Claude Opus 4.8 (1M context) cb3d1f2714 fix(library): reject Windows drive-letter paths in _resolve_dlc_path ...

The new test_absolute_path_rejected pins 'C:/Windows/system32/x' → None, but on
POSIX a drive-letter path isn't absolute, so Path(dlc)/'C:/…' becomes the
contained relative dir '<dlc>/C:/…' and slipped through the lexical containment
check (red on the Linux CI). Not an escape, but the traversal contract should
hold cross-platform (a shared library is reached from either OS). Reject a path
that is absolute or drive-qualified in either POSIX or Windows semantics before
the containment check. Legitimate relative/junction paths are unaffected.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-04 23:48:50 +02:00

.claude/skills

Clean release snapshot

2026-06-16 18:47:13 +02:00

.github

fix(release): lowercase the ghcr repo name in image tags (#738)

2026-07-03 13:16:49 +02:00

.specify

rename: slopsmith → feedBack, byron → got-feedBack (#537)

2026-06-23 11:03:01 +02:00

content/starter

Delete content/starter/beethoven-ode_to_joy.feedpak

2026-07-03 23:42:45 +02:00

data/progression

Clean release snapshot

2026-06-16 18:47:13 +02:00

docs

fix(tuner): mic-verify stamps the tuning it actually checked + on-device test plan (#684)

2026-07-01 11:45:26 +02:00

lib

fix(library): serve art/load songs mounted through a library junction

2026-07-04 09:23:32 -05:00

plugins

Fix 3D drum/keys highways not resizing on fullscreen under splitscreen (#723)

2026-07-02 18:42:26 +02:00

scripts

Merge remote-tracking branch 'origin/main' into feat/feedpak-jsonc

2026-07-01 03:27:38 -04:00

specs

rename: slopsmith → feedBack, byron → got-feedBack (#537)

2026-06-23 11:03:01 +02:00

static

fix(plugins): don't treat transient absence from /api/plugins as uninstall (#741)

2026-07-03 14:45:30 +02:00

tests

fix(library): serve art/load songs mounted through a library junction

2026-07-04 09:23:32 -05:00

.dockerignore

Clean release snapshot

2026-06-16 18:47:13 +02:00

.gitattributes

Purge external-format terminology from code, tests and docs

2026-06-16 19:36:53 +01:00

.gitignore

Bundle drum_highway_3d + keys_highway_3d as in-tree core plugins (#693)

2026-07-02 00:25:31 +02:00

build-proxmox-ct.sh

rename: slopsmith → feedBack, byron → got-feedBack (#537)

2026-06-23 11:03:01 +02:00

CHANGELOG.md

feat(v3): playlist shuffle toggle

2026-07-03 13:07:47 +02:00

CLAUDE.md

perf: allocation/scan hardening for weaker hardware

2026-07-02 00:02:54 +02:00

CONTRIBUTING.md

rename: slopsmith → feedBack, byron → got-feedBack (#537)

2026-06-23 11:03:01 +02:00

docker-compose.nas.yml

rename: slopsmith → feedBack, byron → got-feedBack (#537)

2026-06-23 11:03:01 +02:00

docker-compose.yml

rename: slopsmith → feedBack, byron → got-feedBack (#537)

2026-06-23 11:03:01 +02:00

Dockerfile

fix(docker): repin FFmpeg to autobuild-2026-07-03-13-21

2026-07-03 23:16:50 +02:00

LICENSE

Clean release snapshot

2026-06-16 18:47:13 +02:00

main.py

rename: slopsmith → feedBack, byron → got-feedBack (#537)

2026-06-23 11:03:01 +02:00

package-lock.json

rename: slopsmith → feedBack, byron → got-feedBack (#537)

2026-06-23 11:03:01 +02:00

package.json

rename: slopsmith → feedBack, byron → got-feedBack (#537)

2026-06-23 11:03:01 +02:00

playwright.config.ts

Clean release snapshot

2026-06-16 18:47:13 +02:00

pyproject.toml

Clean release snapshot

2026-06-16 18:47:13 +02:00

requirements-test.txt

Clean release snapshot

2026-06-16 18:47:13 +02:00

requirements.txt

Make the library loader sloppak/loose-only

2026-06-16 19:09:53 +01:00

server.py

fix(library): reject Windows drive-letter paths in _resolve_dlc_path

2026-07-04 23:48:50 +02:00

SUPPORTERS.md

rename: slopsmith → feedBack, byron → got-feedBack (#537)

2026-06-23 11:03:01 +02:00

tailwind.config.js

Re-enable the v3 "Support Us!" donate button (#727)

2026-07-03 00:21:10 +02:00

TODO.md

docs: correct plugin URL casing after the feedBack rename (#576)

2026-06-23 11:20:23 +02:00

uv.lock

Clean release snapshot

2026-06-16 18:47:13 +02:00

VERSION

Bump version to 0.3.0-alpha.1

2026-07-03 13:41:50 +02:00

S

Description

No description provided

AGPL-3.0

982 MiB

Languages

JavaScript 56.4%

Python 37.1%

HTML 3.2%

CSS 1.2%

TypeScript 1.1%

Other 1%