kolaente 446f722b20 fix(gravatar): route avatar requests through the SSRF-safe http client ...

avatar.gravatarbaseurl is operator-configurable, so the request destination was
never a fixed constant - pkg/utils/avatar.go already uses the SSRF-safe client
for the same job. The previous 5s timeout is kept as a context deadline so the
configured (30s by default) client timeout does not apply here.

2026-07-28 17:26:12 +02:00

..

auth

fix(oauth2): burn authorization code even when validation fails (#3350)

2026-07-28 17:13:15 +02:00

avatar

fix(gravatar): route avatar requests through the SSRF-safe http client

2026-07-28 17:26:12 +02:00

background

fix(unsplash): route api requests through the SSRF-safe http client

2026-07-28 17:26:12 +02:00

dump

chore(lint): suppress known gosec false positives

2026-03-23 16:23:15 +01:00

humabridge

chore(deps): replace vendored humaecho5 with upstream humaecho adapter (#3205)

2026-07-17 22:35:53 +02:00

keyvalue

fix: resolve golangci-lint v2.12 findings

2026-06-30 18:53:56 +00:00

migration

fix(migration): seed task positions for exports without order information

2026-07-26 01:13:08 +00:00