Repository navigation
CroCode v0.2.0
New features
- Review findings appear next to the reviewed file diff. Suggested changes show the lines they replace when a stored patch is available.
- Review pages group findings by file and show severity counts in a compact layout.
- The dashboard supports light and dark themes.
- Dashboard accounts show GitHub names and avatars.
- Public guides are available on GitHub Pages at https://kacigaya.github.io/crocode/.
Fixes
- Save findings and patches in one transaction. Read both from one database snapshot.
- Preserve empty context lines and respect hunk bounds when matching findings to a patch.
- Use the plain finding list when a file path cannot be represented safely in a patch header.
Upgrade
- Rebuild the API, worker, and dashboard together. The API applies migration
0002_review_files.sqlat startup. - Existing reviews keep their findings. They use the plain list because their patches were not stored.
- Patches over 256 KiB per file are not stored.
Validation
- Rust format and Clippy checks passed. All 43 Rust tests passed, including 10 database tests.
- Web lint, type checks, 33 tests, production build, and standalone smoke checks passed.
- Static docs build and export checks passed.
- Both Compose configurations passed validation.
- Server, sandbox, and dashboard images built on ARM64. The server command help passed a container check. AMD64 image validation runs in CI; this host has no emulator.
Known dependency advisories
The application lockfile scan checked 807 public package versions. Existing advisories remain documented in docs/security.md and docs/dashboard.md:
unsafe-libyaml0.2.11: RUSTSEC-2024-0449 reports an unmaintained dependency. OSV supplies no severity, CVE alias, or fixed version. https://osv.dev/vulnerability/RUSTSEC-2024-0449- Development lint dependencies
minimatch3.1.5 and 10.2.6: GHSA-g3hv-75wg-m249 / CVE-2026-118764. OSV lists affected versions from 0 to before 11.0.1, with a fix in 11.0.1. Supplied severity vector:CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N. No cross-major override is applied. https://osv.dev/vulnerability/GHSA-g3hv-75wg-m249
The scan does not cover container OS packages or dependencies embedded in agent binaries.