mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-25 17:45:53 +01:00
fix/duplex-readiness-buffer-cap
3764
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Priya RamanandPaperclip
|
e26b917971 |
fix(sandbox): enforce the duplex readiness cap on every pre-READY path and tolerate PTY noise
Enforce the O(1) readiness-buffer cap on every pre-READY path. Before this change the gate checked the cap only on the no-newline branch. An over-cap blank prefix followed by a valid nonce-bound READY frame in one chunk reached READY acceptance without a cap check. The gate now rejects when the cursor passes the cap after it skips a line, and before it decodes a completed candidate line. The cap check has priority over READY acceptance on every path. A cap breach settles protocol contamination and falls back to the file bridge with bounded cleanup. Make the readiness gate tolerant of pre-READY noise. A PTY channel echoes the launch wrapper line before it sets raw mode, so the first line is often not the READY frame. The gate now skips each pre-READY line that does not decode as a READY frame, then accepts the first line that decodes as a READY frame with the matching nonce. A READY frame with a wrong nonce still fails the handshake. The skipped bytes stay in the capped buffer, so the cap and the timeout still bound the wait, and the newline scan stays linear in the bytes received. Fix the gateway launch command. A POSIX shell rejects an environment-assignment prefix on exec, so exec NAME=value command exits 127 and the gateway never starts. Use exec env NAME=value command, which keeps the exec-replaces-shell property and passes the assigned environment. Add fallback_reason to the channel-open span on the fallback path only. fallback_reason is an existing closed dimension key, so no new key reaches a sink. Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
Priya RamanandPaperclip
|
49bb13dc23 |
fix(sandbox): make the pre-READY duplex blank-line scan incremental
The pre-READY readiness gate scanned for newlines incrementally, but the blank-line branch was not incremental. Each leading blank line reset the search to offset zero and copied the remaining buffer, so one untrusted chunk of blank lines plus one invalid line drove quadratic CPU work in the pre-authentication gate. Keep an advancing line-start cursor and a scan cursor over an append-only buffer. Skip a blank line by moving the cursors past the newline, without a buffer copy and without a search restart. Slice only the single candidate line for the decode. Each code unit is read at most one time. The scan counter now records the real indexOf distance, so a test can prove the blank-line path stays linear. Add a regression that sends one chunk of 15000 blank lines and an invalid line, and asserts the scan work is within 4x the bytes received and the contaminated fallback and cleanup happen. Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
Priya RamanandPaperclip
|
65a8cecf31 |
fix(sandbox): make the pre-READY duplex newline scan incremental
The pre-READY readiness gate searched the full accumulated buffer with
buffer.indexOf("\\n") for every chunk. String#indexOf is linear in the
searched string, so many small newline-less chunks made the cumulative
scan work quadratic in the bytes received before the cap fired. An
untrusted provider could monopolize a host worker CPU.
Record the buffer length before each append and search from that offset
with buffer.indexOf("\\n", from). A newline can only be inside the new
chunk, so the search is correct and the total scan work is linear. Reset
the offset to 0 after the blank-line skip consumes a line.
Add a regression test that counts the scan work through a test-only seam
and asserts it stays proportional to the bytes received. The O(1) buffer
cap, the protocol_contamination result, the settled byte-drop guard, the
nonce check, and the file-bridge fallback stay unchanged.
Co-authored-by: Paperclip <noreply@paperclip.ing>
|
||
|
Priya RamanandPaperclip
|
a33d2aaae9 |
fix(sandbox): bound the pre-READY duplex buffer cap check in O(1)
The duplex readiness gate checked the pre-READY buffer cap with Buffer.byteLength, which is O(n) in the buffer length. A provider that controls the chunk size could send many small newline-less chunks, so the per-chunk byte scan made the pre-READY window quadratic in the bytes received. This was a CPU-exhaustion path on channel open. Gate on buffer.length, the UTF-16 code-unit count, which is O(1). The UTF-8 byte length is greater than or equal to the UTF-16 code-unit count for every string, so the check never fires before the byte cap is truly exceeded. It can fire late by at most a factor of 3, so peak buffer memory stays bounded near 3 MB. The failure reason and every other gate behavior stay unchanged. Add a test that feeds many small newline-less chunks past the cap and asserts the gate finishes with protocol contamination. Correct one telemetry README sentence. Counters carry no dimension labels; fallback_reason and loss_class fold into the counter metric name. The full closed dimension set rides only the spans and the transport event. Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
Priya RamanandPaperclip
|
8e26e17408 |
feat(sandbox): stream duplex run logs and bind the duplex telemetry recorder
Stream sandbox run logs on the duplex transport with the same gate and the same log line as the file transport. The duplex path starts no file bridge worker, so the host creates the log directory before the tail starts. The step is best effort and never tears down a working duplex transport. Bind the fixed duplex telemetry surface to real host sinks. The host builds one recorder per run: the spans go to the OTel tracer, the guarded counters go to the tool-runtime metric store, and the transport event goes to the run-event path. Each sink runs guarded and fire-and-forget, so a telemetry failure never breaks the request path. The server attaches the recorder to the sandbox target next to the runner; a run with no recorder keeps the safe no-op default. Update the telemetry README to name the counter store file. Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
Priya RamanandPaperclip
|
2215416898 |
fix(sandbox): harden the duplex transport before the bridge merges
Bound the pre-READY readiness buffer, apply the header allowlist on the host duplex forward path, derive the nested broker budgets from the forward budget, and remove a dead cleanup branch. - The readiness gate caps the pre-READY buffer at the codec frame-size bound plus one line of margin. Past the cap with no newline, the gate finishes with protocol contamination. The gate drops later bytes after it settles, so a failed handshake never grows the buffer. - The broker forward callback applies the host header allowlist next to the route check, so a frame header outside the allowlist never reaches the authenticated fetch. The sandbox-side filter stays a convenience. - The broker budgets derive the response budget and the gateway wait budget from the forward budget, so any forward budget keeps the nested order. The host constructs the broker inside the guarded region, so a construction throw closes the channel and selects the file bridge. - The channel-open catch block drops the dead `if (channel)` branch, because the open call is the last statement of the try. Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
Priya RamanandPaperclip
|
9e22537f34 |
chore(ci): retrigger PR metadata checks
Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
Priya RamanandPaperclip
|
f09d5ba416 |
fix(sandbox): make a pre-response duplex forward failure non-retryable for a mutating method
The duplex broker forwarded each request and mapped a forward rejection to a retryable 502 when its controller was not aborted. A fetch can reject after the request bytes reach the host and the host commits a mutation, but before the response headers arrive. A retry then sent a new request id outside the broker deduplication set, so the host applied the mutation twice. The broker now classifies a non-aborted forward rejection by method safety. A safe method (GET, HEAD, OPTIONS, TRACE) never changes host state, so its rejection stays a retryable 502. Any other method may have committed, so the broker returns a non-retryable 504 and marks the outcome indeterminate. The in-sandbox gateway maps the indeterminate outcome to a terminal 409, so a caller never repeats a possibly-committed mutation. Add broker coverage for both paths. Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
Priya RamanandPaperclip
|
d68ef2a41a |
docs(telemetry): document the sandbox duplex transport contract
The duplex transport adds spans, one event, counters, and dimensions in duplex-telemetry.ts. The generated telemetry contract does not cover them, so the telemetry README is their canonical contract. Add a section for the span, event, and counter names, the closed dimension-key set with its enum values, and the opt-in and no-user-content rules. Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
Priya RamanandPaperclip
|
d0c4968e97 |
fix(sandbox): make a post-commit response-read failure non-retryable
The bridge forward reads the host response body after the fetch resolves. A mutating request may have committed on the host by then. A body over the size limit, or a stream read error, made the forward reject. The duplex broker and the file bridge both mapped that rejection to a retryable 502. A retry then sent a new request id outside the broker deduplication set, so the host applied the mutation twice. The forward now catches a response-body read failure and returns a non-retryable 504 with the indeterminate outcome marker. The in-sandbox server maps the indeterminate 504 to a non-retryable 409 for both transports, so a caller never repeats a possibly-committed mutation. Add broker and integration coverage. Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
Priya RamanandPaperclip
|
8036019807 |
fix(sandbox): bound the duplex request-id bytes in the codec and the broker
The duplex frame codec accepted a request or a response `id` of any length up to the whole-frame cap. The host broker keeps one id per distinct dispatched request for the no-replay guarantee. A provider that controls the transport could send distinct near-frame-limit ids and force the host to retain many gigabytes before the lifetime count ceiling, so the host adapter process could exhaust memory. Add a finite protocol bound for the id field: - Export `DEFAULT_MAX_DUPLEX_REQUEST_ID_BYTES` (256 bytes). The generated gateway builds each id with `randomUUID()` (36 bytes), so this bound gives large headroom and caps the retained bytes per id. - Reject an over-limit id as an `id_too_large` protocol error in both codec copies (the host codec and the embedded gateway codec). The read path returns the error; it never throws. The whole-frame cap stays unchanged. - Enforce the id bound in the broker before the seen set, the pending record, and the forward, as defense in depth. The refusal allocates no controller, no timer, and no forward, and records no telemetry. - State the worst-case retained id bytes at the lifetime-limit definition (50,000 * 256 = 12,800,000 bytes). Add shared fixture vectors for a maximal-allowed id and an over-limit id, so both codec copies prove the same bound. Add regression tests for the flood, the no-replay path, and the byte-not-character measure. Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
Priya RamanandPaperclip
|
fc1f74131e |
test(sandbox): prove the duplex broker request limits
Inject more than the limit of unique valid frames straight into the broker through an in-memory channel, the same as a malicious provider. The tests prove: no forward past the limit, bounded pending and retained-id bookkeeping, orderly bounded 503 responses with no route, query, body, or token, a freed slot that forwards a resent refused id one time, and an unchanged loss and telemetry redaction surface. Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
Priya RamanandPaperclip
|
0d728d0f45 |
feat(sandbox): bound untrusted duplex broker frame concurrency and id retention
The provider controls the duplex transport directly, so each request frame is untrusted. The broker now enforces two finite, fail-closed limits before it adds the id to the seen set, allocates the pending record, or calls the forward handler: - an in-flight limit that bounds the controllers, the timers, and the concurrent authenticated forwards. - a lifetime limit that bounds the retained request-id memory. On a limit the broker answers the refused request with one bounded terminal 503 response and forwards nothing. An in-flight refusal is retryable and keeps the id out of the seen set, so a resend passes after a slot frees. A lifetime refusal is terminal. The refusal preserves the no-replay and no-double-dispatch rules and records no telemetry, so the fixed observability surface stays unchanged. Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
Priya RamanandPaperclip
|
50c9c10a80 |
test(sandbox): pin the exact fixed duplex dimension-key set
Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
Priya RamanandPaperclip
|
767d12c166 |
test(sandbox): prove the live duplex provider metrics and fix the channel command argument
Pass the channel command as an argument list, so the live launch wrapper builds the raw-mode wrapper instead of failing on a string. The live test now runs when the provider credential is present. Add two live cases against the real provider. The first sends repeated channel round trips over one open channel, measures the round-trip latency, and asserts the provider session count never rises: zero idle polls and zero per-request session growth. The second forces a mid-flight disconnect and asserts no leaked session and a still-usable sandbox. Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
Priya RamanandPaperclip
|
c881bc460c |
feat(sandbox): add fixed duplex observability with a redacted telemetry surface
Add the closed telemetry contract for the sandbox duplex transport: the two fixed spans, the four guarded counters, and the one transport event. A new provider-scoped facade maps each record to the fixed names and dimension keys. It maps the raw provider key through a one-value allowlist before every sink, so a plugin key never reaches a span, a counter, or the event; a non-approved key maps to the constant other. Wire the facade into the transport selection path and the broker. The selection path records the channel-open span, the fallback counter, and the transport event, and it maps each readiness failure to a fixed fallback reason. The broker records one request span with latency per delivered request and one loss record per terminal loss, classified as pre_dispatch or post_dispatch. Keep the per-request debug output off the duplex path: suppress the route and query proxy logs and pass no free-form logger to the broker, so no route, query, body, token, or raw provider error rides a log line, a span, an event, or a counter. Every recorder call sits inside an error swallow, so a telemetry failure never breaks the request path. The default recorder is a no-op, so the surface stays inert until the host binds a real recorder. Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
Priya RamanandPaperclip
|
43f9d3c4a2 |
feat(sandbox): wire the duplex bridge kill switch to the transport selection callers
Carry the per-run duplex bridge kill switch from the instance setting to every caller of startAdapterExecutionTargetPaperclipBridge. The host reads readSandboxDuplexBridgeInput() and stamps enableSandboxDuplexBridge on the sandbox target, on the same seam as effectiveCapabilities. The value stays on the host and never enters the sandbox environment. The stamp fails closed. An absent runtime, an absent read method, a read error, or any value other than true keeps the file bridge. The adapter-side spec parse reads the boolean and treats an absent or non-boolean field as no grant. The acpx engine and the six local adapter callers pass the parsed value into the bridge, so the two-gate selection is now reachable. Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
Priya RamanandPaperclip
|
3e8d9d6f6b |
test(sandbox): add the local real-process duplex end-to-end harness
Spawn the generated gateway with plain node from a temporary file, attach the real host broker to the child stdin and stdout, and forward each request to a local fake API server on a real HTTP call. The harness needs no provider credentials and adds no dependency. The harness proves the composed duplex path over real kernel pipes: - The child sends a valid liveness-only READY frame to the broker. - One HTTP request travels through the child and the broker to the API and the response body returns unchanged. - A large response spans many pipe chunks and returns complete. - A multi-byte UTF-8 sequence split across chunk borders decodes correctly. - Concurrent requests through one child each receive the matching response. - A real stdin EOF makes the gateway answer 409 outcome_indeterminate to every outstanding request and 503 bridge_unavailable to every new one. - A real process kill moves the broker to lost, stops all dispatch, and leaves no open pipe or socket handle after teardown. Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
Priya RamanandPaperclip
|
aa55a49370 |
feat(sandbox): select the duplex transport behind two gates with a liveness-only readiness contract
Select the duplex transport only when the experimental setting enableSandboxDuplexBridge is exactly true and the resolved capability duplexCommandStream is exactly true. Any other value of either gate selects the file bridge. The host assigns the loopback port and one random per-open nonce, and passes both to the gateway only through the launch environment. The host builds the sandbox-facing origin http://127.0.0.1:<assigned port> from its own stored port. No field of any channel frame contributes to the endpoint. Change the READY frame from an address string to a strict version-plus-nonce schema in the host codec, the embedded gateway codec, and the shared fixture; the gateway echoes the nonce and sends READY only after it binds the assigned port. The gateway binds exactly that port or writes a diagnostic and exits nonzero. Readiness fails closed. On a mismatched nonce, an address-bearing or incomplete READY frame, protocol contamination before READY, a bind failure, or a timeout, the host closes the partial channel inside a bounded budget and selects the file bridge, and leaves no live provider session. The broker starts only after readiness passes, so no request that carries the bridge token reaches a rejected endpoint. Teardown closes the channel before lease release. Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
Priya RamanandPaperclip
|
cf0d2b823a |
feat(sandbox): add the host duplex bridge broker with nested budgets
