vyos-documentation.git - VyOS readthedocs (mirror of https://github.com/vyos/vyos-documentation.git)

Age	Commit message (Collapse)	Author
8 days	Merge pull request #2172 from ↵	Yuriy Andamasov
	vyos/dependabot/npm_and_yarn/workers/postcss-8.5.23 chore(deps): bump postcss from 8.5.17 to 8.5.23 in /workers
8 days	Merge pull request #2161 from ↵	Yuriy Andamasov
	vyos/dependabot/npm_and_yarn/workers/multi-1160cd7046 chore(deps): bump sharp, @cloudflare/vitest-pool-workers and wrangler in /workers
8 days	chore(deps): bump postcss from 8.5.17 to 8.5.23 in /workersdependabot/npm_and_yarn/workers/postcss-8.5.23	dependabot[bot]
	Bumps [postcss](https://github.com/postcss/postcss) from 8.5.17 to 8.5.23. - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/postcss/postcss/compare/8.5.17...8.5.23) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.23 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
8 days	security: remediate CodeQL code-scanning alerts (#2171)	Yuriy Andamasov
	* security: remediate CodeQL code-scanning alerts (picker XSS sinks, test sanitization, vendored DataTables exclusion) Remediates all 11 open CodeQL alerts on the default branch: - version-picker.js (js/xss-through-dom, alerts 1-3): percent-encode every DOM-derived path component (select.value, parsed location segments) at URL construction time via encodePath()/langUrlFor(), and tighten the parseLocation slug charset to [A-Za-z0-9._-]. No-op on legitimate sphinx slugs — URLs stay byte-identical (asserted by tests). - workers/apex/test/manifest.test.ts (js/incomplete-multi-character- sanitization, alert 6): strip HTML comments from the root.html fixture repeatedly to a fixpoint instead of a single pass. - docs/_static/js/datatables.js (alerts 4,5,7-11): excluded from CodeQL analysis via .github/codeql/codeql-config.yml (new codeql-cfg-path input to the fleet reusable workflow). The file is vendored stock DataTables 1.11.5; the flagged helpers are display/sort normalization, not sanitization boundaries. Excluding keeps the vendored copy byte-identical to upstream instead of hand-patching it. Adds 9 picker tests (hostile-input encoding + slug-charset accept/reject); workers suite 103/103 green. 🤖 Generated by [robots](https://vyos.io) * security: normalize pre-existing percent escapes in encodePath Adversarial-review finding (Codex, medium): location.pathname returns well-formed escapes verbatim, so blind encodeURIComponent double-encoded them (%2E -> %252E), broke the HEAD probe on escaped deep links, and dumped the user at the version root. Each segment is now decoded first (malformed escapes keep the raw segment — no throw), then re-encoded to canonical single encoding. Decoding cannot resurrect dot-segments: the URL parser resolves '.'/'..' and their percent-encoded forms during navigation, so pathname never presents them (verified against the WHATWG parser in Node). workers suite 106/106 (+2 regression tests, mutation-verified). 🤖 Generated by [robots](https://vyos.io) * security: normalize percent escapes per run, not per segment Round-2 adversarial finding (Codex, medium): whole-segment decode meant one malformed escape (a%20b%zz) threw for the segment and double-encoded the valid escapes beside it. encodeSegment now decodes+re-encodes each well-formed %HH run independently; literal spans (including a bare '%') always pass through encodeURIComponent, so taint neutralization holds unconditionally; a run decoding to invalid UTF-8 stays verbatim (already pure %HH text). workers suite 108/108 (+2 discriminating regression tests). 🤖 Generated by [robots](https://vyos.io)
10 days	chore(deps): bump sharp, @cloudflare/vitest-pool-workers and wranglerdependabot/npm_and_yarn/workers/multi-1160cd7046	dependabot[bot]
