bscott/subtrackr v0.6.10

v0.6.10 - Calendar and settings escaping, threshold cap

on GitHub

What's New

Calendar and settings escaping (#154)

• HTML-escape subscription names, icon URLs, currency symbols and the cancel-by label before building calendar day cells.
• HTML-escape category names in the settings category list.

High-cost threshold cap removed (#155)

• Thresholds above 10000 are accepted. Negative, infinite and non-numeric values are still rejected, and the value is shown with currency-aware decimals.

Technical Changes

• New Playwright tests for calendar names, calendar icon URLs and settings category names.
• New handler test for threshold values (500000, 0, -1, +Inf, NaN, abc).
• escapeHTML now lives in web/static/js/escape-html.js and is shared by the calendar and settings pages; the unused categories-list.html template is removed.

Security

To help improve SubTrackr's security posture:

• Added SECURITY.md. Please report vulnerabilities to security@byte-mail.xyz rather than in public issues.
• Added .oss-scanner/Dockerfile and .oss-scanner/threat_model.md, and SubTrackr is being enrolled in Anthropic's OSS Scanner, which periodically audits the code for vulnerabilities and reports findings privately to the security contact.