Chuck 6a60a57421 fix(starlark): security and race condition improvements ...

Security fixes:
- Add path traversal validation for output_path in download_star_file
- Remove XSS-vulnerable inline onclick handlers, use delegated events
- Add type hints to helper functions for better type safety

Race condition fixes:
- Lock manifest file BEFORE creating temp file in _save_manifest
- Hold exclusive lock for entire read-modify-write cycle in _update_manifest_safe
- Prevent concurrent writers from racing on manifest updates

Other improvements:
- Fix pages_v3.py standalone mode to load config.json from disk
- Improve error handling with proper logging in cleanup blocks
- Add explicit type annotations to Starlark helper functions

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

2026-02-19 19:37:09 -05:00

..

js

fix(web): use window.installedPlugins for bulk update button (#250)

2026-02-15 15:28:51 -05:00

app.css

feat(plugins): add sorting, filtering, and fix Update All button (#252)

2026-02-17 07:38:16 -05:00

app.js

Plugins (#145)

2025-12-27 14:15:49 -05:00

plugins_manager.js

fix(starlark): security and race condition improvements

2026-02-19 19:37:09 -05:00