Add the host broker for the sandbox duplex channel. The broker reads request frames from one persistent channel, forwards each request on the existing API path, and writes one response frame back. It sends heartbeat frames on an interval to prove liveness. The broker keeps the forward path unchanged. The caller passes a forward handler, and the broker calls it for each request. The handler owns the route allowlist, the token replacement, and the run attribution, so those rules stay in one place. The broker runs nested timeout budgets: forward 30 s, response 32 s, and gateway wait 35 s. Each inner budget is smaller than its outer budget. The broker asserts this order at construction and rejects a configuration that breaks it. Loss is terminal. The broker detects loss through channel exit, a stream write failure, a protocol failure, a heartbeat write failure, and a close timeout. On loss the broker stops, records the loss for metrics only, and dispatches nothing more. It never reconnects and never replays a request. Wire the existing forward timeout in execution-target.ts to a new option that defaults to the broker forward budget (30 s), so the current behavior does not change. Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
Nicky LeachandPaperclip
|
faab2620ad |
feat(sandbox): add a duplex transport for Daytona behind a default-off kill switch (#11750)
## Thinking Path > - Paperclip is an open source app that manages AI agents for work > - Paperclip runs agents in local and remote sandbox environments > - A sandbox needs a bounded channel for commands and asynchronous input > - Daytona needs a real pseudo-terminal transport for this channel > - The sandbox gateway also needs a mode that handles channel loss safely > - This pull request adds the Daytona transport and gateway mode behind a default-off kill switch > - The benefit is a tested foundation for later transport selection ## Linked Issues or Issue Description **Subsystem affected** Cross-cutting (multiple of the above): sandbox providers, plugin SDK, server settings, and shared types. **Problem or motivation** The merged sandbox protocol has no runtime transport for Daytona. The generated sandbox gateway also has no duplex mode. A later transport-selection change needs both parts and a safe per-run gate. **Proposed solution** Add a Daytona `duplexCommandStream` transport over a raw pseudo-terminal. Add a generated gateway mode named `duplex_v1`. Add the `enableSandboxDuplexBridge` setting with a default value of `false`. Keep transport selection disabled until a later pull request. **Alternatives considered** Keep the protocol unused until the transport-selection change. This would delay provider tests and leave the gateway path without direct coverage. **Roadmap alignment** This change supports the completed Roadmap item for cloud and sandbox agents. It extends the merged sandbox channel foundation in pull request #11738. **Additional context** The Daytona provider remains an untrusted boundary. Deployments must use least-privilege provider credentials and provider-side quota controls. Operators must name an owner for duplex telemetry retention before rollout. ## What Changed - Add the Daytona `duplexCommandStream` capability over a raw pseudo-terminal. - Add a launch wrapper that disables echo and newline translation for NDJSON frames. - Close channels on lease release, destroy, resume of a stopped worker, and worker shutdown. - Declare the capability in the Daytona manifest and set `PLUGIN_VERSION` to `0.1.5`. - Add the worker-to-host notification sink at `ctx.duplexChannel.data` and `ctx.duplexChannel.exit`. - Add the generated sandbox gateway mode `PAPERCLIP_API_BRIDGE_MODE=duplex_v1`. - Add channel-loss results of `409 outcome_indeterminate` and `503 bridge_unavailable`. - Add the per-run setting `enableSandboxDuplexBridge`, with a default value of `false`. - Add unit tests, generated-source codec tests, lifecycle tests, and a credential-gated live Daytona test. ## Verification - Daytona suite: 185 tests pass. - Adapter utilities: 754 tests pass and 4 tests skip. - Plugin SDK: 62 tests pass. - Shared package: 28 tests pass. - Server duplex tests pass. - Shared, plugin SDK, server, and Daytona TypeScript checks pass. - The live Daytona test passes 3 cases when `DAYTONA_API_KEY` is set. - The live Daytona test skips 3 cases without `DAYTONA_API_KEY`. - CI must run the full workspace typecheck, test, and build gates after PR creation. ## Risks - The Daytona control plane and pseudo-terminal remain untrusted boundaries. - The duplex gateway changes behavior only when the mode and per-run setting enable it. - A lost channel fails requests without replay, so callers must handle indeterminate outcomes. - The transport-selection change must require both `duplexCommandStream === true` and `enableSandboxDuplexBridge === true`. - The provider credential and quota limits need operator control before rollout. ## Model Used OpenAI Codex, GPT-5, tool use and code execution. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes: #` / `Refs: #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
Nicky LeachandPaperclip
|
d5416fde9a |
fix(runtime): route sandbox git-bundle export through native syncOut (#11749)
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work > - Sandbox-managed runtimes move files between a host and an isolated sandbox > - The git-bundle export path reads the full bundle into host memory > - The workspace restore path already uses the provider native `syncOut` transfer > - This pull request uses `syncOut` for bundle export and keeps `readFile` as a fallback > - The change reduces host buffering and exposes the transfer to provider tracing ## Linked Issues or Issue Description **What happened?** The sandbox git-bundle export used `client.readFile` even when the provider supported native `syncOut`. The path buffered the full bundle in host memory and used a chunked base64 command loop. **Expected behavior** The export should use one confined native file transfer when the provider supports `syncOut`. Providers without that capability should keep the existing `readFile` fallback. **Steps to reproduce** 1. Prepare a sandbox-managed runtime with native `syncOut` support. 2. Export the sandbox git bundle. 3. Inspect the sync operations and file reads. 4. Confirm that the bundle uses one native file mapping and that the status file still uses `readFile`. **Paperclip version or commit** Commit `3fc88d14be7133867897e87838276e15aba675fd`. **Deployment mode** Built from source. The change applies to sandbox-managed runtime execution. **Additional context** This PR contains a focused bug fix. No public issue matched this change during the duplicate search. ## What Changed - Route bundle export through `nativeSyncOut` when the provider supports it. - Keep the existing `readFile` fallback for providers without native sync support. - Confine the native bundle mapping with `assertSyncOperationsConfined`. - Cover the native path, fallback path, retry path, and confinement checks with unit tests. ## Verification - `npx vitest run packages/adapter-utils/src/sandbox-managed-runtime.test.ts` — 52 tests passed. - `npx tsc --noEmit` in `packages/adapter-utils` — passed. - The PR CI workflow must pass before merge. ## Risks Low risk. The native path runs only when the provider advertises `syncOut`. The existing `readFile` path remains available as a fallback. Native transfer progress reports only start and finish events. ## Model Used OpenAI GPT-5 Codex. Exact runtime model ID: GPT-5 Codex. Context window: not exposed in this run. Capabilities used: code review, shell tools, GitHub CLI, and Paperclip API coordination. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge Co-authored-by: Paperclip <noreply@paperclip.ing>canary/v2026.820.0-canary.0 |
||
|
Nicky LeachandPaperclip
|
b8a76081ec |
feat(environments): expose boot-relevant drift attribution in the custom-image overview (#11751)
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work > - Paperclip lets operators prepare and use custom images for sandbox environments > - The custom-image overview detected drift but did not show which boot source changed > - Operators need the changed field and values to understand why a template no longer matches > - This pull request adds safe drift attribution to the overview API and the out-of-sync banner > - The benefit is faster diagnosis without exposing secrets or internal snapshot data ## Linked Issues or Issue Description **Subsystem affected** Cross-cutting (server and UI). **Problem or motivation** The custom-image overview reported drift without identifying the changed boot source. Operators had to inspect other data to find the cause. **Proposed solution** Return a classified drift summary with changed paths and their prior and current values. Show the boot-source field in the UI banner. Keep legacy templates and unclassified drift on the generic message. **Alternatives considered** The change does not expose the full snapshot or fingerprint. This keeps the overview contract small and avoids secret disclosure. **Roadmap alignment** The change supports the existing custom-image environment workflow and does not duplicate a roadmap item. ## What Changed - Add `activeTemplateDrift` to the custom-image overview response. - Classify drift as `boot_source_drift`, `knob_only`, or `unclassified`. - Return drifted paths with safe `from` and `to` values. - Show the changed boot-source field and values in the out-of-sync banner. - Keep legacy templates fail-closed and exclude secrets, fingerprints, and raw snapshots. - Add server and UI tests for the new behavior. ## Verification - `npx vitest run server/src/__tests__/environment-custom-images-service.test.ts` passes with 27 tests. - `npx vitest run ui/src/pages/CompanyEnvironments.test.tsx` passes with 27 tests. - `pnpm --filter @paperclipai/ui exec tsc --noEmit` passes. - Review the overview response and banner cases for boot-source, knob-only, and legacy drift. ## Risks The overview response gains one optional field. Legacy templates remain compatible because they return `unclassified` and keep the generic banner. The service excludes secret values, fingerprints, and raw snapshots. ## Model Used OpenAI Codex, GPT-5, tool use and code execution enabled. The model reviewed the handoff and managed the pull request. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes: #` / `Refs: #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [ ] I will address all Greptile and reviewer comments before requesting merge Co-authored-by: Paperclip <noreply@paperclip.ing>canary/v2026.819.0-canary.9 |
||
|
DottaandPaperclip
|
2eb9a09c0c |
fix(runtime): adopt surviving shell-command services (#11744)
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work > - Managed workspace services must continue after a control-plane restart > - A service command can use shell control operators before it starts the final process > - The final process command line then differs from the stored shell expression > - Paperclip rejected that valid process even when its listener, process group, and workspace matched > - This pull request uses the stronger ownership checks for shell expressions > - The benefit is that Paperclip can adopt a valid service after a restart ## Linked Issues or Issue Description Refs #11740 **What happened?** A managed service could use a command such as `env | sort > file; exec pnpm dev`. After a control-plane restart, the surviving process command line contained only the final program. Paperclip compared it with the complete shell expression and rejected the service. **Expected behavior** Paperclip must adopt the surviving service when the listener, process group, and workspace directory prove ownership. **Steps to reproduce** 1. Configure a managed workspace service with a shell pipeline or command sequence. 2. Start the service. 3. Restart the control plane while the service stays alive. 4. Observe that Paperclip starts a replacement instead of adopting the live service. **Paperclip version or commit** `bd059a073d` **Deployment mode** Local dev with managed workspace services. ## What Changed - Detect shell control syntax outside quoted strings. - Skip the weak command-line comparison for these shell expressions. - Require the live port owner to remain in the recorded process group. - Keep the existing workspace directory check. - Add unit and restart-adoption regression tests. ## Verification - `pnpm --filter @paperclipai/server exec vitest run src/__tests__/local-service-supervisor.test.ts src/__tests__/workspace-runtime.test.ts -t 'does not compare shell expressions|re-adopts a live service whose shell command differs' --reporter=verbose` — 2 passed. - `pnpm --filter @paperclipai/server typecheck` — passed. - `git diff --check origin/master...HEAD` — passed. ## Risks - Low risk. The relaxed command comparison applies only to shell expressions. - Listener ownership, process-group ownership, and workspace directory checks still fail closed. - This change does not change the database schema, lockfile, workflow files, or user interface. > For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and discuss it in `#dev` before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See `CONTRIBUTING.md`. ## Model Used - OpenAI Codex, GPT-5. The serving suffix and context-window size are not exposed. The model used agentic reasoning, repository tools, code execution, test execution, and GitHub tools. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
|
1b259d7be4 |
build(deps): bump radix-ui from 1.6.4 to 1.6.7 (#11726)
Bumps [radix-ui](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/radix-ui) from 1.6.4 to 1.6.7. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/radix-ui/primitives/blob/main/packages/react/radix-ui/CHANGELOG.md">radix-ui's changelog</a>.</em></p> <blockquote> <h2>1.6.6, 1.6.7</h2> <ul> <li>Reverted breaking changes that caused compatibility issues with React Server Components.</li> </ul> <h2>1.6.5</h2> <ul> <li>Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/radix-ui/primitives/commits/1.6.7/packages/react/radix-ui">compare view</a></li> </ul> </details> <br /> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Priya Raman <priya@paperclip.ing> Co-authored-by: Paperclip <noreply@paperclip.ing>canary/v2026.819.0-canary.8 |
||
|
DottaandPaperclip
|
01ddc26a37 |
fix(routines): clear transient execution failures (#9689)
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work > - Scheduled routines track each dispatch in `routine_runs` and link it to an execution issue > - Moving an execution issue to `blocked` or `cancelled` correctly records a failed run state for operator visibility > - When that issue later resumes or completes, the run can retain the earlier failure reason and completion timestamp > - That stale state makes an active or successfully completed routine appear failed > - This pull request reconciles the run back to a live state on resume and preserves cleared failure details as completion context > - The benefit is that routine run status consistently reflects the current execution issue lifecycle without losing useful recovery history ## Linked Issues or Issue Description Refs #9201 ### What happened? A routine execution issue that temporarily moved to `blocked` or `cancelled` caused its linked routine run to become `failed`. If the issue later returned to an active status or reached `done`, the routine run could keep the stale failure reason and terminal timestamp. ### Expected behavior Active execution issues should have an `issue_created` run with no failure or completion timestamp. Completed execution issues should have a `completed` run with no active failure reason, while retaining any earlier transient failure in structured trigger context for diagnosis. ### Steps to reproduce 1. Create a routine run linked to a routine execution issue. 2. Move the issue to `blocked` and synchronize the run state. 3. Move the issue back to `in_progress` or forward to `done` and synchronize again. 4. Observe that the run previously retained stale failed-state fields. ### Environment - Reproduced on `master` at `da549123cc`. - Core server behavior; not adapter-specific. - Covered with the embedded PostgreSQL routines service test harness. ## What Changed - Load the linked routine run while synchronizing execution issue status. - Restore transiently failed runs to `issue_created` when their execution issue resumes active work. - Clear stale failure state when an execution issue completes and retain the earlier failure under `triggerPayload.transientFailure`. - Add regression coverage for both resumed and completed execution issues. ## Verification - `pnpm --filter @paperclipai/server exec vitest run src/__tests__/routines-service.test.ts` — 57 tests passed. - `pnpm --filter @paperclipai/server typecheck` — passed. ## Risks - Low risk: the change is limited to routine execution issue/run reconciliation. - A completed run now stores a prior failed-state reason as structured transient context instead of leaving `failureReason` populated. - No schema, migration, API contract, or UI behavior changes are included. > For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and discuss it in `#dev` before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See `CONTRIBUTING.md`. ## Model Used - OpenAI Codex using GPT-5.4 with reasoning, repository tools, GitHub CLI access, code execution, and focused test execution. The runtime did not expose a context-window size. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
Nicky LeachandPaperclip
|
8161244284 |
feat(sandbox): add opt-in duplex command-stream foundation (capability, protocol, bounded host route, frame codec) (#11738)
