Skip to content

Issue 282: Fix missing feature field in project tasks API response#301

Merged
Wirasm merged 1 commit intocoleam00:mainfrom
ericfisherdev:fix/feature-field-not-updating
Aug 19, 2025
Merged

Issue 282: Fix missing feature field in project tasks API response#301
Wirasm merged 1 commit intocoleam00:mainfrom
ericfisherdev:fix/feature-field-not-updating

Conversation

@ericfisherdev
Copy link
Copy Markdown

@ericfisherdev ericfisherdev commented Aug 18, 2025

Pull Request

Summary

Resolves issue #282 by adding feature field to task dictionary in TaskService.list_tasks() method. The project tasks API endpoint was excluding the feature field while individual task API included it, causing frontend to default to 'General' instead of showing custom feature values.

Changes Made

  • Add feature field to task response in list_tasks method

Before the change:
feature-label-before

After the change:
feature-label-after

Type of Change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Documentation update
  • Performance improvement
  • Code refactoring

Affected Services

  • Frontend (React UI)
  • Server (FastAPI backend)
  • MCP Server (Model Context Protocol)
  • Agents (PydanticAI service)
  • Database (migrations/schema)
  • Docker/Infrastructure
  • Documentation site

Testing

  • All existing tests pass
  • Added new tests for new functionality
  • Manually tested affected user flows
  • Docker builds succeed for all services

Test Evidence

uv run pytest tests/ -v

================= 212 passed, 54 warnings in 81.90s (0:01:21) ==================

Checklist

  • My code follows the service architecture patterns
  • If using an AI coding assistant, I used the CLAUDE.md rules
  • I have added tests that prove my fix/feature works
  • All new and existing tests pass locally
  • My changes generate no new warnings
  • I have updated relevant documentation
  • I have verified no regressions in existing features

@ericfisherdev
Fix missing feature field in project tasks API response
5293687 
Resolves issue coleam00#282 by adding feature field to task dictionary in
TaskService.list_tasks() method. The project tasks API endpoint was
excluding the feature field while individual task API included it,
causing frontend to default to 'General' instead of showing custom
feature values.

Changes:
- Add feature field to task response in list_tasks method
- Maintains compatibility with existing API consumers
- All 212 tests pass with this change
@Wirasm
Copy link
Copy Markdown
Collaborator

Wirasm commented Aug 19, 2025

thanks for this @ericfisherdev

@Wirasm Wirasm merged commit 92b3c04 into coleam00:main Aug 19, 2025
7 checks passed
POWERFULMOVES added a commit to POWERFULMOVES/PMOVES-Archon that referenced this pull request Feb 12, 2026
@POWERFULMOVES @claude
docs: Docker 2025 security best practices and deployment guide (colea…
423bb76 
…m00#301)

* security: fix HIGH severity vulnerabilities in dependencies

This commit addresses critical security vulnerabilities:

1. **python-multipart DoS (CVE-2025-*)**: Upgraded to >=0.0.7
   - Fixed in: flute-gateway, presign, retrieval-eval
   - All instances now use >=0.0.20 for maximum safety

2. **Next.js DoS with Server Components (CVE-2025-55184, CVE-2025-55183)**
   - Upgraded pmoves/ui from 16.0.7 to 16.0.9
   - Upgraded PMOVES-DoX from 15.4.8 to 15.4.9
   - Upgraded PMOVES-Open-Notebook from 15.4.8 to 15.4.9
   - Upgraded PMOVES-BoTZ/cipher from 15.3.6 to 15.3.7
   - Fixes DoS and source code exposure vulnerabilities

3. **MCP Python SDK DNS Rebinding (CVE-2025-66416)**: Upgraded to >=1.23.0
   - Fixed in: PMOVES-Agent-Zero, PMOVES-BoTZ features
   - Enables DNS rebinding protection by default for localhost servers

4. **glob CLI command injection (CVE-2025-64756)**: Verified not affected
   - Repository uses glob@^7.1.3, vulnerability only affects 10.3.7-11.0.3
   - No CLI usage detected, only programmatic API usage

