v1.0.0 Release#11
Merged
Merged
Conversation
darox
force-pushed
the
claude/review-project-improvements-eUgOu
branch
from
9e7ae1b to
b815fa2
Compare
|
Failed to generate code suggestions for PR |
darox
force-pushed
the
claude/review-project-improvements-eUgOu
branch
2 times, most recently
from
f660ea6 to
681da97
Compare
darox
force-pushed
the
claude/review-project-improvements-eUgOu
branch
from
681da97 to
7b82806
Compare
|
Failed to generate code suggestions for PR |
PR Reviewer Guide 🔍(Review updated until commit 91497ad)Here are some key observations to aid the review process:
|
|
Failed to generate code suggestions for PR |
1 similar comment
|
Failed to generate code suggestions for PR |
Owner
Author
|
Preparing review... |
2 similar comments
Owner
Author
|
Preparing review... |
Owner
Author
|
Preparing review... |
|
Failed to generate code suggestions for PR |
Owner
Author
|
Preparing review... |
darox
force-pushed
the
claude/review-project-improvements-eUgOu
branch
from
fcd10a5 to
eb2dd3c
Compare
Owner
Author
|
Preparing review... |
2 similar comments
Owner
Author
|
Preparing review... |
Owner
Author
|
Preparing review... |
darox
changed the title
github-actions
Bot
added
Review effort 3/5
and removed
Review effort 4/5
Possible security concern
labels
|
Persistent review updated to latest commit 91497ad |
- Safety hardening: API key sanitization, array bounds, safe error logging - Wired Ethernet connection support - VPN tunnel stability fixes - Certificate pinning with TOFU + expiry validation - View extraction: CollapsibleSection, DiagnosticsLog, UpdateChecker - Add CHANGELOG.md documenting all features - Add swift test to CI release workflow - Remove buggy PR-Agent integration
darox
force-pushed
the
claude/review-project-improvements-eUgOu
branch
from
70909fe to
0e5eb11
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
User description
Summary
swift teststep to CI release workflowPre-merge Verification
After merging, create tag
v1.0.0on main to trigger the release workflow.PR Type
Enhancement, Bug fix
Description
Security hardening: moved cert pins to Keychain, reject on mismatch (MITM fix), validate cert expiry via X.509 OIDs, strip control chars from API key, exponential backoff with auth-failure halt, URL validation, and response sanity caps
Added wired Ethernet detection, monitoring sections (DDNS, port forwards, nearby APs), diagnostics log with export, update checker, section visibility prefs, compact mode, and configurable poll interval
Fixed sites response null-data crash, overlapping refresh races, URLSession/memory leaks on reconfigure, and generation-based refresh cancellation
Refactored UI to explicit parameters, added cert-pin reset flow, detailed error states with reasons, and SI/decimal byte formatting
Security Impact Assessment:
Certificate pinning TOFU fix: Previously, on cert mismatch the pin was silently overwritten, allowing MITM attacks. Now mismatches are rejected and explicitly flagged for user review.
Keychain storage: Certificate pins moved from
UserDefaults(world-readable) toKeychainwithkSecAttrAccessibleWhenUnlockedThisDeviceOnly.API key sanitization: Control characters stripped from API key to prevent HTTP header injection.
Safe error logging:
safeErrorDescription()strips URLs and credential fragments from log output.Response sanity caps: Client list capped at 5,000, devices at 500, sessions at 1,000 to prevent memory exhaustion from compromised controllers.
Auth failure halt: Polling stops on 401/403; no further credential replay until user reconfigures.
Diagram Walkthrough
File Walkthrough
10 files
Security hardening, flexible decoding, monitoring APIs, cert pinmigrationError handling, backoff, auth halt, monitoring fetch, diagnosticsloggingRedesigned preferences with sections, diagnostics, cert reset,visibility togglesRefactored to explicit params, error views with diagnostics,monitoring sectionsAdded ErrorState reasons, monitoring fields, clearState, SI byteformattingImproved error messages, URL validation integration, rate limiting fixRefactored to explicit parameters instead of WiFiStatus dependencyNew diagnostics log with categories, levels, export, and event capAdded section visibility, compact mode, poll interval, cert cleanup onresetReturn all active interface IPs for wired+WiFi matching1 files
Tests for quality labels, status bar colors/symbols, clearState, errordisplay, formatting35 files