Skip to content

Commit ba5ae3c

Browse files
sviat-barbutsasviat-barbutsa
committed
feat: dependencies and repo security enhancement
1 parent 2116403 commit ba5ae3c

11 files changed

Lines changed: 275 additions & 29 deletions

File tree

‎.github/ISSUE_TEMPLATE/bug_report.yml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
name: Bug report
2+
description: Report a reproducible problem in Zharwing Memory.
3+
title: "bug: "
4+
labels:
5+
- bug
6+
body:
7+
- type: markdown
8+
attributes:
9+
value: |
10+
Thank you for helping improve Zharwing Memory. Do not include tokens,
11+
private memory content, credentials, or proprietary repository data.
12+
- type: dropdown
13+
id: component
14+
attributes:
15+
label: Component
16+
options:
17+
- Daemon
18+
- CLI
19+
- MCP server
20+
- Browser UI
21+
- Desktop UI
22+
- Documentation
23+
- Other
24+
validations:
25+
required: true
26+
- type: textarea
27+
id: description
28+
attributes:
29+
label: What happened?
30+
description: Describe the behavior and what you expected instead.
31+
validations:
32+
required: true
33+
- type: textarea
34+
id: reproduction
35+
attributes:
36+
label: Minimal reproduction
37+
description: Provide sanitized steps using disposable data where possible.
38+
validations:
39+
required: true
40+
- type: input
41+
id: version
42+
attributes:
43+
label: Version or commit
44+
placeholder: v0.1.0 or commit SHA
45+
validations:
46+
required: true
47+
- type: input
48+
id: environment
49+
attributes:
50+
label: Environment
51+
placeholder: Windows 11, Node 24, pnpm 9, desktop or browser UI
52+
validations:
53+
required: true
54+
- type: checkboxes
55+
id: privacy
56+
attributes:
57+
label: Privacy check
58+
options:
59+
- label: I removed secrets and private project or memory content from this report.
60+
required: true
61+

‎.github/ISSUE_TEMPLATE/config.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
blank_issues_enabled: false
2+
contact_links:
3+
- name: Report a security vulnerability
4+
url: https://github.com/zharwing/memory/blob/main/SECURITY.md
5+
about: Follow the private reporting instructions in the security policy.
6+
- name: Read the documentation
7+
url: https://zharwing.barbutsa.com/memory/docs/
8+
about: Check setup, usage, limitations, and troubleshooting guidance first.

‎.github/ISSUE_TEMPLATE/feature_request.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
name: Feature request
2+
description: Suggest a focused improvement for the developer preview.
3+
title: "feature: "
4+
labels:
5+
- enhancement
6+
body:
7+
- type: textarea
8+
id: problem
9+
attributes:
10+
label: Problem
11+
description: What workflow or limitation should this change address?
12+
validations:
13+
required: true
14+
- type: textarea
15+
id: proposal
16+
attributes:
17+
label: Proposed behavior
18+
description: Describe the smallest useful outcome, not only the implementation.
19+
validations:
20+
required: true
21+
- type: textarea
22+
id: alternatives
23+
attributes:
24+
label: Alternatives considered
25+
description: What workarounds or other designs have you tried?
26+
- type: checkboxes
27+
id: boundaries
28+
attributes:
29+
label: Project boundaries
30+
options:
31+
- label: This request preserves the local-first and project-scoped privacy model.
32+
required: true
33+
- label: I removed private project or memory content from this request.
34+
required: true
35+

‎.github/dependabot.yml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
version: 2
2+
3+
updates:
4+
- package-ecosystem: npm
5+
directory: /
6+
schedule:
7+
interval: weekly
8+
day: monday
9+
time: "09:00"
10+
timezone: America/Chicago
11+
open-pull-requests-limit: 5
12+
groups:
13+
production-dependencies:
14+
dependency-type: production
15+
update-types:
16+
- minor
17+
- patch
18+
development-dependencies:
19+
dependency-type: development
20+
update-types:
21+
- minor
22+
- patch
23+
24+
- package-ecosystem: cargo
25+
directory: /apps/desktop/src-tauri
26+
schedule:
27+
interval: weekly
28+
day: monday
29+
time: "09:30"
30+
timezone: America/Chicago
31+
open-pull-requests-limit: 3
32+
groups:
33+
rust-dependencies:
34+
update-types:
35+
- minor
36+
- patch
37+
38+
- package-ecosystem: github-actions
39+
directory: /
40+
schedule:
41+
interval: monthly
42+
open-pull-requests-limit: 3
43+