## Thinking Path > - Paperclip provides a control plane for companies that run AI agents. > - Sandboxed agents need a safe execution path for persistent command streams. > - The existing callback transport does not provide a bounded, generic duplex route. > - The host must control capability access, route identity, protocol limits, and close behavior. > - This pull request adds an opt-in duplex command-stream foundation across the sandbox layers. > - The feature stays inert because no current provider declares the capability. ## Linked Issues or Issue Description **Subsystem affected** Cross-cutting (multiple of the above) **Problem or motivation** Sandbox command execution needs a persistent host-to-sandbox stream. The current callback bridge uses a file transport and does not provide this generic route. **Proposed solution** Add a fail-closed provider capability, generic worker protocol messages, a host-owned bounded route, cross-layer service mediation, and a versioned newline-delimited frame codec. **Alternatives considered** Keep the file transport and add feature-specific commands. This does not provide one reusable duplex contract or host-owned route bounds. **Roadmap alignment** This work supports the completed Cloud / Sandbox agents roadmap area and the safe autonomy goal in the product definition. **Additional context** The change passed a two-stage security review. The final code review verdict was approve after fixes for active-stream bounds and service-layer capability mediation. ## What Changed - Add the opt-in `duplexCommandStream` provider capability with fail-closed narrowing. - Add duplex open, write, stop, and close requests and data and exit notifications to the plugin worker protocol. - Add a host-owned route with bounds for chunk size, cumulative bytes, lifetime, protocol errors, pending requests, and pre-bind buffering. - Add close acknowledgement handling with worker retirement when the close remains unconfirmed. - Wire `openDuplexChannel` through the execution target, runtime service, and plugin worker. - Add a versioned frame codec with shared wire-compatibility vectors and split UTF-8 handling. ## Verification - `server/src/__tests__/plugin-worker-manager-duplex.test.ts` passes 18 tests. - `server/src/__tests__/environment-execution-target-duplex.test.ts` passes 11 tests. - `packages/adapter-utils/src/duplex-frame-codec.test.ts` passes 38 tests. - `server/src/__tests__/sandbox-capability-contract.test.ts` passes 15 tests. - Setup-token pseudo-terminal regression tests pass 47 tests. - Server TypeScript check passes. - Continuous integration will run the full required test, typecheck, build, and policy checks. ## Risks - Providers that opt into the capability must implement the complete worker protocol. - Route limit defaults can close a stream when a workload exceeds the configured bounds. - The capability remains disabled for current providers, so current production behavior does not change. ## Model Used OpenAI GPT-5 (`gpt-5`), with tool use and code execution. The model reviewed and prepared this pull request from the supplied implementation and verification record. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes: #` / `Refs: #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>canary/v2026.819.0-canary.7 |
||
|
|
bd059a073d |
fix(workspaces): make managed runtimes reliable across restarts (#11740)
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work > - Execution workspaces need isolated databases, ports, and runtime services > - Concurrent workspaces could reuse ports or lose service ownership after a restart > - A markerless worktree also needed seed recovery, but normal markerless instances still needed to boot > - This pull request makes seed, port, and service ownership state explicit and recoverable > - It also checks live process and listener identity before it reclaims shared resources > - The benefit is reliable workspace startup, restart, adoption, and concurrent provisioning ## Linked Issues or Issue Description **What happened?** Managed workspaces could lose runtime service ownership after a control-plane restart. Concurrent worktrees could also reuse a port when their parent paths differed. A seed recovery change made every markerless instance resolve a worktree seed source, so normal instances without a source could not start. **Expected behavior** Paperclip must preserve healthy managed services across restarts. It must reserve unique ports across worktree parents. It must provision a registered markerless worktree, but it must skip seed work for a normal markerless instance. **Steps to reproduce** 1. Start two managed worktrees under different parent paths at the same time. 2. Restart the control plane while a managed service stays alive. 3. Start Paperclip with a config that has no seed markers and no registered worktree source. 4. Observe duplicate port selection, lost service adoption, or a seed-source startup error. **Paperclip version or commit** Current `master` plus the workspace runtime reliability changes in this pull request. **Deployment mode** Local development with managed execution workspaces and embedded Postgres. ## What Changed - Added a shared port registry with lease heartbeats, process identity checks, and live listener probes. - Reserved worktree ports across custom parent paths and repaired duplicate legacy assignments. - Preserved and adopted healthy managed services across control-plane restarts. - Reconciled guest bind modes and verified listener ownership before termination or reuse. - Provisioned registered markerless worktree databases and kept normal markerless instance startup as a no-op. - Added CLI, shared, server, and shell regression tests for seed, port, listener, restart, and adoption behavior. - Updated the worktree development documentation. ## Verification - `pnpm exec vitest run cli/src/__tests__/worktree.test.ts --reporter=verbose` — 63 tests passed. - `pnpm exec vitest run packages/shared/src/worktree-port-registry.test.ts --reporter=verbose` — 5 tests passed. - Focused runtime Vitest set — 199 tests passed across 37 suites. - `node --test scripts/__tests__/provision-worktree-self-heal.test.mjs` — 10 tests passed. - `git diff --check` passed. ## Risks - Port reservation now depends on lease and process identity data. The fallback listener probe prevents early reclamation when process metadata is incomplete. - Runtime adoption is stricter about bind and owner identity. The tests cover healthy adoption, stale records, PID reuse, and unrelated listeners. - Markerless seed detection now separates registered worktrees from normal instances. The tests cover both paths. - There are no database schema migrations. > For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and discuss it in `#dev` before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See `CONTRIBUTING.md`. ## Model Used - OpenAI Codex with the `gpt-5` model family. The serving snapshot and context-window size are not exposed. The agent used reasoning, repository tools, code execution, and test execution. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing> Co-authored-by: Dev Agent <dev@paperclip.ing> |
||
|
dependabot[bot]
|
433b1eb099 |
build(deps): bump @aws-sdk/client-s3 from 3.1106.0 to 3.1111.0 (#11714)
Bumps [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) from 3.1106.0 to 3.1111.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/aws/aws-sdk-js-v3/releases">@aws-sdk/client-s3's releases</a>.</em></p> <blockquote> <h2>v3.1111.0</h2> <h4>3.1111.0(2026-08-14)</h4> <h5>Chores</h5> <ul> <li>upgrade to typescript 7 (<a href="https://redirect.github.com/aws/aws-sdk-js-v3/pull/8264">#8264</a>) (<a href="https://github.com/aws/aws-sdk-js-v3/commit/ca81fbb7398345aa31482dd7aa1971bccf278989">ca81fbb7</a>)</li> <li>remove jest, use vitest for remaining test suites (<a href="https://redirect.github.com/aws/aws-sdk-js-v3/pull/8263">#8263</a>) (<a href="https://github.com/aws/aws-sdk-js-v3/commit/3a88aada579866331fe642d4b8147ede799deafa">3a88aada</a>)</li> </ul> <h5>Documentation Changes</h5> <ul> <li><strong>client-redshift:</strong> Amazon Redshift now unlocks a locked admin user account and resets the failed-login counter when you update the admin password using the ModifyCluster API. This option is available only when account lockout security is enabled. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/b93cb20c99c76c43369ffe2fb633577971c93236">b93cb20c</a>)</li> <li><strong>client-redshift-serverless:</strong> Amazon Redshift now unlocks a locked admin user account and resets the failed-login counter when you update the admin password using the UpdateNamespace API. This option is available only when account lockout security is enabled. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/197b4aa6163ac76eef6c7dce29b922fafdab395d">197b4aa6</a>)</li> </ul> <h5>New Features</h5> <ul> <li><strong>clients:</strong> update client endpoints as of 2026-08-14 (<a href="https://github.com/aws/aws-sdk-js-v3/commit/1e7a28061dde539727980cb25689db3c50d1507e">1e7a2806</a>)</li> <li><strong>client-bedrock-agentcore-control:</strong> Adds AgentCore Payments support for CMK, Marketplace Subscriptions and QuickCreate (<a href="https://github.com/aws/aws-sdk-js-v3/commit/39108eb0d601bb5916971f56dc8573ec17842cf8">39108eb0</a>)</li> <li><strong>client-sagemaker:</strong> Release support for g7.2xlarge, g7.4xlarge, g7.8xlarge, g7.12xlarge, g7.24xlarge, and g7.48xlarge instance types for SageMaker HyperPod (<a href="https://github.com/aws/aws-sdk-js-v3/commit/7198c1938d7897dc4f3839b04d8a55dba0f75c4b">7198c193</a>)</li> <li><strong>client-mwaa-serverless:</strong> Adds support for Consuming code for MWAA Serverless (<a href="https://github.com/aws/aws-sdk-js-v3/commit/e3edae27ddc8bcaf3e30f5ec93abdae0e013fae2">e3edae27</a>)</li> <li><strong>client-bedrock-agent-runtime:</strong> Adds CheckIngestedDocumentAcl and GetIngestedDocumentAcl APIs to Amazon Bedrock Knowledge Bases. Customers can verify user access to documents based on ingested ACLs and retrieve full ACL details including allow and deny entries, enabling validation of ACL ingestion without test retrievals. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/e86c42049cc69793f80c332bd9829ba6871153ad">e86c4204</a>)</li> <li><strong>client-observabilityadmin:</strong> CloudWatch Logs centralization rules now support tag propagation. You can configure a TagPropagationConfiguration on your centralization rule to automatically sync resource tags from source to destination log groups, with configurable conflict resolution strategies. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/c57d7a4cd3b279d750cc035e8861f1b2c8857da7">c57d7a4c</a>)</li> <li><strong>client-bedrock-agentcore:</strong> Add support for the Machine Payments Protocol (MPP) and x402 upto scheme payments protocol in Amazon Bedrock AgentCore Payments. Customers can now pay for MPP-gated resources and also pay services which requires upto scheme in x402 (<a href="https://github.com/aws/aws-sdk-js-v3/commit/7fdf457a8a7ff25eb019ef61c074158a3630816a">7fdf457a</a>)</li> <li><strong>client-glue:</strong> Added support for associating glossary terms with iterable form items, such as table columns. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/4c2e27d138f73f804774572c7772bcfd6a44006c">4c2e27d1</a>)</li> </ul> <hr /> <p>For list of updated packages, view <strong>updated-packages.md</strong> in <strong>assets-3.1111.0.zip</strong></p> <h2>v3.1110.0</h2> <h4>3.1110.0(2026-08-13)</h4> <h5>New Features</h5> <ul> <li><strong>client-auto-scaling:</strong> Amazon EC2 Auto Scaling now supports terminating multiple instances in a single TerminateInstanceInAutoScalingGroup call via the new InstanceIds parameter, returning an Activities list. LaunchInstances now returns IdempotentCallInProgressFault for duplicate client tokens. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/ee707980d238c2b5028e03084914a3398ce92709">ee707980</a>)</li> <li><strong>client-cleanrooms:</strong> This release adds support for minimum aggregation thresholds and comparison controls to the Custom analysis rule type. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/1f84f2ae77a1cf4aed0b61dafba5da358894d61f">1f84f2ae</a>)</li> <li><strong>client-codecommit:</strong> Added the GetBlobDifferences API operation, which returns line-level diffs between two blob versions without requiring a local clone. Returns structured hunks with context, additions, and deletions. Supports pagination for large diffs. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/f1165c620804c3e7e1b035ecb9e083c723b8fba3">f1165c62</a>)</li> <li><strong>client-securityagent:</strong> Add support for setting a maximum task-hour budget cap on penetration tests and code reviews, and for revalidating previously reported findings via a new REVALIDATION job type. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/aba75d728bf5a19eebc7afa1c78df8f18d9ae8d0">aba75d72</a>)</li> <li><strong>client-connect:</strong> Adds the StartAssistantContact API to start chat contacts handled by an AI agent. Adds SegmentAttributes to StartWebRTCContact, and corrects its error response to now receive AccessDeniedException (previously returned as an internal server error due to a missing error declaration). (<a href="https://github.com/aws/aws-sdk-js-v3/commit/67f9b7bb9bed253cc03580527faf7a94a2ebb2bf">67f9b7bb</a>)</li> <li><strong>client-acm:</strong> This change allows customers to update their existing email-validated certificates to use the DNS validation method. (<a href="https://github.com/aws/aws-sdk-js-v3/commit/71c194a4678abd7a368925a38c5b63f411fbd483">71c194a4</a>)</li> </ul> <hr /> <p>For list of updated packages, view <strong>updated-packages.md</strong> in <strong>assets-3.1110.0.zip</strong></p> <h2>v3.1109.0</h2> <h4>3.1109.0(2026-08-12)</h4> <h5>Documentation Changes</h5> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md">@aws-sdk/client-s3's changelog</a>.</em></p> <blockquote> <h1><a href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1110.0...v3.1111.0">3.1111.0</a> (2026-08-14)</h1> <p><strong>Note:</strong> Version bump only for package <code>@aws-sdk/client-s3</code></p> <h1><a href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1109.0...v3.1110.0">3.1110.0</a> (2026-08-13)</h1> <p><strong>Note:</strong> Version bump only for package <code>@aws-sdk/client-s3</code></p> <h1><a href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1108.0...v3.1109.0">3.1109.0</a> (2026-08-12)</h1> <p><strong>Note:</strong> Version bump only for package <code>@aws-sdk/client-s3</code></p> <h1><a href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1107.0...v3.1108.0">3.1108.0</a> (2026-08-11)</h1> <p><strong>Note:</strong> Version bump only for package <code>@aws-sdk/client-s3</code></p> <h1><a href="https://github.com/aws/aws-sdk-js-v3/compare/v3.1106.0...v3.1107.0">3.1107.0</a> (2026-08-10)</h1> <p><strong>Note:</strong> Version bump only for package <code>@aws-sdk/client-s3</code></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/c41e9a98d4227b06099fdc7ea42bcf6fc5a1029f"><code>c41e9a9</code></a> Publish v3.1111.0</li> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/ca81fbb7398345aa31482dd7aa1971bccf278989"><code>ca81fbb</code></a> chore: upgrade to typescript 7 (<a href="https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3/issues/8264">#8264</a>)</li> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/4efe5bc67b71dc5ec652fe77130f3bae9efe0173"><code>4efe5bc</code></a> Publish v3.1110.0</li> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/d2ee371d0cc488521fbb8a2304f941a4a0b53d1a"><code>d2ee371</code></a> Publish v3.1109.0</li> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/26b0eb790ff86399b7af7b74ce8c188f25512cc6"><code>26b0eb7</code></a> Publish v3.1108.0</li> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/785d467fbde2fe2f3720bbb944caefcb198039ed"><code>785d467</code></a> chore(codegen): update smithy-ts commit to bring in TS6 change (<a href="https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3/issues/8262">#8262</a>)</li> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/edabd4a5228e259e9f3352cd47414069db755188"><code>edabd4a</code></a> chore: upgrade to typescript 6 (<a href="https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3/issues/8257">#8257</a>)</li> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/d87c82ba2021a598a478383ae50647e7c1af45e0"><code>d87c82b</code></a> Publish v3.1107.0</li> <li><a href="https://github.com/aws/aws-sdk-js-v3/commit/2e4482a67896a98b3fc23933c5cf2ad7c1d61f10"><code>2e4482a</code></a> chore(codegen): smithy-aws-typescript-codegen 0.52.0 (<a href="https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3/issues/8255">#8255</a>)</li> <li>See full diff in <a href="https://github.com/aws/aws-sdk-js-v3/commits/v3.1111.0/clients/client-s3">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Nicky LeachandPaperclip
|
e0e503e1bc |
fix(server): make blockers-resolved wake dedup level-triggered (#11732)
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - Paperclip uses issue dependencies to pause work until blockers reach a ready state. > - A blocked issue with several blockers can miss its wake when the final blocker completes. > - The wake deduplication used a historical per-edge key, so an old completed wake hid the current ready state. > - This pull request adds a level-triggered key for the sorted set of blocker issue ids and uses one helper for all wake paths. > - The benefit is that the final blocker wake can repair a missed wake, while repeated reconciliation stays bounded. ## Linked Issues or Issue Description Refs #8009, #7853, and #6719. These public pull requests cover related dependency-wake and deduplication behavior. This pull request fixes a separate multi-blocker state-key gap. **What happened?** A blocked issue with multiple blockers received no `issue_blockers_resolved` wake when the final blocker completed. An earlier completed per-edge wake suppressed the wake for the current all-ready state. **Expected behavior** The final blocker completion must emit one wake for the current ready state. A later reconciliation pass must not emit a second wake for the same state. **Steps to reproduce** 1. Create a blocked issue with at least two blocker issues. 2. Complete one blocker and record its completed per-edge wake. 3. Complete the final blocker. 4. Run the route-time or reconciliation wake path. 5. Confirm that one level-triggered wake exists for the sorted blocker set. **Paperclip version or commit** `eed1e5cad91a37547e1b521232da04b9ddb316f0` **Deployment mode** Local dev from source. ## What Changed - Add a SHA-256 level-triggered idempotency key from the sorted blocker issue ids. - Share one deduplication helper across route-time, finalize-time, and periodic wake paths. - Treat state-key rows with idempotent statuses as duplicates. - Treat legacy per-edge rows as duplicates only while they remain in flight. - Record skipped route-time wakes without suppressing later finalize-time or periodic wakes. - Add regression coverage for a completed earlier-blocker wake and a second reconciliation pass. ## Verification - Run `npx vitest run server/src/__tests__/issue-dependency-wakeups-routes.test.ts`. - Run `npx vitest run server/src/__tests__/heartbeat-issue-liveness-escalation.test.ts`. - Run `npx vitest run server/src/__tests__/heartbeat-dependency-scheduling.test.ts`. - Run `npx vitest run server/src/__tests__/issue-rewake-throttle.test.ts server/src/__tests__/recovery-stale-issue-lock-sweep.test.ts`. - Run `tsc --noEmit` on the touched files. ## Risks The change alters wake deduplication for dependency reconciliation. The new key uses the full sorted blocker set, so a change in that set permits a new wake. The regression tests cover the missed-final-blocker case and repeated reconciliation. ## Model Used OpenAI Codex, GPT-5, tool-use model with code execution and repository review support. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
Nicky LeachandPaperclip
|
233be4b36c |
feat: parallelize sandbox file-sync behind a provider opt-in capability (#11736)
