Skip to content

Fix/drop docker dep - #206

Closed
GoliathLabs wants to merge 1439 commits into
Place1:masterfrom
freifunkMUC:fix/drop-docker-dep
Closed

Fix/drop docker dep#206
GoliathLabs wants to merge 1439 commits into
Place1:masterfrom
freifunkMUC:fix/drop-docker-dep

Conversation

@GoliathLabs

@GoliathLabs GoliathLabs commented Sep 14, 2026

Copy link
Copy Markdown

detectDNSUpstream used github.com/docker/docker for two calls.

internal/resolvconf replaces both calls. It follows resolv.conf(5) the same
way: whitespace separated fields, '#' and ';' comments, entries that are not
a valid IP skipped, order preserved, addresses normalised through netip.

when /etc/resolv.conf lists 127.0.0.53 as its only nameserver, the real
upstreams are read from /run/systemd/resolve/resolv.conf

dependabot Bot and others added 30 commits October 1, 2025 19:01
@dependabot
build(deps): bump actions/setup-go from 5.5.0 to 6.0.0
6a2a4bc 
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5.5.0 to 6.0.0.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@d35c59a...4469467)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
build(deps): bump github/codeql-action from 3.29.7 to 3.30.5
3ef8eda 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.29.7 to 3.30.5.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@51f7732...3599b3b)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 3.30.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@T0biii
fix Version
c89e6e2
@T0biii
Merge pull request #985 from freifunkMUC/dependabot/github_actions/ac…
03110fb 
…tions/cache-4.3.0
@T0biii
Merge pull request #981 from freifunkMUC/dependabot/github_actions/do…
ba399aa 
…cker/login-action-3.6.0
@T0biii
Merge pull request #989 from freifunkMUC/dependabot/github_actions/gi…
406b678 
…thub/codeql-action-3.30.5
@T0biii
remove go 1.23 as go.mod requires go 1.24
0a62e90
@T0biii
Merge pull request #987 from freifunkMUC/dependabot/github_actions/ac…
3fc1114 
…tions/setup-go-6.0.0
@T0biii
go: run linter
5eae826
@T0biii
CI: bump golangci linter to v2.5
5a58110
@DasSkelett
Merge pull request #995 from freifunkMUC/run-linter
ad79b89 
go: run linter
@DasSkelett
Merge pull request #996 from freifunkMUC/T0biii-patch-1
591d7cc 
CI: bump golangci linter to v2.5
@dependabot
build(deps): bump gacts/gitleaks from 1.2.4 to 1.3.0 (#1003)
cd51e1e 
Bumps [gacts/gitleaks](https://github.com/gacts/gitleaks) from 1.2.4 to 1.3.0.
- [Release notes](https://github.com/gacts/gitleaks/releases)
- [Commits](gacts/gitleaks@c608b17...02aceef)

---
updated-dependencies:
- dependency-name: gacts/gitleaks
  dependency-version: 1.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): update mkdocs-material requirement (#1004)
7319496 
Updates the requirements on [mkdocs-material](https://github.com/squidfunk/mkdocs-material) to permit the latest version.
- [Release notes](https://github.com/squidfunk/mkdocs-material/releases)
- [Changelog](https://github.com/squidfunk/mkdocs-material/blob/master/CHANGELOG)
- [Commits](squidfunk/mkdocs-material@9.6.19...9.6.23)

---
updated-dependencies:
- dependency-name: mkdocs-material
  dependency-version: 9.6.23
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump crate-ci/typos from 1.34.0 to 1.39.0 (#999)
b17f69d 
Bumps [crate-ci/typos](https://github.com/crate-ci/typos) from 1.34.0 to 1.39.0.
- [Release notes](https://github.com/crate-ci/typos/releases)
- [Changelog](https://github.com/crate-ci/typos/blob/master/CHANGELOG.md)
- [Commits](crate-ci/typos@392b78f...07d900b)

---
updated-dependencies:
- dependency-name: crate-ci/typos
  dependency-version: 1.39.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump github/codeql-action from 3.30.5 to 4.31.2 (#1001)
9780b5d 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.30.5 to 4.31.2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@3599b3b...0499de3)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.31.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps-dev): bump vite (#997)
676b0aa 
Bumps the npm_and_yarn group with 1 update in the /website directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).


