Security & reliability hardening: SSRF, atomic writes, bounded URL replace, config caps - #13

Merged

leonardomso merged 14 commits into

leonardomso/lyon-v1

May 17, 2026

Commits on May 17, 2026

fix(cmd): harden cli test coverage paths
leonardomso
committed
a7e6eef
refactor(cmd): improve reliability and testability
leonardomso
committed
7206e09
fix(cmd): align interactive mode and clean lint
leonardomso
committed
bd70ce2
ci: fix bounded fuzz workflow
leonardomso
committed
3f326b8
fix(security): skip symlinks in scanner and refuse symlink writes in fixer
leonardomso
committed
738de49
fix(security): block SSRF to private, loopback, link-local and metadata ranges
leonardomso
committed
15f57df
fix(fixer): replace URLs only at URL boundaries
leonardomso
committed
e7d08ff
feat(atomicfile): write files atomically via temp file + fsync + rename
leonardomso
committed
9008446
fix(config): enforce upper bounds on check.concurrency, timeout and retries
leonardomso
committed
3941de8
fix(config): bound FindAndLoad's upward walk via required stopAt arg
leonardomso
committed
c7cce3e
chore(deps): bump Go to 1.26.3 and update dependencies
leonardomso
committed
b07e4d8
fix(lint): satisfy gocritic, gofmt, and revive line-length
leonardomso
committed
33b49be
test(checker): close HTTP client to avoid persistConn goleak
leonardomso
committed
788e82d
Merge remote-tracking branch 'origin/master' into leonardomso/lyon-v1
leonardomso
committed
3afb19b