All pull requests

Pull requests

• Scope localhost provider requests to the calling user

  #496·SashaMIT opened Oct 26, 2026Contributor·

  ·

• Enforce capability policy decisions on grant

  #495·SashaMIT opened Oct 26, 2026Contributor·

  ·

• docs: THREAT-MODEL.md and known limitations for 0.8.0 (draft for review)

  #494·SashaMIT opened Oct 26, 2026Contributor·

  ·

• test(wallet): cover fresh-account rail creation (#393)

  #493·andersalm opened Oct 25, 2026Contributor·

  ·

• ci: pinned actions, least-privilege token, secret scan

  #492·SashaMIT opened Oct 25, 2026Contributor·

  ·
  1

• Services and Documents: counters select their section; Documents actions follow the document (#332)

  #491·andersalm opened Oct 25, 2026Contributor·

  ·

• docs: require Deepen notes before substantive changes

  #490·andersalm opened Oct 25, 2026Contributor·

  ·

• docs: preserve the attributed test audit register

  #487·andersalm opened Oct 22, 2026Contributor·

  ·

• chore(deps): webpki-roots 1.0.10, rustls-webpki 0.103.16 (eMudhra distrust)

  #478·SashaMIT opened Oct 22, 2026Contributor·

  ·
  1

• browser: update guest Chromium to 155.0.8059.79

  #474·SashaMIT opened Oct 21, 2026Contributor·

  ·
  1

• browser: update host Node to 24.22.1

  #473·SashaMIT opened Oct 21, 2026Contributor·

  ·
  1

• Add OSS Scanner enrollment files

  #460·SashaMIT opened Oct 20, 2026Contributor·

  ·

• [HUB-05] Keep unfixed security issues out of public text

  #442·SashaMIT opened Oct 18, 2026Contributor·

  ·
  1

• Stamped installer: no environment or flag override of the maintainer DID

  #435·SashaMIT opened Oct 17, 2026Contributor·

  ·
  5

• Keep Library navigation, uploads and rendering coherent under load

  #428·SashaMIT opened Oct 17, 2026Contributor·

  ·
  8

• Share CDP domain preparation within each connection

  #424·SashaMIT opened Oct 17, 2026Contributor·

  ·
  9

• test(people): the first-run layout smoke waits for the rendered Profile text

  #422·SashaMIT opened Oct 17, 2026Contributor·

  ·
  1

• Keep deferred Browser input with its owning page

  #421·SashaMIT opened Oct 17, 2026Contributor·

  ·
  7

• Retire superseded Browser observations and verify lifecycle recovery

  #420·SashaMIT opened Oct 17, 2026Contributor·

  ·
  8

• model-provider: every held-lock journal test takes its lock with the bounded retry

  #419·SashaMIT opened Oct 17, 2026Contributor·

  ·
  2

• fix(setup): Linux setup names the removal command for an earlier release's Browser host access

  #418·SashaMIT opened Oct 17, 2026Contributor·

  ·
  2

• deps: move zip to 9.x for RUSTSEC-2026-0367/0368/0369

  #417·SashaMIT opened Oct 17, 2026Contributor·

  ·
  9

• Keep Component compilation off async workers and limit slot waits

  #416·SashaMIT opened Oct 17, 2026Contributor·

  ·
  9

• test(home): Clipboard source gate binds Chat's fixed target, and CI runs it

  #415·SashaMIT opened Oct 17, 2026Contributor·

  ·
  2

• ci: installed journeys name the observer failure, and the SmolLM2 proof uses a vendored license

  #413·SashaMIT opened Oct 17, 2026Contributor·

  ·
  9