## Thinking Path > - Paperclip runs AI agents through local and remote execution adapters. > - Sandbox providers move workspace and asset files before and after agent runs. > - Serial file transfers delay startup and teardown when several operations do not depend on each other. > - Providers need an opt-in contract so existing providers keep their serial behavior. > - This pull request adds a bounded scheduler and routes inbound and outbound sync operations through it. > - The benefit is shorter sandbox setup and teardown with stable errors, clear telemetry, and a safe opt-in path. ## Linked Issues or Issue Description **Subsystem affected** Cross-cutting (multiple of the above): packages/shared, packages/adapter-utils, packages/plugins, and server. **Problem or motivation** Sandbox sync processes the workspace, assets, and referenced projects in series. This adds avoidable wait time to agent startup and teardown. **Proposed solution** Add a fail-closed provider capability named concurrentSyncOperations. Use a bounded scheduler with a limit of four operations. Preserve operation order for error reporting. Keep non-opted-in providers on the serial path. **Alternatives considered** Increase the serial transfer speed or add provider-specific schedulers. Those options do not provide one shared contract or stable behavior across providers. **Roadmap alignment** ROADMAP.md lists cloud and sandbox agents as a product area. This change improves sandbox execution without changing the control-plane contract. **Additional context** The Daytona provider opts in. Board trials on this commit showed overlap for inbound sync and outbound restore, with no referenced-project staging failures. ## What Changed - Add the concurrentSyncOperations sandbox capability and fail-closed parsing. - Add a bounded settle-all scheduler with stable input-order errors. - Parallelize inbound workspace, asset, and referenced-project sync operations when the provider opts in. - Parallelize outbound workspace and asset restore operations when the provider opts in. - Surface referenced-project failure text in run logs and server telemetry. - Add Daytona sync spans and the capability declaration. - Preserve in-flight upload scratch tarballs during workspace wipe. - Add unit and regression tests for the scheduler, coordinators, provider behavior, telemetry, and wipe race. ## Verification - Run the adapter-utils and server type checks. - Run the targeted adapter-utils, server, and Daytona test suites. - Run the full automated sweep. - Review six cold Daytona trials, with three serial and three parallel runs. - Confirm that parallel trials show inbound overlap and outbound restore overlap. - Confirm that providers without the capability keep serial behavior. ## Risks - Providers must opt in only when their file operations can run safely at the same time. - A provider that declares the capability incorrectly can expose transfer races. - The scheduler keeps a limit of four to bound resource use. - Providers without the capability keep the prior serial behavior. ## Model Used OpenAI GPT-5 in the Codex runtime. The model used tool calls, code inspection, and GitHub workflow support. The model did not author the implementation commits. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with Fixes: # / Closes # / Refs # OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub #NNN / github.com/paperclipai/paperclip URLs) - [x] My branch name describes the change and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>canary/v2026.819.0-canary.6 |
||
|
github-actions[bot]andlockfile-bot
|
a5f3ac6b48 |
chore(lockfile): refresh pnpm-lock.yaml (#11737)
Auto-generated lockfile refresh after dependencies changed on master. This PR only updates pnpm-lock.yaml. Co-authored-by: lockfile-bot <lockfile-bot@users.noreply.github.com> |
||
|
Nicky LeachandPaperclip
|
e0b64529b3 |
feat(auth): normalize agent login in the sandbox onto one session table and a capability contract (#11730)
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work > - Sandbox agents need a safe login path for each supported adapter > - Codex device login and Claude setup-token login used separate session stores and route logic > - Separate stores made session lookup, expiry, and login capability checks harder to keep consistent > - This pull request unifies both flows on one session table and one capability contract > - The benefit is one company-scoped login model with public session identifiers and shared lifecycle rules ## Linked Issues or Issue Description **Subsystem affected** Cross-cutting (multiple of the above) **Problem or motivation** Codex and Claude sandbox login used separate session stores and different route paths. This split increased the risk of inconsistent company scoping, session lookup, and cleanup. **Proposed solution** Use `adapter_auth_sessions` for both login flows. Use public session identifiers for API access. Select login behavior from projected adapter capability data. Share the route spine, lease arguments, runner lifecycle, and reaper rules. **Alternatives considered** Keep two session tables and add matching fixes to both routes. This keeps duplicate logic and does not provide one capability contract, so this pull request uses shared infrastructure. **Roadmap alignment** This change supports the shipped Cloud / Sandbox agents milestone in `ROADMAP.md`. ## What Changed - Unify Codex device login and Claude setup-token login on `adapter_auth_sessions`. - Return and look up sessions with company-scoped public session identifiers. - Enforce one active session for each company, owner, and adapter. - Share the login route spine, sandbox lease arguments, runner lifecycle, and missing-auth check. - Add a standalone setup-token reaper with adapter-specific row selection. - Add optional login capability projection for adapters and drive route and UI selection from that data. - Rename the provider flag to `supportsLoginPty` and validate its deprecated alias. - Remove the old Claude setup-token session table and add the required migrations. ## Verification - Server typecheck passed with `tsc`. - Database typecheck passed. - UI typecheck passed with `tsc -b`. - Codex login service and route suites passed. - Setup-token session, route, and reaper suites passed. - Adapter session schema, plugin validator, capability projection, UI render, and Daytona suites passed. - GitHub Actions must confirm the complete CI gate after pull request creation. ## Risks - The migrations remove short-lived in-flight login rows during deployment. A login that spans the migration can continue until its provider lease expires. - The Codex credential store remains company-scoped. A cross-owner credential race remains a documented, board-accepted risk. - API clients that use internal session row identifiers no longer work. The API accepts only public session identifiers. ## Model Used Codex, GPT-5, exact runtime model ID not exposed in this handoff, large context window, reasoning, and repository tool use. The implementing engineer produced the code with AI assistance. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes: #` / `Refs: #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
dependabot[bot]
|
61b4fc02d4 |
build(deps-dev): bump @storybook/addon-a11y from 10.5.4 to 10.5.8 (#11713)
Bumps [@storybook/addon-a11y](https://github.com/storybookjs/storybook/tree/HEAD/code/addons/a11y) from 10.5.4 to 10.5.8. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/storybookjs/storybook/releases">@storybook/addon-a11y's releases</a>.</em></p> <blockquote> <h2>v10.5.8</h2> <h2>10.5.8</h2> <ul> <li>React: Fix RDT tsconfig selection for Vite project references - <a href="https://redirect.github.com/storybookjs/storybook/pull/35743">#35743</a>, thanks <a href="https://github.com/ndelangen"><code>@ndelangen</code></a>!</li> <li>Tanstack React: Remove <code>@cloudflare/vite-plugin</code> from the inherited Vite config - <a href="https://redirect.github.com/storybookjs/storybook/pull/35706">#35706</a>, thanks <a href="https://github.com/FrancoKaddour"><code>@FrancoKaddour</code></a>!</li> <li>Tanstack: Wait for router to load before rendering - <a href="https://redirect.github.com/storybookjs/storybook/pull/35784">#35784</a>, thanks <a href="https://github.com/huang-julien"><code>@huang-julien</code></a>!</li> <li>Test: Fix Illegal invocation when reading prototype.focus - <a href="https://redirect.github.com/storybookjs/storybook/pull/35528">#35528</a>, thanks <a href="https://github.com/FrancoKaddour"><code>@FrancoKaddour</code></a>!</li> </ul> <h2>v10.5.7</h2> <h2>10.5.7</h2> <ul> <li>Angular: Serve ancestor node_modules for addon-vitest in browser mode - <a href="https://redirect.github.com/storybookjs/storybook/pull/35600">#35600</a>, thanks <a href="https://github.com/brandonroberts"><code>@brandonroberts</code></a>!</li> <li>Refactor: Update getVersionedPackages method to handle non-Storybook packages correctly - <a href="https://redirect.github.com/storybookjs/storybook/pull/35769">#35769</a>, thanks <a href="https://github.com/valentinpalkovic"><code>@valentinpalkovic</code></a>!</li> </ul> <h2>v10.5.6</h2> <h2>10.5.6</h2> <ul> <li>Dependencies: Pin `@testing-library/jest-dom` to `6.9.1` - <a href="https://redirect.github.com/storybookjs/storybook/pull/35614">#35614</a>, thanks <a href="https://github.com/ndelangen"><code>@ndelangen</code></a>!</li> <li>ESLint Plugin: Add plugin meta and document oxlint usage - <a href="https://redirect.github.com/storybookjs/storybook/pull/35655">#35655</a>, thanks <a href="https://github.com/yannbf"><code>@yannbf</code></a>!</li> <li>Vue: Skip docgen for module ids carrying a query - <a href="https://redirect.github.com/storybookjs/storybook/pull/35598">#35598</a>, thanks <a href="https://github.com/seanogdev"><code>@seanogdev</code></a>!</li> </ul> <h2>v10.5.5</h2> <h2>10.5.5</h2> <ul> <li>CLI: Update AI setup instructions to msw-storybook-addon v3 - <a href="https://redirect.github.com/storybookjs/storybook/pull/35512">#35512</a>, thanks <a href="https://github.com/yannbf"><code>@yannbf</code></a>!</li> <li>Core: Upgrade `ws` to fix security advisories - <a href="https://redirect.github.com/storybookjs/storybook/pull/35584">#35584</a>, thanks <a href="https://github.com/ndelangen"><code>@ndelangen</code></a>!</li> <li>ReactNative: Telemetry framework detection fix - <a href="https://redirect.github.com/storybookjs/storybook/pull/35560">#35560</a>, thanks <a href="https://github.com/ndelangen"><code>@ndelangen</code></a>!</li> <li>SyntaxHighlighter: Fix PrismJS dark mode mismatch - <a href="https://redirect.github.com/storybookjs/storybook/pull/35541">#35541</a>, thanks <a href="https://github.com/hxy-asdw"><code>@hxy-asdw</code></a>!</li> <li>TanStack: Preserve explicit route ids on pathful clones - <a href="https://redirect.github.com/storybookjs/storybook/pull/35499">#35499</a>, thanks <a href="https://github.com/unpunnyfuns"><code>@unpunnyfuns</code></a>!</li> <li>TanStack: Resolve mock redirects through Vite's resolver - <a href="https://redirect.github.com/storybookjs/storybook/pull/35501">#35501</a>, thanks <a href="https://github.com/unpunnyfuns"><code>@unpunnyfuns</code></a>!</li> <li>TanStack: Respect routeOverrides component overrides in stories - <a href="https://redirect.github.com/storybookjs/storybook/pull/35497">#35497</a>, thanks <a href="https://github.com/unpunnyfuns"><code>@unpunnyfuns</code></a>!</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md">@storybook/addon-a11y's changelog</a>.</em></p> <blockquote> <h2>10.5.8</h2> <ul> <li>React: Fix RDT tsconfig selection for Vite project references - <a href="https://redirect.github.com/storybookjs/storybook/pull/35743">#35743</a>, thanks <a href="https://github.com/ndelangen"><code>@ndelangen</code></a>!</li> <li>Tanstack React: Remove <code>@cloudflare/vite-plugin</code> from the inherited Vite config - <a href="https://redirect.github.com/storybookjs/storybook/pull/35706">#35706</a>, thanks <a href="https://github.com/FrancoKaddour"><code>@FrancoKaddour</code></a>!</li> <li>Tanstack: Wait for router to load before rendering - <a href="https://redirect.github.com/storybookjs/storybook/pull/35784">#35784</a>, thanks <a href="https://github.com/huang-julien"><code>@huang-julien</code></a>!</li> <li>Test: Fix Illegal invocation when reading prototype.focus - <a href="https://redirect.github.com/storybookjs/storybook/pull/35528">#35528</a>, thanks <a href="https://github.com/FrancoKaddour"><code>@FrancoKaddour</code></a>!</li> </ul> <h2>10.5.7</h2> <ul> <li>Angular: Serve ancestor node_modules for addon-vitest in browser mode - <a href="https://redirect.github.com/storybookjs/storybook/pull/35600">#35600</a>, thanks <a href="https://github.com/brandonroberts"><code>@brandonroberts</code></a>!</li> <li>Refactor: Update getVersionedPackages method to handle non-Storybook packages correctly - <a href="https://redirect.github.com/storybookjs/storybook/pull/35769">#35769</a>, thanks <a href="https://github.com/valentinpalkovic"><code>@valentinpalkovic</code></a>!</li> </ul> <h2>10.5.6</h2> <ul> <li>Dependencies: Pin <code>@testing-library/jest-dom</code> to <code>6.9.1</code> - <a href="https://redirect.github.com/storybookjs/storybook/pull/35614">#35614</a>, thanks <a href="https://github.com/ndelangen"><code>@ndelangen</code></a>!</li> <li>ESLint Plugin: Add plugin meta and document oxlint usage - <a href="https://redirect.github.com/storybookjs/storybook/pull/35655">#35655</a>, thanks <a href="https://github.com/yannbf"><code>@yannbf</code></a>!</li> <li>Vue: Skip docgen for module ids carrying a query - <a href="https://redirect.github.com/storybookjs/storybook/pull/35598">#35598</a>, thanks <a href="https://github.com/seanogdev"><code>@seanogdev</code></a>!</li> </ul> <h2>10.5.5</h2> <ul> <li>CLI: Update AI setup instructions to msw-storybook-addon v3 - <a href="https://redirect.github.com/storybookjs/storybook/pull/35512">#35512</a>, thanks <a href="https://github.com/yannbf"><code>@yannbf</code></a>!</li> <li>Core: Upgrade <code>ws</code> to fix security advisories - <a href="https://redirect.github.com/storybookjs/storybook/pull/35584">#35584</a>, thanks <a href="https://github.com/ndelangen"><code>@ndelangen</code></a>!</li> <li>ReactNative: Telemetry framework detection fix - <a href="https://redirect.github.com/storybookjs/storybook/pull/35560">#35560</a>, thanks <a href="https://github.com/ndelangen"><code>@ndelangen</code></a>!</li> <li>SyntaxHighlighter: Fix PrismJS dark mode mismatch - <a href="https://redirect.github.com/storybookjs/storybook/pull/35541">#35541</a>, thanks <a href="https://github.com/hxy-asdw"><code>@hxy-asdw</code></a>!</li> <li>TanStack: Preserve explicit route ids on pathful clones - <a href="https://redirect.github.com/storybookjs/storybook/pull/35499">#35499</a>, thanks <a href="https://github.com/unpunnyfuns"><code>@unpunnyfuns</code></a>!</li> <li>TanStack: Resolve mock redirects through Vite's resolver - <a href="https://redirect.github.com/storybookjs/storybook/pull/35501">#35501</a>, thanks <a href="https://github.com/unpunnyfuns"><code>@unpunnyfuns</code></a>!</li> <li>TanStack: Respect routeOverrides component overrides in stories - <a href="https://redirect.github.com/storybookjs/storybook/pull/35497">#35497</a>, thanks <a href="https://github.com/unpunnyfuns"><code>@unpunnyfuns</code></a>!</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/storybookjs/storybook/commit/6ef7d1ae816ebd5fb8bf84b8dec7d4a92410d73c"><code>6ef7d1a</code></a> Bump version from "10.5.7" to "10.5.8" [skip ci]</li> <li><a href="https://github.com/storybookjs/storybook/commit/7c6fb3a5ecf4495d73de6d70f802251934e079bd"><code>7c6fb3a</code></a> Bump version from "10.5.6" to "10.5.7" [skip ci]</li> <li><a href="https://github.com/storybookjs/storybook/commit/80195a019c8fc3c2d3554005c8c61fa2d97b319b"><code>80195a0</code></a> Merge pull request <a href="https://github.com/storybookjs/storybook/tree/HEAD/code/addons/a11y/issues/35486">#35486</a> from storybookjs/valentin/cli-local-postinstall-aut...</li> <li><a href="https://github.com/storybookjs/storybook/commit/3126f0a14a351e971679f61cd0bd5609d086ed57"><code>3126f0a</code></a> Bump version from "10.5.5" to "10.5.6" [skip ci]</li> <li><a href="https://github.com/storybookjs/storybook/commit/05a52b7a888c6b85c3f8aa6765ed9a0a69a79e4c"><code>05a52b7</code></a> Bump version from "10.5.4" to "10.5.5" [skip ci]</li> <li>See full diff in <a href="https://github.com/storybookjs/storybook/commits/v10.5.8/code/addons/a11y">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
05e89db1d0 |
build(deps): bump react-i18next from 17.0.10 to 17.0.11 (#11711)
[//]: # (dependabot-start) ⚠️ **Dependabot is rebasing this PR** ⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Bumps [react-i18next](https://github.com/i18next/react-i18next) from 17.0.10 to 17.0.11. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md">react-i18next's changelog</a>.</em></p> <blockquote> <h2>17.0.11</h2> <ul> <li>chore: <code>html-parse-stringify</code> updated to <code>^4.0.1</code>. The parser powering <code><Trans></code> is now actively maintained under the i18next org (<a href="https://github.com/i18next/html-parse-stringify">i18next/html-parse-stringify</a>) after years without upstream releases. 4.x brings modern dual ESM/CJS packaging with an <code>exports</code> map, zero runtime dependencies, reworked TypeScript types and a long list of parser fixes (literal <code><</code> in text, multiline/CRLF attribute values, comments containing <code>></code>, doctype handling, quote-aware bracket handling).</li> <li>refactor(Trans): the internal <code>escapeLiteralLessThan</code> scanner (~80 lines) is replaced by the parser's new <code>allowedTags</code> option with identical semantics: only numbered tags, kept basic HTML tags and known component names are parsed as markup, any other tag-shaped sequence in the translation stays literal text. Rendered output is unchanged (all 493 tests pass, including the <a href="https://redirect.github.com/i18next/react-i18next/issues/1880">#1880</a> and <a href="https://redirect.github.com/i18next/react-i18next/issues/1893">#1893</a> escaping cases).</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/i18next/react-i18next/commit/274e2e60785514388495466137c195c72d6749fb"><code>274e2e6</code></a> 17.0.11</li> <li><a href="https://github.com/i18next/react-i18next/commit/3c4c5631150080453d5f63aac71575694fabef7c"><code>3c4c563</code></a> build</li> <li><a href="https://github.com/i18next/react-i18next/commit/1e7ccae22a755ea8471f0cab5cd3d94c925c527c"><code>1e7ccae</code></a> chore: html-parse-stringify ^4.0.1 + 17.0.11 changelog</li> <li><a href="https://github.com/i18next/react-i18next/commit/4412e25621ec9d0f45f7137e3a5cb7207bcfd8b0"><code>4412e25</code></a> html-parse-stringify ^4.0.0: replace escapeLiteralLessThan with the parser's ...</li> <li><a href="https://github.com/i18next/react-i18next/commit/5787979e38d03c2affb05cec0bf23daa6f2ad3ec"><code>5787979</code></a> ci: types-compat falls back to latest when no <code>@types/react</code> pre-release tag ex...</li> <li>See full diff in <a href="https://github.com/i18next/react-i18next/compare/v17.0.10...v17.0.11">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
81c9fdc5aa |
build(deps): bump react-router-dom from 7.18.1 to 7.18.2 (#11715)
