gh-glance 0.6.0 → 0.6.1

package/CHANGELOG.md

@@ -7,6 +7,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.6.1] - 2026-08-06
+
+### Security
+
+- **The GraphQL repository-resolution check no longer risks catastrophic
+  backtracking.** CodeQL flagged `isUnavailable()`'s `.*`-joined pattern as
+  worst-case superlinear over the repository name `gh` echoes back verbatim in
+  its error text -- attacker-influenced input reaching a vulnerable regex. It
+  is now two fixed-substring checks with the same matching behaviour and no
+  backtracking risk.
+
+### Added
+
+- **The status bar shows gh-glance's own version**, right-aligned in the
+  lower-right corner the way lazygit's footer does. It is dropped on narrow
+  terminals rather than left to compete with the `Quit` hint for space.
+
 ## [0.6.0] - 2026-08-06
 
 ### Added
@@ -557,6 +574,7 @@ engineering, security, QA and UX. What follows is what changed as a result.
 - The `main` field from `package.json`. It advertised the file as importable,
   but importing it took over the terminal or exited the host process.
 
+[0.6.1]: https://github.com/juan294/gh-glance/releases/tag/v0.6.1
 [0.6.0]: https://github.com/juan294/gh-glance/releases/tag/v0.6.0
 [0.5.1]: https://github.com/juan294/gh-glance/releases/tag/v0.5.1
 [0.5.0]: https://github.com/juan294/gh-glance/releases/tag/v0.5.0

package/index.mjs

@@ -333,11 +333,18 @@ function errText(err) {
 // "you can't see this here" -- everything else (auth expiry, rate limiting,
 // DNS, a 502) is a real failure that used to be reported as a confident,
 // plausible, and wrong claim that the feature was switched off.
+// The GraphQL variant is matched as two fixed substrings rather than one
+// `.*`-joined regex: CodeQL (js/polynomial-redos) flags a wildcard spanning
+// attacker-influenced text -- a repository name gh echoes back verbatim --
+// as worst-case superlinear. Two `includes` calls are index-scan cheap
+// regardless of what sits between the markers and carry no backtracking risk.
 function isUnavailable(err) {
   const text = errText(err);
+  const lower = text.toLowerCase();
   return (
     /HTTP (403|404)/.test(text) ||
-    /Could not resolve to a Repository with the name .* \(repository\)/i.test(text)
+    (lower.includes("could not resolve to a repository with the name") &&
+      lower.includes("(repository)"))
   );
 }
 
@@ -2398,6 +2405,12 @@ function StatusBar({ fetching, spin, stale, interactive, cols, remoteSetup = fal
         ),
       ])
       .filter(Boolean),
+    // Right-aligned, like lazygit's footer. Dropped in compact mode rather than
+    // left to shrink alongside the hints: it would compete for the same shrink
+    // budget as "Quit", the one hint the comment above already fought to keep
+    // on screen down to 45 columns, and version digits are not worth that.
+    !compact && e(Box, { flexGrow: 1 }),
+    !compact && e(Text, { key: "version", dimColor: true, wrap: "truncate-end" }, version),
   );
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gh-glance",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "A live-refreshing GitHub dashboard for your terminal: Actions, Issues, Pull Requests, and Security alerts in one narrow pane",
   "type": "module",
   "bin": {