Merge branch 'main' into brendan/cve-simple-git

Author: brendan-kellam

CHANGELOG.md

@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+- Added `exclude.private` option to github connection config. [#1632](https://github.com/sourcebot-dev/sourcebot/pull/1632)
+
 ### Fixed
 - Silenced a false-positive `MaxListenersExceededWarning` logged on every request proxied through an external rewrite. [#1697](https://github.com/sourcebot-dev/sourcebot/pull/1697)
 - Upgraded `brace-expansion` to `^1.1.21`, `^2.1.7`, and `^5.0.12`. [#1700](https://github.com/sourcebot-dev/sourcebot/pull/1700)
@@ -17,6 +20,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Upgraded `next` to `^16.3.8`. [#1709](https://github.com/sourcebot-dev/sourcebot/pull/1709)
 - Upgraded `seroval` to `^1.6.8`, `proxy-addr` to `^2.0.8`, `shell-quote` to `^1.12.0`, and `@grpc/grpc-js` to `^1.14.6`. [#1713](https://github.com/sourcebot-dev/sourcebot/pull/1713)
 - Upgraded `simple-git` to `^4.0.2`. [#1715](https://github.com/sourcebot-dev/sourcebot/pull/1715)
+- Upgraded `katex` to `^0.18.2` and `postcss-selector-parser` to `^7.1.6`. [#1717](https://github.com/sourcebot-dev/sourcebot/pull/1717)
+- Upgraded `engine.io` to `^6.6.11`, `source-map-js` to `^1.2.2`, `smol-toml` to `^1.9.0`, `fast-copy` to `^3.1.0`, and `dompurify` to `^3.4.16`. [#1714](https://github.com/sourcebot-dev/sourcebot/pull/1714)
+- Upgraded `golang.org/x/crypto` to `v0.56.0` and OpenTelemetry-Go exporters and SDK to `v1.45.0` in Zoekt. [#1716](https://github.com/sourcebot-dev/sourcebot/pull/1716)
+- Upgraded `@modelcontextprotocol/sdk` to `^1.32.1`. [#1719](https://github.com/sourcebot-dev/sourcebot/pull/1719)
+- Decoded percent-encoded characters in repo names derived from direct generic git URLs. [#1666](https://github.com/sourcebot-dev/sourcebot/pull/1666)
+- Fixed `.gitattributes` `linguist-language` overrides being ignored for files in subdirectories. [#1692](https://github.com/sourcebot-dev/sourcebot/pull/1692)
+- Fixed selected language and repository filters disappearing when filtering the available options. [#1685](https://github.com/sourcebot-dev/sourcebot/pull/1685)
+- Fixed code highlights not covering every line of a multi-line range. [#1699](https://github.com/sourcebot-dev/sourcebot/pull/1699)
 
 ## [5.1.15] - 2026-09-29
 

Dockerfile

@@ -14,7 +14,7 @@ ARG NEXT_PUBLIC_SENTRY_BACKEND_DSN
 ARG NEXT_PUBLIC_BUILD_COMMIT_SHA
 
 FROM node:24-alpine3.23 AS node-alpine
-FROM golang:1.25-alpine AS go-alpine
+FROM golang:1.26-alpine AS go-alpine
 # ----------------------------------
 
 # ------ Build Zoekt ------

docs/snippets/schemas/v3/connection.schema.mdx

@@ -125,6 +125,11 @@
               "default": false,
               "description": "Exclude archived repositories from syncing."
             },
+            "private": {
+              "type": "boolean",
+              "default": false,
+              "description": "Exclude private repositories from syncing. Internal repositories are not affected."
+            },
             "repos": {
               "type": "array",
               "items": {

docs/snippets/schemas/v3/github.schema.mdx

@@ -121,6 +121,11 @@
           "default": false,
           "description": "Exclude archived repositories from syncing."
         },
+        "private": {
+          "type": "boolean",
+          "default": false,
+          "description": "Exclude private repositories from syncing. Internal repositories are not affected."
+        },
         "repos": {
           "type": "array",
           "items": {

docs/snippets/schemas/v3/index.schema.mdx

@@ -622,6 +622,11 @@
                       "default": false,
                       "description": "Exclude archived repositories from syncing."
                     },
+                    "private": {
+                      "type": "boolean",
+                      "default": false,
+                      "description": "Exclude private repositories from syncing. Internal repositories are not affected."
+                    },
                     "repos": {
                       "type": "array",
                       "items": {

package.json

@@ -66,6 +66,10 @@
         "fast-uri@npm:^3.0.1": "^3.1.2",
         "shell-quote@npm:1.8.3": "^1.8.4",
         "ws@npm:~8.20.1": "^8.21.0",
-        "postcss-selector-parser@npm:6.0.10": "^6.1.3"
+        "postcss-selector-parser@npm:6.0.10": "^7.1.6",
+        "postcss-selector-parser@npm:^6.1.1": "^7.1.6",
+        "postcss-selector-parser@npm:^6.1.2": "^7.1.6",
+        "postcss-selector-parser@npm:^6.1.3": "^7.1.6",
+        "katex@npm:^0.16.45": "^0.18.2"
     }
 }

packages/backend/src/github.test.ts

@@ -214,6 +214,40 @@ test('shouldExcludeRepo handles archived repos correctly', () => {
     expect(shouldExcludeRepo({ repo, exclude: { archived: false } })).toBe(false);
 });
 
