vyos-documentation.git/docs, branch agents-md-bot-workflow

docs: Update DNS forwarding page to VyOS 1.5 standards (#2163)

2026-08-04T10:46:14+00:00

* docs: Update DNS forwarding page to VyOS 1.5 standards * Update dns.md * Update dns.md

docs: Update Dynamic DNS page to VyOS 1.5 standards (#2164)

2026-08-04T10:31:13+00:00

* docs: Update Dynamic DNS page to VyOS 1.5 standards

docs: Update DHCP Relay page to VyOS 1.5 standards (#2146)

2026-08-04T10:19:21+00:00

docs: Update Router Advertisements page to VyOS 1.5 standards (#2132)

2026-08-04T10:11:23+00:00

* docs: Update Router Advertisements page to VyOS 1.5 standards

docs: Update HTTP API page to VyOS 1.5 standards (#2131)

2026-08-04T10:02:32+00:00

* docs: Update HTTP API page to VyOS 1.5 standards * Clarify the wording about self-signed certificates * Fix unsual wording regarding DH parameters configuration * Update https.md --------- Co-authored-by: Daniil Baturin

vyos-api: clarify comment regarding commit failure and partial commits (#2178)

2026-08-03T13:21:55+00:00

docs(Installation): Remove outdated portal link and Proxmox/KVM cloud… (#2176)

2026-07-31T11:03:03+00:00

* docs(Installation): Remove outdated portal link and Proxmox/KVM cloud-init note * Update install.md

security: remediate CodeQL code-scanning alerts (#2171)

2026-07-28T09:16:46+00:00

* security: remediate CodeQL code-scanning alerts (picker XSS sinks, test sanitization, vendored DataTables exclusion) Remediates all 11 open CodeQL alerts on the default branch: - version-picker.js (js/xss-through-dom, alerts 1-3): percent-encode every DOM-derived path component (select.value, parsed location segments) at URL construction time via encodePath()/langUrlFor(), and tighten the parseLocation slug charset to [A-Za-z0-9._-]. No-op on legitimate sphinx slugs — URLs stay byte-identical (asserted by tests). - workers/apex/test/manifest.test.ts (js/incomplete-multi-character- sanitization, alert 6): strip HTML comments from the root.html fixture repeatedly to a fixpoint instead of a single pass. - docs/_static/js/datatables.js (alerts 4,5,7-11): excluded from CodeQL analysis via .github/codeql/codeql-config.yml (new codeql-cfg-path input to the fleet reusable workflow). The file is vendored stock DataTables 1.11.5; the flagged helpers are display/sort normalization, not sanitization boundaries. Excluding keeps the vendored copy byte-identical to upstream instead of hand-patching it. Adds 9 picker tests (hostile-input encoding + slug-charset accept/reject); workers suite 103/103 green. 🤖 Generated by [robots](https://vyos.io) * security: normalize pre-existing percent escapes in encodePath Adversarial-review finding (Codex, medium): location.pathname returns well-formed escapes verbatim, so blind encodeURIComponent double-encoded them (%2E -> %252E), broke the HEAD probe on escaped deep links, and dumped the user at the version root. Each segment is now decoded first (malformed escapes keep the raw segment — no throw), then re-encoded to canonical single encoding. Decoding cannot resurrect dot-segments: the URL parser resolves '.'/'..' and their percent-encoded forms during navigation, so pathname never presents them (verified against the WHATWG parser in Node). workers suite 106/106 (+2 regression tests, mutation-verified). 🤖 Generated by [robots](https://vyos.io) * security: normalize percent escapes per run, not per segment Round-2 adversarial finding (Codex, medium): whole-segment decode meant one malformed escape (a%20b%zz) threw for the segment and double-encoded the valid escapes beside it. encodeSegment now decodes+re-encodes each well-formed %HH run independently; literal spans (including a bare '%') always pass through encodeURIComponent, so taint neutralization holds unconditionally; a run decoding to invalid UTF-8 stays verbatim (already pure %HH text). workers suite 108/108 (+2 discriminating regression tests). 🤖 Generated by [robots](https://vyos.io)

docs: exclude superpowers/ from the Sphinx build

2026-07-28T00:13:48+00:00

`docs/superpowers/` holds Claude Code plugin-generated internal design specs and plans, not user documentation. Adding `superpowers` to `exclude_patterns` guards against Sphinx ever picking the directory up and publishing it should it reappear in the source tree. Guard only — the content itself was already removed in 3ab97e71 and abb8be5b.

Merge pull request #2152 from BradKollmyer/vyos-api-doc-gaps-T9087-T9092

2026-07-21T12:41:44+00:00

vyos-api: fill automation API doc gaps (T9087–T9092)