- Dockerfile: Go 1.26, npm ci, go mod verify, non-root user, alpine 3.22.
- Compose: Postgres no longer published on the host, password and new
security settings read from .env, GOMEMLIMIT.
- README: document new environment variables and reading shortcuts.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- New Reader (desktop + mobile): loads full content on open, prefetches
the next article, reading progress and time, "Aa" settings (light /
sepia / dark / auto theme, serif / sans / Atkinson Hyperlegible font,
size, line height, measure), Space-to-next, keyboard shortcuts, focus
management, inert background, URL-driven (?a=) so Back closes it.
- Dashboard: cursor pagination, unread/all filter, CSS grid (no masonry),
no re-sorting under the reader, optimistic cache patches instead of
refetch storms, "new articles" banner, error/offline states, j/k/o/m/s/v
shortcuts and help dialog.
- Cards: keyboard-openable, lazy <img>, memoized, touch-only swipe.
- Focus mode: framer drag (drop @use-gesture), Read button, undo restores
unread state, arrow keys.
- WebSocket: single connection, backoff, cache patching, no console logs.
- Contrast fixes (on-nature tokens), 44px targets, lang="fr", reduced
motion, self-hosted fonts, theme applied before first paint.
- Code splitting + vendor chunk, prompt-based PWA updates, smaller
precache, offline cache for opened articles and images, caches cleared
on logout; upgrade react-router (CVE), drop unused deps and assets.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Security:
- WebSocket events are routed to their owner only (no cross-user leak);
hub close is idempotent (fixes double-close panic), adds ping/pong and
write deadlines.
- Session tokens stored as SHA-256 (migration 008 keeps sessions valid);
single-query auth middleware puts the user in the request context.
- Client IP only trusts X-Forwarded-For from TRUSTED_PROXIES; rate limiter
map is bounded; per-user limit on AI summaries.
- Argon2id at OWASP minimum with a concurrency cap; constant-time login
for unknown emails; atomic first-admin bootstrap; REGISTRATION_ENABLED.
- CSP/HSTS/COOP headers, same-origin guard on mutations, body size limits,
wider SSRF denylist, bounded feed/page/AI response reads, generic errors.
- Upgrade chi, pgx, x/net, x/text, x/crypto (known CVEs); commit go.sum.
Performance:
- List endpoints return a plain-text excerpt and reading time instead of
full HTML; content is sanitized once at ingest (legacy rows backfilled).
- Keyset pagination on (sort_at, id) with matching partial indexes;
redundant indexes dropped (migration 007).
- Fetcher: bounded worker pool, conditional GET (ETag/Last-Modified),
exponential backoff, dedupe before insert, column-safe truncation,
retention-aware ingest, per-user refresh coalescing.
- Read/favorite/read-all are single ownership-scoped statements.
- gzip compression, immutable caching for hashed assets, path-safe SPA
handler, server timeouts; expired sessions purged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Le petit point vert peu visible est remplacé par le bandeau d'angle
d'origine (vert nature, texte blanc), découpé dans le coin de la couverture.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- XSS stocké (critique) : sanitisation bluemonday sur tous les endpoints
d'articles (List, ListByFeed, Favorites, Search, Get), pas seulement Get
- SSRF (élevé) : nouveau utils/safehttp.go (ValidateExternalURL + client durci
via Dialer.Control, bloque IP privées/loopback/link-local/metadata,
anti-DNS-rebinding et limite de redirections) appliqué à l'extracteur et au parser
- WebSocket CSWSH (élevé) : politique same-origin + override WS_ALLOWED_ORIGINS
- rate-limiting (moyen) : token-bucket en mémoire sur /auth/*
- token de session retiré du corps JSON (json:"-"), livré uniquement par le
cookie HttpOnly
- cookie Secure correct derrière un reverse-proxy (X-Forwarded-Proto +
override COOKIE_SECURE)
- admin : interdiction de supprimer son propre compte
- en-têtes de sécurité (nosniff, X-Frame-Options, Referrer-Policy,
Permissions-Policy)
Note : backend non compilé localement (pas de toolchain Go) ; à valider via Docker.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Refonte de toutes les vues en conservant l'identité magazine/vert nature,
avec un système de design cohérent et accessible.
- index.css : tokens sémantiques, échelle radius/ombres, classes réutilisables
(btn-*, chip, surface-card, magazine-content), :focus-visible,
prefers-reduced-motion, grain papier affiné
- nouveaux composants AuthShell (auth split-screen) et MobileTopBar
(navigation mobile, auparavant absente)
- framer-motion sur toutes les vues ; AddFeedModal expose l'import OPML ;
Sidebar ajoute déconnexion + identité utilisateur
- corrections : text-gold cassé -> nature, arithmétique Date -> getTime(),
suppression de App.css mort, ProtectedRoute en Tailwind,
snapshot du deck Focus conforme aux règles React
Frontend : npm run lint + build OK.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Antigravity AgentandClaude Opus 5.5
LogiFlow
MichaelandClaude Opus 4.8