Skip to content

Track the floating esp-web-tools@10 tag #84

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
balloob wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Track the floating esp-web-tools@10 tag #84

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion auto.htm
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
<title>Install WLED</title>
<script
type="module"
src="https://unpkg.com/esp-web-tools@10.1.0/dist/web/install-button.js?module"
src="https://unpkg.com/esp-web-tools@10/dist/web/install-button.js?module"

@coderabbitai coderabbitai Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Files present:"
git ls-files | rg '(^|/)auto\.htm$|(^|/)index\.htm$' || true

echo
echo "Relevant script refs:"
for f in auto.htm index.htm; do
  if [ -f "$f" ]; then
    echo "--- $f ---"
    sed -n '1,30p' "$f" | nl -ba
  fi
done

echo
echo "Check unpkg versions if network available:"
python3 - <<'PY'
import json, urllib.request, urllib.error
for spec in ["esp-web-tools@10/index.json", "esp-web-tools@^10/index.json"]:
    try:
        req = urllib.request.urlopen("https://unpkg.com/" + spec, timeout=10)
        data = json.load(req)
        print(spec)
        if "files" in data:
            print("  directory listing")
        if "version" in data:
            print("  resolved version:", data["version"])
        if "latest" in data:
            print("  latest:", data["latest"])
    except Exception as e:
        print(spec, "ERROR", repr(e))
PY

Repository: wled/WLED-WebInstaller

Length of output: 275

🏁 Script executed:

#!/bin/bash
set -u

echo "--- auto.htm lines ---"
python3 - <<'PY'
with open("auto.htm", encoding="utf-8") as f:
    for i, line in enumerate(f, 1):
        if i <= 30:
            print(f"{i}: {line}", end="")
PY

echo
echo "--- index.htm lines ---"
python3 - <<'PY'
with open("index.htm", encoding="utf-8") as f:
    for i, line in enumerate(f, 1):
        if i <= 30:
            print(f"{i}: {line}", end="")
PY

echo
echo "--- matching script src refs ---"
python3 - <<'PY'
from pathlib import Path
for path in Path(".").glob("*.htm"):
    src = None
    with open(path, encoding="utf-8") as f:
        for i, line in enumerate(f, 1):
            if "src=" in line and "esp-web-tools" in line:
                src = line.strip()
                print(f"{path}:{i}:{src}")
                break
PY

echo
echo "--- unpkg resolution probes ---"
python3 - <<'PY'
import json, urllib.request, urllib.error, re
specs = ["esp-web-tools@10/index.json", "esp-web-tools@10.0.0/index.json", "esp-web-tools@latest/index.json", "esp-web-tools@10/dist/web/install-button.js?module=true"]
for spec in specs:
    url = "https://unpkg.com/" + spec
    try:
        with urllib.request.urlopen(url, timeout=10) as r:
            body = r.read(8000).decode("utf-8", errors="replace")
            is_json = spec.endswith(".json")
            data = json.loads(body) if is_json else None
            print(f"OK {spec}, status={r.status}, length={r.headers.get('x-unpkg-cache')}")
            if data is not None:
                print("  version:", data.get("version"), "latest:", data.get("latest"), "semver:", data.get("semver"))
    except Exception as e:
        print(f"ERR {spec}: {type(e).__name__}: {e}")
PY

Repository: wled/WLED-WebInstaller

Length of output: 3588

Pin the installer dependency and update both entry points.

@10 resolves to the latest esp-web-tools v10 at runtime, so minor/patch releases can change the production installer without a repo change. Use a versioned/pinned artifact for both auto.htm and index.htm; if updates are expected, make this an approved release-management policy.

📍 Affects 2 files
  • auto.htm#L13-L13 (this comment)
  • index.htm#L13-L13
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@auto.htm` at line 13, Pin the esp-web-tools installer URL to an explicit
immutable version instead of the floating `@10` selector in auto.htm:13 and
index.htm:13, keeping both entry points on the same pinned artifact. If
dependency updates are intended, document and follow an approved
release-management policy rather than allowing runtime version changes.

></script>
<script src="enable-threads.js"></script>
</head>
Expand Down
2 changes: 1 addition & 1 deletion index.htm
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
<title>Install WLED</title>
<script
type="module"
src="https://unpkg.com/esp-web-tools@10.1.0/dist/web/install-button.js?module"
src="https://unpkg.com/esp-web-tools@10/dist/web/install-button.js?module"
></script>
<script src="enable-threads.js"></script>
</head>
Expand Down