Updates `vite` from 6.3.6 to 6.4.1
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/create-vite@6.4.1/packages/vite)

---
updated-dependencies:
- dependency-name: vite
  dependency-version: 6.4.1
  dependency-type: direct:development
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump github.com/miekg/dns from 1.1.67 to 1.1.68 (#958)
9e54b0f 
Bumps [github.com/miekg/dns](https://github.com/miekg/dns) from 1.1.67 to 1.1.68.
- [Changelog](https://github.com/miekg/dns/blob/master/Makefile.release)
- [Commits](miekg/dns@v1.1.67...v1.1.68)

---
updated-dependencies:
- dependency-name: github.com/miekg/dns
  dependency-version: 1.1.68
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump github.com/stretchr/testify from 1.10.0 to 1.11.1 (#…
43b4257 
…959)

Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.10.0 to 1.11.1.
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](stretchr/testify@v1.10.0...v1.11.1)

---
updated-dependencies:
- dependency-name: github.com/stretchr/testify
  dependency-version: 1.11.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump google-protobuf from 4.0.0-rc.2 to 4.0.0 in /website (
7a41a90 
#960)

Bumps [google-protobuf](https://github.com/protocolbuffers/protobuf-javascript) from 4.0.0-rc.2 to 4.0.0.
- [Release notes](https://github.com/protocolbuffers/protobuf-javascript/releases)
- [Changelog](https://github.com/protocolbuffers/protobuf-javascript/blob/main/protobuf_javascript_release.bzl)
- [Commits](https://github.com/protocolbuffers/protobuf-javascript/commits/v4.0.0)

---
updated-dependencies:
- dependency-name: google-protobuf
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump google.golang.org/protobuf from 1.36.6 to 1.36.9 (#980
edb3dbc 
)

Bumps google.golang.org/protobuf from 1.36.6 to 1.36.9.

---
updated-dependencies:
- dependency-name: google.golang.org/protobuf
  dependency-version: 1.36.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump alpine from 3.22.1 to 3.22.2 (#1000)
ad99567 
Bumps alpine from 3.22.1 to 3.22.2.

---
updated-dependencies:
- dependency-name: alpine
  dependency-version: 3.22.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump golang from 1.24.5-alpine to 1.25.3-alpine in /proto (
2035c8a 
#1005)

Bumps golang from 1.24.5-alpine to 1.25.3-alpine.

---
updated-dependencies:
- dependency-name: golang
  dependency-version: 1.25.3-alpine
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump node from 24.8.0-bookworm to 25.1.0-bookworm in /pr…
8b1deb8 
…oto (#1006)

Bumps node from 24.8.0-bookworm to 25.1.0-bookworm.

---
updated-dependencies:
- dependency-name: node
  dependency-version: 25.1.0-bookworm
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump golang from 1.24.5-alpine to 1.25.3-alpine (#1002)
25751a9 
Bumps golang from 1.24.5-alpine to 1.25.3-alpine.

---
updated-dependencies:
- dependency-name: golang
  dependency-version: 1.25.3-alpine
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump node from 24.8.0-bookworm to 25.1.0-bookworm (#998)
096d1ed 
Bumps node from 24.8.0-bookworm to 25.1.0-bookworm.

---
updated-dependencies:
- dependency-name: node
  dependency-version: 25.1.0-bookworm
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump golang.org/x/crypto from 0.40.0 to 0.42.0 (#984)
5d14232 
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.40.0 to 0.42.0.
- [Commits](golang/crypto@v0.40.0...v0.42.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.42.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps-dev): bump @vitejs/plugin-react-swc in /website (#991)
b3626b9 
Bumps [@vitejs/plugin-react-swc](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react-swc) from 3.11.0 to 4.1.0.
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react-swc/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/v4.1.0/packages/plugin-react-swc)

---
updated-dependencies:
- dependency-name: "@vitejs/plugin-react-swc"
  dependency-version: 4.1.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump js-yaml (#1007)
b5dade7 
Bumps the npm_and_yarn group with 1 update in the /website directory: [js-yaml](https://github.com/nodeca/js-yaml).


Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.1.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps-dev): bump vite-plugin-svgr from 4.3.0 to 4.5.0 in /website (
aa10fde 
#968)

Bumps [vite-plugin-svgr](https://github.com/pd4d10/vite-plugin-svgr) from 4.3.0 to 4.5.0.
- [Release notes](https://github.com/pd4d10/vite-plugin-svgr/releases)
- [Commits](pd4d10/vite-plugin-svgr@v4.3.0...v4.5.0)

---
updated-dependencies:
- dependency-name: vite-plugin-svgr
  dependency-version: 4.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
dependabot Bot and others added 28 commits September 7, 2026 10:28
@dependabot
build(deps): bump github/codeql-action/init from 4.32.4 to 4.37.9 (#1211
e2416fa 
)

Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.32.4 to 4.37.9.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@89a39a4...cdf488f)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1 (#…
ee5f996 
…1208)

Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.11.1 to 1.12.1.
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](stretchr/testify@v1.11.1...v1.12.1)

---
updated-dependencies:
- dependency-name: github.com/stretchr/testify
  dependency-version: 1.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump actions/setup-go from 6.4.0 to 7.0.0 (#1198)
65029c4 
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.4.0 to 7.0.0.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@4a36011...b7ad1da)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump docker/setup-buildx-action from 4.1.0 to 4.3.0 (#1213)
deb82f7 
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 4.1.0 to 4.3.0.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@d7f5e7f...37fe631)

---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
  dependency-version: 4.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump github/codeql-action/analyze from 4.32.4 to 4.37.9 (#…
1cd52c0 
…1212)

Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.32.4 to 4.37.9.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@89a39a4...cdf488f)

---
updated-dependencies:
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): update pygments requirement from ~=2.20.0 to ~=2.21.0 (#…
25d2297 
…1207)

Updates the requirements on [pygments](https://github.com/pygments/pygments) to permit the latest version.
- [Release notes](https://github.com/pygments/pygments/releases)
- [Changelog](https://github.com/pygments/pygments/blob/master/CHANGES)
- [Commits](pygments/pygments@2.20.0...2.21.0)

---
updated-dependencies:
- dependency-name: pygments
  dependency-version: 2.21.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump node from 26.4.0-bookworm to 26.8.1-bookworm (#1204)
c17f3a9 
Bumps node from 26.4.0-bookworm to 26.8.1-bookworm.

---
updated-dependencies:
- dependency-name: node
  dependency-version: 26.8.1-bookworm
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@sampletext32 @GoliathLabs
Expose per-device Prometheus metrics (#1202)
6ac586c 
* feat: expose per-device Prometheus metrics

* fix(metrics): bound the per-device metrics exposure

* Fix typo in comment about UTF-8 parsing

---------

Co-authored-by: GoliathLabs <git@xdfr.de>
Co-authored-by: Felix <8057646+GoliathLabs@users.noreply.github.com>
@dependabot
build(deps-dev): bump the npm_and_yarn group across 1 directory with …
4ad6d51 
…2 updates (#1217)

Bumps the npm_and_yarn group with 2 updates in the /website directory: [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) and [browserslist](https://github.com/browserslist/browserslist).


Updates `@babel/core` from 7.28.6 to 7.29.7
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-core)

Updates `browserslist` from 4.28.1 to 4.28.9
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](browserslist/browserslist@4.28.1...4.28.9)

---
updated-dependencies:
- dependency-name: "@babel/core"
  dependency-version: 7.29.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: browserslist
  dependency-version: 4.28.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
build(deps): bump google.golang.org/grpc (#1216)
108fff2 
Bumps the go_modules group with 1 update in the / directory: [google.golang.org/grpc](https://github.com/grpc/grpc-go).


Updates `google.golang.org/grpc` from 1.83.1 to 1.83.2
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.83.1...v1.83.2)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.83.2
  dependency-type: direct:production
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@grische @claude @GoliathLabs
fix(auth): send and verify OIDC nonce to prevent ID token replay
7fd4e49 
The OIDC login flow only set the OAuth2 state parameter (stored in the
confusingly-named AuthSession.Nonce field) and validated it on callback.
No OpenID Connect nonce was ever sent in the authentication request, and
the ID token's nonce claim was never checked, so nothing bound a verified
ID token to the specific login session, leaving the claimsFromIDToken
path open to ID token replay.

