From 30bdcf061b0ac1841b6673eb529b81f54d0a2bff Mon Sep 17 00:00:00 2001 From: Maurice Date: Thu, 8 Oct 2026 12:00:04 +0200 Subject: [PATCH] chore(server): spell out the coverage pin and drop a dash from the redirect note Wording only: the comment over the new coverage entries and the safeFetch doc comment it shares a change with. --- server/src/utils/ssrfGuard.ts | 2 +- server/vitest.config.ts | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/server/src/utils/ssrfGuard.ts b/server/src/utils/ssrfGuard.ts index bf4c7ced0..666ec7ee9 100644 --- a/server/src/utils/ssrfGuard.ts +++ b/server/src/utils/ssrfGuard.ts @@ -447,7 +447,7 @@ export function capResponse(response: Response, maxBytes: number | null): Respon * Redirects are followed through safeFetchFollow, so every hop is re-checked and * re-pinned, with safeFetchFollow's defaults: a body cap and, for a call without * a signal, a bounded wait for the headers. It used to hand the platform a - * `redirect: 'follow'` with a dispatcher pinned to the FIRST hop only — the same shape as + * `redirect: 'follow'` with a dispatcher pinned to the FIRST hop only, the same shape as * GHSA-8mw6-xphx-886m, and pinning does not help there because Node skips the * pinned lookup for an IP-literal host. Sixteen callers ride on this, several * with a URL out of a per-user setting (Immich, Synology, AirTrail), and one diff --git a/server/vitest.config.ts b/server/vitest.config.ts index bf730a163..b88b2ec7f 100644 --- a/server/vitest.config.ts +++ b/server/vitest.config.ts @@ -110,9 +110,9 @@ export default defineConfig({ 'src/nest/geo/**/*.ts': { statements: 99, branches: 95, functions: 99, lines: 99 }, // google-quota, managed, mcp-shared, mcp-transport, public-api, // receipt-scan, route-usage, scheduling, school-holidays, tokens and tours - // sat on the 80 catch-all until 2026-10-08. Each is pinned at - // floor(measured) - 1 over the unit, integration and e2e suites that load - // it, a subset a full run can only measure higher. managed holds an empty + // sat on the 80 catch-all until 2026-10-08. Each is pinned one point under + // what the unit, integration and e2e suites that load it measure, as the + // script prints it: a subset a full run can only measure higher. managed holds an empty // module and nothing to count. mcp-shared and route-usage measure below // the 80 floor on branches and functions and are pinned where they are. // tests/unit/coverage-thresholds.test.ts fails on a domain without an entry.