VyOS readthedocs (mirror of https://github.com/vyos/vyos-documentation.git) https://git.amelek.net/vyos/vyos-documentation.git/atom?h=claude%2Fdatatables-2x-upgrade 2026-07-28T16:24:41+00:00 2026-07-28T16:24:41+00:00 Yuriy Andamasov yuriy@vyos.io 2026-07-28T16:24:41+00:00 urn:sha1:bcb972553eec07a439376015f5af37f8e884668d DataTables 1.x nested the search <input> inside its <label>; 2.x renders them as siblings inside div.dt-search, so the narrow-viewport descendant rule 'label input' no longer matched and the 10px top margin was silently lost below 576px. Target '.dt-search input' instead. Flagged independently by the implementation pass and both adversarial reviewers (Codex + agy). 🤖 Generated by [robots](https://vyos.io) 2026-07-28T16:01:59+00:00 Yuriy Andamasov yuriy@vyos.io 2026-07-28T16:01:59+00:00 urn:sha1:858a4b2b7183c5bbc049bbdeb413e6afad45b090 The hover rule carried 'background-color: #E1E4E5 !important' followed by 'background: none'. The important longhand outranks the later normal-importance shorthand, so the gray hover fill did apply — but the pair is confusing and CodeRabbit read it as a dead declaration. Collapse to a single 'background: #E1E4E5 !important', which produces the identical effective state (gray fill, upstream 2.x hover gradient suppressed) in one declaration. 🤖 Generated by [robots](https://vyos.io) 2026-07-28T15:38:48+00:00 Yuriy Andamasov yuriy@vyos.io 2026-07-28T15:25:46+00:00 urn:sha1:b3aeaf3e80e05b692d132de6bd316dceab41be0b Swap the vendored single-component DataTables downloader build from 1.11.5 to 2.3.8 (docs/_static/js/datatables.js, docs/_static/css/datatables.css). The only init site, docs/_static/js/tables.js, uses the option-less jQuery-style $('#id').DataTable() form, which is unchanged in 2.x, so neither it nor docs/_templates/layout.html needed edits. jQuery 3.6.0 is still injected ahead of the bundle by sphinxcontrib-jquery and satisfies 2.x. Remove docs/_static/css/DataTables-1.11.5/ (10 sort-icon images). 2.x draws sort indicators in pure CSS: the new datatables.css contains no url() references at all, and the replaced 1.11.5 stylesheet was the only thing in the repo that referenced those files. Migrate custom selectors for the 2.x generated-class renames, each verified against the downloaded bundle rather than assumed: - .dataTables_info -> .dt-info (tables.css, text.css) - .paginate_button -> .dt-paging-button (tables.css, text.css) - #coverage a.paginate_button{,.current,.next,.previous} -> #coverage button.dt-paging-button{...} 2.x renders paging controls as <button> (was <a> in 1.x), so the old rules failed on both element type and class. The .current/.next/ .previous modifiers are still emitted and are retained. The #table-cfgcmd_wrapper / #table-opcmd_wrapper rules are deliberately untouched: only the wrapper *class* changed (dataTables_wrapper -> dt-container); the element id is still <tableId>_wrapper. Drop the CodeQL exclusion (.github/codeql/codeql-config.yml, plus the optional codeql-cfg-path input in .github/workflows/codeql.yml). That config existed solely to paths-ignore the 1.11.5 bundle, which tripped 7 alerts (5x js/incomplete-multi-character-sanitization, 2x js/incomplete-sanitization). Upstream 2.x hardened the implicated helpers - _stripHtml now runs a do/while fixpoint over the <script> strip, and _escapeHtml uses all-global regexes - so those patterns are not expected to recur. Removing the exclusion restores default CodeQL coverage of the file; this PR's own CodeQL run is the empirical test. Provenance (DataTables downloader builder, styling "DataTables default", component set dt only - the 2.x equivalent of the previous #dt/dt-1.11.5): https://cdn.datatables.net/v/dt/dt-2.3.8/datatables.js sha256 184fb4bd0b9a81a955acd608ba94d0643c74271e78c0fae30f1f40b824f88b1d https://cdn.datatables.net/v/dt/dt-2.3.8/datatables.css sha256 e37677437e0fbe4a463aafc83bc4ea8d60986b72050ba9f47f740b41148184ae Verified with a local make html: build succeeded, and coverage.html renders both tables (table-cfgcmd 9095 rows, table-opcmd 3036 rows) with the 2.3.8 assets injected in the correct order after jQuery. 🤖 Generated by [robots](https://vyos.io) 2026-07-28T09:16:46+00:00 Yuriy Andamasov yuriy@vyos.io 2026-07-28T09:16:46+00:00 urn:sha1:95e9ad86def9b1f33d65a422e1235011e0fb1225 * security: remediate CodeQL code-scanning alerts (picker XSS sinks, test sanitization, vendored DataTables exclusion) Remediates all 11 open CodeQL alerts on the default branch: - version-picker.js (js/xss-through-dom, alerts 1-3): percent-encode every DOM-derived path component (select.value, parsed location segments) at URL construction time via encodePath()/langUrlFor(), and tighten the parseLocation slug charset to [A-Za-z0-9._-]. No-op on legitimate sphinx slugs — URLs stay byte-identical (asserted by tests). - workers/apex/test/manifest.test.ts (js/incomplete-multi-character- sanitization, alert 6): strip HTML comments from the root.html fixture repeatedly to a fixpoint instead of a single pass. - docs/_static/js/datatables.js (alerts 4,5,7-11): excluded from CodeQL analysis via .github/codeql/codeql-config.yml (new codeql-cfg-path input to the fleet reusable workflow). The file is vendored stock DataTables 1.11.5; the flagged helpers are display/sort normalization, not sanitization boundaries. Excluding keeps the vendored copy byte-identical to upstream instead of hand-patching it. Adds 9 picker tests (hostile-input encoding + slug-charset accept/reject); workers suite 103/103 green. 