mirror of
https://github.com/storytold/artcraft-services.git
synced 2026-11-01 20:34:27 -08:00
Dylan M. Taylor
83cacf36ad
Resolves the bundled-asset and script security findings SonarCloud reports outside vendored code. - **Web:S5725** `frontend/api_docs.html` — Swagger UI was loaded over protocol-relative `//unpkg.com` URLs with no integrity check. Now `https://` plus `integrity`/`crossorigin` on all three assets. - **shell:S6505** the three remaining `npx` calls in Netlify/dev scripts now pass `--no-install`, so they run the pinned local binary instead of downloading and running one. - **secrets:S6418** removed the long-dead MinIO access/secret key pair commented out in the deprecated inference-job env file. - **python:S4790** the Gravatar hash is an MD5 identifier required by Gravatar's URL scheme, so it is marked `usedforsecurity=False`. Verified: file contents diffed against the previous URLs; no build-affecting script semantics changed (`--no-install` only rejects on-demand downloads). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Bug Fixes** * API documentation resources now load over HTTPS with integrity verification. * Account-copying operations preserve their existing output while supporting environments that restrict security-related hashing. * **Chores** * Build and cleanup commands use locally available tooling and continue cleanup if the reset command fails. * Removed commented-out credential settings from the development configuration. <!-- end of auto-generated comment: release notes by coderabbit.ai -->