rabbitblood f4207cd1dc fix(F1085): scope rm to /configs/<path> not /configs + <path> ... rm received /configs and filePath as two separate arguments, deleting the entire /configs dir on every call. Concatenate to target only the intended file. validateRelPath already prevents traversal, so this is a logic bug not a security vulnerability. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>		2026-04-22 15:42:50 -07:00
..
artifacts	fix(tenant-guard): allowlist /registry/register + /registry/heartbeat (#1236)	2026-04-21 02:47:27 +00:00
bundle	fix(platform): unblock SaaS workspace registration end-to-end	2026-04-21 03:06:46 -07:00
channels	fix(errcheck): suppress unchecked resp.Body.Close() across workspace-server (#1229)	2026-04-21 02:45:34 +00:00
crypto
db
envx
events
handlers	fix(F1085): scope rm to /configs/<path> not /configs + <path>	2026-04-22 15:42:50 -07:00
metrics
middleware	fix(restart): support SaaS control-plane provisioner (unblocks Platform Go build too) (#1512)	2026-04-21 22:56:01 +00:00
models	fix: CWE-78 rm scope, go vet failures, delegation idempotency	2026-04-21 18:22:30 +00:00
orgtoken	fix: CWE-78 rm scope, go vet failures, delegation idempotency	2026-04-21 18:22:30 +00:00
plugins
provisioner	feat(provisioner): pull workspace-template images from GHCR	2026-04-22 12:39:56 -07:00
registry	fix(sweeper): emit WORKSPACE_PROVISION_FAILED so canvas updates UI	2026-04-20 20:38:41 -07:00
router	Merge remote-tracking branch 'origin/staging' into feat/bootstrap-failed-and-console-proxy	2026-04-20 17:31:16 -07:00
scheduler	fix: CWE-78 rm scope, go vet failures, delegation idempotency	2026-04-21 18:22:30 +00:00
supervised
ws
wsauth