38165872331
84%

Ran 11 Oct 2026 06:58PM UTC

Jobs 1

Files 54

Run time 1min

Badge

Embed ▾

Committed 11 Oct 2026 06:55PM UTC coverage: 84.488% (+0.2%) from 84.265%

Build # 38165872331

Build Type

push

github

Committed by

web-flow

Commit Message

Bump go-pkgz/auth to reject foreign tokens in email login (#2265)

* Bump go-pkgz/auth to reject foreign tokens in email login

The email login accepted any token carrying a user and address
handshake signed with the shared secret. Unsubscribe links carry such a
token for every notified user, valid for a century, so anyone holding
one could sign in with the email identity for that address. The auth
master now accepts only the email provider's own confirmation tokens;
no release with the change is tagged yet, so the module points at that
commit.

* Move go-pkgz/auth to the master commit that redacts later errors

The previous pin still logged the request, confirmation token included,
when verify login failed after accepting the token: on a bad handshake,
an avatar save error, a token id error or a session token error. The
current master passes the redacted request on those paths too.

* Move go-pkgz/auth to the v2.3.1 release

v2.3.1 is tagged at the commit the module was already pinned to, so the
vendored code stays the same and only the version moves to the release.

Coverage Stats

6073 of 7188 relevant lines covered (84.49%)

31.97 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	38165872331.1	11 Oct 2026 06:58PM UTC	54	84.49	GitHub Action Run

umputun / remark42 / 38165872331
84%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 38165872331

umputun / remark42 / 38165872331 84%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 38165872331

umputun / remark42 / 38165872331
84%

README BADGES
x