5. **jws HMAC signature verification (CVE-2025-65945)**: Verified not affected
   - No direct jws package dependencies found in repository
   - jose package uses jws as keyword only, not as dependency

All security fixes align with December 2025 security advisories.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix(security): address CRITICAL CVE-2025-55182 (Next.js) and CVE-2025-32434 (PyTorch)

This commit addresses two CRITICAL severity vulnerabilities:

## CVE-2025-55182: Next.js/React RCE (CVSS 10.0)
Updated Next.js in all submodules to patched versions to fix React Server
Components "Flight" protocol vulnerability allowing unauthenticated RCE.

Affected projects and updates:
- PMOVES-Open-Notebook: 15.4.7 → 15.4.8
- PMOVES-DoX: 14.1.0 → 15.4.8
- PMOVES-ToKenism-Multi: 13.4.19 → 15.4.8
- PMOVES-BoTZ/cipher: 15.3.1 → 15.3.6

Default Next.js apps with App Router were vulnerable to exploitation via
crafted HTTP requests with no code changes required. Public exploits exist
and active exploitation has been observed in the wild.

## CVE-2025-32434: PyTorch torch.load RCE (CVSS 9.3)
Updated PyTorch minimum version to >=2.6.0 in PMOVES-Creator to address
deserialization vulnerability in torch.load() that allows RCE even with
weights_only=True parameter when loading specially crafted .tar model files.

References:
- https://nextjs.org/blog/CVE-2025-66478
- GHSA-53q9-r3pm-6pq6
- https://nvd.nist.gov/vuln/detail/CVE-2025-32434
- https://www.wiz.io/blog/critical-vulnerability-in-react-cve-2025-55182

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* docs(security): add Docker 2025 best practices and deployment security guide

- Add Port Allocation Reference Table with 40+ services and security classifications
- Add Service Discovery Patterns (Docker DNS, NATS, Supabase Realtime)
- Add Docker 2025 Security Advisories (CVE-2025-9074, CVE-2025-62725)
- Add Docker Compose V5 breaking changes documentation
- Add Container Security Best Practices (2025 standards)
- Add Production Deployment Checklist with verification commands
- Create docker-compose-networking-best-practices-2025.md with CVE mitigations
- Document Supabase integration path for data services

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* docs: address CodeRabbit review comments for docker-compose guide

- Add official Docker security advisory links for CVE-2025-9074 and CVE-2025-62725
- Update Docker Compose V5 changes to match official release notes only
- Add platform/scope clarification for iptables mitigation with subnet discovery guidance
- Fix markdown lint issues (MD036/MD040) for emphasis-as-heading and missing code block languages

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix(docs): address CodeRabbit review comments

- Fix CRITICAL CVE-2025-55182 Next.js version guidance - correct patched versions are 15.0.5, 15.1.9, 15.2.6, 15.3.6+, 15.4.8+, 15.5.7+, 16.0.7+ (versions 15.3.0-15.3.5 are NOT patched)
- Fix MD056 table column count issues - add missing columns to section header rows
- Add missing language tags to code blocks (MD040) - use 'text' for cross-tier rules and NATS subjects
- Remove low-trust blog links from Additional Resources section
- Replace with official Docker documentation and security advisories

Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix(docs): address additional CodeRabbit review comments

- Add Linux portability note for host.docker.internal with workarounds
- Fix Compose Bridge command syntax (docker compose bridge convert)
- Update security checklist to avoid grep secret leak - use safe placeholder checks and secret scanners instead

Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix(docs): correct CVE-2025-55182 as RCE and add iptables platform notes

- Fix CVE-2025-55182 description: it's RSC Remote Code Execution via
  unsafe deserialization, not authorization bypass
- Add note that App Router is primary attack surface, Pages Router has
  reduced exposure
- Add platform notes for iptables mitigation: Linux-only, Docker Desktop
  uses different networking model
- Include common subnet values and verification command

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

---------

Co-authored-by: Codex Agent <codex-agent@example.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@ericfisherdev @Wirasm