	Bumps [sharp](https://github.com/lovell/sharp) to 0.35.2 and updates ancestor dependencies [sharp](https://github.com/lovell/sharp), [@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers) and [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler). These dependencies need to be updated together. Updates `sharp` from 0.34.5 to 0.35.2 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](https://github.com/lovell/sharp/compare/v0.34.5...v0.35.2) Updates `@cloudflare/vitest-pool-workers` from 0.18.4 to 0.18.8 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vitest-pool-workers/CHANGELOG.md) - [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-pool-workers@0.18.8/packages/vitest-pool-workers) Updates `wrangler` from 4.110.0 to 4.114.0 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.114.0/packages/wrangler) --- updated-dependencies: - dependency-name: sharp dependency-version: 0.35.2 dependency-type: indirect - dependency-name: "@cloudflare/vitest-pool-workers" dependency-version: 0.18.8 dependency-type: direct:development - dependency-name: wrangler dependency-version: 4.114.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
14 days	docs-gates: smoke per-probe retry + explicit UA; workers: broaden asset-ext ↵claude/smoke-hardening	Yuriy Andamasov
	classification smoke.py — BIC independence: probe requests now send an explicit User-Agent (vyos-docs-smoke/1.0) so the gate no longer depends on a Cloudflare Browser Integrity Check UA-skip rule surviving. The default Python-urllib UA was blocked by BIC until that exemption was added; a silent dependency on it is a latent gate failure the moment the rule is touched. smoke.py — propagation-race tolerance: each probe now retries up to 3 attempts (20s apart; MAX_ATTEMPTS + RETRY_SLEEP_SECONDS are module-level so tests can shrink them) and only fails after the final attempt. A freshly deployed worker version loses a brief propagation race in which a single probe is served by the PREVIOUS version (observed: status 307 + stale X-Docs-Build minutes after deploy), which previously failed the entire gate. Intermediate attempts log SMOKE-RETRY; only exhaustion logs SMOKE-FAIL and counts a failure. Retry fires only on a not-ok outcome (wrong status, wrong/missing build header, missing search mount, or a transport exception); a legitimately-expected 404 passes on the first attempt. workers/branch — broaden asset classification (CodeRabbit post-merge nit): fold .pdf into the case-insensitive ASSET_EXT_RE and add webp + otf, so uppercase .PDF and modern image/font assets get the longer asset cache class. /_static/ and /_images/ path checks unchanged. 🤖 Generated by [robots](https://vyos.io)
14 days	workers: bare-directory 301 via asset probe + asset-class images + config ↵	Yuriy Andamasov
	congruence test (review round 1)
14 days	workers: html_handling none + worker index-mapping — RTD .html URL parity ↵claude/html-handling-parity	Yuriy Andamasov
	(smoke 307 fix)
2026-07-12	docs-infra: align vitest with pool-workers 0.18 peer (dependabot ERESOLVE)	Yuriy Andamasov
	Dependabot bumped @cloudflare/vitest-pool-workers to 0.18.4 (peer: vitest ^4.1.0) while workers/package.json still pinned vitest ~3.2.0, so npm ci ERESOLVEs in workers/ on rolling (docs-build run 29153221240; apex-deploy affected too). Bump vitest to ~4.1.0 to match the peer. 0.18.4 also removed the `@cloudflare/vitest-pool-workers/config` subpath export in favor of a `cloudflareTest()` Vite plugin — vitest.config.ts updated to the new shape (defineConfig from vitest/config + plugins: [cloudflareTest(...)]), matching the package's own vitest-v3-to-v4 codemod. No other files reference the old API. Verified: clean `npm ci` from a deleted node_modules resolves without --force/--legacy-peer-deps, `npm audit` reports 0 vulnerabilities (ws/wrangler bumps stay in place), and the full suite (`npx vitest run`) passes 84/84 across all 9 test files. 🤖 Generated by [robots](https://vyos.io)
