Issues - iterative-works/support - Forgejo: Beyond coding. We Forge.

iterative-works/support

Watch

New issue

email: require STARTTLS and check the SMTP server identity (configurable)

#73 opened 2026-10-17 19:34:43 +00:00 by claude

tapir JS client: send the pac4j CSRF token on every request, and set the session cookie Secure flag behind a path callbackBase

#72 opened 2026-10-17 18:54:41 +00:00 by claude

MariaDBFormPersistenceService draft delete generates SQL that MariaDB 10.6 rejects

#69 opened 2026-10-04 12:09:16 +00:00 by claude

CI: a GitHub outage fails every job at the JDK download

#68 opened 2026-10-03 22:29:58 +00:00 by claude

pac4j session security: empty CSRF token accepted, session cookie never Secure, session map never evicted

#63 opened 2026-09-22 18:50:22 +00:00 by claude

Pac4jModuleRegistry: no hook for matchers/authorizers; non-rotating CSRF token expires after 4 h and is never renewed

#62 opened 2026-09-20 10:46:06 +00:00 by claude

maxformbodysize is not bounds-checked, so a bad value fails at layer construction instead of config load

#58 opened 2026-09-14 19:55:58 +00:00 by claude

Four pac4j security files carry no PURPOSE header, unlike the rest of the package

#57 opened 2026-09-14 19:55:58 +00:00 by claude

Body-borne pac4jCsrfToken fails the CSRF check when Content-Type carries a charset parameter

#56 opened 2026-09-14 19:55:58 +00:00 by claude

Pac4jCsrfSupport.tokenFor builds a body-reading web context, a latent re-entry point for the SUPP-53 body drain

#55 opened 2026-09-14 19:55:58 +00:00 by claude

Text.scala's four opaque types validate identically, so their names promise a safety distinction they do not make

#52 opened 2026-09-07 09:40:21 +00:00 by mph

MessageCatalogue.debug drops UserMessage args, unlike the unresolved-key fallback

#51 opened 2026-09-07 09:40:04 +00:00 by mph

InMemoryFormPersistenceService is JS-only, so no JVM unit spec can use it

#50 opened 2026-09-07 08:54:36 +00:00 by mph

e2e-testing: no way to register per-navigation page state on the shared Page

#49 opened 2026-09-03 10:39:19 +00:00 by mph

Transition.emit cannot express that requiresPayload already validated its payload

#48 opened 2026-09-03 09:50:28 +00:00 by mph

EventCoordinate should own its persistenceId|sequenceNr string format

#47 opened 2026-08-30 10:45:09 +00:00 by mph

MessageId: build the translation-key completeness check the type's own docstring promises

#44 opened 2026-08-22 07:07:19 +00:00 by mph

PekkoProjectionSupport: exactlyOnce does not cover the read-model write — projections are at-least-once against their own read model

#41 opened 2026-07-31 07:03:56 +00:00 by mph

BaseUri name is misleading — overloaded as path-prefix and as URL across consumers

#32 opened 2026-06-12 05:22:50 +00:00 by mprihoda

expense-log example: step 1 — skeleton module + Mill build + /health endpoint

#23 opened 2026-04-28 08:13:45 +00:00 by mprihoda Reference example: expense log 0 / 6

1 2