Chore(deps): Bump release-drafter/release-drafter/autolabeler from 7.8.0 to 7.10.0 (#7248)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.github/workflows/docker-publish.yml

@@ -68,7 +68,7 @@ jobs:
           run_install: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
         with:
           node-version: 24
           cache: 'pnpm'

.github/workflows/lint.yml

@@ -32,7 +32,7 @@ jobs:
           run_install: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
         with:
           node-version: 24
           cache: 'pnpm'

.github/workflows/release-drafter.yml

@@ -26,14 +26,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - if: github.event_name == 'workflow_dispatch' && github.event.inputs.version != ''
-        uses: release-drafter/release-drafter@c345907820e0396f6f44bcfd9ac4763325f8feb0 # v7
+        uses: release-drafter/release-drafter@978bb0b30c5ee8cdd332ced253758157150d43f0 # v7
         with:
           config-name: release-drafter.yml
           version: ${{ github.event.inputs.version }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - if: github.event_name != 'workflow_dispatch' || github.event.inputs.version == ''
-        uses: release-drafter/release-drafter@c345907820e0396f6f44bcfd9ac4763325f8feb0 # v7
+        uses: release-drafter/release-drafter@978bb0b30c5ee8cdd332ced253758157150d43f0 # v7
         with:
           config-name: release-drafter.yml
         env:
@@ -47,7 +47,7 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-      - uses: release-drafter/release-drafter/autolabeler@c345907820e0396f6f44bcfd9ac4763325f8feb0
+      - uses: release-drafter/release-drafter/autolabeler@978bb0b30c5ee8cdd332ced253758157150d43f0
         with:
           config-name: release-drafter.yml
         env:

.github/workflows/test.yml

@@ -22,7 +22,7 @@ jobs:
         with:
           version: 9
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
         with:
           node-version: 24
           cache: pnpm

src/__tests__/pages/api/mcp/index.test.js

@@ -34,7 +34,7 @@ function mockResponse() {
 
 async function loadHandler() {
   vi.resetModules();
-  return (await import("./index")).default;
+  return (await import("pages/api/mcp/index")).default;
 }
 
 describe("pages/api/mcp", () => {

src/__tests__/pages/api/services/proxy-request-shaping.test.js

@@ -57,7 +57,7 @@ vi.mock("widgets/widgets", () => ({
   },
 }));
 
-import handler from "./proxy";
+import handler from "pages/api/services/proxy";
 
 function createReq({ method = "GET", body, query = {} } = {}) {
   return { method, body, query };

src/__tests__/pages/no-colocated-tests.test.js

@@ -0,0 +1,19 @@
+import { readdirSync } from "fs";
+
+import { expect, it } from "vitest";
+
+// Next compiles everything under src/pages into routes, so a colocated test ships
+// to users and drags its dev dependencies into the runtime image.
+function filesIn(dir, found = []) {
+  readdirSync(dir, { withFileTypes: true }).forEach((entry) => {
+    const path = `${dir}/${entry.name}`;
+    if (entry.isDirectory()) filesIn(path, found);
+    else found.push(path);
+  });
+  return found;
+}
+
+it("keeps test files out of src/pages", () => {
+  const tests = filesIn("src/pages").filter((path) => /\.(test|spec)\.[jt]sx?$/.test(path));
+  expect(tests).toEqual([]);
+});

src/utils/config/config.js

@@ -69,11 +69,11 @@ export function substituteEnvironmentVars(str) {
     const cachedVars = getCachedEnvironmentVars();
     cachedVars.forEach(([key, value]) => {
       if (key.startsWith(homepageVarPrefix)) {
-        result = result.replaceAll(`{{${key}}}`, value);
+        result = result.replaceAll(`{{${key}}}`, () => value);
       } else if (key.startsWith(homepageFilePrefix)) {
         const filename = value;
         const fileContents = readFileSync(filename, "utf8");
-        result = result.replaceAll(`{{${key}}}`, fileContents);
+        result = result.replaceAll(`{{${key}}}`, () => fileContents);
       }
     });
   }

src/utils/config/config.test.js

@@ -1,4 +1,4 @@
-import { mkdtempSync, writeFileSync } from "node:fs";
+import { mkdtempSync, rmdirSync, unlinkSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import path from "node:path";
 
@@ -37,6 +37,39 @@ describe("utils/config/config", () => {
     expect(mod.substituteEnvironmentVars("token={{HOMEPAGE_FILE_SECRET}}")).toBe("token=secret");
   });
 
