LotusGuild/matrix

fix(cinny-nginx): own rate budget for content-hashed app files #40

Merged

jared merged 2 commits from fix/asset-rate-limit into main

2026-10-24 17:39:18 -04:00

Author	SHA1	Message	Date
Lotus CIandClaude Opus 5.5	d36c782e56	ci(pip-audit): ignore filelock CVEs in pip-audit's own dependency Lint / Shell (shellcheck) (push) Successful in 10s Details Lint / JS (eslint) (push) Successful in 9s Details Lint / No secrets in webhook configs (push) Successful in 7s Details Lint / Landing page is rendered (matrix (push) Successful in 8s Details Lint / Python (ruff) (push) Successful in 7s Details Lint / Python deps (pip-audit) (push) Successful in 1m4s Details Lint / Secret scan (gitleaks) (push) Successful in 6s Details Lint / Shell (shellcheck) (pull_request) Successful in 13s Details Lint / JS (eslint) (pull_request) Successful in 10s Details Lint / No secrets in webhook configs (pull_request) Successful in 6s Details Lint / Landing page is rendered (matrix (pull_request) Successful in 7s Details Lint / Python (ruff) (pull_request) Successful in 6s Details Lint / Python deps (pip-audit) (pull_request) Successful in 42s Details Lint / Secret scan (gitleaks) (pull_request) Successful in 9s Details pip-audit --local scans the whole audit env, which includes pip-audit's own CacheControl[filecache] -> filelock 4.1.0. Six new CVEs (fixed in 4.2.1) started failing every run; 4.2+ requires Python 3.11 and the audit env is 3.10. The bot does not use filelock. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-24 17:35:45 -04:00
Lotus CIandClaude Opus 5.5	ad7d735739	fix(cinny-nginx): give content-hashed app files their own rate budget Lint / Shell (shellcheck) (pull_request) Successful in 15s Details Lint / JS (eslint) (pull_request) Successful in 10s Details Lint / No secrets in webhook configs (pull_request) Successful in 5s Details Lint / Landing page is rendered (matrix (pull_request) Successful in 5s Details Lint / Python (ruff) (pull_request) Successful in 6s Details Lint / Python deps (pip-audit) (pull_request) Failing after 57s Details Lint / Secret scan (gitleaks) (pull_request) Successful in 11s Details Lint / Shell (shellcheck) (push) Successful in 11s Details Lint / JS (eslint) (push) Successful in 9s Details Lint / No secrets in webhook configs (push) Successful in 5s Details Lint / Landing page is rendered (matrix (push) Successful in 5s Details Lint / Python (ruff) (push) Successful in 8s Details Lint / Python deps (pip-audit) (push) Failing after 51s Details Lint / Secret scan (gitleaks) (push) Successful in 6s Details A cold page load fires ~75 requests within a second and the service worker precaches all ~126 build files at once (every deploy renames them), both past chat_limit's burst of 60. The excess got 503 "limiting requests": a fresh visit to /register/matrix.org rendered blank (4 chunks refused), and precache installs could fail after deploys. Like decorations (matrix #22), hashed js/css/fonts/images/wasm now use assets_limit (100 r/s, burst 400); pages and the webhook keep chat_limit. The deploy validates with nginx -t and restores the old config on failure. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-24 17:05:11 -04:00