Bumps [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) from 7.18.1 to 7.18.2. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/remix-run/react-router/blob/react-router-dom@7.18.2/packages/react-router-dom/CHANGELOG.md">react-router-dom's changelog</a>.</em></p> <blockquote> <h2>v7.18.2</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies: <ul> <li><a href="https://github.com/remix-run/react-router/releases/tag/react-router@7.18.2"><code>react-router@7.18.2</code></a></li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/remix-run/react-router/commit/69a653ee6ab1ac95b13c917ec56c5f3dc17ca9c1"><code>69a653e</code></a> Release v7.18.2 (<a href="https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom/issues/15354">#15354</a>)</li> <li>See full diff in <a href="https://github.com/remix-run/react-router/commits/react-router-dom@7.18.2/packages/react-router-dom">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
6eb0739ff5 |
build(deps-dev): bump tailwindcss from 4.3.2 to 4.3.3 (#11718)
[//]: # (dependabot-start) ⚠️ **Dependabot is rebasing this PR** ⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Bumps [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) from 4.3.2 to 4.3.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tailwindlabs/tailwindcss/releases">tailwindcss's releases</a>.</em></p> <blockquote> <h2>v4.3.3</h2> <h3>Fixed</h3> <ul> <li>Support <code>--watch --poll[=ms]</code> in <code>@tailwindcss/cli</code> when filesystem events are unreliable or unavailable (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20297">#20297</a>)</li> <li>Canonicalization: match arbitrary hex colors against theme colors case-insensitively (e.g. <code>bg-[#fff]</code> and <code>bg-[#FFF]</code> → <code>bg-white</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20298">#20298</a>)</li> <li>Prevent Preflight from overriding Firefox's native <code>iframe:focus-visible</code> outline styles (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20292">#20292</a>)</li> <li>Ensure <code>theme('colors.foo')</code> in JS plugins resolves correctly when both <code>--color-foo</code> and <code>--color-foo-bar</code> exist (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20299">#20299</a>)</li> <li>Ensure fractional opacity modifiers work with named shadow sizes like <code>shadow-sm/12.5</code>, <code>text-shadow-sm/12.5</code>, <code>drop-shadow-sm/12.5</code>, and <code>inset-shadow-sm/12.5</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20302">#20302</a>)</li> <li>Parse selectors like <code>[data-foo]div</code> as two selectors instead of one (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20303">#20303</a>)</li> <li>Ensure <code>@tailwindcss/postcss</code> rebuilds when a preprocessor like Sass changes the input CSS without changing the input file on disk (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20310">#20310</a>)</li> <li>Ensure CSS nesting is handled even when Lightning CSS isn't run, such as in <code>@tailwindcss/browser</code> and Tailwind Play (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20124">#20124</a>)</li> <li>Prevent achromatic theme colors from shifting hue when mixed in polar color spaces like <code>oklch</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20314">#20314</a>)</li> <li>Ensure <code>--spacing(0)</code> is optimized to <code>0px</code> instead of <code>0</code> so it remains a <code><length></code> when used in <code>calc(…)</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20319">#20319</a>)</li> <li>Load <code>@parcel/watcher</code> only when needed in <code>@tailwindcss/cli --watch</code> mode, so one-off builds and <code>--watch --poll</code> work when <code>@parcel/watcher</code> can't be loaded (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20325">#20325</a>)</li> <li>Use explicit platform fonts instead of <code>system-ui</code> and <code>ui-sans-serif</code> so CJK text respects the page's <code>lang</code> attribute on Windows (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20318">#20318</a>)</li> <li>Prevent <code>@tailwindcss/upgrade</code> from rewriting ignored files when run from a subdirectory (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20329">#20329</a>)</li> <li>Ensure earlier <code>@source</code> rules pointing to nested files are scanned when later <code>@source</code> rules point to files in parent folders (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20335">#20335</a>)</li> <li>Prevent <code>@tailwindcss/vite</code> from triggering full page reloads when scanned files are processed by Vite but haven't been loaded as modules yet (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20336">#20336</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md">tailwindcss's changelog</a>.</em></p> <blockquote> <h2>[4.3.3] - 2026-07-16</h2> <h3>Fixed</h3> <ul> <li>Support <code>--watch --poll[=ms]</code> in <code>@tailwindcss/cli</code> when filesystem events are unreliable or unavailable (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20297">#20297</a>)</li> <li>Canonicalization: match arbitrary hex colors against theme colors case-insensitively (e.g. <code>bg-[#fff]</code> and <code>bg-[#FFF]</code> → <code>bg-white</code>) (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20298">#20298</a>)</li> <li>Prevent Preflight from overriding Firefox's native <code>iframe:focus-visible</code> outline styles (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20292">#20292</a>)</li> <li>Ensure <code>theme('colors.foo')</code> in JS plugins resolves correctly when both <code>--color-foo</code> and <code>--color-foo-bar</code> exist (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20299">#20299</a>)</li> <li>Ensure fractional opacity modifiers work with named shadow sizes like <code>shadow-sm/12.5</code>, <code>text-shadow-sm/12.5</code>, <code>drop-shadow-sm/12.5</code>, and <code>inset-shadow-sm/12.5</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20302">#20302</a>)</li> <li>Parse selectors like <code>[data-foo]div</code> as two selectors instead of one (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20303">#20303</a>)</li> <li>Ensure <code>@tailwindcss/postcss</code> rebuilds when a preprocessor like Sass changes the input CSS without changing the input file on disk (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20310">#20310</a>)</li> <li>Ensure CSS nesting is handled even when Lightning CSS isn't run, such as in <code>@tailwindcss/browser</code> and Tailwind Play (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20124">#20124</a>)</li> <li>Prevent achromatic theme colors from shifting hue when mixed in polar color spaces like <code>oklch</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20314">#20314</a>)</li> <li>Ensure <code>--spacing(0)</code> is optimized to <code>0px</code> instead of <code>0</code> so it remains a <code><length></code> when used in <code>calc(…)</code> (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20319">#20319</a>)</li> <li>Load <code>@parcel/watcher</code> only when needed in <code>@tailwindcss/cli --watch</code> mode, so one-off builds and <code>--watch --poll</code> work when <code>@parcel/watcher</code> can't be loaded (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20325">#20325</a>)</li> <li>Use explicit platform fonts instead of <code>system-ui</code> and <code>ui-sans-serif</code> so CJK text respects the page's <code>lang</code> attribute on Windows (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20318">#20318</a>)</li> <li>Prevent <code>@tailwindcss/upgrade</code> from rewriting ignored files when run from a subdirectory (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20329">#20329</a>)</li> <li>Ensure earlier <code>@source</code> rules pointing to nested files are scanned when later <code>@source</code> rules point to files in parent folders (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20335">#20335</a>)</li> <li>Prevent <code>@tailwindcss/vite</code> from triggering full page reloads when scanned files are processed by Vite but haven't been loaded as modules yet (<a href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/20336">#20336</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/c2b24dd15fed1c59dd521bd86082f520c9f5ad0d"><code>c2b24dd</code></a> 4.3.3 (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss/issues/20334">#20334</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/e48c5e80473c25fe5a27fe267fbaf4f6512424a3"><code>e48c5e8</code></a> Fix weird character rendering on Windows with Japanese locale (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss/issues/20318">#20318</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/35a3e9c5159bea77af0d48f0c8849279211cc7e9"><code>35a3e9c</code></a> Always produce <code>\<length></code> value when optimizing <code>--spacing(0)</code> (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss/issues/20319">#20319</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/4af47fbe942245fd05ad8cd4776c2dbd27237bee"><code>4af47fb</code></a> Fix hues in achromatic theme colors to be <code>none</code> (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss/issues/20314">#20314</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/5835691d210b1c530160c844a562c36fa5fcbdb3"><code>5835691</code></a> Handle CSS nesting natively (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss/issues/20124">#20124</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/67c745efde4c6b36879e812b4c3d9250f7e0b31e"><code>67c745e</code></a> Fix bug in attribute selector parsing (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss/issues/20303">#20303</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/2683903b86d695f9c2647a06eb58bd96ade1eaee"><code>2683903</code></a> Support fractional opacity modifiers for named shadow sizes (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss/issues/20302">#20302</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/04588b1e8f3dbc856d8a3fad97c460bee689dbf3"><code>04588b1</code></a> Fix theme() in JS plugins returning unresolved object instead of DEFAULT valu...</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/b53fa096c92d830fc64b7cf69581496242583446"><code>b53fa09</code></a> fix: exclude iframes from focus-visible auto outline in Preflight (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss/issues/20292">#20292</a>)</li> <li><a href="https://github.com/tailwindlabs/tailwindcss/commit/ef79119d4e2b8b0f37710e736605bd0b3419afb7"><code>ef79119</code></a> Bump dependencies (<a href="https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss/issues/20300">#20300</a>)</li> <li>Additional commits viewable in <a href="https://github.com/tailwindlabs/tailwindcss/commits/v4.3.3/packages/tailwindcss">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
98298cb7ff |
build(deps-dev): bump tsx from 4.23.1 to 4.23.12 (#11722)
Bumps [tsx](https://github.com/privatenumber/tsx) from 4.23.1 to 4.23.12. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/privatenumber/tsx/releases">tsx's releases</a>.</em></p> <blockquote> <h2>v4.23.12</h2> <h2><a href="https://github.com/privatenumber/tsx/compare/v4.23.11...v4.23.12">4.23.12</a> (2026-08-10)</h2> <h3>Bug Fixes</h3> <ul> <li>shim <code>import.meta</code> when tokens are split by comments or newlines (<a href="https://redirect.github.com/privatenumber/tsx/issues/829">#829</a>) (<a href="https://github.com/privatenumber/tsx/commit/ed9d33046a135de13a35fdfce12368b79d1b1518">ed9d330</a>), closes <a href="https://redirect.github.com/privatenumber/tsx/issues/828">#828</a></li> </ul> <hr /> <p>This release is also available on:</p> <ul> <li><a href="https://www.npmjs.com/package/tsx/v/4.23.12"><code>npm package (@latest dist-tag)</code></a></li> </ul> <h2>v4.23.11</h2> <h2><a href="https://github.com/privatenumber/tsx/compare/v4.23.10...v4.23.11">4.23.11</a> (2026-08-07)</h2> <h3>Bug Fixes</h3> <ul> <li>preserve async ESM require fallback (<a href="https://github.com/privatenumber/tsx/commit/55cbecef8ebe839c7110e8c141a1c3bc4da326cd">55cbece</a>)</li> </ul> <hr /> <p>This release is also available on:</p> <ul> <li><a href="https://www.npmjs.com/package/tsx/v/4.23.11"><code>npm package (@latest dist-tag)</code></a></li> </ul> <h2>v4.23.10</h2> <h2><a href="https://github.com/privatenumber/tsx/compare/v4.23.9...v4.23.10">4.23.10</a> (2026-08-07)</h2> <h3>Bug Fixes</h3> <ul> <li>support nyc coverage discovery (<a href="https://redirect.github.com/privatenumber/tsx/issues/710">#710</a>) (<a href="https://github.com/privatenumber/tsx/commit/ec1bcd5f711e5159b67cb0aea211f06cf2cfce8a">ec1bcd5</a>)</li> </ul> <hr /> <p>This release is also available on:</p> <ul> <li><a href="https://www.npmjs.com/package/tsx/v/4.23.10"><code>npm package (@latest dist-tag)</code></a></li> </ul> <h2>v4.23.9</h2> <h2><a href="https://github.com/privatenumber/tsx/compare/v4.23.8...v4.23.9">4.23.9</a> (2026-08-06)</h2> <h3>Bug Fixes</h3> <ul> <li>map Node test locations (<a href="https://github.com/privatenumber/tsx/commit/2f55884195a8c745fbe64a0288de69bc062ed876">2f55884</a>)</li> <li>support data URLs in tsImport (<a href="https://github.com/privatenumber/tsx/commit/b94f46f6b6a7e6dc575624b0ecc7124318723056">b94f46f</a>)</li> </ul> <hr /> <p>This release is also available on:</p> <ul> <li><a href="https://www.npmjs.com/package/tsx/v/4.23.9"><code>npm package (@latest dist-tag)</code></a></li> </ul> <h2>v4.23.8</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/privatenumber/tsx/commit/ed9d33046a135de13a35fdfce12368b79d1b1518"><code>ed9d330</code></a> fix: shim <code>import.meta</code> when tokens are split by comments or newlines (<a href="https://redirect.github.com/privatenumber/tsx/issues/829">#829</a>)</li> <li><a href="https://github.com/privatenumber/tsx/commit/651f5bec70d9a116d1fe1706000b7ca011a516fc"><code>651f5be</code></a> test: cover CommonJS TypeScript import.meta paths</li> <li><a href="https://github.com/privatenumber/tsx/commit/bd3bc6448e957c1172eb91a0584ec7fec2d6a7ad"><code>bd3bc64</code></a> test: cover CommonJS loader source fallback</li> <li><a href="https://github.com/privatenumber/tsx/commit/55cbecef8ebe839c7110e8c141a1c3bc4da326cd"><code>55cbece</code></a> fix: preserve async ESM require fallback</li> <li><a href="https://github.com/privatenumber/tsx/commit/6c5ba85f7a1e57f06bcb760718d6ba3b978e5a05"><code>6c5ba85</code></a> docs: document CommonJS default interop</li> <li><a href="https://github.com/privatenumber/tsx/commit/ec1bcd5f711e5159b67cb0aea211f06cf2cfce8a"><code>ec1bcd5</code></a> fix: support nyc coverage discovery (<a href="https://redirect.github.com/privatenumber/tsx/issues/710">#710</a>)</li> <li><a href="https://github.com/privatenumber/tsx/commit/b6e5b48a7b0fa4639e67119c8b02150ec8c6cef7"><code>b6e5b48</code></a> docs: clarify CommonJS default imports</li> <li><a href="https://github.com/privatenumber/tsx/commit/2f55884195a8c745fbe64a0288de69bc062ed876"><code>2f55884</code></a> fix: map Node test locations</li> <li><a href="https://github.com/privatenumber/tsx/commit/de935d588b6c0959ac8af71e2cf40d1a61e659e7"><code>de935d5</code></a> docs: document Node source-map stack formatting</li> <li><a href="https://github.com/privatenumber/tsx/commit/b94f46f6b6a7e6dc575624b0ecc7124318723056"><code>b94f46f</code></a> fix: support data URLs in tsImport</li> <li>Additional commits viewable in <a href="https://github.com/privatenumber/tsx/compare/v4.23.1...v4.23.12">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
ec8d7dd21f |
build(deps): bump ws from 8.21.1 to 8.21.3 (#11729)
Bumps [ws](https://github.com/websockets/ws) from 8.21.1 to 8.21.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/websockets/ws/releases">ws's releases</a>.</em></p> <blockquote> <h2>8.21.3</h2> <h1>Bug fixes</h1> <ul> <li>The server now correctly rejects permessage-deflate offers if the incoming <code>client_max_window_bits</code> parameter value is smaller than its configured <code>clientMaxWindowBits</code> (e97a20ea).</li> </ul> <h2>8.21.2</h2> <h1>Bug fixes</h1> <ul> <li>Fixed a test for <a href="https://github.com/nodejs/citgm">CITGM</a> (2eb3be0b).</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/websockets/ws/commit/c791e707eab3c13dd9a261d2479c3cc4a49a6fed"><code>c791e70</code></a> [dist] 8.21.3</li> <li><a href="https://github.com/websockets/ws/commit/e97a20eaa6f2ad7969419eed732a506453251eb9"><code>e97a20e</code></a> [fix] Reject offers with <code>client_max_window_bits</code> below config</li> <li><a href="https://github.com/websockets/ws/commit/787ebf22ce3d091fb6f931d20b4c7e914ba7cf85"><code>787ebf2</code></a> [dist] 8.21.2</li> <li><a href="https://github.com/websockets/ws/commit/b4d62ebad40c3b925c84ff305a47975406015422"><code>b4d62eb</code></a> Revert "[ci] Trust Coveralls Homebrew tap"</li> <li><a href="https://github.com/websockets/ws/commit/e4bb883723a0c18452eea10a74139901ae33c61d"><code>e4bb883</code></a> [security] Use GitHub PVR as main reporting channel</li> <li><a href="https://github.com/websockets/ws/commit/2eb3be0bff2453e2654b1315c5872e8d5d424a50"><code>2eb3be0</code></a> [test] Skip test on Node.js versions where it does not apply</li> <li>See full diff in <a href="https://github.com/websockets/ws/compare/8.21.1...8.21.3">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>canary/v2026.819.0-canary.5 |
||
|
Nicky LeachandPaperclip
|
8b2dbd9d87 |
chore(deps): open one dependabot PR per major update (#11709)
## Thinking Path
> - Paperclip is the open source app people use to manage AI agents for
work.
> - Dependabot keeps the project dependencies current.
> - The npm update rule groups all major updates into one pull request.
> - One blocked major update can stop that grouped pull request.
> - This pull request gives each major update its own pull request.
> - The higher limit keeps the initial major updates and normal updates
visible.
## Linked Issues or Issue Description
**What happened?**
Dependabot grouped all npm major updates into one weekly pull request. A
blocked upgrade stopped the grouped pull request and hid other ready
updates.
**Expected behavior**
Dependabot should open one pull request for each npm major update.
**Steps to reproduce**
1. Read the npm entry in `.github/dependabot.yml`.
2. Run the weekly Dependabot update.
3. Inspect the pull requests for major npm updates.
**Paperclip version or commit**
`master` at the base commit for this pull request.
**Deployment mode**
Not applicable. This change affects repository configuration.
**Installation method**
Not applicable. This change affects repository configuration.
**Agent adapter(s) involved**
Not adapter-specific (repository configuration).
**Database mode**
Not database-related.
**Additional context**
The grouped major update included a blocked `js-yaml` upgrade. Separate
pull requests let other major updates proceed independently.
## What Changed
- Remove the `major-updates` group from the npm Dependabot entry.
- Raise the npm `open-pull-requests-limit` from 10 to 20.
- Keep the GitHub Actions Dependabot entry unchanged.
## Verification
- Run `python3 -c "import yaml;
yaml.safe_load(open('.github/dependabot.yml'))"`.
- Confirm the diff changes only `.github/dependabot.yml`.
- Confirm CI passes on this pull request.
## Risks
This change can open more Dependabot pull requests. The limit of 20
bounds the number of open npm update pull requests. No application code
changes.
