TechSquidTV · KyleTryon · Sep 20, 2026 · Sep 19, 2026 · Sep 20, 2026
diff --git a/.env.example b/.env.example
@@ -74,3 +74,6 @@ CORS_ORIGIN=http://localhost:5173
 # Minimum: 5 minutes
 # Default: 60 minutes
 FETCH_INTERVAL_MINUTES=60
+
+# Enable only behind a trusted proxy that overwrites client IP headers.
+TRUST_PROXY_HEADERS=false
diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml
@@ -5,22 +5,22 @@ inputs:
   node-version:
     description: "Node.js version"
     required: false
-    default: "20"
+    default: "24"
   pnpm-version:
     description: "pnpm version"
     required: false
-    default: "10.19.0"
+    default: "12.4.2"
 
 runs:
   using: "composite"
   steps:
     - name: Setup pnpm
-      uses: pnpm/action-setup@v4
+      uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
       with:
         version: ${{ inputs.pnpm-version }}
 
     - name: Setup Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: ${{ inputs.node-version }}
         cache: "pnpm"

diff --git a/.github/workflows/ci-reusable.yml b/.github/workflows/ci-reusable.yml
@@ -29,16 +29,16 @@ on:
         type: string
 
 env:
-  PNPM_VERSION: 10.19.0
-  NODE_VERSION: "20"
+  PNPM_VERSION: 12.4.2
+  NODE_VERSION: "24"
 
 jobs:
   lint:
     name: Lint
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js and pnpm
         uses: ./.github/actions/setup
@@ -57,7 +57,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js and pnpm
         uses: ./.github/actions/setup
@@ -73,7 +73,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js and pnpm
         uses: ./.github/actions/setup
@@ -95,7 +95,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js and pnpm
         uses: ./.github/actions/setup
@@ -111,15 +111,15 @@ jobs:
 
       - name: Upload API test coverage
         if: ${{ inputs.upload_coverage }}
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{ inputs.pr_number && format('api-coverage-pr-{0}', inputs.pr_number) || 'api-coverage' }}
           path: packages/api/coverage
           retention-days: ${{ inputs.coverage_retention_days }}
 
       - name: Upload API coverage to Codecov
         if: ${{ inputs.upload_coverage }}
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: packages/api/coverage/lcov.info
@@ -132,7 +132,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js and pnpm
         uses: ./.github/actions/setup
@@ -145,15 +145,15 @@ jobs:
 
       - name: Upload App test coverage
         if: ${{ inputs.upload_coverage }}
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{ inputs.pr_number && format('app-coverage-pr-{0}', inputs.pr_number) || 'app-coverage' }}
           path: packages/app/coverage
           retention-days: ${{ inputs.coverage_retention_days }}
 
       - name: Upload App coverage to Codecov
         if: ${{ inputs.upload_coverage }}
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: packages/app/coverage/lcov.info
@@ -166,7 +166,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js and pnpm
         uses: ./.github/actions/setup
@@ -185,7 +185,7 @@ jobs:
 
       - name: Upload build artifacts
         if: ${{ inputs.upload_artifacts }}
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: build-artifacts
           path: |

diff --git a/.github/workflows/ci-tricorder.yml b/.github/workflows/ci-tricorder.yml
@@ -24,8 +24,8 @@ on:
   workflow_dispatch:
 
 env:
-  PNPM_VERSION: 10.19.0
-  NODE_VERSION: "20"
+  PNPM_VERSION: 12.4.2
+  NODE_VERSION: "24"
 
 # Cancel in-progress runs when a new run is triggered
 concurrency:
@@ -38,15 +38,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js and pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         with:
           version: ${{ env.PNPM_VERSION }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: "pnpm"
@@ -62,15 +62,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js and pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         with:
           version: ${{ env.PNPM_VERSION }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: "pnpm"
@@ -86,15 +86,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js and pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         with:
           version: ${{ env.PNPM_VERSION }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: "pnpm"
@@ -110,15 +110,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js and pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         with:
           version: ${{ env.PNPM_VERSION }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: "pnpm"
@@ -130,14 +130,14 @@ jobs:
         run: pnpm --filter @tuvixrss/tricorder test:coverage
 