- Rename AuthSession.Nonce to AuthSession.State to reflect that it holds
  the OAuth2 CSRF state, and add a dedicated Nonce field for the real
  OIDC nonce. The field is only used by the OIDC provider; established
  sessions rely solely on Identity, so their (de)serialization is
  unaffected.
- loginHandler now generates a separate random nonce, stores state and
  nonce in the session, and passes oidc.Nonce(nonce) to AuthCodeURL.
- callbackHandler keeps the existing state/CSRF check and, on the
  claimsFromIDToken path where the ID token is verified, rejects the
  login if idToken.Nonce does not match the stored session nonce.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 4924ee76a677824a51584f9c4d867f95f8263096)
@grische @claude @GoliathLabs
fix(storage): match device owner exactly in in-memory list to stop cr…
48c9707 
…oss-user leak

The in-memory backend filtered devices by key prefix without a
trailing separator, so listing devices for "alice" also returned
devices owned by "alicebob". Compare device.Owner for equality
instead, matching the SQL backend's owner = ? semantics, and add a
regression test.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit dec9e93979dc0bd8e98a60d8e3a3b74a36fa6798)
@grische @claude @GoliathLabs
fix(storage): prevent metadata sync from resurrecting deleted devices
c25862e 
The periodic metadata sync (syncMetrics) read a device by public key and
then persisted it via Storage.Save. In the pinned gorm v1.9.16, db.Save
falls back to an INSERT when the UPDATE matches 0 rows, so if the device
was deleted between the read and the write (by its owner, an admin, or
the inactive-device reaper), the row was silently re-inserted. The
insert also fired the storage add event (EmitAdd for postgres/in-memory,
the gorm Create callback for sqlite/mysql), whose OnAdd handler re-added
the WireGuard peer - permanently restoring VPN access for a revoked
device.

Fix by adding an update-only UpdateMetadata method to the Storage
interface and using it from the metadata sync instead of Save:

- SQL backend: an explicit UPDATE scoped to owner+name that can never
  insert; a 0-row match is a no-op. It also never emits an add event,
  so metadata updates no longer re-trigger AddPeer.
- In-memory backend: only mutates the entry if the key still exists.

Storage.Save keeps its upsert semantics for AddDevice, which must still
insert brand-new devices.

Adds a regression test asserting that UpdateMetadata after Delete does
not recreate the device on both the in-memory and sqlite backends.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 4807b318323a16e9c63a6894558994f4b3b6260d)
@grische @claude @GoliathLabs
fix(devices): hold IP allocation lock through device save to prevent …
1920f9e 
…duplicate IPs

nextIPLock was only held inside nextClientAddress(), being released
before AddDevice persisted the device via SaveDevice. Since
usedAddresses() reads the set of occupied IPs from storage, two
concurrent AddDevice calls could both observe the same address as free
and both persist it (classic TOCTOU; there is no unique constraint on
Address). The manual IP assignment path never took the lock at all and
could collide the same way.

AddDevice now acquires nextIPLock before the address is chosen (both
the manual and automatic branches) and holds it through SaveDevice,
making the read-check-save sequence atomic. nextClientAddress() is
renamed to nextClientAddressLocked() and no longer locks internally,
avoiding a self-deadlock; AddDevice is its only caller.

The mutex is process-local and documented as such: it does not protect
against multiple server replicas sharing one Postgres database.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 5c234c330d4f5805d15d0e015e59e3110226623b)
@grische @claude @GoliathLabs
fix(storage): don't emit watcher events for failed/rolled-back gorm o…
2fc2c6f 
…perations

gorm v1 runs registered Create/Delete callbacks unconditionally, even
when the statement failed and the transaction was rolled back. This
caused phantom OnAdd/OnDelete events (and thus wg.AddPeer/RemovePeer)
for devices that were never persisted or never deleted. Skip emitting
when the scope has an error, matching the commit-only semantics of the
Postgres and in-process watchers.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit ae4aa6f3d0bd0924cb0f670306686058fe559c56)
@grische @claude @GoliathLabs
fix(auth): set HttpOnly and SameSite=Lax on the session cookie
64729da 
gorilla/sessions v1.4.0 creates cookie stores with Secure=true but
HttpOnly=false and SameSite=None. That leaves the session cookie
readable by JavaScript (stealable via any XSS) and sends it on all
cross-site requests (no CSRF protection).

