sami7777/dashcaddy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

DC-039: claim for Hermes
CI / Test & Lint (push) Has been cancelled
Details
CI / Security audit (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Hermes
2026-07-07 08:13:23 -07:00
parent 6fb4f9b169
commit e036bfe452
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
BACKLOG.md
+2 -2
View File
@@ -196,8 +196,8 @@
- **impact:** Faster incident recovery. Currently takes 5-10 manual steps to roll back a failed update; would take 1. - **impact:** Faster incident recovery. Currently takes 5-10 manual steps to roll back a failed update; would take 1.
### DC-039: Audit repo for other `__dirname + sibling-file` patterns — DC-033 class of bug ### DC-039: Audit repo for other `__dirname + sibling-file` patterns — DC-033 class of bug
- **status:** todo - **status:** in-progress
- **owner:** unclaimed - **owner:** hermes
- **details:** DC-033 was caused by `path.join(__dirname, 'package.json')` in a module loaded from a subdirectory. There may be other instances of the same pattern elsewhere in `src/`. Quick grep: `grep -rn "path.join(__dirname" dashcaddy-api/src/ --include="*.js"` and review each hit. Any that join `'package.json'`, `'VERSION'`, `'.env'`, `'openapi.yaml'`, `'Dockerfile'`, or `'.license-secret'` is suspect (these all live at the api root, not in subdirectories). For each suspect match, either: (a) verify the file does exist at the expected `__dirname` location, or (b) fix it to use the api-root path. Effort: ~30 min. Risk: low. Just an audit + targeted fixes. - **details:** DC-033 was caused by `path.join(__dirname, 'package.json')` in a module loaded from a subdirectory. There may be other instances of the same pattern elsewhere in `src/`. Quick grep: `grep -rn "path.join(__dirname" dashcaddy-api/src/ --include="*.js"` and review each hit. Any that join `'package.json'`, `'VERSION'`, `'.env'`, `'openapi.yaml'`, `'Dockerfile'`, or `'.license-secret'` is suspect (these all live at the api root, not in subdirectories). For each suspect match, either: (a) verify the file does exist at the expected `__dirname` location, or (b) fix it to use the api-root path. Effort: ~30 min. Risk: low. Just an audit + targeted fixes.
- **impact:** Catches latent bugs before users do. The fact that DC-033 shipped undiscovered through multiple releases suggests this antipattern might exist elsewhere. - **impact:** Catches latent bugs before users do. The fact that DC-033 shipped undiscovered through multiple releases suggests this antipattern might exist elsewhere.