2026-07-11	chore(deps): bump wrangler and @cloudflare/vitest-pool-workers (#2142)	dependabot[bot]
	Bumps [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) to 4.110.0 and updates ancestor dependency [@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers). These dependencies need to be updated together. Updates `wrangler` from 4.35.0 to 4.110.0 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.110.0/packages/wrangler) Updates `@cloudflare/vitest-pool-workers` from 0.8.71 to 0.18.4 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vitest-pool-workers/CHANGELOG.md) - [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-pool-workers@0.18.4/packages/vitest-pool-workers) --- updated-dependencies: - dependency-name: wrangler dependency-version: 4.110.0 dependency-type: indirect - dependency-name: "@cloudflare/vitest-pool-workers" dependency-version: 0.18.4 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-10	docs: Cloudflare Workers hosting pipeline (apex, content workers, CI, ↵	Yuriy Andamasov
	previews) (#2140) * docs-infra: scaffold Cloudflare workers workspace (versions.json v2, matrix, toolchain) 🤖 Generated by [robots](https://vyos.io) * docs-infra: record full Phase-0 plan decision in workers/PLAN.md 🤖 Generated by [robots](https://vyos.io) * docs-infra: shared content worker — asset serving, cache classes, X-Docs-Build, canary no-store 🤖 Generated by [robots](https://vyos.io) * docs-infra: run worker script before assets; test fetch entrypoint 🤖 Generated by [robots](https://vyos.io) * docs-infra: apex manifest loader + dispatch map + runtime binding guard (TDD) 🤖 Generated by [robots](https://vyos.io) * docs-infra: apex redirects (aliases, PDF, trailing-slash) + special paths (TDD) 🤖 Generated by [robots](https://vyos.io) * docs-infra: PDF redirect honors pdf:null and preserves query 🤖 Generated by [robots](https://vyos.io) * docs-infra: apex UA gate — allowlist-wins, log-only AI crawlers, empty block list at launch 🤖 Generated by [robots](https://vyos.io) * docs-infra: apex router (pipeline §3.2), themed 404/503, /kb seam, env configs + congruence test 🤖 Generated by [robots](https://vyos.io) * docs-infra: add missing-User-Agent regression test for apex UA gate 🤖 Generated by [robots](https://vyos.io) * docs-infra: R2-streaming preview worker — MIME map, noindex, no-store (TDD) 🤖 Generated by [robots](https://vyos.io) * docs-infra: preview 404 no-store + fetch handler tests 🤖 Generated by [robots](https://vyos.io) * docs-infra: bootstrap script — binding-target workers must exist before apex deploys 🤖 Generated by [robots](https://vyos.io) * docs-infra: apex run_worker_first, lockfile for npm ci, PDF Location from manifest 🤖 Generated by [robots](https://vyos.io) * docs-infra: derive html_baseurl from DOCS_VERSION_SLUG with RTD fallback (canonical gate prereq) 🤖 Generated by [robots](https://vyos.io) * docs-infra: version picker + status banner + language scaffold (vanilla JS, TDD pure core) 🤖 Generated by [robots](https://vyos.io) * docs-infra: picker preserves query+hash across switch; valid breadcrumb markup 🤖 Generated by [robots](https://vyos.io) * docs-infra: Pagefind search wrapper with runtime base-path + preview prefix handling (TDD) 🤖 Generated by [robots](https://vyos.io) * docs-infra: pagefind wrapper — asset-failure notice + UI stylesheet load 🤖 Generated by [robots](https://vyos.io) * docs-infra: gate Pagefind searchbox to CF builds (RTD keeps stock search until cutover) 🤖 Generated by [robots](https://vyos.io) * docs-infra: deploy sanity gates — limits, critical pages, count-delta, canonical (TDD) 🤖 Generated by [robots](https://vyos.io) * docs-infra: hermetic gate tests via fixture versions.json 🤖 Generated by [robots](https://vyos.io) * docs-infra: docs-build workflow — candidate/smoke/promote two-stage deploy + registry + rollback Two-stage CF Workers pipeline: build in pinned container, assemble artifact, sanity gates, deploy candidate, scoped pre-traffic smoke via canary apex, promote (rollback-id capture, hostname purge, registry upload), post-promote probe + auto-rollback. DOCS_CF_LIVE repo variable gates every docs.vyos.io production interaction pre-cutover. scripts/docs_gates/smoke.py adds one authorized check beyond the spec: the version's index.html probe asserts the #vyos-search mount div is present in the response body, guarding CI silently forgetting DOCS_VERSION_SLUG (which would otherwise ship stock RTD search without the Pagefind gate noticing). 🤖 Generated by [robots](https://vyos.io) * docs-infra: build docs image in-workflow with buildx cache (v4.1 — digest pin dropped) Plan v4.1 amendment: the ghcr.io digest-pinned image does not exist (workflow would hard-fail at the first docker step on every push). Replace the BUILD_IMAGE env placeholder with an in-workflow docker build from docker/Dockerfile via docker/setup-buildx-action@v3 + docker/build-push-action@v6 (context: docker/, load: true, tags: docs-build:local, GHA cache from/to). The checked-out commit is the pin; buildx GHA cache keeps repeat builds cheap. Sphinx-build step swaps to docs-build:local; inner script unchanged. 🤖 Generated by [robots](https://vyos.io) * docs-infra: apex/preview deploy workflow — canary auto, production behind environment approval * docs-infra: apex-deploy concurrency guard (per-ref, cancel-in-progress) 🤖 Generated by [robots](https://vyos.io) * docs-infra: fork-safe PR preview pipeline — approval record, R2 prefixes, label consumption, cleanup * docs-infra: nightly preview sweep — pipefail + per-prefix failure isolation 🤖 Generated by [robots](https://vyos.io) * docs-infra: nightly canary QA — per-entry sweep + URL-parity corpus vs RTD 🤖 Generated by [robots](https://vyos.io) * docs-infra: parity sweep scoped to CF-built versions; transport-error resilience 🤖 Generated by [robots](https://vyos.io) * docs-infra: one-off bootstrap workflow (binding targets — runs once on this push) 🤖 Generated by [robots](https://vyos.io) * docs-infra: remove one-off bootstrap workflow (bootstrap complete) 🤖 Generated by [robots](https://vyos.io) * docs-infra: one-off canary apex + preview deploy (route targets for Task 3.6 step 2c) 🤖 Generated by [robots](https://vyos.io) * docs-infra: remove one-off canary deploy workflow (targets live) 🤖 Generated by [robots](https://vyos.io) * docs-infra: address Phase-0 CodeRabbit findings (canonical gate, error caching, registry pointer, validation) 🤖 Generated by [robots](https://vyos.io) * docs-infra: strengthen manifest tests (full dispatch iteration, mutation-free validate) 🤖 Generated by [robots](https://vyos.io) * docs-infra: address GitHub CodeRabbit review (pointer-after-probe, fail-closed sweeps, block-precedence UA gate, preview hardening) 🤖 Generated by [robots](https://vyos.io) * docs-infra: adversarial review fixes — error no-store, probe retry, PR-list membership, preview dotted-segment 🤖 Generated by [robots](https://vyos.io) * docs-infra: serve oversized legacy PDF from R2 via apex (spec §5 fallback) The 1.3 PDF (29.2 MiB) exceeds the 25 MiB static-asset cap and is absent from the legacy content Worker's build, so /_/downloads/en/1.3/pdf/ (and the picker's PDF link) 301'd into a dead-end 404 post-cutover. Add the R2 object fallback spec §5 already documented but never implemented: a DOCS_PDFS R2 bucket binding on the apex Worker, a manifest pdf_r2_key field (1.3 only), and a router step ahead of version dispatch that streams the object with its own cache class (canary/error still force no-store). 🤖 Generated by [robots](https://vyos.io) * docs-infra: PDF R2 fallback honors Range + If-None-Match, preserves ETag 🤖 Generated by [robots](https://vyos.io)