Frederic CabassutandClaude Opus 4.6 d34b3a18bc fix: address PR review — sanitize attachments, SSR safety, a11y ...

- Strip server paths from public attachment responses (new PublicAttachment type)
- Use $page.url.origin instead of window.location.origin (SSR-safe)
- Fix toggle switch left-4.5 → left-[1.125rem] (valid Tailwind)
- Add aria-label to SharingIndicator button for screen readers
- Add opportunistic pruning to IP rate limiter to prevent unbounded growth
- Reduce shared attachment cache to 1 hour (respect share revocation)
- Update OpenAPI schema with PublicAttachment type
- Add unit test asserting server paths are not leaked

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-03-20 22:06:41 +01:00

..

(app)

chore: update about page wording to "bretzel.app universe"

2026-03-12 23:53:40 +01:00

(auth)

fix: resolve all svelte-check warnings (a11y + state_referenced_locally)

2026-03-09 02:37:07 +01:00

(share)

fix: address PR review — sanitize attachments, SSR safety, a11y

2026-03-20 22:06:41 +01:00

api

fix: address PR review — sanitize attachments, SSR safety, a11y

2026-03-20 22:06:41 +01:00

+error.svelte

feat: replace pretzel emoji with favicon across the app

2026-03-07 07:05:59 +01:00

+layout.server.ts

feat(layout): expose user data to app shell

2026-03-09 01:10:37 +01:00

+layout.svelte

fix: register PWA service worker via virtual:pwa-register for offline support

2026-03-12 20:53:38 +01:00