VyOS readthedocs (mirror of https://github.com/vyos/vyos-documentation.git) https://git.amelek.net/vyos/vyos-documentation.git/atom?h=claude%2Fdatatables-2x-upgrade 2026-07-28T16:24:41+00:00 2026-07-28T16:24:41+00:00 Yuriy Andamasov yuriy@vyos.io 2026-07-28T16:24:41+00:00 urn:sha1:bcb972553eec07a439376015f5af37f8e884668d DataTables 1.x nested the search <input> inside its <label>; 2.x renders them as siblings inside div.dt-search, so the narrow-viewport descendant rule 'label input' no longer matched and the 10px top margin was silently lost below 576px. Target '.dt-search input' instead. Flagged independently by the implementation pass and both adversarial reviewers (Codex + agy). 🤖 Generated by [robots](https://vyos.io) 2026-07-28T16:01:59+00:00 Yuriy Andamasov yuriy@vyos.io 2026-07-28T16:01:59+00:00 urn:sha1:858a4b2b7183c5bbc049bbdeb413e6afad45b090 The hover rule carried 'background-color: #E1E4E5 !important' followed by 'background: none'. The important longhand outranks the later normal-importance shorthand, so the gray hover fill did apply — but the pair is confusing and CodeRabbit read it as a dead declaration. Collapse to a single 'background: #E1E4E5 !important', which produces the identical effective state (gray fill, upstream 2.x hover gradient suppressed) in one declaration. 🤖 Generated by [robots](https://vyos.io) 2026-07-28T15:38:48+00:00 Yuriy Andamasov yuriy@vyos.io 2026-07-28T15:25:46+00:00 urn:sha1:b3aeaf3e80e05b692d132de6bd316dceab41be0b Swap the vendored single-component DataTables downloader build from 1.11.5 to 2.3.8 (docs/_static/js/datatables.js, docs/_static/css/datatables.css). The only init site, docs/_static/js/tables.js, uses the option-less jQuery-style $('#id').DataTable() form, which is unchanged in 2.x, so neither it nor docs/_templates/layout.html needed edits. jQuery 3.6.0 is still injected ahead of the bundle by sphinxcontrib-jquery and satisfies 2.x. Remove docs/_static/css/DataTables-1.11.5/ (10 sort-icon images). 2.x draws sort indicators in pure CSS: the new datatables.css contains no url() references at all, and the replaced 1.11.5 stylesheet was the only thing in the repo that referenced those files. Migrate custom selectors for the 2.x generated-class renames, each verified against the downloaded bundle rather than assumed: - .dataTables_info -> .dt-info (tables.css, text.css) - .paginate_button -> .dt-paging-button (tables.css, text.css) - #coverage a.paginate_button{,.current,.next,.previous} -> #coverage button.dt-paging-button{...} 2.x renders paging controls as <button> (was <a> in 1.x), so the old rules failed on both element type and class. The .current/.next/ .previous modifiers are still emitted and are retained. The #table-cfgcmd_wrapper / #table-opcmd_wrapper rules are deliberately untouched: only the wrapper *class* changed (dataTables_wrapper -> dt-container); the element id is still <tableId>_wrapper. Drop the CodeQL exclusion (.github/codeql/codeql-config.yml, plus the optional codeql-cfg-path input in .github/workflows/codeql.yml). That config existed solely to paths-ignore the 1.11.5 bundle, which tripped 7 alerts (5x js/incomplete-multi-character-sanitization, 2x js/incomplete-sanitization). Upstream 2.x hardened the implicated helpers - _stripHtml now runs a do/while fixpoint over the <script> strip, and _escapeHtml uses all-global regexes - so those patterns are not expected to recur. Removing the exclusion restores default CodeQL coverage of the file; this PR's own CodeQL run is the empirical test. Provenance (DataTables downloader builder, styling "DataTables default", component set dt only - the 2.x equivalent of the previous #dt/dt-1.11.5): https://cdn.datatables.net/v/dt/dt-2.3.8/datatables.js sha256 184fb4bd0b9a81a955acd608ba94d0643c74271e78c0fae30f1f40b824f88b1d https://cdn.datatables.net/v/dt/dt-2.3.8/datatables.css sha256 e37677437e0fbe4a463aafc83bc4ea8d60986b72050ba9f47f740b41148184ae Verified with a local make html: build succeeded, and coverage.html renders both tables (table-cfgcmd 9095 rows, table-opcmd 3036 rows) with the 2.3.8 assets injected in the correct order after jQuery. 