+test('shouldExcludeRepo handles private repos correctly', () => {
+    const privateRepo = {
+        full_name: 'test/private-repo',
+        clone_url: 'https://github.com/test/private-repo.git',
+        private: true,
+        visibility: 'private',
+    } as OctokitRepository;
+
+    expect(shouldExcludeRepo({ repo: privateRepo })).toBe(false);
+    expect(shouldExcludeRepo({ repo: privateRepo, exclude: { private: true } })).toBe(true);
+    expect(shouldExcludeRepo({ repo: privateRepo, exclude: { private: false } })).toBe(false);
+});
+
+test('shouldExcludeRepo does not exclude internal repos when exclude.private is true', () => {
+    const internalRepo = {
+        full_name: 'test/internal-repo',
+        clone_url: 'https://github.com/test/internal-repo.git',
+        private: true,
+        visibility: 'internal',
+    } as OctokitRepository;
+
+    expect(shouldExcludeRepo({ repo: internalRepo, exclude: { private: true } })).toBe(false);
+});
+
+test('shouldExcludeRepo excludes private repos with missing visibility when exclude.private is true', () => {
+    const repo = {
+        full_name: 'test/private-no-visibility',
+        clone_url: 'https://github.com/test/private-no-visibility.git',
+        private: true,
+    } as OctokitRepository;
+
+    expect(shouldExcludeRepo({ repo, exclude: { private: true } })).toBe(true);
+});
+
 test('shouldExcludeRepo handles include.topics correctly', () => {
     const repo = {
         full_name: 'test/repo',

packages/backend/src/github.ts

@@ -77,6 +77,7 @@ export type OctokitRepository = {
     full_name: string,
     fork: boolean,
     private: boolean,
+    visibility?: string,
     html_url: string,
     clone_url?: string,
     stargazers_count?: number,
@@ -507,6 +508,11 @@ export const shouldExcludeRepo = ({
             return true;
         }
 
+        if (!!exclude?.private && repo.private && repo.visibility !== 'internal') {
+            reason = `\`exclude.private\` is true`;
+            return true;
+        }
+
         if (exclude?.repos) {
             if (micromatch.isMatch(repoName, exclude.repos)) {
                 reason = `\`exclude.repos\` contains ${repoName}`;

packages/backend/src/repoCompileUtils.test.ts

@@ -334,4 +334,24 @@ describe('compileGenericGitHostConfig_url', () => {
         const metadata = result[0].metadata as { gitConfig?: Record<string, string> };
         expect(metadata.gitConfig!['zoekt.name']).toBe('github.com/test/repo');
     });
+
+    test('should decode percent-encoded characters in the repo name', async () => {
+        mockedIsUrlAValidGitRepo.mockResolvedValue(true);
+
+        const config = {
+            type: 'git' as const,
+            url: 'https://github.com/test/Project%20Name%20With%20Spaces.git',
+        };
+
+        const result = await compileGenericGitHostConfig_url(config, 1);
+
+        expect(result).toHaveLength(1);
+        // The repo name should have decoded spaces, not %20
+        expect(result[0].name).toBe('github.com/test/Project Name With Spaces');
+        expect(result[0].displayName).toBe('github.com/test/Project Name With Spaces');
+
+        const metadata = result[0].metadata as { gitConfig?: Record<string, string> };
+        expect(metadata.gitConfig!['zoekt.name']).toBe('github.com/test/Project Name With Spaces');
+        expect(metadata.gitConfig!['zoekt.display-name']).toBe('github.com/test/Project Name With Spaces');
+    });
 });

packages/backend/src/repoCompileUtils.ts

@@ -725,7 +725,28 @@ export const compileGenericGitHostConfig_url = async (
 
     // @note: matches the naming here:
     // https://github.com/sourcebot-dev/zoekt/blob/main/gitindex/index.go#L293
-    const repoName = path.join(remoteUrl.host, remoteUrl.pathname.replace(/\.git$/, ''));
+    // Decode URL-encoded characters (e.g., %20 -> space) to ensure consistent repo names
+    let decodedPathname: string;
+    try {
+        decodedPathname = decodeURIComponent(remoteUrl.pathname);
+    } catch (e) {
+        if (e instanceof URIError) {
+            const warning = `Skipping ${remoteUrl.toString()} - malformed URL encoding.`;
+            logger.warn(warning);
+            reportRepositoryDiscoveryIssue({
+                code: "INVALID_REPOSITORY_SOURCE",
+                effect: "TARGET_SKIPPED",
+                subject: {
+                    kind: "url",
+                    value: remoteUrl.toString(),
+                },
+                message: warning,
+            });
+            return [];
+        }
+        throw e;
+    }
+    const repoName = path.join(remoteUrl.host, decodedPathname.replace(/\.git$/, ''));
 
     const repo: RepoData = {
         external_codeHostType: 'genericGitHost',