From ad7d73573939c5ca8fb97e6680bc72477c0dac34 Mon Sep 17 00:00:00 2001 From: Lotus CI Date: Sat, 24 Oct 2026 17:05:11 -0400 Subject: [PATCH 1/2] fix(cinny-nginx): give content-hashed app files their own rate budget A cold page load fires ~75 requests within a second and the service worker precaches all ~126 build files at once (every deploy renames them), both past chat_limit's burst of 60. The excess got 503 "limiting requests": a fresh visit to /register/matrix.org rendered blank (4 chunks refused), and precache installs could fail after deploys. Like decorations (matrix #22), hashed js/css/fonts/images/wasm now use assets_limit (100 r/s, burst 400); pages and the webhook keep chat_limit. The deploy validates with nginx -t and restores the old config on failure. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5 --- cinny/nginx.conf | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/cinny/nginx.conf b/cinny/nginx.conf index 68c3376..2e174bf 100644 --- a/cinny/nginx.conf +++ b/cinny/nginx.conf @@ -17,6 +17,14 @@ map $uri $lotus_shell_cache_control { # decoration picker can fetch hundreds of thumbnails, which would otherwise use # up chat_limit and 503 the app's own files. limit_req_zone $binary_remote_addr zone=decorations_limit:10m rate=100r/s; +# +# [cinny #201 follow-up] Content-hashed app files (js/css/fonts/images/wasm) +# likewise: a cold page load fires ~75 requests within a second, and the +# service worker precaches all ~126 build files at once (every deploy renames +# them), both past chat_limit's burst of 60, so chunks 503ed and pages +# rendered blank / the precache install failed. Immutable files, cheap to +# serve; pages and the webhook keep chat_limit. +limit_req_zone $binary_remote_addr zone=assets_limit:10m rate=100r/s; server { listen 80; @@ -85,6 +93,8 @@ server { } location ~* \.(?:js|css|woff2?|png|svg|ico|webp|wasm)$ { include snippets/cinny-security-headers-framed.conf; + # Own budget (replaces the server-level chat_limit; see assets_limit). + limit_req zone=assets_limit burst=400 nodelay; expires 1y; add_header Cache-Control "public, immutable" always; } @@ -93,6 +103,8 @@ server { # Cache content-addressed static assets aggressively location ~* \.(?:js|css|woff2?|png|svg|ico|webp)$ { include snippets/cinny-security-headers.conf; + # Own budget (replaces the server-level chat_limit; see assets_limit). + limit_req zone=assets_limit burst=400 nodelay; expires 1y; add_header Cache-Control "public, immutable" always; } @@ -189,6 +201,8 @@ server { } location ~* \.(?:js|css|woff2?|png|svg|ico|webp|wasm)$ { include snippets/cinny-security-headers-call.conf; + # Own budget (replaces the server-level chat_limit; see assets_limit). + limit_req zone=assets_limit burst=400 nodelay; expires 1y; add_header Cache-Control "public, immutable" always; } -- 2.47.3 From d36c782e56f44b0ef945cdc928ff1c5522142556 Mon Sep 17 00:00:00 2001 From: Lotus CI Date: Sat, 24 Oct 2026 17:35:45 -0400 Subject: [PATCH 2/2] ci(pip-audit): ignore filelock CVEs in pip-audit's own dependency pip-audit --local scans the whole audit env, which includes pip-audit's own CacheControl[filecache] -> filelock 4.1.0. Six new CVEs (fixed in 4.2.1) started failing every run; 4.2+ requires Python 3.11 and the audit env is 3.10. The bot does not use filelock. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5 --- .gitea/workflows/lint.yml | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/.gitea/workflows/lint.yml b/.gitea/workflows/lint.yml index d5d24b3..666bee6 100644 --- a/.gitea/workflows/lint.yml +++ b/.gitea/workflows/lint.yml @@ -94,8 +94,16 @@ jobs: - name: Audit matrixbot dependencies # --local scans the env without spawning a venv (required for standalone Python) - # CVE-2026-3219 is in pip itself, not our code — ignore it explicitly - run: /opt/python/bin/pip-audit --local --ignore-vuln CVE-2026-3219 + # CVE-2026-3219 is in pip itself, not our code — ignore it explicitly. + # The filelock CVEs (fixed in 4.2.1) are in pip-audit's own dependency + # (CacheControl[filecache]); the bot doesn't use filelock, and 4.2+ + # needs Python 3.11, which this 3.10 audit env can't install. + run: >- + /opt/python/bin/pip-audit --local + --ignore-vuln CVE-2026-3219 + --ignore-vuln CVE-2026-112906 --ignore-vuln CVE-2026-112907 + --ignore-vuln CVE-2026-112913 --ignore-vuln CVE-2026-112914 + --ignore-vuln CVE-2026-112937 --ignore-vuln CVE-2026-112940 secret-scan: name: Secret scan (gitleaks) -- 2.47.3