🤖 Generated by [robots](https://vyos.io) 2026-07-28T09:16:46+00:00 Yuriy Andamasov yuriy@vyos.io 2026-07-28T09:16:46+00:00 urn:sha1:95e9ad86def9b1f33d65a422e1235011e0fb1225 * security: remediate CodeQL code-scanning alerts (picker XSS sinks, test sanitization, vendored DataTables exclusion) Remediates all 11 open CodeQL alerts on the default branch: - version-picker.js (js/xss-through-dom, alerts 1-3): percent-encode every DOM-derived path component (select.value, parsed location segments) at URL construction time via encodePath()/langUrlFor(), and tighten the parseLocation slug charset to [A-Za-z0-9._-]. No-op on legitimate sphinx slugs — URLs stay byte-identical (asserted by tests). - workers/apex/test/manifest.test.ts (js/incomplete-multi-character- sanitization, alert 6): strip HTML comments from the root.html fixture repeatedly to a fixpoint instead of a single pass. - docs/_static/js/datatables.js (alerts 4,5,7-11): excluded from CodeQL analysis via .github/codeql/codeql-config.yml (new codeql-cfg-path input to the fleet reusable workflow). The file is vendored stock DataTables 1.11.5; the flagged helpers are display/sort normalization, not sanitization boundaries. Excluding keeps the vendored copy byte-identical to upstream instead of hand-patching it. Adds 9 picker tests (hostile-input encoding + slug-charset accept/reject); workers suite 103/103 green. 🤖 Generated by [robots](https://vyos.io) * security: normalize pre-existing percent escapes in encodePath Adversarial-review finding (Codex, medium): location.pathname returns well-formed escapes verbatim, so blind encodeURIComponent double-encoded them (%2E -> %252E), broke the HEAD probe on escaped deep links, and dumped the user at the version root. Each segment is now decoded first (malformed escapes keep the raw segment — no throw), then re-encoded to canonical single encoding. Decoding cannot resurrect dot-segments: the URL parser resolves '.'/'..' and their percent-encoded forms during navigation, so pathname never presents them (verified against the WHATWG parser in Node). workers suite 106/106 (+2 regression tests, mutation-verified). 🤖 Generated by [robots](https://vyos.io) * security: normalize percent escapes per run, not per segment Round-2 adversarial finding (Codex, medium): whole-segment decode meant one malformed escape (a%20b%zz) threw for the segment and double-encoded the valid escapes beside it. encodeSegment now decodes+re-encodes each well-formed %HH run independently; literal spans (including a bare '%') always pass through encodeURIComponent, so taint neutralization holds unconditionally; a run decoding to invalid UTF-8 stays verbatim (already pure %HH text). workers suite 108/108 (+2 discriminating regression tests). 🤖 Generated by [robots](https://vyos.io) 2026-07-28T00:31:47+00:00 Yuriy Andamasov yuriy@andamasov.com 2026-07-28T00:31:47+00:00 urn:sha1:a16c5ef2654ab7bc2a5a54494880543f91c5d89d docs: exclude superpowers/ from the Sphinx build 2026-07-28T00:13:48+00:00 Yuriy Andamasov yuriy@vyos.io 2026-07-28T00:13:48+00:00 urn:sha1:a9dc16aac2a7e7a6e5e4bb1c19897b3d707ba4d1 `docs/superpowers/` holds Claude Code plugin-generated internal design specs and plans, not user documentation. Adding `superpowers` to `exclude_patterns` guards against Sphinx ever picking the directory up and publishing it should it reappear in the source tree. Guard only — the content itself was already removed