- Dockerfile: Go 1.26, npm ci, go mod verify, non-root user, alpine 3.22.
- Compose: Postgres no longer published on the host, password and new
security settings read from .env, GOMEMLIMIT.
- README: document new environment variables and reading shortcuts.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- New Reader (desktop + mobile): loads full content on open, prefetches
the next article, reading progress and time, "Aa" settings (light /
sepia / dark / auto theme, serif / sans / Atkinson Hyperlegible font,
size, line height, measure), Space-to-next, keyboard shortcuts, focus
management, inert background, URL-driven (?a=) so Back closes it.
- Dashboard: cursor pagination, unread/all filter, CSS grid (no masonry),
no re-sorting under the reader, optimistic cache patches instead of
refetch storms, "new articles" banner, error/offline states, j/k/o/m/s/v
shortcuts and help dialog.
- Cards: keyboard-openable, lazy <img>, memoized, touch-only swipe.
- Focus mode: framer drag (drop @use-gesture), Read button, undo restores
unread state, arrow keys.
- WebSocket: single connection, backoff, cache patching, no console logs.
- Contrast fixes (on-nature tokens), 44px targets, lang="fr", reduced
motion, self-hosted fonts, theme applied before first paint.
- Code splitting + vendor chunk, prompt-based PWA updates, smaller
precache, offline cache for opened articles and images, caches cleared
on logout; upgrade react-router (CVE), drop unused deps and assets.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Security:
- WebSocket events are routed to their owner only (no cross-user leak);
hub close is idempotent (fixes double-close panic), adds ping/pong and
write deadlines.
- Session tokens stored as SHA-256 (migration 008 keeps sessions valid);
single-query auth middleware puts the user in the request context.
- Client IP only trusts X-Forwarded-For from TRUSTED_PROXIES; rate limiter
map is bounded; per-user limit on AI summaries.
- Argon2id at OWASP minimum with a concurrency cap; constant-time login
for unknown emails; atomic first-admin bootstrap; REGISTRATION_ENABLED.
- CSP/HSTS/COOP headers, same-origin guard on mutations, body size limits,
wider SSRF denylist, bounded feed/page/AI response reads, generic errors.
- Upgrade chi, pgx, x/net, x/text, x/crypto (known CVEs); commit go.sum.
Performance:
- List endpoints return a plain-text excerpt and reading time instead of
full HTML; content is sanitized once at ingest (legacy rows backfilled).
- Keyset pagination on (sort_at, id) with matching partial indexes;
redundant indexes dropped (migration 007).
- Fetcher: bounded worker pool, conditional GET (ETag/Last-Modified),
exponential backoff, dedupe before insert, column-safe truncation,
retention-aware ingest, per-user refresh coalescing.
- Read/favorite/read-all are single ownership-scoped statements.
- gzip compression, immutable caching for hashed assets, path-safe SPA
handler, server timeouts; expired sessions purged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Antigravity AgentandClaude Opus 5.5