Yuvomi-App/docs/upstream-audit.md

Upstream source audit

Inspected 2026-10-20: https://github.com/ulsklyc/yuvomi revision 10bfef7686ed7303b4c74c7fcc55a5eb16356c9d, package version 2.78.0. Source was cloned outside this repository; no upstream files were modified.

Read README, CONTRIBUTING (including AI disclosure), SECURITY, DESIGN, package manifest, server/index.js, server/auth.js, public/sw.js, sw-register.js and notification settings. Reviewed the latest 100 open issues/PRs via GitHub API; that sample is not an exhaustive review of all historical reports.

Findings:

• Frontend has no framework/build step; native projects remain separate.
• Public /api/v1/version exposes app_name, setup_required, password_reset_enabled, not a release number before authentication.
• /api/v1/auth/oidc/config exposes enabled/password-login flags.
• Sessions are HttpOnly, SameSite=Lax, persistent cookies. Operators must set SESSION_SECURE=true behind TLS. Native code must not replace auth or CSRF.
• Username/password, TOTP/recovery codes, reset and logout are web features.
• OIDC stores state, nonce and PKCE in the initiating browser's server session, and returns to the configured server callback. There is no mobile callback, one-time session exchange, or universal-link association protocol.
• Root-relative API, assets, redirects, service-worker registration and cookie path mean subpaths cannot be promised. Use a dedicated hostname instead.
• Service worker has versioned shell caches and allow-listed read-only API caching; mutations and authentication remain network-only. No offline editing.
• Web Push is not native push. Optional upstream ntfy/Gotify/webhook channels provide self-hosted alternatives through their own clients.
• Upstream uses violet #6C3AED, warm grouped background #F5F3ED, and native system fonts. Native screens follow these tokens without changing web design.

Compatibility probing is structural, not cryptographic identification: any server can imitate the public endpoints. Users must trust the URL they enter. Exact release compatibility needs authenticated integration testing; no version range is inferred.