All pull requests

Pull requests

• fix(backend): validate counts, revisions, and string lengths in chat session models ($50 bounty proposal)

  #21667·aiwithrajan opened Oct 15, 2026·

  ·

• fix(backend): validate duration, chunk timestamps, and span bounds in audio file models ($50 bounty proposal)

  #21666·aiwithrajan opened Oct 15, 2026·

  ·

• fix(backend): validate non-negative bounds and time window in support models ($50 bounty proposal)

  #21665·aiwithrajan opened Oct 15, 2026·

  ·

• fix(backend): validate non-blank strings and bounds in goal models ($50 bounty proposal)

  #21664·aiwithrajan opened Oct 15, 2026·

  ·

• fix(backend): validate non-blank strings and bounds in review answer models ($50 bounty proposal)

  #21663·aiwithrajan opened Oct 15, 2026·

  ·

• fix: end desktop Gemini streams before Cloud Run's request timeout

  #21662·Git-on-my-level opened Oct 15, 2026Collaborator·

  ·
  5

• fix(desktop): make memory deletion stick — zombie purge, empty-account reconcile, gate-busy retry

  #21661·Git-on-my-level opened Oct 15, 2026Collaborator·

  ·
  8

• fix(deps): bump proxy-addr to 2.0.8

  dependency-review
  #21644·katsugtgz opened Oct 14, 2026Contributor·

  ·

• fix(android): resolve BLE address type to allow pairing public-address peripherals like OMI Glass (#21526)

  androidpositive-signal
  #21643·Dragonire9 opened Oct 14, 2026Contributor·

  ·
  1

  1

• fix(backend): stop memory-delete 409 storms — kind-aware deletion gate + takeover fencing

  #21642·Git-on-my-level opened Oct 14, 2026Collaborator·

  ·
  11

• feat(native): native iOS and Android apps in native_mobile_apps/

  feature-fit-reviewneeds-maintainer-review
  #21641·AlexSchardin opened Oct 14, 2026Collaborator·

  ·
  1

• fix(macos): adjust offset when loaded row is removed or unstarred (#21596)

  macOSpositive-signal
  #21639·Dragonire9 opened Oct 14, 2026Contributor·

  ·
  1

  1

• fix(cache): an uninitialized Redis client can't break the fail-open contract

  backendneeds-maintainer-reviewneeds-tests
  #21638·yggdrasilworld opened Oct 14, 2026·

  ·
  1

  2

• fix(database): validate uids and fence the deletion marker against malformed input

  #21637·yggdrasilworld opened Oct 14, 2026·

  ·
  1

  1

• fix(database): robust exception chaining traversal for transaction contention retry

  backendneeds-maintainer-reviewneeds-tests
  #21636·yggdrasilworld opened Oct 14, 2026·

  ·
  1

  3

• fix(speakers): add error boundaries, validation, and sanitization to speaker-label routes

  backendneeds-tests
  #21635·yggdrasilworld opened Oct 14, 2026·

  ·
  1

  2

• fix(advice): a malformed stored advice doc can't 500 the feed

  #21634·yggdrasilworld opened Oct 14, 2026·

  ·
  1

  1

• fix(chat): a malformed stored message can't 500 the desktop reconcile page

  #21633·yggdrasilworld opened Oct 14, 2026·

  ·
  1

  1

• fix(x_connector): prevent open redirects, XSS, and state delimiter injection in OAuth

  #21632·yggdrasilworld opened Oct 14, 2026·

  ·
  1

  1

• fix(security): an empty ADMIN_KEY no longer authenticates release/cache routes

  #21631·yggdrasilworld opened Oct 14, 2026·

  ·
  1

  1

• fix(imports): prevent zip upload path traversal, shield storage errors, validate job ids

  backendpositive-signalsecurity-review
  #21627·yggdrasilworld opened Oct 14, 2026·

  ·
  1

  2

• fix(ios): describe current features in permission purpose strings

  ci:fulliosneeds-maintainer-reviewpositive-signal
  #21619·apoorvdarshan opened Oct 14, 2026Collaborator·

  ·
  1

  1

• fix(calendar): return recent matching events nearest time_max on search_query (#21573)

  backend
  #21616·pranav440 opened Oct 14, 2026·

  ·
  1

  1

• fix(app): restore a conversation row when its server delete fails

  ci:fullflutterpositive-signalsecurity-review
  #21605·apoorvdarshan opened Oct 14, 2026Collaborator·

  ·
  1

  3

• fix(python-sdk): drain in-flight and buffered audio on Whisper transcription cancellation (#21577)

  positive-signalpython
  #21598·pranav440 opened Oct 14, 2026·

  ·
  1

  1