## Model Used
OpenAI GPT-5. Tool use and code repository inspection assisted this
change.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` /
`Closes: #` / `Refs #` OR (b) described the issue in-PR following the
relevant issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
Co-authored-by: Paperclip <noreply@paperclip.ing>
canary/v2026.819.0-canary.4
|
||
|
DottaandPaperclip
|
e0d46d1375 |
test(workspaces): fix runtime provision metadata assertion (#11707)
## Thinking Path > - Paperclip manages agent work in isolated execution workspaces. > - Workspace operations record operation metadata and command-result metadata separately. > - Runtime provisioning records its provision kind in the operation metadata. > - One merged regression test checked that value in the command-result metadata. > - The production behavior was correct, but the test failed. > - This pull request checks the provision kind in the operation metadata. > - The benefit is that the regression test now matches the recorder contract. ## Linked Issues or Issue Description Related pull request: #11706 **What happened?** The runtime provisioning regression test expected `provisionKind` in `result.metadata`. The recorder stores this value in the operation's top-level `metadata`. The command-result metadata is `null` for this case. **Expected behavior** The test must check `metadata.provisionKind`. It must continue to check `result.status`. **Steps to reproduce** 1. Check out commit `e1df4c6068fea684a1e9714ebd64bce95f3db19a`. 2. Run the focused runtime provisioning test. 3. Observe that the assertion checks the wrong metadata object. **Paperclip version or commit** `e1df4c6068fea684a1e9714ebd64bce95f3db19a` **Deployment mode** Local development. ## What Changed - Move the `provisionKind` assertion from `result.metadata` to the operation's top-level `metadata`. - Keep the `result.status` assertion unchanged. ## Verification - `pnpm --filter @paperclipai/server exec vitest run src/__tests__/workspace-runtime.test.ts -t "keeps an explicit command matching the built-in seed command as runtime provisioning"` - Result: 1 test passed and 125 tests skipped. ## Risks - Low risk. This pull request changes one test assertion and does not change production code. > For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and discuss it in `#dev` before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See `CONTRIBUTING.md`. ## Model Used - OpenAI Codex, GPT-5, high-reasoning mode, with repository, shell, Git, GitHub, and code execution tools. The runtime does not expose a context-window value. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge Co-authored-by: Paperclip <noreply@paperclip.ing>canary/v2026.819.0-canary.3 |
||
|
DottaandPaperclip
|
e1df4c6068 |
fix(workspaces): keep deferred seed databases reliable (#11706)
## Thinking Path > - Paperclip manages agent work in isolated execution workspaces. > - A workspace depends on a valid database seed before it can run. > - Deferred seed failures were hidden behind a successful provision status. > - The seed restore also had two possible owners for the embedded PostgreSQL process. > - That allowed the target database to stop while the restore was still running. > - This pull request makes seed failures visible and gives the seed process sole lifecycle ownership. > - The benefit is that workspace provisioning reports the real result and does not stop its own target database. ## Linked Issues or Issue Description Related: #11684 **What happened?** Initial worktree provisioning could report success before its deferred database seed completed. The seed restore could also reuse a target embedded PostgreSQL process with another shutdown owner. This could stop the target database during the restore. **Expected behavior** Workspace status must show a failed deferred seed as a failure. The seed restore must own the target embedded PostgreSQL process until restore, migration, and validation finish. **Steps to reproduce** 1. Provision a worktree with deferred database seeding. 2. Make the seed manifest end in a failed state while the command exits with code 0. 3. Observe that the provision status remains successful on `master`. 4. Start a seed restore against an already-running target embedded PostgreSQL process. 5. Observe that another lifecycle owner can stop the target during restore. **Paperclip version or commit** `51a843e135` **Deployment mode** Local dev with execution workspaces and embedded PostgreSQL. ## What Changed - Add a first-class `workspace_seed` operation for deferred database seeds. - Require terminal, verified seed evidence before the seed operation succeeds. - Surface the seed phase and failure metadata in workspace status and UI state. - Give the seed process exclusive lifecycle ownership of the target embedded PostgreSQL process. - Suppress imported embedded-Postgres exit hooks without removing existing host listeners. - Record a credential-safe shutdown diagnostic in failed seed manifests. ## Verification - The original deferred-seed commit passed 4 server tests, 24 workspace-status UI tests, shared/server/UI typechecks, and the UI token gate. - The original PostgreSQL-lifecycle commit passed 3 lifecycle tests, 3 ownership/diagnostic tests, 1 real embedded-Postgres seed integration, and the affected package typechecks. - No local tests were rerun after the clean cherry-pick because the operator requested the shortest landing path. - Review the automatic PR checks for the clean `origin/master` replay. ## Risks - A live target database now causes an early error instead of being reused. The error includes recovery guidance. - Workspace consumers must handle the new `workspace_seed` operation type. Shared types and UI state handling are updated in this pull request. > For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and discuss it in `#dev` before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See `CONTRIBUTING.md`. ## Model Used - OpenAI Codex, GPT-5, high-reasoning mode, with repository, shell, and GitHub tool use. The runtime does not expose a more specific deployment suffix or context-window value. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [ ] All Paperclip CI gates are green - [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
DottaandPaperclip
|
51a843e135 |
fix(cli): accept renumbered migration journal order (#11684)
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work > - Worktree provisioning clones a source database into an isolated workspace > - Source validation must accept a migration journal that matches a prefix of the checkout journal > - Long-lived instances can apply migrations in a different order after migration files are renumbered > - The validator compared application order with filename order and rejected a valid source > - This pull request compares the resolved migration names as a set and records the checkout-prefix revision > - The benefit is that valid renumbered migration histories can pass source validation without allowing divergent histories ## Linked Issues or Issue Description **What happened?** Worktree seed source validation compared applied migrations in database application order with available migration files in filename order. A current source with the same migration set failed with `Migration journal is not a prefix` after migration files were renumbered. **Expected behavior** Source validation must accept a source when its resolved applied migration set equals a prefix of the checkout migration files. It must still reject a source that contains a resolved migration outside that prefix. **Steps to reproduce** 1. Apply migrations before a migration-file renumber operation. 2. Update the checkout so the same migration files have a different filename order. 3. Run worktree seed source validation against the long-lived source. 4. Observe that positional comparison rejects the source even though the sets are equal. **Paperclip version or commit** The bug reproduces on the master-equivalent worktree-seeding implementation before this commit. **Deployment mode** Local dev with embedded PostgreSQL. ## What Changed - Compare resolved applied migration names with the expected checkout prefix as an order-independent set. - Derive the reported source revision from the checkout prefix instead of database application order. - Add unit and embedded-PostgreSQL regressions for shuffled application order, stale unresolved rows, lagging sources, and true divergence. ## Verification - `pnpm exec vitest run cli/src/__tests__/worktree.test.ts` — 54 tests passed. - `pnpm --filter paperclipai typecheck` — passed. - The focused suite includes the real embedded-PostgreSQL seed path. ## Risks - Low risk. The change is limited to source migration-prefix validation. - The validator still rejects missing or unknown resolved migrations. - Duplicate resolved names remain set-equivalent by design. Raw stale journal rows remain tolerated. - Existing documentation already specifies order-independent checkout-prefix behavior, so no documentation change is required. > For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and discuss it in `#dev` before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See `CONTRIBUTING.md`. ## Model Used - OpenAI Codex, exact model ID `gpt-5.6-sol`. The Codex runtime manages the context window. The model used reasoning, shell tools, code execution, and test execution. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge Co-authored-by: Paperclip <noreply@paperclip.ing>canary/v2026.819.0-canary.2 |
||
|
dependabot[bot]
|
536d5880c5 |
build(deps): bump @cursor/sdk from 1.0.24 to 1.0.28 (#11520)
Bumps [@cursor/sdk](https://github.com/cursor/cursor) from 1.0.24 to 1.0.28. <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/cursor/cursor/commits">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>canary/v2026.819.0-canary.1 nightly/v2026.819.0-nightly.0 |
||
|
dependabot[bot]
|
59c4b5a9c7 |
build(deps): bump @base-ui/react from 1.6.0 to 1.7.0 (#11518)
Bumps [@base-ui/react](https://github.com/mui/base-ui/tree/HEAD/packages/react) from 1.6.0 to 1.7.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/mui/base-ui/releases">@base-ui/react's releases</a>.</em></p> <blockquote> <h2>v1.7.0</h2> <h3>General changes</h3> <ul> <li>Restore visible focus after keyboard close in Safari and Firefox (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5093">#5093</a>) by <a href="https://github.com/lyzno1"><code>@lyzno1</code></a></li> <li>Type <code>render</code> callback props based on the rendered element (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5104">#5104</a>) by <a href="https://github.com/atomiks"><code>@atomiks</code></a></li> <li>Reduce popup bundle size (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5233">#5233</a>) by <a href="https://github.com/atomiks"><code>@atomiks</code></a></li> <li>Reduce store bundle size (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5250">#5250</a>) by <a href="https://github.com/atomiks"><code>@atomiks</code></a></li> <li>Keep unpositioned popups at the viewport origin (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5299">#5299</a>) by <a href="https://github.com/flaviendelangle"><code>@flaviendelangle</code></a></li> <li>Correct layout and passive effect timing (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5337">#5337</a>) by <a href="https://github.com/atomiks"><code>@atomiks</code></a></li> <li>Remove redundant lifecycle synchronization (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5341">#5341</a>) by <a href="https://github.com/atomiks"><code>@atomiks</code></a></li> <li>Prevent stale cleanup from clearing registered part IDs (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5340">#5340</a>) by <a href="https://github.com/atomiks"><code>@atomiks</code></a></li> <li>Complete popup unmounting after a canceled exit transition (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5401">#5401</a>) by <a href="https://github.com/atomiks"><code>@atomiks</code></a></li> <li>Fix rendered trigger ID ownership (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5110">#5110</a>) by <a href="https://github.com/atomiks"><code>@atomiks</code></a></li> <li>Prevent unwanted flip with capped scrollable content (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5120">#5120</a>) by <a href="https://github.com/atomiks"><code>@atomiks</code></a></li> <li>Fix <code>collisionPadding</code> off-by-one on the biased side (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5143">#5143</a>) by <a href="https://github.com/atomiks"><code>@atomiks</code></a></li> <li>Reduce shared popup bundle size (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5192">#5192</a>) by <a href="https://github.com/atomiks"><code>@atomiks</code></a></li> <li>Mount popup subtrees synchronously when opening in React 17 (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5309">#5309</a>) by <a href="https://github.com/atomiks"><code>@atomiks</code></a></li> <li>Fix auto-resize origin for left-anchored popups (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5370">#5370</a>) by <a href="https://github.com/sai6855"><code>@sai6855</code></a></li> <li>Avoid redundant re-renders during lazy flipping (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5372">#5372</a>) by <a href="https://github.com/mdm317"><code>@mdm317</code></a></li> <li>Strip implementation-only types from published <code>.d.ts</code> files (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5165">#5165</a>) by <a href="https://github.com/michaldudak"><code>@michaldudak</code></a></li> <li>Fix <code>usePreviousValue</code> equality comparison (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5264">#5264</a>) by <a href="https://github.com/lyzno1"><code>@lyzno1</code></a></li> </ul> <h3>Accordion</h3> <ul> <li>Remove the implicit <code>dir</code> attribute from <code><Accordion.Root></code> (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5117">#5117</a>) by <a href="https://github.com/chuganzy"><code>@chuganzy</code></a></li> </ul> <h3>Alert Dialog</h3> <ul> <li>Prevent <code><AlertDialog.Root></code> from reopening after remounting with a reused handle (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5109">#5109</a>) by <a href="https://github.com/michaldudak"><code>@michaldudak</code></a></li> </ul> <h3>Autocomplete</h3> <ul> <li>Respect locale when filtering (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5195">#5195</a>) by <a href="https://github.com/atomiks"><code>@atomiks</code></a></li> <li>Add <code>input-press</code> to change event details (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5356">#5356</a>) by <a href="https://github.com/chuganzy"><code>@chuganzy</code></a></li> <li>Add <code>cancel-open</code> to change event details (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5376">#5376</a>) by <a href="https://github.com/chuganzy"><code>@chuganzy</code></a></li> <li>Reset list scroll position on filter (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5231">#5231</a>) by <a href="https://github.com/atomiks"><code>@atomiks</code></a></li> <li>Remove dead code and deduplicate handlers (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5194">#5194</a>) by <a href="https://github.com/atomiks"><code>@atomiks</code></a></li> <li>Fix listbox separator semantics (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5399">#5399</a>) by <a href="https://github.com/sarthakmalik0810"><code>@sarthakmalik0810</code></a></li> </ul> <h3>Avatar</h3> <ul> <li>Show <code><Avatar.Fallback></code> immediately when <code>delay={0}</code> (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5147">#5147</a>) by <a href="https://github.com/chuganzy"><code>@chuganzy</code></a></li> </ul> <h3>Button</h3> <ul> <li>Fix keyboard click handling for custom elements (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/4838">#4838</a>) by <a href="https://github.com/atomiks"><code>@atomiks</code></a></li> </ul> <h3>Checkbox</h3> <ul> <li>Remove redundant validation input ref (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5188">#5188</a>) by <a href="https://github.com/nami8824"><code>@nami8824</code></a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/mui/base-ui/blob/master/CHANGELOG.md">@base-ui/react's changelog</a>.</em></p> <blockquote> <h2>v1.7.0</h2> <p><em>Aug 4, 2026</em></p> <h3>General changes</h3> <ul> <li>Restore visible focus after keyboard close in Safari and Firefox (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5093">#5093</a>) by <a href="https://github.com/lyzno1"><code>@lyzno1</code></a></li> <li>Type <code>render</code> callback props based on the rendered element (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5104">#5104</a>) by <a href="https://github.com/atomiks"><code>@atomiks</code></a></li> <li>Reduce popup bundle size (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5233">#5233</a>) by <a href="https://github.com/atomiks"><code>@atomiks</code></a></li> <li>Reduce store bundle size (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5250">#5250</a>) by <a href="https://github.com/atomiks"><code>@atomiks</code></a></li> <li>Keep unpositioned popups at the viewport origin (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5299">#5299</a>) by <a href="https://github.com/flaviendelangle"><code>@flaviendelangle</code></a></li> <li>Correct layout and passive effect timing (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5337">#5337</a>) by <a href="https://github.com/atomiks"><code>@atomiks</code></a></li> <li>Remove redundant lifecycle synchronization (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5341">#5341</a>) by <a href="https://github.com/atomiks"><code>@atomiks</code></a></li> <li>Prevent stale cleanup from clearing registered part IDs (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5340">#5340</a>) by <a href="https://github.com/atomiks"><code>@atomiks</code></a></li> <li>Complete popup unmounting after a canceled exit transition (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5401">#5401</a>) by <a href="https://github.com/atomiks"><code>@atomiks</code></a></li> <li>Fix rendered trigger ID ownership (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5110">#5110</a>) by <a href="https://github.com/atomiks"><code>@atomiks</code></a></li> <li>Prevent unwanted flip with capped scrollable content (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5120">#5120</a>) by <a href="https://github.com/atomiks"><code>@atomiks</code></a></li> <li>Fix <code>collisionPadding</code> off-by-one on the biased side (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5143">#5143</a>) by <a href="https://github.com/atomiks"><code>@atomiks</code></a></li> <li>Reduce shared popup bundle size (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5192">#5192</a>) by <a href="https://github.com/atomiks"><code>@atomiks</code></a></li> <li>Mount popup subtrees synchronously when opening in React 17 (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5309">#5309</a>) by <a href="https://github.com/atomiks"><code>@atomiks</code></a></li> <li>Fix auto-resize origin for left-anchored popups (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5370">#5370</a>) by <a href="https://github.com/sai6855"><code>@sai6855</code></a></li> <li>Avoid redundant re-renders during lazy flipping (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5372">#5372</a>) by <a href="https://github.com/mdm317"><code>@mdm317</code></a></li> <li>Strip