‎.github/pull_request_template.md‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
## Summary
2+
3+
Describe the problem and the smallest change that solves it.
4+
5+
## Validation
6+
7+
- [ ] Relevant tests pass.
8+
- [ ] `pnpm typecheck` passes for TypeScript changes.
9+
- [ ] `pnpm check:source-artifacts` passes.
10+
- [ ] Documentation is updated when behavior or setup changes.
11+
12+
## Safety and scope
13+
14+
- [ ] The change contains no credentials, private memory, or proprietary project data.
15+
- [ ] New agent-visible behavior remains project-scoped and fails closed.
16+
- [ ] Dependency or lockfile changes are intentional and explained.
17+
- [ ] The diff does not include generated source artifacts or unrelated cleanup.
18+

‎.github/workflows/codeql.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
name: CodeQL
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
branches: [main]
8+
schedule:
9+
- cron: "31 4 * * 1"
10+
11+
permissions:
12+
contents: read
13+
14+
jobs:
15+
analyze:
16+
name: Analyze JavaScript and TypeScript
17+
runs-on: ubuntu-latest
18+
timeout-minutes: 20
19+
permissions:
20+
actions: read
21+
contents: read
22+
security-events: write
23+
steps:
24+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
25+
with:
26+
persist-credentials: false
27+
- uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
28+
with:
29+
languages: javascript-typescript
30+
- uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
31+
with:
32+
category: /language:javascript-typescript
33+

‎CODE_OF_CONDUCT.md‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
# Code of Conduct
2+
3+
## Our commitment
4+
5+
Zharwing Memory welcomes constructive participation from people of different
6+
backgrounds and experience levels. We are committed to a respectful,
7+
professional, and harassment-free project community.
8+
9+
## Expected behavior
10+
11+
- Discuss ideas and code with patience and technical honesty.
12+
- Critique the work, not the person.
13+
- Respect privacy. Never post another person's credentials, private memory,
14+
proprietary source, personal information, or unredacted logs.
15+
- Give credit for meaningful contributions and disclose relevant conflicts.
16+
- Accept maintainers' decisions about the project's local-first, privacy, and
17+
developer-preview boundaries.
18+
19+
## Unacceptable behavior
20+
21+
Harassment, threats, discriminatory language, personal attacks, deliberate
22+
misinformation, doxxing, sexualized attention, and publishing private material
23+
without permission are not acceptable. Repeated disruption or attempts to
24+
bypass security-reporting procedures are also unacceptable.
25+
26+
## Scope
27+
28+
This policy applies in the repository, issue tracker, pull requests, project
29+
discussions, and other spaces where someone is representing Zharwing Memory.
30+
31+
## Reporting and enforcement
32+
33+
For conduct concerns, contact `sviatoslavbarbutsa@gmail.com`. Reports will be
34+
reviewed privately and handled according to their context and severity.
35+
Maintainers may edit or remove contributions, restrict participation, or ban a
36+
participant when necessary to protect the community.
37+
38+
Security vulnerabilities should not be included in conduct reports or public
39+
issues. Follow the private email reporting instructions in
40+
[SECURITY.md](SECURITY.md) instead.

‎SECURITY.md‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,9 @@ Only the latest release and the current `main` branch receive security fixes.
88

99
Please do not open public issues for security vulnerabilities.
1010

11-
Report them privately via GitHub Security Advisories
12-
([Report a vulnerability](https://github.com/zharwing/memory/security/advisories/new))
13-
or by email to sviatoslavbarbutsa@gmail.com. You should receive a response
14-
within a few days. Please include reproduction steps and the affected
15-
component (daemon, CLI, desktop, MCP server).
11+
Report them privately by email to `sviatoslavbarbutsa@gmail.com`. You should
12+
receive a response within a few days. Please include reproduction steps and
13+
the affected component (daemon, CLI, desktop, MCP server).
1614

1715
## Threat Model Notes
1816

‎apps/desktop/package.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,13 +21,13 @@
2121
"@tauri-apps/plugin-dialog": "^2.2.0",
2222
"d3": "^7.9.0",
2323
"lucide-react": "^0.468.0",
24-
"mermaid": "^11.4.1",
24+
"mermaid": "^11.16.1",
2525
"lexical": "^0.35.0",
2626
"mobx": "^6.13.5",
2727
"mobx-react-lite": "^4.0.7",
2828
"react": "^19.0.0",
2929
"react-dom": "^19.0.0",
30-
"react-router-dom": "^7.0.0"
30+
"react-router-dom": "^7.18.2"
3131
},
3232
"devDependencies": {
3333
"@tauri-apps/cli": "^2.2.0",

‎package.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,12 @@
66
"license": "Apache-2.0",
77
"type": "module",
88
"packageManager": "pnpm@9.0.0",
9+
"pnpm": {
10+
"overrides": {
11+
"dompurify@3.4.11": "3.4.13",
12+
"js-yaml@4.1.1": "4.3.1"
13+
}
14+
},
915
"engines": {
1016
"node": ">=22.21.0 <23 || >=24.0.0 <25",
1117
"pnpm": "9.0.0"

0 commit comments

Comments
 (0)