8000 fix(deps): patch vulnerable dependencies by Holzherr · Pull Request #2 · dhuynh95/duck_talk · GitHub
[go: up one dir, main page]

Skip to content

fix(deps): patch vulnerable dependencies - #2

Closed
Holzherr wants to merge 16 commits into
dhuynh95:mainfrom
Holzherr:fix/deps-2026-10-26
Closed

Holzherr wants to merge 16 commits into
dhuynh95:mainfrom
Holzherr:fix/deps-2026-10-26

Conversation

@Holzherr
Copy link
Copy Markdown

npm audit fix with --ignore-scripts and --before=2026-10-19 (7-day release age gate during the October supply-chain wave). Builds/tests pass; any failing tests also fail on main.

Holzherr and others added 16 commits October 4, 2026 19:13
…skill (DT-002)

The skill's SKILL.md body, frontmatter off, is appended to the system prompt after
the claude prompt under "Start in this mode". --skill / CLAUDE_SKILL pick another,
none turns it off, and the startup line says which.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ine (DT-004) (#2)

* fix(app): try each saved relay address in turn and say why it is offline (DT-004)

Settings > Server holds an ordered list; the app uses the first address that
answers within 2 s and asks again on every network change and on returning to
the front. When none answers, a sentence under the Offline pill says why.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(app): build the relay addresses into the app and try them all at once, so it connects with nothing typed (DT-004)

Claude-Session: https://claude.ai/code/session_01C7bcYNPJXoFx26YGoH42iH

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…opback only

The relay accepted any WebSocket on every interface with no authentication, so
anyone on the LAN or tailnet, or any web page open on the Mac, could switch the
session to bypassPermissions and run shell commands through Claude.
fix(server): authenticate the relay, bind loopback, refuse browser origins
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ns (DT-001)

Reads turns.jsonl, corrections and the run logs for one local day and prints
a markdown digest: one count per failure kind from specs/turn-review.md, the
first turn of each quoted, and the five slowest waits to first audio.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…(DT-001)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…-001)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@Holzherr
Copy link
Copy Markdown
Author

Opened against upstream by mistake — sorry, please ignore.

@Holzherr Holzherr closed this Oct 26, 2026
@Holzherr
Holzherr deleted the fix/deps-2026-10-26 branch October 26, 2026 08:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

0