implementation-only types from published <code>.d.ts</code> files (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5165">#5165</a>) by <a href="https://github.com/michaldudak"><code>@michaldudak</code></a></li> <li>Fix <code>usePreviousValue</code> equality comparison (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5264">#5264</a>) by <a href="https://github.com/lyzno1"><code>@lyzno1</code></a></li> </ul> <h3>Accordion</h3> <ul> <li>Remove the implicit <code>dir</code> attribute from <code><Accordion.Root></code> (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5117">#5117</a>) by <a href="https://github.com/chuganzy"><code>@chuganzy</code></a></li> </ul> <h3>Alert Dialog</h3> <ul> <li>Prevent <code><AlertDialog.Root></code> from reopening after remounting with a reused handle (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5109">#5109</a>) by <a href="https://github.com/michaldudak"><code>@michaldudak</code></a></li> </ul> <h3>Autocomplete</h3> <ul> <li>Respect locale when filtering (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5195">#5195</a>) by <a href="https://github.com/atomiks"><code>@atomiks</code></a></li> <li>Add <code>input-press</code> to change event details (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5356">#5356</a>) by <a href="https://github.com/chuganzy"><code>@chuganzy</code></a></li> <li>Add <code>cancel-open</code> to change event details (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5376">#5376</a>) by <a href="https://github.com/chuganzy"><code>@chuganzy</code></a></li> <li>Reset list scroll position on filter (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5231">#5231</a>) by <a href="https://github.com/atomiks"><code>@atomiks</code></a></li> <li>Remove dead code and deduplicate handlers (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5194">#5194</a>) by <a href="https://github.com/atomiks"><code>@atomiks</code></a></li> <li>Fix listbox separator semantics (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5399">#5399</a>) by <a href="https://github.com/sarthakmalik0810"><code>@sarthakmalik0810</code></a></li> </ul> <h3>Avatar</h3> <ul> <li>Show <code><Avatar.Fallback></code> immediately when <code>delay={0}</code> (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5147">#5147</a>) by <a href="https://github.com/chuganzy"><code>@chuganzy</code></a></li> </ul> <h3>Button</h3> <ul> <li>Fix keyboard click handling for custom elements (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/4838">#4838</a>) by <a href="https://github.com/atomiks"><code>@atomiks</code></a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/mui/base-ui/commit/254f4744f0a241c20697b9eeab33402f4469a081"><code>254f474</code></a> [release] v1.7.0 (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5404">#5404</a>)</li> <li><a href="https://github.com/mui/base-ui/commit/9222cdac2509af9ecf80c413516830e5f707c5fd"><code>9222cda</code></a> [meter] Format clamped values (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5409">#5409</a>)</li> <li><a href="https://github.com/mui/base-ui/commit/becc19ace935f8058f64efd4b9232a005a2ff750"><code>becc19a</code></a> [combobox][autocomplete][select] Fix listbox separator semantics (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5399">#5399</a>)</li> <li><a href="https://github.com/mui/base-ui/commit/7cc0eef3a34500830932dc8a8f2873896877e1a3"><code>7cc0eef</code></a> [drawer] Fix click-only outside dismissal after swipe (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5392">#5392</a>)</li> <li><a href="https://github.com/mui/base-ui/commit/1a2ca3c9f8a39bd8c0dda939a7a23b72da226124"><code>1a2ca3c</code></a> [all components] Fix canceled exit unmount (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5401">#5401</a>)</li> <li><a href="https://github.com/mui/base-ui/commit/166e8ac0151107b08595147513717dd479a83aa9"><code>166e8ac</code></a> [popups] Fix quadratic dev-mode trigger registration check (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5400">#5400</a>)</li> <li><a href="https://github.com/mui/base-ui/commit/071e892016b5836b7a1cda190a2a59f83c26753e"><code>071e892</code></a> [all components] Avoid unused popup handle attachments (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5394">#5394</a>)</li> <li><a href="https://github.com/mui/base-ui/commit/cbc87d195a40e0f9fd64e90516cc789c7e6913be"><code>cbc87d1</code></a> [select] Stabilize scroll arrow cleanup test (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5402">#5402</a>)</li> <li><a href="https://github.com/mui/base-ui/commit/3b5715cc70f6b1988051c989ae32f8082c71d5ae"><code>3b5715c</code></a> [all components] Fix popup handle lifecycle regressions (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5387">#5387</a>)</li> <li><a href="https://github.com/mui/base-ui/commit/54cfcc18836088979b6f8c15da57b92e00849ddb"><code>54cfcc1</code></a> [typescript] Preserve published internals types (<a href="https://github.com/mui/base-ui/tree/HEAD/packages/react/issues/5386">#5386</a>)</li> <li>Additional commits viewable in <a href="https://github.com/mui/base-ui/commits/v1.7.0/packages/react">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
f27c0ee3f9 |
build(deps): bump open from 11.0.0 to 11.0.1 (#11517)
Bumps [open](https://github.com/sindresorhus/open) from 11.0.0 to 11.0.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sindresorhus/open/releases">open's releases</a>.</em></p> <blockquote> <h2>v11.0.1</h2> <ul> <li>Fix WSL failure when the working directory is unreachable from Windows 6ac3fe4</li> </ul> <hr /> <p><a href="https://github.com/sindresorhus/open/compare/v11.0.0...v11.0.1">https://github.com/sindresorhus/open/compare/v11.0.0...v11.0.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sindresorhus/open/commit/f38acc807a8760968310759a203cf14ca4d54727"><code>f38acc8</code></a> 11.0.1</li> <li><a href="https://github.com/sindresorhus/open/commit/6ac3fe443994a3a2a61ee6785b9169faf96115c3"><code>6ac3fe4</code></a> Fix WSL failure when the working directory is unreachable from Windows</li> <li><a href="https://github.com/sindresorhus/open/commit/a30acc78bef1c1e5448bd88d19180e8ad6899ab9"><code>a30acc7</code></a> Meta tweaks</li> <li>See full diff in <a href="https://github.com/sindresorhus/open/compare/v11.0.0...v11.0.1">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
DottaandPaperclip
|
a2bf936f9a |
feat(workspaces): sign the workspace login handoff and gate readiness (#11671)
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - Managed worktree services run isolated Paperclip instances with cloned databases. > - A reachable service was reported as ready even when its database, runtime identity, or login path was not usable. > - The first candidate added verified database seeding and managed repair in #11665. > - This pull request consolidates that candidate with signed login handoff and a complete readiness contract. > - Post-QA fixes close five defects in repair identity, repair responses, UI retry, seed journal handling, and seed-source trust. > - The benefit is a workspace that either opens safely or reports one accurate recovery action. ## Linked Issues or Issue Description No public GitHub issue exists for this work, so the problem is described here. **What happened** Managed workspace URLs could return HTTP 200 and report ready while login failed. QA also found cases where repair used the wrong instance identity, returned a generic error, left the UI stuck, rejected a safe journal lag, or trusted a mutable workspace manifest. **Expected behavior** Opening a ready workspace signs the board user in to the correct isolated instance. Provisioning and repair use a registered source and report a structured recovery state. **Actual behavior** Entry depended on a password copied into the clone. Several failure paths could publish stale readiness, hide the repair precondition, or trust state that the workspace could modify. **Additional context** This pull request includes the commits first published in #11665. That pull request keeps the original base head for review history. This consolidated pull request is the merge candidate. Related open readiness work includes #11575 and #11621. ## What Changed - Adds a short-lived, signed, single-use login ticket. It binds the user, workspace, instance, and runtime origin. - Exchanges the ticket through Better Auth. It creates the session and cookie through the supported adapter path. - Adds protected workspace readiness fields for the database, clone data, login handoff, seed phase, and runtime identity. - Fails readiness closed when the guest has no company or execution-workspace binding. - Binds ticket issuance to the exact cloned user and active company membership selected for the handoff. - Verifies every current active board identity through the exact-user handoff before publication or reuse. - Gates managed runtime publication on the readiness contract and the recorded worktree instance identity. - Refreshes runtime work products from the live runtime row after a port change. - Adds one workspace access card with ready, degraded, repairing, and failed states. - Uses the runtime response identity for repair. It returns structured repair precondition errors. - Lets a valid source journal lag converge during provisioning. - Binds seed and repair manifests to a source registered outside the agent-writable worktree. - Clears recovered UI errors so a successful retry can open the workspace. - Makes runtime tests register canonical sources and avoid ports owned by live host listeners. - Keeps Vitest on source suites when compiled `dist` trees exist. - Isolates CLI and adapter tests from ambient AWS and runtime API environment variables. - Preserves a 404 response for cross-company workspace ID lookups before runtime authorization. - Makes concurrent single-flight coverage independent of path-canonicalization scheduling order. ## Verification The following checks passed on the integrated head: ```sh pnpm -r typecheck pnpm build pnpm check:token-gates pnpm --filter @paperclipai/db check:migrations ``` - The server source lane passed 420 files and 4,953 tests. Five tests were skipped. - The CLI lane passed 57 files and 385 tests. - The database lane passed 26 files and 97 tests. - The shared package passed 58 files and 506 tests. - The adapter utility lane passed 640 tests. Four tests were skipped. - The Claude adapter passed 220 tests. One test was skipped. - The Codex adapter passed 323 tests. - The OpenClaw adapter passed 13 tests. - The OpenCode adapter passed 42 tests. - The plugin SDK passed 45 tests. - The workspace runtime suite passed 124 tests. - The caller-scoped readiness and handoff suite passed 52 tests. - The workspace provisioning shell suite passed 7 tests. - The runtime exposure suite passed 17 tests while live host mappings occupied fixed test ports. - `git diff --check` passed and the worktree is clean. The serialized route lane will run in GitHub CI with its normal shards. No deployment or active-workspace migration was performed. ## Risks - This is a medium-risk authentication and runtime-readiness change. - The login ticket uses exact origin, workspace, instance, and user binding. It has a short expiry and a one-time nonce. - Runtime publication is stricter. A real readiness, identity, per-user handoff, or control-plane database disagreement now blocks publication. - This pull request supersedes #11665 as the merge candidate. Close #11665 after this pull request merges. - No new database migration is included. The lockfile and workflow files are unchanged. - Deployment and active-workspace migration are intentionally outside this pull request. > For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and discuss it in `#dev` before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See `CONTRIBUTING.md`. ## Model Used Claude Opus 5 (`claude-opus-5[1m]`), 1M context, extended thinking, tool use, and code execution produced the main candidate. OpenAI GPT-5 (`gpt-5`) through Codex, with agentic reasoning, tool use, and code execution, integrated the post-QA fixes and hardened the test gates. The Codex context-window size was not exposed. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing> |
||
|
dependabot[bot]
|
6aaef2998f |
build(deps): bump better-auth from 1.6.25 to 1.6.28 (#11516)
Bumps [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) from 1.6.25 to 1.6.28. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/better-auth/better-auth/releases">better-auth's releases</a>.</em></p> <blockquote> <h2>v1.6.28</h2> <h2><code>better-auth</code></h2> <h3>Bug Fixes</h3> <ul> <li>Prevented duplicate session requests during React Suspense retries while preserving revalidation for interrupted refreshes (<a href="https://redirect.github.com/better-auth/better-auth/pull/10769">#10769</a>)</li> <li>Restored client plugin declaration compatibility for downstream TypeScript consumers (<a href="https://redirect.github.com/better-auth/better-auth/pull/10794">#10794</a>)</li> </ul> <p>For detailed changes, see the <a href="https://github.com/better-auth/better-auth/blob/86faaee69b6c2afe237fff8a00602ecc8eccc367/packages/better-auth/CHANGELOG.md"><code>CHANGELOG</code></a>.</p> <h2><code>@better-auth/electron</code></h2> <h3>Bug Fixes</h3> <ul> <li>Restored client plugin declaration compatibility for downstream TypeScript consumers (<a href="https://redirect.github.com/better-auth/better-auth/pull/10794">#10794</a>)</li> </ul> <p>For detailed changes, see the <a href="https://github.com/better-auth/better-auth/blob/86faaee69b6c2afe237fff8a00602ecc8eccc367/packages/electron/CHANGELOG.md"><code>CHANGELOG</code></a>.</p> <h2><code>@better-auth/expo</code></h2> <h3>Bug Fixes</h3> <ul> <li>Restored client plugin declaration compatibility for downstream TypeScript consumers (<a href="https://redirect.github.com/better-auth/better-auth/pull/10794">#10794</a>)</li> </ul> <p>For detailed changes, see the <a href="https://github.com/better-auth/better-auth/blob/86faaee69b6c2afe237fff8a00602ecc8eccc367/packages/expo/CHANGELOG.md"><code>CHANGELOG</code></a>.</p> <h2>Contributors</h2> <p>Thanks to everyone who contributed to this release:</p> <p><a href="https://github.com/bytaesu"><code>@bytaesu</code></a></p> <p><strong>Full changelog:</strong> <a href="https://github.com/better-auth/better-auth/compare/v1.6.27...v1.6.28"><code>v1.6.27...v1.6.28</code></a></p> <h2>v1.6.27</h2> <h2><code>better-auth</code></h2> <h3>Bug Fixes</h3> <ul> <li>Fixed duplicate session requests being made across Suspense retries (<a href="https://redirect.github.com/better-auth/better-auth/pull/10676">#10676</a>)</li> </ul> <p>For detailed changes, see <a href="https://github.com/better-auth/better-auth/blob/be47e9418b4a25a4ecd51ba781d2296373b65a03/packages/better-auth/CHANGELOG.md"><code>CHANGELOG</code></a></p> <h2><code>@better-auth/scim</code></h2> <h3>Bug Fixes</h3> <ul> <li>Fixed auth endpoint types to align with <code>better-call</code> (<a href="https://redirect.github.com/better-auth/better-auth/pull/10657">#10657</a>)</li> </ul> <p>For detailed changes, see <a href="https://github.com/better-auth/better-auth/blob/be47e9418b4a25a4ecd51ba781d2296373b65a03/packages/scim/CHANGELOG.md"><code>CHANGELOG</code></a></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md">better-auth's changelog</a>.</em></p> <blockquote> <h2>1.6.28</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10769">#10769</a> <a href="https://github.com/better-auth/better-auth/commit/773de54b18c0e920a3542bdecaf8b42fffc0dc4b"><code>773de54</code></a> Thanks <a href="https://github.com/bytaesu"><code>@bytaesu</code></a>! - Prevent duplicate session requests during transient remounts while ensuring incomplete refreshes are revalidated.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10794">#10794</a> <a href="https://github.com/better-auth/better-auth/commit/2ad2928f967afa9f9858caecd01466ecb8686982"><code>2ad2928</code></a> Thanks <a href="https://github.com/bytaesu"><code>@bytaesu</code></a>! - Restore client plugin declaration compatibility for downstream TypeScript consumers.</p> </li> <li> <p>Updated dependencies []:</p> <ul> <li><code>@better-auth/core</code><a href="https://github.com/1"><code>@1</code></a>.6.28</li> <li><code>@better-auth/drizzle-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.28</li> <li><code>@better-auth/kysely-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.28</li> <li><code>@better-auth/memory-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.28</li> <li><code>@better-auth/mongo-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.28</li> <li><code>@better-auth/prisma-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.28</li> <li><code>@better-auth/telemetry</code><a href="https://github.com/1"><code>@1</code></a>.6.28</li> </ul> </li> </ul> <h2>1.6.27</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10657">#10657</a> <a href="https://github.com/better-auth/better-auth/commit/2ae491eac3ece50839a0eb2d4f868c4deedac67b"><code>2ae491e</code></a> Thanks <a href="https://github.com/bytaesu"><code>@bytaesu</code></a>! - Aligned endpoint and middleware context types with runtime route parameters, and preserved response headers when resolving sessions from endpoint contexts.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10676">#10676</a> <a href="https://github.com/better-auth/better-auth/commit/90b509344794b8064700371cbc04b985d0519839"><code>90b5093</code></a> Thanks <a href="https://github.com/bytaesu"><code>@bytaesu</code></a>! - Deduplicate in-flight session requests when React retries a suspended component.</p> </li> <li> <p>Updated dependencies [<a href="https://github.com/better-auth/better-auth/commit/2ae491eac3ece50839a0eb2d4f868c4deedac67b"><code>2ae491e</code></a>]:</p> <ul> <li><code>@better-auth/core</code><a href="https://github.com/1"><code>@1</code></a>.6.27</li> <li><code>@better-auth/drizzle-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.27</li> <li><code>@better-auth/kysely-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.27</li> <li><code>@better-auth/memory-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.27</li> <li><code>@better-auth/mongo-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.27</li> <li><code>@better-auth/prisma-adapter</code><a href="https://github.com/1"><code>@1</code></a>.6.27</li> <li><code>@better-auth/telemetry</code><a href="https://github.com/1"><code>@1</code></a>.6.27</li> </ul> </li> </ul> <h2>1.6.26</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10619">#10619</a> <a href="https://github.com/better-auth/better-auth/commit/9ede8059b56e1415c1e8cfdd93ff72691b848bbf"><code>9ede805</code></a> Thanks <a href="https://github.com/jeroenvandermerwe"><code>@jeroenvandermerwe</code></a>! - Ensure database rate-limit cleanup completes when no background task handler is configured.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10608">#10608</a> <a href="https://github.com/better-auth/better-auth/commit/5a811f1b4314b8bcf6f21c0b72de5cb67d552d97"><code>5a811f1</code></a> Thanks <a href="https://github.com/bytaesu"><code>@bytaesu</code></a>! - Pass the email verification type to custom OTP generators after email sign-up.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10605">#10605</a> <a href="https://github.com/better-auth/better-auth/commit/d8327f1fea92243b6fea1b0ab183e2a989792c0c"><code>d8327f1</code></a> Thanks <a href="https://github.com/XXMOHAMED012"><code>@XXMOHAMED012</code></a>! - The email OTP verification check no longer reveals whether an email is registered before the OTP itself is verified.