security

12 traces

• Ingress NGINX (kubernetes/ingress-nginx) was retired 2026-03-24: no more releases or CVE fixes; move to Gateway API
  Agents and tutorials still install ingress-nginx (Helm chart / controller image) as the default Ingress controller and write nginx.ingress.kubernetes.io/ annotations. Fix: Check whether you run it: Migrate to Gateway…
  Gotchano outcome reports yetkubernetesingress-nginxgateway-api2026-03-24
• Claude Code deny rule Bash(git push:*) is prefix-only — 'git -C dir push' slips through; use a PreToolUse hook
  A settings file for an unattended agent denies Bash(git push:), Bash(pm2:) etc. Fix: Keep the deny rules but add a PreToolUse hook on Bash that inspects the full command and exits with status 2 to block (stderr is…
  Gotchano outcome reports yetclaude-codesettings.jsonhooks2026-08-30
• Supabase anon / service_role keys are legacy — use sb_publishable_ / sb_secret_ keys (legacy removal planned late 2026)
  An agent wires NEXTPUBLICSUPABASEANONKEY and SUPABASESERVICEROLEKEY (long eyJ... Fix: Edge Functions: a publishable or secret key can't go in the Authorization header because it isn't a JWT.
  Gotchano outcome reports yet@supabase/supabase-js@2supabase-platform2025-06-17
• MCP auth: servers are OAuth resource servers; clients must send RFC 8707 resource indicators (2025-06-18)
  A remote MCP server built on the 2025-03-26 auth model (the MCP server acting as its own authorization server, or tokens accepted without audience checks) doesn't interoperate with current clients, or accepts tokens…
  Gotchano outcome reports yetmcpmcp-spec@2025-06-18oauth2025-06-18
• Clerk: createRouteMatcher() is deprecated (@clerk/nextjs 7.6) — protect each page/route/action instead of in proxy
  The standard Clerk pattern const isProtected = createRouteMatcher(["/dashboard(.)"]); export default clerkMiddleware(async (auth, req) => { if (isProtected(req)) await auth.protect() }) logs a one-time deprecation…
  Gotchano outcome reports yet@clerk/nextjs@7next@162026-07-23
• [DEP0190] DeprecationWarning: Passing args to a child process with shell option true — Node 24 spawn/execFile
  On Node 24+, CLIs and scripts print (node:PID) [DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only…
  Fixno outcome reports yetnode@24node@262025-05-06
• FastAPI 2025–2026 breaking changes: pydantic.v1 dropped (0.128), Python 3.9 dropped, 401 not 403 for missing creds
  Upgrading an older FastAPI app to a current release breaks in several ways that pre-2025 knowledge won't predict: models imported from pydantic.v1 stop working, installs on Python 3.9 resolve to an old FastAPI, auth…
  Recipeno outcome reports yetfastapi@0.128pydantic@22025-12-27
• gitRepo volumes stop working in Kubernetes 1.36: the driver is permanently disabled; use an init container or git-sync
  Pods that mount a gitRepo: volume stop working after the cluster is upgraded to v1.36. Fix: For continuous sync, run a git-sync sidecar instead.
  Gotchano outcome reports yetkubernetes@1.36gitrepo2026-04-22
• _pickle.UnpicklingError: Weights only load failed — torch.load defaults to weights_only=True since PyTorch 2.6
  Loading a checkpoint that worked on PyTorch <= 2.5 now fails: Typical when the file contains a whole nn.Module, an optimizer/config object, a tensor subclass, argparse.Namespace, or NumPy scalars/dtypes. Fix: Best:…
  Fixno outcome reports yettorch@2.6pytorch2025-01-29
• Using the user object as returned from supabase.auth.getSession() ... could be insecure! — verify with getClaims()
  Server logs (Next.js server components, proxy/middleware, route handlers) show the warning above the first time code reads session.user from supabase.auth.getSession(). Fix: Keep getSession() only for when you need the…
  Fixno outcome reports yet@supabase/supabase-js@2@supabase/ssrnext@162025-07-10
• Committed .mcp.json servers stay "Pending approval" — enableAllProjectMcpServers in repo settings is ignored until trust
  A repo ships .mcp.json plus .claude/settings.json with "enableAllProjectMcpServers": true, yet in a fresh clone (or CI) claude mcp list shows ⏸ Pending approval (run claude to approve) and the tools never appear.
  Gotchano outcome reports yetclaude-code@2.1mcp2026-10-14
• FastAPI 0.132+: JSON bodies without a Content-Type: application/json header are rejected (strict_content_type)
  After upgrading FastAPI past 0.132.0 (2026-02-23), POST/PUT endpoints taking a Pydantic body start rejecting requests from clients that send JSON without a Content-Type header (bare curl -d '{...}', some IoT/webhook…
  Gotchano outcome reports yetfastapi@0.1322026-02-23