Nostr Summary's avatar
Nostr Summary
nostr-summary@snowcait.github.io
npub10l47...v2ux
A bot that posts the latest commit from repositories tagged with the #nostr topic once an hour.
Nostr Summary's avatar
nostr-summary 17 hours ago
[ BigBrotr/bigbrotr ] fix: upgrade pip/setuptools/wheel in Docker image for CVE fixes Upgrade pip, setuptools, and wheel before installing project wheels to resolve fixable vulnerabilities found by Trivy gate scan: - jaraco.context 5.3.0 → 6.1.0 (CVE-2026-23949, path traversal) - wheel 0.45.1 → 0.46.2 (CVE-2026-24049, privilege escalation) Also add Codecov coverage badge to README.
Nostr Summary's avatar
nostr-summary 17 hours ago
[ nostr-dev-kit/ndk ] Release NDK major versions - remove all beta version suffixes - Update all package versions from X.Y.Z-beta.71 to X.Y.Z across all NDK packages - Update all @nostr-dev-kit package cross-references to clean major release versions - Includes: 17 main packages, 7 example/test files, and lock file - All packages now on clean major release versions: - @nostr-dev-kit/ndk: 3.0.0 - @nostr-dev-kit/svelte: 4.0.0 - @nostr-dev-kit/wallet: 1.0.0 - @nostr-dev-kit/react: 1.3.13
Nostr Summary's avatar
nostr-summary 19 hours ago
[ chebizarro/nostrc ] fix: UAF in answer channel — remove go_channel_free from all writers (nostrc-pub3) The nostrc-pub2 fix moved channel ownership to write_operations, but the channel is buffered (capacity 1) so go_channel_send returns immediately. write_operations freed the channel while the publisher was still inside go_select_timeout polling it — UAF on c->chan->magic. Same bug existed in neg-client.c (go_channel_free immediately after nostr_relay_write) and subscription.c (never closed the channel).
Nostr Summary's avatar
nostr-summary 20 hours ago
[ chebizarro/nostrc ] fix: SEGV in update_timestamp_tick Pango finalize (nostrc-pgo3) Timer ref keeps NoteCardRow alive after window/surface is destroyed. gtk_label_set_text unrefs old PangoLayout whose PangoContext is gone (owned by the now-destroyed native surface) -> SEGV writing to NULL in pango finalize. Add gtk_widget_get_native() check to LABEL_SAFE_TO_UPDATE macro. Labels without a native surface have no valid PangoContext, so updating their text is unsafe. Less restrictive than get_mapped()
Nostr Summary's avatar
nostr-summary 20 hours ago
[ flox1an/nostube ] feat: add upload onboarding dialog and fix private playlist tags - Add UploadOnboardingDialog that appears when no servers are configured, explaining primary/mirror model with visual flow and auto-configuring defaults or allowing manual setup - Fix private playlists to include `encrypted` tag per NIP-51 spec for proper detection (previously relied only on non-empty content) - Add Russian language option to settings language selector - Remove old "Use recommended servers" button and yellow warning box from upload page in favor of the new onboarding dialog