openvibers/openvibe.live Commits

CI green on main: openvibe-contracts v0.83.0 and a gitleaks allowlist for the site-config fixture

OP OpenVibers committed 1 Oct 2026 · 325232e433 · 3 files, +16 −5

Main's CI has been red since 09-29 on three things; this branch already
fixes the openvibe-shared pin-drift. It also:

- moves openvibe-contracts v0.71.0 → v0.83.0. The contracts check failed
  because live.analytics.read, live.url_registry.refresh and
  live.avatar.write, which server/ already uses, are not in 0.71.0.
- adds .gitleaks.toml (the estate's format: path AND value). The
  push-time history scan flagged the made-up Stripe secret in
  test/site-config.test.js, which proves a secret never leaves the
  admin API.

Local: npm test 154/155 (one skip: no local model), contracts check ok,
pin-drift none.

Changes

ddiff --git a/.gitleaks.toml b/.gitleaks.toml
nnew file mode 100644
iindex 00000000..65df6369
---- /dev/null
++++ b/.gitleaks.toml
@@@ -0,0 +1,11 @@
++# gitleaks configuration, used by the shared security workflow
++# (OpenVibers/OpenVibe.Shared/.github/workflows/security.yml). The default rules stay on; every
++# allowlist below is one proven false positive, matched on path AND value so nothing else is hidden.
++[extend]
++useDefault = true
++
++[[allowlists]]
++description = "A made-up Stripe secret in the site-config test that proves a secret never leaves the admin API (real keys are longer and mixed-case)"
++condition = "AND"
++paths = ['''^test/site-config\.test\.js$''']
++regexes = ['''^sk_live_[a-z]{10}$''']
ddiff --git a/package-lock.json b/package-lock.json
iindex cff575b3..d6148b59 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -25,7 +25,7 @@
          "multer": "^1.4.5-lts.1",
          "node-media-server": "^2.7.1",
          "onnxruntime-node": "^1.20.0",
--        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.71.0",
++        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.83.0",
          "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.16.0",
          "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.3.1",
          "sanitize-html": "^2.17.7",
@@@ -2814,9 +2814,9 @@
        }
      },
      "node_modules/openvibe-contracts": {
--      "version": "0.71.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.71.0",
--      "integrity": "sha512-BLS6gP/MKuwhvTdWO8UYUaOyhmf7ni0cQ8r7150o57R5TrCnzdWQEVESxfMFCGgSbm2wdKtdZwTID69nxD14Tg==",
++      "version": "0.83.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.83.0",
++      "integrity": "sha512-KMIJfTjpjVfE/cH2VDmzbZL9KnBm9guyFRniic7kdl/dN0RV2IlgExJG13hDOO39Qq4+RfjPcwuhp06qWuD2SQ==",
        "license": "AGPL-3.0-only",
        "dependencies": {
          "ajv": "^8.17.1",
ddiff --git a/package.json b/package.json
iindex 6eab322c..30b6a732 100644
---- a/package.json
++++ b/package.json
@@@ -44,7 +44,7 @@
      "multer": "^1.4.5-lts.1",
      "node-media-server": "^2.7.1",
      "onnxruntime-node": "^1.20.0",
--    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.71.0",
++    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.83.0",
      "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.16.0",
      "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v2.3.1",
      "sanitize-html": "^2.17.7",