       - name: Upload coverage
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: tricorder-coverage
           path: packages/tricorder/coverage
           retention-days: 7
 
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: packages/tricorder/coverage/lcov.info
@@ -150,15 +150,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js and pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         with:
           version: ${{ env.PNPM_VERSION }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: "pnpm"
@@ -178,7 +178,7 @@ jobs:
           echo "✅ Package is ready for publishing"
 
       - name: Upload build artifacts
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: tricorder-dist
           path: packages/tricorder/dist

diff --git a/.github/workflows/deploy-cloudflare.yml b/.github/workflows/deploy-cloudflare.yml
@@ -15,8 +15,8 @@ concurrency:
   cancel-in-progress: false
 
 env:
-  PNPM_VERSION: 10.19.0
-  NODE_VERSION: "20"
+  PNPM_VERSION: 12.4.2
+  NODE_VERSION: "24"
 
 # Only run for app releases (v*), not package releases (@tuvixrss/*)
 # Package releases like @tuvixrss/tricorder@x.y.z should not trigger deployment
@@ -54,7 +54,7 @@ jobs:
       SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.release.tag_name || github.event.inputs.version || github.ref }}
 
@@ -102,24 +102,6 @@ jobs:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
 
-      - name: Deploy to Cloudflare Workers
-        id: deploy
-        uses: cloudflare/wrangler-action@v3
-        with:
-          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          workingDirectory: packages/api
-          command: deploy
-          packageManager: pnpm
-
-      - name: Output API deployment URL
-        if: success()
-        run: |
-          API_URL="https://${{ steps.worker-name.outputs.name }}.workers.dev"
-          echo "API_URL=$API_URL" >> $GITHUB_OUTPUT
-          echo "## API Deployment" >> $GITHUB_STEP_SUMMARY
-          echo "- **URL:** $API_URL" >> $GITHUB_STEP_SUMMARY
-
       - name: Prepare D1 migrations
         if: success()
         working-directory: packages/api
@@ -154,7 +136,7 @@ jobs:
 
       - name: Run database migrations
         if: success()
-        uses: cloudflare/wrangler-action@v3
+        uses: cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4.0.0
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
@@ -171,6 +153,24 @@ jobs:
           rm -rf migrations
           echo "✅ Cleaned up migrations folder"
 
+      - name: Deploy to Cloudflare Workers
+        id: deploy
+        uses: cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4.0.0
+        with:
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          workingDirectory: packages/api
+          command: deploy
+          packageManager: pnpm
+
+      - name: Output API deployment URL
+        if: success()
+        run: |
+          API_URL="https://${{ steps.worker-name.outputs.name }}.workers.dev"
+          echo "API_URL=$API_URL" >> $GITHUB_OUTPUT
+          echo "## API Deployment" >> $GITHUB_STEP_SUMMARY
+          echo "- **URL:** $API_URL" >> $GITHUB_STEP_SUMMARY
+
   deploy-app:
     name: Deploy App to Cloudflare Pages
     runs-on: ubuntu-latest
@@ -180,7 +180,7 @@ jobs:
       name: production
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.release.tag_name || github.event.inputs.version || github.ref }}
 
@@ -190,6 +190,9 @@ jobs:
           node-version: ${{ env.NODE_VERSION }}
           pnpm-version: ${{ env.PNPM_VERSION }}
 
+      - name: Build Tricorder
+        run: pnpm run build:tricorder
+
       - name: Type check App
         run: pnpm run type-check:app
 
@@ -260,7 +263,7 @@ jobs:
 
       - name: Deploy to Cloudflare Pages
         id: deploy-app
-        uses: cloudflare/wrangler-action@v3
+        uses: cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4.0.0
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
@@ -285,7 +288,7 @@ jobs:
       name: production
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Create wrangler.toml from example
         uses: ./.github/actions/substitute-d1-database-id