Repository navigation
release: app 2.5.1 — security advisory feed (/security.json) and docs - #33
Merged
Merged
Conversation
jp1337
changed the title
UPDATE_CHECK_ENABLED now also fetches openwhistle/OpenWhistle's published GitHub security advisories. Documented in the settings reference, the outbound-requests table, the System page section of the admin guide and the upgrade page's "Stay up to date" note. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FKEGX9RGdDXHv8qJap41YM
OpenWhistle 2.5.0's update check (on by default) fetches one file a day: /security.json, schema 1 of the app's docs-tech/security-feed.md. The build writes it from the GitHub API (published repository advisories and the latest release), via scripts/security_feed.py; the workflow fetches it once with its token and hands it to the image build (OW_SECURITY_FEED). Anything the app would drop fails the build: a broken feed is never published. nginx serves it as application/json with no log line, so "the site logs nothing" holds. Docs follow: the update check now names openwhistle.net and is on by default (settings reference, outbound requests, admin guide, upgrade note, the architecture diagram and the two blog posts that said "GitHub, opt-in"). Mutations: docs-tech/mutations/v2.5.0-site-security-feed.json, 6/6 red. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FKEGX9RGdDXHv8qJap41YM
jp1337
force-pushed
the
docs/security-advisory-notice
branch
from
November 4, 2026 21:24
ea3efaa to
0d13a6c
Compare
This was referenced Nov 4, 2026
The planned "Multi-Channel Intake" release was numbered 2.5.0, the number the advisory notice shipped under: the plan moves to 2.6.0, end-to-end encryption to 2.7.0, compliance expansion to 2.8.0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FKEGX9RGdDXHv8qJap41YM
jp1337
marked this pull request as ready for review
November 4, 2026 22:35
jp1337
changed the title
/en/changelog/older/ reached 103 KB at 2.5.1, over the 100 KB first-view budget: three releases in a day pushed 2.3.0..2.0.0 onto it. An archived series may now be a closed minor; 2.0.x moves to /en/changelog/2.0.x/ and /older/ is 53 KB again. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FKEGX9RGdDXHv8qJap41YM
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FKEGX9RGdDXHv8qJap41YM
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FKEGX9RGdDXHv8qJap41YM
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FKEGX9RGdDXHv8qJap41YM
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Publishes
/security.json, the one file every OpenWhistle installation fetches daily from 2.5.0 on, anddocuments the changed update check. App PR: openwhistle/OpenWhistle#226. Feed format (schema 1):
docs-tech/security-feed.mdin the app repo.
state=published) +releases/latest→ schema 1; fails on anything the app would dropscripts/security_feed.pyscripts/build_site.pywrite_security_feed()→/security.jsonwebsite-image.yml(both jobs),DockerfileARG OW_SECURITY_FEEDapplication/json, ETag, no log linewebsite/nginx.conflocation = /security.json { access_log off; }tests/fixtures/security.json,tests/conftest.pyMapping:
vulnerabilities[0].vulnerable_version_range→affected,patched_versions→fixed,cve_id→cve_ids, tagv2.4.2→2.4.2.Docs: settings reference (default now
true), outbound requests (openwhistle.net, on by default), adminguide, upgrade note; the architecture diagram (re-rendered) and two blog posts per language still said
"GitHub update check, opt-in".
Checks
v2.5.0-site-security-feed.jsonThe docs describe 2.5.0 behaviour (default on, openwhistle.net); the tests do not compare defaults, so nothing
turns red early. Merge with the app release; the feed itself can go live before it (2.4.x never reads it).
After publishing a GitHub security advisory, run this workflow by hand (
workflow_dispatch): the feed isrebuilt only with the site.
🤖 Generated with Claude Code
https://claude.ai/code/session_01FKEGX9RGdDXHv8qJap41YM