Development

[jordanlambrecht]

No description provided.

[github-actions]

Knip Code Analysis

Found 6 total issues

Category	Count
Unused Dependencies	1
Unused Dev Dependencies	2
Unused Exports	3

View details

Run pnpm knip locally to see the full report.

Use pnpm knip:filter pattern to filter results by file path.

---

Use /** @public */ JSDoc tags to mark intentionally exported symbols.

[github-actions]

✅ Security audit passed

Passed (36/36)

• ✅ Auth enforcement on protected routes (per-handler)
• ✅ No dangerous functions (eval, innerHTML, etc.)
• ✅ No hardcoded secrets in source
• ✅ Security headers in next.config.ts
• ✅ Cookie security (httpOnly, sameSite, secure)
• ✅ No sensitive fields in API responses
• ✅ No .env files committed to repo
• ✅ No raw SQL in API routes
• ✅ No fetch/redirect with unvalidated URLs in routes
• ✅ Timing-safe comparison for secret values
• ✅ No raw SQL migration files (schema-first only)
• ✅ External fetch calls have timeouts
• ✅ Docker container runs as non-root user
• ✅ Public routes match proxy allowlist
• ✅ File delete operations have path traversal defense
• ✅ Password hashing uses Argon2 (not SHA-256/bcrypt)
• ✅ Encrypted columns written via encrypt()
• ✅ TOTP 2FA flow integrity
• ✅ Emergency lockdown flow integrity
• ✅ Scrub & delete (nuke) flow integrity
• ✅ Backup restore flow integrity
• ✅ Login flow integrity
• ✅ Auth result checked before proceeding
• ✅ Backup password inputs bounded before key derivation
• ✅ Webhook delivery fetch uses redirect: "error"
• ✅ SESSION_SECRET minimum-length guard in auth/crypto modules
• ✅ Notification URL validators include SSRF protection
• ✅ Dockerfile does not COPY sensitive files
• ✅ No secret env vars in client components
• ✅ No console.log in API routes
• ✅ No TODO/FIXME in security-critical files
• ✅ JSON.parse wrapped in try-catch
• ✅ No swallowed errors in catch blocks
• ✅ Request body size validation on upload routes
• ✅ BigInt fields use string serialization
• ✅ No raw error messages in API responses

---

Summary: 36/36 checks passed

See scripts/security-audit.ts for check definitions and SECURITY.md for the full security architecture.

[Copilot]

Pull request overview

Updates a small set of frontend/runtime dependencies and refreshes a few GitHub Actions versions to keep the project’s build, release, and tooling workflows current.

Changes:

• Bump next, jose, and @tanstack/react-query to newer patch/minor versions.
• Regenerate pnpm-lock.yaml to reflect updated dependency graph.
• Update GitHub Actions used in docs, release, and knip-report workflows.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
package.json	Updates dependency versions for Next.js, jose, and TanStack React Query.
pnpm-lock.yaml	Lockfile refresh aligning resolved versions/snapshots with package.json bumps.
.github/workflows/release.yml	Updates anchore/sbom-action used during release SBOM generation.
.github/workflows/knip-report.yml	Updates marocchino/sticky-pull-request-comment used to post Knip results.
.github/workflows/docs.yml	Updates actions/setup-python used in docs build/deploy jobs.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

⚠️ Tracker registry warnings

MyAnonaMouse (`myanonamouse`) — Warnings (4)

Field	Status
Missing releaseGroups	⚠️ Warning
Missing notableMembers	⚠️ Warning
Missing bannedGroups	⚠️ Warning
Missing rules.fullRulesMarkdown	⚠️ Warning

---

Allowed content categories: Movies, TV, Music, Games, Apps, Sports, Books, Audiobooks, Comics, Manga, Anime, XXX, Documentaries, Education, Tutorials, Fanres

See src/data/__tests__/tracker-registry.test.ts for all validation rules.

[Copilot]

Pull request overview

Copilot reviewed 139 out of 154 changed files in this pull request and generated 7 comments.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported