no remaining Critical, Important, or Minor finding
• final scope and added-line scans found no runtime artifacts, secrets, local paths, duplicate files, or internal tool markers

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3b987ffe7e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".