🤖 Generated by [robots](https://vyos.io) * security: normalize pre-existing percent escapes in encodePath Adversarial-review finding (Codex, medium): location.pathname returns well-formed escapes verbatim, so blind encodeURIComponent double-encoded them (%2E -> %252E), broke the HEAD probe on escaped deep links, and dumped the user at the version root. Each segment is now decoded first (malformed escapes keep the raw segment — no throw), then re-encoded to canonical single encoding. Decoding cannot resurrect dot-segments: the URL parser resolves '.'/'..' and their percent-encoded forms during navigation, so pathname never presents them (verified against the WHATWG parser in Node). workers suite 106/106 (+2 regression tests, mutation-verified). 🤖 Generated by [robots](https://vyos.io) * security: normalize percent escapes per run, not per segment Round-2 adversarial finding (Codex, medium): whole-segment decode meant one malformed escape (a%20b%zz) threw for the segment and double-encoded the valid escapes beside it. encodeSegment now decodes+re-encodes each well-formed %HH run independently; literal spans (including a bare '%') always pass through encodeURIComponent, so taint neutralization holds unconditionally; a run decoding to invalid UTF-8 stays verbatim (already pure %HH text). workers suite 108/108 (+2 discriminating regression tests). 🤖 Generated by [robots](https://vyos.io) 2026-07-28T00:13:48+00:00 Yuriy Andamasov yuriy@vyos.io 2026-07-28T00:13:48+00:00 urn:sha1:a9dc16aac2a7e7a6e5e4bb1c19897b3d707ba4d1 `docs/superpowers/` holds Claude Code plugin-generated internal design specs and plans, not user documentation. Adding `superpowers` to `exclude_patterns` guards against Sphinx ever picking the directory up and publishing it should it reappear in the source tree. Guard only — the content itself was already removed in 3ab97e71 and abb8be5b. 2026-07-21T12:41:44+00:00 Viacheslav Hletenko v.gletenko@vyos.io 2026-07-21T12:41:44+00:00 urn:sha1:cce3f36602e285a13efe02bf8906f871f04c5ada vyos-api: fill automation API doc gaps (T9087–T9092) 2026-07-20T09:52:42+00:00 LiudmylaNad l.nadolina@vyos.io 2026-07-20T09:52:42+00:00 urn:sha1:d08dbfacca29aa1e9750468293dd00910ad775ee * docs: Update Event handler page to VyOS 1.5 standards * Apply suggestions from code review Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> 2026-07-20T09:38:55+00:00 jvela-dot j.vela@vyos.io 2026-07-20T09:38:55+00:00 urn:sha1:a0067e0fbc8c3bee2af6701b3542eb013146fcf8 * docs: update flowtable and ethernet/bonding documentation * Removing Netfilter word and add the identification of the interfaces to use FlowTables * Fixed warning from commit:c433e15 * Update docs/configuration/firewall/flowtables.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update docs/configuration/firewall/flowtables.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update docs/configuration/firewall/flowtables.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update docs/configuration/firewall/flowtables.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * cfgmc structure and sub-interface offload fixed * Fixed conflicts on flowtable documentation * revert ethernet.md and fixed the latest infos * added subsection to the checks section to show offloaded traffic for sub-interfaces * Final changes * Changed conntrack -L to VyOS command * Replacing new output description with VyOS command --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> 2026-07-14T21:08:40+00:00 Brad Kollmyer bradk@vitalsoft.com 2026-07-14T21:08:40+00:00 urn:sha1:2510eefadc8e7520e7f85f45a2b29fdab634474a Convert the multi-field-node table to wrapped list items per the 80-char docs guideline, and rework the bulk-apply bullet to reconcile state before retrying after a timeout instead of recommending blind retries. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> 2026-07-14T21:00:18+00:00 Brad Kollmyer bradk@vitalsoft.com 2026-07-14T21:00:18+00:00 urn:sha1:9e90088827c53f8d61e82e2e29910a9346009e87 Only port/port-group require protocol in the same request; description alone is fine on an existing rule but fails on a rule no request has created yet. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>