in 3ab97e71 and abb8be5b. 2026-07-22T16:04:39+00:00 Yevhen Bondarenko evgeniy.bondarenko@sentrium.io 2026-07-22T16:04:39+00:00 urn:sha1:56fe7c650ea2b7a1f506eb5823855f02e379f38e docs-gates: re-land HTTPError close + detail logging; widen smoke retry envelope 2026-07-22T15:53:45+00:00 Yuriy Andamasov yuriy@vyos.io 2026-07-22T15:53:45+00:00 urn:sha1:cef13a0cd6aa64ab2a9b30fe1199d60939846357 Codex adversarial finding: DEADLINE_SECONDS was only checked BEFORE each op, so a probe or sleep starting at 479s could overshoot to ~510s — 480 was a soft target, not a hard bound. Make it hard: run() now computes an absolute deadline = start + DEADLINE_SECONDS plus a _remaining() helper. The per-probe socket timeout is capped to min(PROBE_TIMEOUT_SECONDS, max(1, remaining)) — the previously hardcoded 30 is now the PROBE_TIMEOUT_SECONDS constant; a probe with < 1s of budget is skipped and counted unresolved. The inter-round sleep is capped to min(RETRY_SLEEP_SECONDS, remaining) and is skipped entirely when the budget is exhausted (falling into the existing deadline path). No body-read-level deadline is added — pages are small, so the socket-op timeout bounds reads adequately. Deadline-path failure accounting is unchanged. Tests: the probe timeout is capped to the remaining budget (fake opener records the timeout it was opened with); the inter-round sleep is capped to the remaining budget (sleep spy); the existing suite stays green. 🤖 Generated by [robots](https://vyos.io) 2026-07-22T15:39:42+00:00 Yuriy Andamasov yuriy@vyos.io 2026-07-22T15:30:57+00:00 urn:sha1:95b8a4115439826e7dff767bf3515684535d0783 The merge-triggered smoke run for the round-based retry work failed on a worker-version propagation race that outlasted the 3-round x 20s envelope: all probes were served the previous SHA through rounds 1-2 and one path (cli.html) was still stale at round 3 (2 sleeps x 20s = 40s insufficient). Widen to MAX_ROUNDS=5 / RETRY_SLEEP_SECONDS=30 -> 4 inter-round sleeps x 30s = 2 min, covering the observed 1-2+ min propagation waves. The green path is unaffected (no retries -> zero added time); DEADLINE_SECONDS=480 still bounds the worst case. Tests read the constants dynamically (monkeypatch), so none pin the old literals. 🤖 Generated by [robots](https://vyos.io) 2026-07-22T15:29:29+00:00 Yuriy Andamasov yuriy@vyos.io 2026-07-22T15:13:55+00:00 urn:sha1:6ae607d4c37f2c61a5b06fc5649e46dac63eaac8 Two accepted GitHub-side CodeRabbit findings on the smoke gate: Close the HTTPError response stream: _probe_once read the non-2xx body via e.read() but never closed the HTTPError, which is file-like and owns the response socket — leaking it / raising ResourceWarning on the expected-404 path every run. The read is now wrapped in "with e:" INSIDE the crash-containment nesting, so the stream is closed even if the read raises (still yielding the retryable transport-error result, never a traceback). Name the failed assertion in retry/fail logs: _probe_once now returns a compact `detail` naming which check failed ("status" / "docs-build" / "apex-build" / "search-mount", multiple joined by "+", or the transport error text; None when ok) instead of a bare transport-only field. SMOKE-RETRY / SMOKE-FAIL lines gain `detail=<...>` alongside the existing status / docs-build fields, so an apex-build or search-mount failure no longer logs an opaque "status=200 docs-build=<sha>". ok-path behavior and the JSON / exit contract are unchanged. Tests: HTTPError stream is closed on the happy-404 path and when the read raises (RecordingBody close recorder); apex-build-only and search-mount-only failures name their detail in the logs; _probe_once joins multiple failed checks with "+". Removed the now-unused _http_error helper. 🤖 Generated by [robots](https://vyos.io)