Unreleased Commits - UnitVectorY-Labs

Upgrade frontend to HTMX 4.0.0 (#249) Bump the pinned unpkg htmx release from 2.0.3 to 4.0.0 with a re-verified SHA-384 SRI hash, and adapt the template to HTMX 4's behavior changes: - Mark the form's hx-target/hx-swap as :inherited to preserve the 2.x implicit inheritance of the nested service-account request. - Route 4xx/5xx responses to the #error element via hx-status, since htmx 4 swaps error responses by default (2.x did not). - Rename the htmx:afterSwap listener to htmx:after:swap and read the swap target from event.detail.ctx.target (normalizing string selectors), which also clears a stale error when a new token succeeds. - Drop the now-dead hx-target/hx-swap attributes on the #error element. Verified with the official upgrade checker (0 issues), go build/vet/test, and browser tests of the load, success, 400, and 500 paths. Closes #248

chore(deps): bump golang.org/x/net to v0.62.0 golang.org/x/net@v0.62.0 fixes GO-2026-6860 (CVE-2026-78661) and GO-2026-6866 (CVE-2026-97045), reported against go.mod. Verified with: go get golang.org/x/net@v0.62.0 && go mod tidy && go build ./...

chore: remove govulncheck-go workflow superseded by OSV-Scanner OSV-Scanner (osv-scanner-full.yml / osv-scanner-pr.yml) now provides dependency vulnerability scanning for this repository, so the Go-only govulncheck workflow is redundant. The two govulncheck GOVERSION targets are dropped from .repver as well, because repver fails when a target file cannot be read, and the file is removed from the .managedfiles manifest.

chore(deps): bump docker/login-action from 4.6.0 to 4.7.0 Bumps [docker/login-action](https://github.com/docker/login-action) from 4.6.0 to 4.7.0. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/dbcb813823bdd20940b903addbd779551569679f...81c6f93d4bc991e510b342a00b419b3bb4efc5c6) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 4.7.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

chore(deps): bump astral-sh/setup-uv from 10.3.1 to 10.3.3 Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 10.3.1 to 10.3.3. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](https://github.com/astral-sh/setup-uv/compare/18d369b23da25a81e9458561248e1aafff6a70fa...68559e99cc807c1eb7e9238fd43a15bba460eec2) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 10.3.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

chore(deps): bump UnitVectorY-Labs/chromadb-repo-indexer Bumps [UnitVectorY-Labs/chromadb-repo-indexer](https://github.com/unitvectory-labs/chromadb-repo-indexer) from 1.2.0 to 1.2.1. - [Release notes](https://github.com/unitvectory-labs/chromadb-repo-indexer/releases) - [Commits](https://github.com/unitvectory-labs/chromadb-repo-indexer/compare/69bfd4086b9251106a5c8b036068e02f2d0731aa...8ee570e0b30e5252afadb146977b411b8acd3e34) --- updated-dependencies: - dependency-name: UnitVectorY-Labs/chromadb-repo-indexer dependency-version: 1.2.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

chore(deps): bump google.golang.org/api from 0.303.0 to 0.309.0 Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.303.0 to 0.309.0. - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](https://github.com/googleapis/google-api-go-client/compare/v0.303.0...v0.309.0) --- updated-dependencies: - dependency-name: google.golang.org/api dependency-version: 0.309.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

chore: enable Docker SBOM generation

Update Go version to v1.27.3

Add weekly OSV-Scanner vulnerability scans (#285) * Add weekly OSV-Scanner vulnerability scans * Fix OSV merge-group workflow routing * Align OSV-Scanner workflows with SARIF policy * Configure gitrepoforge OSV SARIF workflows --------- Co-authored-by: OpenCode <opencode@users.noreply.github.com>

chore(deps): bump the codeql group across 1 directory with 3 updates Bumps the codeql group with 3 updates in the / directory: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.38.3 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...9b3254085494b55a0f7c4c2b3d2d52cc712ce370) Updates `github/codeql-action/analyze` from 4.38.3 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...9b3254085494b55a0f7c4c2b3d2d52cc712ce370) Updates `github/codeql-action/upload-sarif` from 4.38.3 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...9b3254085494b55a0f7c4c2b3d2d52cc712ce370) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: codeql - dependency-name: github/codeql-action/init dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: codeql - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: codeql ... Signed-off-by: dependabot[bot] <support@github.com>

chore(deps): bump astral-sh/setup-uv from 10.3.0 to 10.3.1 Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 10.3.0 to 10.3.1. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](https://github.com/astral-sh/setup-uv/compare/1c37ad07a6a961277cf70c0d37d6f313000f5884...18d369b23da25a81e9458561248e1aafff6a70fa) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 10.3.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>