feat(widgets): plugin-file-manager, time-picker, file-upload-single + array-table v2#356

Merged

ChuckBuilds merged 17 commits into

mainfrom

feat/plugin-file-manager-widget

May 31, 2026

Commits on May 29, 2026

fix(plugin-loader): detect new deps via requirements.txt hash instead of empty marker

Chuck
and
claude
committed
fix(plugin-loader): address CodeQL path expression and I/O error handling

Chuck
and
claude
committed

Commits on May 30, 2026

fix(plugin-loader): use realpath+startswith containment check for CodeQL path-injection

Chuck
and
claude
committed
fix(plugin-loader): fail-fast when install_dependencies returns False

Chuck
and
claude
committed
fix(plugin-loader): use basename+reconstruct to satisfy CodeQL py/path-injection

Chuck
and
claude
committed
fix(plugin-loader): guard against empty basename when plugin_dir resolves to fs root

Chuck
and
claude
committed
feat(widgets): add plugin-file-manager, time-picker, file-upload-single widgets + array-table improvements

Chuck
and
claude
committed
fix(security): address CodeQL and coderabbit review findings

Chuck
and
claude
committed

Commits on May 31, 2026

fix(pages_v3): add ledmatrix- prefix fallback for plugin_id in web-ui route

Chuck
and
claude
committed
fix(security): apply os.path.basename sanitizer + fix Unicode escapes + remaining review items

Chuck
and
claude
committed
fix(codacy): resolve all 55 Codacy static analysis findings

Chuck
and
claude
committed
fix(codacy): replace innerHTML with DOMParser-based safeSetHTML + fix prototype pollution

Chuck
and
claude
committed
fix(codacy): fix remaining 2 RegExp failures + warnings

Chuck
and
claude
committed
ci: trigger fresh Codacy scan

Chuck
and
claude
committed
chore: add .codacy.yml config

Chuck
and
claude
committed
fix(codacy): replace DOMParser with createContextualFragment + DOM card builder

Chuck
and
claude
committed
chore: simplify .codacy.yml to exclude_paths only

Chuck
and
claude
committed