Matt Miller ae4fcaaf41 security: fix five vulnerabilities (GHSA-779p-m5rp-r4h4) ... - CVE-2026-56670: force download of SVG/XML responses on /view to prevent stored XSS - CVE-2026-56671: contain /experiment/models/preview reads within the model folder - CVE-2026-56672: stop inline rendering of uploaded /userdata/{file} content - CVE-2026-56673: prevent path traversal in get_annotated_filepath (LoadImage /prompt input) - CVE-2026-56674: reject opaque/null Origin to close the CSRF middleware bypass Adds regression tests under tests-unit/security_test/ covering all five.		2026-07-02 19:10:30 -07:00
..
api	security: fix five vulnerabilities (GHSA-779p-m5rp-r4h4)	2026-07-02 19:10:30 -07:00
database	revert(assets): drop job_ids filter from GET /api/assets (#14408)	2026-06-10 19:23:01 -07:00
services	revert(assets): drop job_ids filter from GET /api/assets (#14408)	2026-06-10 19:23:01 -07:00
helpers.py	refactor(assets): modular architecture + async two-phase scanner & background seeder (#12621)	2026-03-07 20:37:25 -05:00
scanner.py	chore(assets): drop vestigial tags.tag_type column (#14248)	2026-06-09 21:07:10 -07:00
seeder.py	feat(assets): register output files as assets after prompt execution (#12812)	2026-03-24 20:48:55 -07:00