+  it.each(["pa$$word", "pa$&word", "pa$`word", "pa$'word", "pa$1word"])(
+    "substituteEnvironmentVars preserves literal environment value %j in every occurrence",
+    async (secret) => {
+      process.env.HOMEPAGE_VAR_SECRET = secret;
+
+      const mod = await import("./config");
+      expect(
+        mod.substituteEnvironmentVars("before {{HOMEPAGE_VAR_SECRET}} between {{HOMEPAGE_VAR_SECRET}} after"),
+      ).toBe(`before ${secret} between ${secret} after`);
+    },
+  );
+
+  it.each(["pa$$word", "pa$&word", "pa$`word", "pa$'word", "pa$1word"])(
+    "substituteEnvironmentVars preserves literal secret file contents %j in every occurrence",
+    async (secret) => {
+      const dir = mkdtempSync(path.join(tmpdir(), "homepage-config-test-"));
+      const secretPath = path.join(dir, "secret.txt");
+      writeFileSync(secretPath, secret, "utf8");
+
+      try {
+        process.env.HOMEPAGE_FILE_SECRET = secretPath;
+
+        const mod = await import("./config");
+        expect(
+          mod.substituteEnvironmentVars("before {{HOMEPAGE_FILE_SECRET}} between {{HOMEPAGE_FILE_SECRET}} after"),
+        ).toBe(`before ${secret} between ${secret} after`);
+      } finally {
+        unlinkSync(secretPath);
+        rmdirSync(dir);
+      }
+    },
+  );
+
   it("getSettings reads from HOMEPAGE_CONFIG_DIR and converts layout list to an object", async () => {
     const dir = mkdtempSync(path.join(tmpdir(), "homepage-settings-test-"));
     process.env.HOMEPAGE_CONFIG_DIR = dir;

src/utils/proxy/handlers/credentialed.js

@@ -55,6 +55,7 @@ export default async function credentialedProxyHandler(req, res, map) {
           "authentik",
           "cloudflared",
           "ghostfolio",
+          "gitea",
           "headscale",
           "hoarder",
           "karakeep",
@@ -143,7 +144,7 @@ export default async function credentialedProxyHandler(req, res, map) {
         headers["X-API-Key"] = `${widget.key}`;
       }
 
-      const [status, contentType, data] = await httpProxy(url, {
+      const [status, contentType, data, responseHeaders] = await httpProxy(url, {
         method: req.method,
         withCredentials: true,
         credentials: "include",
@@ -178,7 +179,7 @@ export default async function credentialedProxyHandler(req, res, map) {
             .status(500)
             .json({ error: { message: "Invalid data", url: sanitizeErrorURL(url), data: resultData } });
         }
-        if (map) resultData = map(resultData);
+        if (map) resultData = map(resultData, responseHeaders);
       }
 
       if (contentType) res.setHeader("Content-Type", contentType);

src/utils/proxy/handlers/credentialed.test.js

@@ -45,6 +45,7 @@ vi.mock("widgets/widgets", () => ({
     autobrr: { api: "{url}/{endpoint}" },
     jellystat: { api: "{url}/{endpoint}" },
     trilium: { api: "{url}/{endpoint}" },
+    gitea: { api: "{url}/api/v1/{endpoint}" },
     gitlab: { api: "{url}/{endpoint}" },
     azuredevops: { api: "{url}/{endpoint}" },
     glances: { api: "{url}/{endpoint}" },
@@ -135,6 +136,33 @@ describe("utils/proxy/handlers/credentialed", () => {
     expect(res.body).toEqual({ ok: true });
   });
 
+  it("uses Bearer auth for gitea widgets and keeps the key out of the URL", async () => {
+    getServiceWidget.mockResolvedValue({ type: "gitea", url: "http://example", key: "token" });
+    httpProxy.mockResolvedValue([200, "application/json", []]);
+
+    const req = { method: "GET", query: { group: "g", service: "s", endpoint: "notifications?limit=1", index: 0 } };
+    const res = createMockRes();
+
+    await credentialedProxyHandler(req, res);
+
+    const [url, params] = httpProxy.mock.calls[0];
+    expect(params.headers.Authorization).toBe("Bearer token");
+    expect(url.toString()).toBe("http://example/api/v1/notifications?limit=1");
+  });
+
+  it("passes response headers to the mapping function", async () => {
+    getServiceWidget.mockResolvedValue({ type: "gitea", url: "http://example", key: "token" });
+    httpProxy.mockResolvedValue([200, "application/json", [], { "x-total-count": "7" }]);
+
+    const req = { method: "GET", query: { group: "g", service: "s", endpoint: "notifications?limit=1", index: 0 } };
+    const res = createMockRes();
+
+    await credentialedProxyHandler(req, res, (data, headers) => ({ count: Number(headers["x-total-count"]) }));
+
+    expect(res.statusCode).toBe(200);
+    expect(res.body).toEqual({ count: 7 });
+  });
+
   it("uses NC-Token auth for nextcloud widgets when key is provided", async () => {
     getServiceWidget.mockResolvedValue({ type: "nextcloud", url: "http://example", key: "nc-token" });
     httpProxy.mockResolvedValue([200, "application/json", { ok: true }]);

src/widgets/gitea/widget.js

@@ -1,4 +1,4 @@
-import genericProxyHandler from "utils/proxy/handlers/generic";
+import credentialedProxyHandler from "utils/proxy/handlers/credentialed";
 
 // Get total from header to avoid pagination limit
 export function totalCount(data, headers) {
@@ -7,8 +7,8 @@ export function totalCount(data, headers) {
 }
 
 const widget = {
-  api: "{url}/api/v1/{endpoint}?access_token={key}",
+  api: "{url}/api/v1/{endpoint}",
-  proxyHandler: genericProxyHandler,
+  proxyHandler: credentialedProxyHandler,
 
   mappings: {
     notifications: {