All pull requests

Pull requests

• fix: Google sign-in links an existing password account only once its email is confirmed

  #397·oracola91 opened Nov 13, 2026·

  ·
  6

• fix: the session cookie is HttpOnly, as COOKIE_HTTP_ONLY says

  #396·oracola91 opened Nov 13, 2026·

  ·
  6

• fix: list a batch's private files only to their creator

  #395·oracola91 opened Nov 13, 2026·

  ·
  9

• Add falling snow to the ArtCraft website

  #394·YarilaFox opened Nov 13, 2026·

  ·
  6

• ci: let Dependabot maintain GitHub Actions dependencies

  #393·dylanmtaylor opened Nov 12, 2026Member·

  ·
  9

• ci: lock workflow actions through an actions.lock lockfile

  #392·dylanmtaylor opened Nov 12, 2026Member·

  ·
  11

• fix: resolve the session through the checker in session media search

  #389·dylanmtaylor opened Nov 11, 2026Member·

  ·
  9

• fix: authorize profile edits by user token, not cached username

  #388·dylanmtaylor opened Nov 11, 2026Member·

  ·
  9

• fix: reject mesh generation without a model before resolving media

  #386·dylanmtaylor opened Nov 11, 2026Member·

  ·
  9

• fix: refuse loopback/private destinations in the media URL downloader

  #385·dylanmtaylor opened Nov 11, 2026Member·

  ·
  16

• fix: authorize before validating in the media file animation-type handler

  #384·dylanmtaylor opened Nov 11, 2026Member·

  ·
  9

• fix: cap decompressed size when extracting PMX zip archives

  #383·dylanmtaylor opened Nov 11, 2026Member·

  ·
  13

• frontend: mark fire-and-forget promises with void (Sonar S9383)

  #375·dylanmtaylor opened Nov 11, 2026Member·

  ·
  9

• Rust: tokio::fs and tokio::time inside async functions (Sonar S7493, S7488)

  #374·dylanmtaylor opened Nov 11, 2026Member·

  ·
  9

• fix: exclude never-paid Stripe statuses from active subscriptions; keep URL options for test DB bootstrap

  #327·dylanmtaylor opened Nov 4, 2026Member·

  ·
  7

• fix: bill and run Veo 3.1 with the same default duration; bound router downloads

  #314·dylanmtaylor opened Nov 3, 2026Member·

  ·
  9

• fix: refuse to start production with the public fallback secrets

  #300·dylanmtaylor opened Nov 3, 2026Member·

  ·
  6

• fix(video-editor): bound allocation and scan work driven by project data

  #296·dylanmtaylor opened Nov 3, 2026Member·

  ·
  34

• fix(webapp): allowlist hosts and stream responses in the dev CDN proxy

  #290·dylanmtaylor opened Nov 3, 2026Member·

  ·
  11

• fix: require the internal API key on the GPT image job callback

  #287·dylanmtaylor opened Nov 3, 2026Member·

  ·
  7

• fix: bound audio preparation and mixing driven by project timing

  #268·dylanmtaylor opened Nov 3, 2026Member·

  ·
  24

• feat(website): check release signatures; drop the unsigned-preview note

  #250·dylanmtaylor opened Nov 3, 2026Member·

  ·
  7

• Add OAuth authorization code with PKCE for third-party connectors

  #235·adikshan11 opened Nov 2, 2026Contributor·

  ·
  43

• Accept API keys and MCP sessions on library and job reads

  #234·adikshan11 opened Nov 2, 2026Contributor·

  ·
  9

• Label Volcengine Seedance jobs with the right image or video category

  #223·g1obalworlds opened Nov 2, 2026Contributor·

  ·
  7