Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

Code review 2026-09-09: fix PRs and deferred findings (tracking)

オープン
  • 何か問題がありますか？
#304 コメント 1 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
5/5
見積もり時間
1週間以上
初心者へのやさしさ
20/100
issue の種類
ドキュメント
明瞭さ
説明が足りない
活発さ
活発
技術スタック
android, csharp, sqlite
領域
devtools, performance, security

調査の方向性

This is a tracking issue summarizing completed fixes and deferred findings, not a request for a specific change. Read the linked issues #288–#302 to find an individual task with a defined scope; this issue itself has no implementation entry point or completion criteria.

索引モデルが issue の本文から書いたものです。

説明

enhancement

Tracking issue for the senior architecture / security / performance review of main at 35d86e1 (2026-09-09). Earlier audit for context: #167.

Overall verdict: a well-engineered codebase with a few sharp, high-consequence defects. Domain is dependency-free, the reference graph is acyclic, warnings-as-errors + AnalysisMode=All + StyleCop are enforced everywhere, every analyzer suppression carries a justification, SQL values are fully parameterised, actions are SHA-pinned, and the sync protocol uses a closed [JsonDerivedType] allowlist. The problems were concentrated in persistence correctness, error observability, lifecycle management and a few security edges on the sync / attachment path.

Fix PRs (each with a regression test that failed on main first)

Prio Finding PR
P0 force_unit_edits never deleted on save → Stärke history duplicated on every save, file grows quadratically #279
P0 IIncidentStore.SaveFailed had no subscriber → disk-full / locked / corrupt-DB failures were invisible while the UI said "gespeichert" #280
P0 Workspace never disposed on navigate-home → abandoned workspaces kept ticking, could still write journal entries and play alarms #284
P1 Remote-supplied attachment name reached a temp path and the OS launcher (path traversal + type confusion across peers) #285
P1 Trust store read race on the TLS callback, non-atomic write, dead accept-any-certificate branch #286
P1 CI token not read-only; @claude workflow triggerable by anyone with contents: write; format-check not in CI; Dependabot gaps #287
P1 Android FileProvider exposed the whole cache dir; provider display names used verbatim as path segments #303

Suggested merge order: #287 first (CI), then #279, #280, #284 (independent), then #285 before the Android PR (the Android PR is robust to either order, but #289 assumes #285).

Deferred findings, filed as issues

  • Security: #288 (sync host: 6-digit PIN, SAN, fingerprint), #289 (Android attachment gate + temp janitor)
  • Performance: #290 (coalesce saves), #291 (recent-file probes on UI thread), #292 (quadratic BuildMatrix), #293 (checklist O(N²) fan-out), #294 (Clear+re-add resets), #295 (sync fire-and-forget), #296 (audio queue timeout)
  • Architecture: #297 (MasterDataSet out of Persistence), #298 (session port location + 5-file ceremony), #299 (Incident aggregate + German text in Domain), #300 (logging + global exception handlers)
  • Hygiene: #301 (coverage, deterministic builds, AnalysisLevel, changelog enforcement), #302 (small cleanups checklist)

Items in #167 that this review re-confirmed as still open: Local/Remote session lockstep (#298), DispatcherTimerTicker subscriber isolation and unbounded remote file cache (#302), BuildChildren full rebuild (#294).

主要言語
C#
スター
1
フォーク
3
平均マージ
4時間 34分
マージ済み PR（30日）
182

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

CodeForFire/lagebuch のほかの issue

CodeForFire/lagebuch の issue をすべて見る

似ている issue

C# の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。