Skip to content

Profullstack footer on the sign-in page (webring + built.indie + pwamart) - #589

Merged
ralyodio merged 1 commit into
mainfrom
footer-signin
Oct 26, 2026
Merged

ralyodio merged 1 commit into
mainfrom
footer-signin

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

Adds the server-rendered @profullstack/footer (0.2.6, clearnet template) to the public sign-in page of app.moshcode.sh, so the site shows the Profullstack webring row and the built.indie + pwamart badges, and serves /.well-known/openwebring.json.

  • apps/pwa/src/lib/ring-footer.mjs: bundled template at boot, @latest template refreshed every 15 min, last good copy kept (same pattern as pit.world's ring-footer.ts).
  • No CSP on this app, so the template's inline CSS is used.
  • Lockfiles: package-lock.json + pnpm-lock.yaml updated lockfile-only.
  • Test: test/ring-footer.test.mjs.

🤖 Generated with Claude Code

…ign-in page

Server-rendered @profullstack/footer (clearnet template) under the sign-in
form, refreshed from the @latest CDN template every 15 min, plus
/.well-known/openwebring.json, so app.moshcode.sh can join the
Profullstack ring.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@socket-security

Copy link
Copy Markdown
Contributor

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Added@​profullstack/​footer@​0.2.67810010094100

View full report

@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

0 finding(s) in the 7 file(s) this pull request changes.

Nothing in the files this pull request changes.

106 pre-existing finding(s) elsewhere in the repository — **HIGH/CRITICAL**: 8 | **MEDIUM**: 87 | **LOW**: 11

Not introduced by this pull request. The full set is in the Security tab.

Severity Rule Location
HIGH js-ssrf-outbound-request apps/pwa/public/sw.js:76
HIGH tls-verification-disabled apps/pwa/src/lib/moshpit-gateway.mjs:299
HIGH sh-remote-script-execution install.sh:86
HIGH sh-remote-script-execution install.sh:90
HIGH sh-remote-script-execution install.sh:258
HIGH sh-remote-script-execution install.sh:269
HIGH sh-remote-script-execution install.sh:275
HIGH tls-verification-disabled src/dns.mjs:823
MEDIUM js-unescaped-html-sink apps/pwa/public/herd/herd.js:117
MEDIUM sql-template-interpolation apps/pwa/src/lib/moshpit-certs.mjs:44
MEDIUM sql-template-interpolation apps/pwa/src/lib/moshpit-certs.mjs:82
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:139
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:153
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:179
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:373
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:377
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:422
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:674
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:870
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:872

…and 86 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit 5ae7a12 into main Oct 26, 2026
7 checks passed
@ralyodio
ralyodio deleted the footer-signin branch October 26, 2026 10:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant