Repository navigation

Sync package updates and check QUERY requests for request forgery - #681

Merged

binaryfire merged 25 commits into

0.4from

upstream-sync-batch-3

Oct 20, 2026

Merged

Sync package updates and check QUERY requests for request forgery#681
binaryfire merged 25 commits into
0.4from
upstream-sync-batch-3

Commits on Oct 20, 2026
- Pass socket read timeouts by name in test fixtures
  binaryfire
  committed
  2fe3f00
- Verify QUERY requests against request forgery
  binaryfire
  committed
  0f10b28
- Limit remote file downloads in kilobytes and reject large declared sizes
  binaryfire
  committed
  b4763f4
- Open rebuilt Gemini turns with their thought step
  binaryfire
  committed
  8c91c61
- Port Scout's queued import queue and connection tests
  binaryfire
  committed
  981edba
- Port Scout's Typesense indexable-name collection tests
  binaryfire
  committed
  40c847e
- Port Scout's Meilisearch whereIn escaping tests
  binaryfire
  committed
  54936e7
- Format query previews by SQL dialect and test them with Vitest
  binaryfire
  committed
  9c1e1a8
- Port Wayfinder's QUERY method tests
  binaryfire
  committed
  959f9ab
- Add a Wayfinder option to skip the database
  binaryfire
  committed
  b493df7
- Document MCP client authentication options
  binaryfire
  committed
  1a0886e
- Document the @stack render order limitation
  binaryfire
  committed
  78b10b7
- Warn that request input can override signed URL query parameters
  binaryfire
  committed
  5e8a1a9
- Filter role models by guard in hasRole checks
  binaryfire
  committed
  a103dbf
- Keep indexed permission lookups consistent with filtering
  binaryfire
  committed
  572cf41
- Port the rate limit plugin's cache hit tests
  binaryfire
  committed
  bc18bc5
- Run benchmark measurements without an idle-confirmation flag
  binaryfire
  committed
  871f241
- Match enum lookup values in cached permission filters
  binaryfire
  committed
  b5197b1
- Match role models by guard in hasAllRoles and hasExactRoles
  binaryfire
  committed
  1a88332
- Require at least 20 permissions in the lookup benchmark
  binaryfire
  committed
  648b66a
- Correct what a URL signature covers in the signed URL warning
  binaryfire
  committed
  70957b5
- Explain why PreventRequestForgery verifies QUERY requests
  binaryfire
  committed
  d743afa
- Assert the exact Meilisearch whereNotIn result
  binaryfire
  committed
  130cba2
- Test Telescope's driver aliases and formatted query output
  binaryfire
  committed
  47d51a7
- Test that a compressed download is limited by its decoded size
  binaryfire
  committed
  48c1c8a

Commits

Commits on Oct 20, 2026