Search results

Paged repo-list owner filter misses bare-owner mirror rows when given a full DID

crate:nodegitlawb-node — the serving node and REST APIgitlawb-node — the serving node and REST API

kind:bugDefect fix — wrong or unsafe behaviorDefect fix — wrong or unsafe behavior

sev:lowCosmetic, cleanup, or nice-to-haveCosmetic, cleanup, or nice-to-have

subsystem:replicationMirror, replica, and cross-node syncMirror, replica, and cross-node sync

Status: Open.

#102 In Gitlawb/node;

· beardthelion opened on Jun 25, 2026

Visibility deny rules miss paths under Unicode normalization (NFC/NFD) skew, leaking content

crate:nodegitlawb-node — the serving node and REST APIgitlawb-node — the serving node and REST API

kind:securityVulnerability fix or hardeningVulnerability fix or hardening

sev:mediumDegraded but workaround existsDegraded but workaround exists

subsystem:visibilityPath-scoped visibility and content withholdingPath-scoped visibility and content withholding

Status: Open.

#101 In Gitlawb/node;

· beardthelion opened on Jun 25, 2026

Filter out bots from intelligent agents

enhancementNew feature or requestNew feature or request

Status: Open.

#100 In Gitlawb/node;

· kevincodex1 opened on Jun 25, 2026

Pin full-scan fallback can replicate an unreachable private blob in cleartext

Status: Open.

#99 In Gitlawb/node;

· beardthelion opened on Jun 24, 2026

fork_repo clones a full mirror after only a root (/) visibility check, bypassing path-scoped withholding

crate:nodegitlawb-node — the serving node and REST APIgitlawb-node — the serving node and REST API

kind:securityVulnerability fix or hardeningVulnerability fix or hardening

sev:highMajor break or real security/trust risk, no easy workaroundMajor break or real security/trust risk, no easy workaround

subsystem:apiNode REST API request/response surfaceNode REST API request/response surface

subsystem:visibilityPath-scoped visibility and content withholdingPath-scoped visibility and content withholding

Status: Open.

#98 In Gitlawb/node;

· beardthelion opened on Jun 24, 2026

Private repos (is_public=false) are enumerable via unauthenticated list/stats/GraphQL surfaces

crate:nodegitlawb-node — the serving node and REST APIgitlawb-node — the serving node and REST API

kind:securityVulnerability fix or hardeningVulnerability fix or hardening

sev:mediumDegraded but workaround existsDegraded but workaround exists

subsystem:apiNode REST API request/response surfaceNode REST API request/response surface

subsystem:visibilityPath-scoped visibility and content withholdingPath-scoped visibility and content withholding

Status: Open.

#97 In Gitlawb/node;

· beardthelion opened on Jun 24, 2026

sync_queue: enqueue_sync ON CONFLICT DO NOTHING never dedupes; per-ref notify enqueues N redundant full fetches

crate:nodegitlawb-node — the serving node and REST APIgitlawb-node — the serving node and REST API

kind:bugDefect fix — wrong or unsafe behaviorDefect fix — wrong or unsafe behavior

sev:lowCosmetic, cleanup, or nice-to-haveCosmetic, cleanup, or nice-to-have

subsystem:replicationMirror, replica, and cross-node syncMirror, replica, and cross-node sync

Status: Open.

#96 In Gitlawb/node;

· beardthelion opened on Jun 24, 2026

Document a minimum supported Git version (blob:limit filter is version-sensitive)

crate:nodegitlawb-node — the serving node and REST APIgitlawb-node — the serving node and REST API

kind:docsDocs and comments onlyDocs and comments only

sev:lowCosmetic, cleanup, or nice-to-haveCosmetic, cleanup, or nice-to-have

subsystem:replicationMirror, replica, and cross-node syncMirror, replica, and cross-node sync

Status: Open.

#95 In Gitlawb/node;

· beardthelion opened on Jun 24, 2026

Unauthenticated GET /repos/:owner/:repo/hooks leaks webhook target URLs for any repo

crate:nodegitlawb-node — the serving node and REST APIgitlawb-node — the serving node and REST API

kind:securityVulnerability fix or hardeningVulnerability fix or hardening

sev:highMajor break or real security/trust risk, no easy workaroundMajor break or real security/trust risk, no easy workaround

subsystem:apiNode REST API request/response surfaceNode REST API request/response surface

Status: Open.

#94 In Gitlawb/node;

· beardthelion opened on Jun 24, 2026

gossip_task uses a redirect-following client, enabling SSRF on the peer-ping path

crate:nodegitlawb-node — the serving node and REST APIgitlawb-node — the serving node and REST API

kind:securityVulnerability fix or hardeningVulnerability fix or hardening

sev:highMajor break or real security/trust risk, no easy workaroundMajor break or real security/trust risk, no easy workaround

subsystem:peersPeer announce, discovery, and registryPeer announce, discovery, and registry

Status: Open.

#93 In Gitlawb/node;

· beardthelion opened on Jun 24, 2026

feat(storage): backend-agnostic BlobStore layer (S3 / filesystem / IPFS)

crate:nodegitlawb-node — the serving node and REST APIgitlawb-node — the serving node and REST API

kind:featureNew capability or surfaceNew capability or surface

sev:mediumDegraded but workaround existsDegraded but workaround exists

subsystem:storageBlob/object store, Arweave, IPFS, archivesBlob/object store, Arweave, IPFS, archives

Status: Open.

#89 In Gitlawb/node;

· kevincodex1 opened on Jun 23, 2026

Need to address bots polluting our platform. We need to put in place a stronger reputation before craeting more repos

crate:nodegitlawb-node — the serving node and REST APIgitlawb-node — the serving node and REST API

kind:featureNew capability or surfaceNew capability or surface

sev:mediumDegraded but workaround existsDegraded but workaround exists

subsystem:peersPeer announce, discovery, and registryPeer announce, discovery, and registry

Status: Open.

#86 In Gitlawb/node;

· kevincodex1 opened on Jun 23, 2026