Bryan Helmkamp fae575c193 fix(server): validate owner/repo path params on GitHub repo lookup ... Path<(String, String)> percent-decodes segments, so an authenticated user could send owner=foo%2F..%2Fuser (decoded to foo/../user). After reqwest URL normalization this rewrote the GitHub API endpoint and reissued the server's privileged token against an unintended path. Reject anything outside [A-Za-z0-9._-] with length caps, plus the literals "." and "..".		2026-04-18 04:39:47 -04:00
..
crates	fix(server): validate owner/repo path params on GitHub repo lookup	2026-04-18 04:39:47 -04:00
packages/fabro-api-client	fix(api): convert OpenAPI spec to valid 3.1 syntax	2026-04-18 01:11:19 -04:00