Explicitly set store.Options with HttpOnly=true and SameSite=Lax while
keeping Secure=true, Path=/ and the default 30-day MaxAge (86400*30),
which ClearSession still overrides with MaxAge=-1 on signout. Lax still
sends the cookie on top-level GET navigations, so the OIDC redirect
callback and login flows keep working.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 40acfa4c289843b24e808427dd454524d89db67f)
@grische @claude @GoliathLabs
fix(dnsproxy): don't cache TTL-0 responses and use minimum record TTL
2290e96 
The DNS proxy cached responses using only Answer[0]'s TTL. This had two
problems:

1. go-cache treats a zero duration passed to Set as DefaultExpiration,
   and the cache is constructed with a 10-minute default. A response
   whose records carry TTL 0 (deliberately uncacheable, e.g. DNS
   failover) was therefore pinned in the cache for 10 minutes and
   served stale to all clients.

2. Only the first answer's TTL governed the whole message, so a
   response whose later records had shorter TTLs could be served past
   their expiry.

Compute the TTL as the minimum across all Answer, Ns and Extra records
(ignoring OPT pseudo-records, whose header TTL encodes extended RCODE
and flags), and skip caching entirely when that minimum is 0. The
caching decision is extracted into cacheResponse and covered by unit
tests for the TTL-0, mixed-TTL and no-answer cases.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 3c23769a89aaddd11532923c03541ce69c1f6ec2)
@grische @claude @GoliathLabs
fix(dnsproxy): remove all EDNS0 client-subnet options safely
daa17ea 
purgeECS removed elements from opt.Option while range-iterating over the
same slice. Since range captures the slice length up front, an in-place
append-removal shifts subsequent elements left, so a second EDNS0SUBNET
option could be skipped and survive in the forwarded query. Because the
cache key ignores ECS, a subnet-specific upstream answer could then be
cached and served to clients in other subnets.

Rebuild the option slice in place, keeping only non-ECS options, so
zero, one, or multiple EDNS0SUBNET options are all handled correctly.
Add unit tests covering these cases.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 17b4b75925a384051b9e1388e1f979795a3ffc92)
@grische @claude @GoliathLabs
fix(auth): enforce OIDC accessClaim for auth.multiple providers
a73f54f 
ClaimsMiddleware only checked the accessClaim of the legacy top-level
auth.oidc provider. Users authenticating via an OIDC provider configured
under auth.multiple.<name>.oidc were never checked against that
provider's accessClaim, so they gained access without carrying the
required claim.

Look up the OIDC provider config matching the authenticated user's
provider name across both the top-level OIDC config and all
auth.multiple providers (falling back to the map key when no explicit
name is set, mirroring AuthConfig.Providers), and enforce its
accessClaim if configured.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 1296b1c3ef6915f9319995524271e96b26a9f124)
@GoliathLabs
fix(auth): make the Secure session cookie flag opt-in
a38c211
@GoliathLabs
test(storage): check the db.Close error in the gorm watcher test
7ce4512
@GoliathLabs
chores: update deps (#1218)
12c1e78
@GoliathLabs
fix: make linter happy
a836da5
@GoliathLabs
linting: fix eslint findings & configure linter (#1219)
2981291
@GoliathLabs
chore: mobx updates (#1220)
e823b45
@GoliathLabs
bump: mui, react (#1221)
0b4ee1f
@GoliathLabs
build(deps): switch codegen to @freifunkmuc/grpc-ts-web (#1222)
4a52d58 
* build(deps): move the web client to grpc-web 2

* build(deps): switch codegen to @freifunkmuc/grpc-ts-web
@GoliathLabs
refactor: read resolv.conf directly instead of pulling in Moby
00bc096
@GoliathLabs
GoliathLabs deleted the fix/drop-docker-dep branch September 22, 2026 13:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@GoliathLabs @T0biii @DasSkelett @sampletext32 @grische