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10513">#10513</a> <a href="https://github.com/better-auth/better-auth/commit/e2c73fbec87f5e19f6a2b5ac371bc5bba9bd49ff"><code>e2c73fb</code></a> Thanks <a href="https://github.com/mrosberghaus"><code>@mrosberghaus</code></a>! - Fix <code>jwtClient()</code> collapsing <code>createAuthClient</code> type inference when combined with other client plugins such as <code>inferAdditionalFields</code>. Additional user fields (for example on <code>updateUser</code>) are preserved again.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10635">#10635</a> <a href="https://github.com/better-auth/better-auth/commit/af50c45553a62cfb6cdcdede86828731ca00c22c"><code>af50c45</code></a> Thanks <a href="https://github.com/krish-vachhani"><code>@krish-vachhani</code></a>! - Fix <code>oneTapClient()</code> collapsing <code>createAuthClient</code> type inference when combined with other client plugins. The <code>oneTap</code> action is available on the client again.</p> </li> <li> <p><a href="https://redirect.github.com/better-auth/better-auth/pull/10633">#10633</a> <a href="https://github.com/better-auth/better-auth/commit/701cd43babac52784d855291a6adc0cf3fba7970"><code>701cd43</code></a> Thanks <a href="https://github.com/gustavovalverde"><code>@gustavovalverde</code></a>! - Minting or reading a JWKS signing key inside an active database transaction now uses the transaction-scoped adapter instead of the root connection. On a single-connection SQLite database with native transactions enabled, this no longer deadlocks, and on Postgres and MySQL the key commits with the surrounding transaction instead of independently of it.</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/better-auth/better-auth/commit/86faaee69b6c2afe237fff8a00602ecc8eccc367"><code>86faaee</code></a> chore: release v1.6.28 (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10796">#10796</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/773de54b18c0e920a3542bdecaf8b42fffc0dc4b"><code>773de54</code></a> fix(client): deduplicate settled session requests during Suspense retries (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/1">#1</a>...</li> <li><a href="https://github.com/better-auth/better-auth/commit/c92a1ca27bb3f430811f007e6b7769ac31c9749a"><code>c92a1ca</code></a> chore: upgrade <code>next</code> to 16.3 (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10787">#10787</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/be47e9418b4a25a4ecd51ba781d2296373b65a03"><code>be47e94</code></a> chore: release v1.6.27 (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10686">#10686</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/2ae491eac3ece50839a0eb2d4f868c4deedac67b"><code>2ae491e</code></a> fix(types): align auth endpoints with <code>better-call</code> (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10657">#10657</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/90b509344794b8064700371cbc04b985d0519839"><code>90b5093</code></a> fix(client): deduplicate session requests across suspense retries (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10676">#10676</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/a16b30e8437927c08350194000178073b06af8cf"><code>a16b30e</code></a> chore: release v1.6.26 (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10521">#10521</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/9ede8059b56e1415c1e8cfdd93ff72691b848bbf"><code>9ede805</code></a> fix(rate-limit): await database cleanup by default (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10619">#10619</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/af50c45553a62cfb6cdcdede86828731ca00c22c"><code>af50c45</code></a> fix(one-tap): preserve client plugin inference with oneTapClient (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10635">#10635</a>)</li> <li><a href="https://github.com/better-auth/better-auth/commit/222facff556e6c570bbd6b7fd5923757b5a55711"><code>222facf</code></a> fix(jwt): resolve the transaction-scoped adapter when signing (<a href="https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth/issues/10623">#10623</a>)</li> <li>Additional commits viewable in <a href="https://github.com/better-auth/better-auth/commits/v1.6.28/packages/better-auth">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>canary/v2026.819.0-canary.0 |
||
|
dependabot[bot]
|
03ddca4df7 |
build(deps): bump @agentclientprotocol/codex-acp from 1.1.7 to 1.2.0 (#11515)
Bumps [@agentclientprotocol/codex-acp](https://github.com/agentclientprotocol/codex-acp) from 1.1.7 to 1.2.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/agentclientprotocol/codex-acp/releases">@agentclientprotocol/codex-acp's releases</a>.</em></p> <blockquote> <h2>v1.2.0</h2> <h2><a href="https://github.com/agentclientprotocol/codex-acp/compare/v1.1.14...v1.2.0">1.2.0</a> (2026-08-11)</h2> <h3>Features</h3> <ul> <li>expose typed session failures for AIR (<a href="https://redirect.github.com/agentclientprotocol/codex-acp/issues/383">#383</a>) (<a href="https://github.com/agentclientprotocol/codex-acp/commit/54987e1c4a4f878af9afad96ec8b6b0b48c7045e">54987e1</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>normalize cwd filters for Windows sessions (<a href="https://redirect.github.com/agentclientprotocol/codex-acp/issues/377">#377</a>) (<a href="https://github.com/agentclientprotocol/codex-acp/commit/145ebba5d2030b4aa6d19cbb89d190b7b498d454">145ebba</a>)</li> </ul> <h2>v1.1.14</h2> <h2>What's Changed</h2> <ul> <li>Update codex to 0.147.0 by <a href="https://github.com/acp-release-bot"><code>@acp-release-bot</code></a>[bot] in <a href="https://redirect.github.com/agentclientprotocol/codex-acp/pull/375">agentclientprotocol/codex-acp#375</a></li> <li>feat: support replacing goals through ACP control by <a href="https://github.com/nikita-ashihmin"><code>@nikita-ashihmin</code></a> in <a href="https://redirect.github.com/agentclientprotocol/codex-acp/pull/376">agentclientprotocol/codex-acp#376</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/agentclientprotocol/codex-acp/compare/v1.1.13...v1.1.14">https://github.com/agentclientprotocol/codex-acp/compare/v1.1.13...v1.1.14</a></p> <h2>v1.1.13</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/agentclientprotocol/codex-acp/compare/v1.1.12...v1.1.13">https://github.com/agentclientprotocol/codex-acp/compare/v1.1.12...v1.1.13</a></p> <h2>v1.1.12</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/agentclientprotocol/codex-acp/compare/v1.1.11...v1.1.12">https://github.com/agentclientprotocol/codex-acp/compare/v1.1.11...v1.1.12</a></p> <h2>v1.1.11</h2> <h2>What's Changed</h2> <ul> <li>build(deps-dev): bump the npm_and_yarn group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/agentclientprotocol/codex-acp/pull/372">agentclientprotocol/codex-acp#372</a></li> <li>Fix resuming paused goals by <a href="https://github.com/nikita-ashihmin"><code>@nikita-ashihmin</code></a> in <a href="https://redirect.github.com/agentclientprotocol/codex-acp/pull/374">agentclientprotocol/codex-acp#374</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/agentclientprotocol/codex-acp/compare/v1.1.10...v1.1.11">https://github.com/agentclientprotocol/codex-acp/compare/v1.1.10...v1.1.11</a></p> <h2>v1.1.10</h2> <h2>What's Changed</h2> <ul> <li>fix: Stop emitting "Conversation interrupted" message by <a href="https://github.com/Rizzen"><code>@Rizzen</code></a> in <a href="https://redirect.github.com/agentclientprotocol/codex-acp/pull/358">agentclientprotocol/codex-acp#358</a></li> <li>Update codex to 0.146.0 by <a href="https://github.com/acp-release-bot"><code>@acp-release-bot</code></a>[bot] in <a href="https://redirect.github.com/agentclientprotocol/codex-acp/pull/341">agentclientprotocol/codex-acp#341</a></li> <li>build(deps): bump the npm_and_yarn group across 1 directory with 2 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/agentclientprotocol/codex-acp/pull/362">agentclientprotocol/codex-acp#362</a></li> <li>feat: support device code authentication via URL elicitation by <a href="https://github.com/AlexandrSuhinin"><code>@AlexandrSuhinin</code></a> in <a href="https://redirect.github.com/agentclientprotocol/codex-acp/pull/347">agentclientprotocol/codex-acp#347</a></li> <li>Update codex to 0.146.1 by <a href="https://github.com/acp-release-bot"><code>@acp-release-bot</code></a>[bot] in <a href="https://redirect.github.com/agentclientprotocol/codex-acp/pull/370">agentclientprotocol/codex-acp#370</a></li> <li>feat: expose provider-neutral ACP goal extension by <a href="https://github.com/nikita-ashihmin"><code>@nikita-ashihmin</code></a> in <a href="https://redirect.github.com/agentclientprotocol/codex-acp/pull/371">agentclientprotocol/codex-acp#371</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/agentclientprotocol/codex-acp/compare/v1.1.9...v1.1.10">https://github.com/agentclientprotocol/codex-acp/compare/v1.1.9...v1.1.10</a></p> <h2>v1.1.9</h2> <h2>What's Changed</h2> <ul> <li>Throttle ACP plan update snapshots by <a href="https://github.com/nikita-ashihmin"><code>@nikita-ashihmin</code></a> in <a href="https://redirect.github.com/agentclientprotocol/codex-acp/pull/354">agentclientprotocol/codex-acp#354</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/agentclientprotocol/codex-acp/blob/main/CHANGELOG.md">@agentclientprotocol/codex-acp's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/agentclientprotocol/codex-acp/compare/v1.1.14...v1.2.0">1.2.0</a> (2026-08-11)</h2> <h3>Features</h3> <ul> <li>expose typed session failures for AIR (<a href="https://redirect.github.com/agentclientprotocol/codex-acp/issues/383">#383</a>) (<a href="https://github.com/agentclientprotocol/codex-acp/commit/54987e1c4a4f878af9afad96ec8b6b0b48c7045e">54987e1</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>normalize cwd filters for Windows sessions (<a href="https://redirect.github.com/agentclientprotocol/codex-acp/issues/377">#377</a>) (<a href="https://github.com/agentclientprotocol/codex-acp/commit/145ebba5d2030b4aa6d19cbb89d190b7b498d454">145ebba</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/agentclientprotocol/codex-acp/commit/b51bedf60050c60fef78fc669e6ccf2ff61e3f47"><code>b51bedf</code></a> chore(main): release 1.2.0 (<a href="https://redirect.github.com/agentclientprotocol/codex-acp/issues/389">#389</a>)</li> <li><a href="https://github.com/agentclientprotocol/codex-acp/commit/2dccf45b53a33089d5b6e82508a1887aec8b20cc"><code>2dccf45</code></a> ci: release-please release flow (<a href="https://redirect.github.com/agentclientprotocol/codex-acp/issues/388">#388</a>)</li> <li><a href="https://github.com/agentclientprotocol/codex-acp/commit/54987e1c4a4f878af9afad96ec8b6b0b48c7045e"><code>54987e1</code></a> feat: expose typed session failures for AIR (<a href="https://redirect.github.com/agentclientprotocol/codex-acp/issues/383">#383</a>)</li> <li><a href="https://github.com/agentclientprotocol/codex-acp/commit/9edc92458504a9653f539f2a515f59e4a95796a7"><code>9edc924</code></a> build(deps-dev): bump hono in the npm_and_yarn group across 1 directory (<a href="https://redirect.github.com/agentclientprotocol/codex-acp/issues/380">#380</a>)</li> <li><a href="https://github.com/agentclientprotocol/codex-acp/commit/145ebba5d2030b4aa6d19cbb89d190b7b498d454"><code>145ebba</code></a> fix: normalize cwd filters for Windows sessions (<a href="https://redirect.github.com/agentclientprotocol/codex-acp/issues/377">#377</a>)</li> <li><a href="https://github.com/agentclientprotocol/codex-acp/commit/5faefec5d55ded33c54b68ffec93def4f6c547f5"><code>5faefec</code></a> Release v1.1.14</li> <li><a href="https://github.com/agentclientprotocol/codex-acp/commit/0d45a13c2618e8175a24d0bb080a482c7920f291"><code>0d45a13</code></a> feat: support replacing goals through ACP control (<a href="https://redirect.github.com/agentclientprotocol/codex-acp/issues/376">#376</a>)</li> <li><a href="https://github.com/agentclientprotocol/codex-acp/commit/a8cedc8d3789371f992979a4f4facac29f0bd681"><code>a8cedc8</code></a> Update codex to 0.147.0 (<a href="https://redirect.github.com/agentclientprotocol/codex-acp/issues/375">#375</a>)</li> <li><a href="https://github.com/agentclientprotocol/codex-acp/commit/ea57892f7d8e305fc1bd489de420adb19de055b0"><code>ea57892</code></a> Release v1.1.13</li> <li><a href="https://github.com/agentclientprotocol/codex-acp/commit/91cbfd30467d57eae06d3a57ccb068320bb7e171"><code>91cbfd3</code></a> Release v1.1.12</li> <li>Additional commits viewable in <a href="https://github.com/agentclientprotocol/codex-acp/compare/v1.1.7...v1.2.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
|
3dd2d21e4d |
build(deps-dev): bump @storybook/react-vite from 10.5.0 to 10.5.8 (#11514)
Bumps [@storybook/react-vite](https://github.com/storybookjs/storybook/tree/HEAD/code/frameworks/react-vite) from 10.5.0 to 10.5.8. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/storybookjs/storybook/releases">@storybook/react-vite's releases</a>.</em></p> <blockquote> <h2>v10.5.8</h2> <h2>10.5.8</h2> <ul> <li>React: Fix RDT tsconfig selection for Vite project references - <a href="https://redirect.github.com/storybookjs/storybook/pull/35743">#35743</a>, thanks <a href="https://github.com/ndelangen"><code>@ndelangen</code></a>!</li> <li>Tanstack React: Remove <code>@cloudflare/vite-plugin</code> from the inherited Vite config - <a href="https://redirect.github.com/storybookjs/storybook/pull/35706">#35706</a>, thanks <a href="https://github.com/FrancoKaddour"><code>@FrancoKaddour</code></a>!</li> <li>Tanstack: Wait for router to load before rendering - <a href="https://redirect.github.com/storybookjs/storybook/pull/35784">#35784</a>, thanks <a href="https://github.com/huang-julien"><code>@huang-julien</code></a>!</li> <li>Test: Fix Illegal invocation when reading prototype.focus - <a href="https://redirect.github.com/storybookjs/storybook/pull/35528">#35528</a>, thanks <a href="https://github.com/FrancoKaddour"><code>@FrancoKaddour</code></a>!</li> </ul> <h2>v10.5.7</h2> <h2>10.5.7</h2> <ul> <li>Angular: Serve ancestor node_modules for addon-vitest in browser mode - <a href="https://redirect.github.com/storybookjs/storybook/pull/35600">#35600</a>, thanks <a href="https://github.com/brandonroberts"><code>@brandonroberts</code></a>!</li> <li>Refactor: Update getVersionedPackages method to handle non-Storybook packages correctly - <a href="https://redirect.github.com/storybookjs/storybook/pull/35769">#35769</a>, thanks <a href="https://github.com/valentinpalkovic"><code>@valentinpalkovic</code></a>!</li> </ul> <h2>v10.5.6</h2> <h2>10.5.6</h2> <ul> <li>Dependencies: Pin `@testing-library/jest-dom` to `6.9.1` - <a href="https://redirect.github.com/storybookjs/storybook/pull/35614">#35614</a>, thanks <a href="https://github.com/ndelangen"><code>@ndelangen</code></a>!</li> <li>ESLint Plugin: Add plugin meta and document oxlint usage - <a href="https://redirect.github.com/storybookjs/storybook/pull/35655">#35655</a>, thanks <a href="https://github.com/yannbf"><code>@yannbf</code></a>!</li> <li>Vue: Skip docgen for module ids carrying a query - <a href="https://redirect.github.com/storybookjs/storybook/pull/35598">#35598</a>, thanks <a href="https://github.com/seanogdev"><code>@seanogdev</code></a>!</li> </ul> <h2>v10.5.5</h2> <h2>10.5.5</h2> <ul> <li>CLI: Update AI setup instructions to msw-storybook-addon v3 - <a href="https://redirect.github.com/storybookjs/storybook/pull/35512">#35512</a>, thanks <a href="https://github.com/yannbf"><code>@yannbf</code></a>!</li> <li>Core: Upgrade `ws` to fix security advisories - <a href="https://redirect.github.com/storybookjs/storybook/pull/35584">#35584</a>, thanks <a href="https://github.com/ndelangen"><code>@ndelangen</code></a>!</li> <li>ReactNative: Telemetry framework detection fix - <a href="https://redirect.github.com/storybookjs/storybook/pull/35560">#35560</a>, thanks <a href="https://github.com/ndelangen"><code>@ndelangen</code></a>!</li> <li>SyntaxHighlighter: Fix PrismJS dark mode mismatch - <a href="https://redirect.github.com/storybookjs/storybook/pull/35541">#35541</a>, thanks <a href="https://github.com/hxy-asdw"><code>@hxy-asdw</code></a>!</li> <li>TanStack: Preserve explicit route ids on pathful clones - <a href="https://redirect.github.com/storybookjs/storybook/pull/35499">#35499</a>, thanks <a href="https://github.com/unpunnyfuns"><code>@unpunnyfuns</code></a>!</li> <li>TanStack: Resolve mock redirects through Vite's resolver - <a href="https://redirect.github.com/storybookjs/storybook/pull/35501">#35501</a>, thanks <a href="https://github.com/unpunnyfuns"><code>@unpunnyfuns</code></a>!</li> <li>TanStack: Respect routeOverrides component overrides in stories - <a href="https://redirect.github.com/storybookjs/storybook/pull/35497">#35497</a>, thanks <a href="https://github.com/unpunnyfuns"><code>@unpunnyfuns</code></a>!</li> </ul> <h2>v10.5.4</h2> <h2>10.5.4</h2> <ul> <li>ReactNative: Telemetry framework detection fix - <a href="https://redirect.github.com/storybookjs/storybook/pull/35560">#35560</a>, thanks <a href="https://github.com/ndelangen"><code>@ndelangen</code></a>!</li> <li>SyntaxHighlighter: Fix PrismJS dark mode mismatch - <a href="https://redirect.github.com/storybookjs/storybook/pull/35541">#35541</a>, thanks <a href="https://github.com/hxy-asdw"><code>@hxy-asdw</code></a>!</li> </ul> <h2>v10.5.3</h2> <h2>10.5.3</h2> <ul> <li>Dependencies: Upgrade TypeScript to 6.0.3 - <a href="https://redirect.github.com/storybookjs/storybook/pull/34971">#34971</a>, thanks <a href="https://github.com/valentinpalkovic"><code>@valentinpalkovic</code></a>!</li> </ul> <h2>v10.5.2</h2> <h2>10.5.2</h2> <ul> <li>Angular-Vite: Drop <code>@angular/platform-browser-dynamic</code> peer dependency - <a href="https://redirect.github.com/storybookjs/storybook/pull/35457">#35457</a>, thanks <a href="https://github.com/valentinpalkovic"><code>@valentinpalkovic</code></a>!</li> <li>Angular-Vite: Widen TypeScript peer dependency range to support TypeScript 6 - <a href="https://redirect.github.com/storybookjs/storybook/pull/35455">#35455</a>, thanks <a href="https://github.com/valentinpalkovic"><code>@valentinpalkovic</code></a>!</li> <li>Core: Include chromatic packages in ecosystem identifier - <a href="https://redirect.github.com/storybookjs/storybook/pull/35170">#35170</a>, thanks <a href="https://github.com/yannbf"><code>@yannbf</code></a>!</li> <li>TanStack: Fix createServerFn validator mock - <a href="https://redirect.github.com/storybookjs/storybook/pull/35185">#35185</a>, thanks <a href="https://github.com/sjh9714"><code>@sjh9714</code></a>!</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md">@storybook/react-vite's changelog</a>.</em></p> <blockquote> <h2>10.5.8</h2> <ul> <li>React: Fix RDT tsconfig selection for Vite project references - <a href="https://redirect.github.com/storybookjs/storybook/pull/35743">#35743</a>, thanks <a href="https://github.com/ndelangen"><code>@ndelangen</code></a>!</li> <li>Tanstack React: Remove <code>@cloudflare/vite-plugin</code> from the inherited Vite config - <a href="https://redirect.github.com/storybookjs/storybook/pull/35706">#35706</a>, thanks <a href="https://github.com/FrancoKaddour"><code>@FrancoKaddour</code></a>!</li> <li>Tanstack: Wait for router to load before rendering - <a href="https://redirect.github.com/storybookjs/storybook/pull/35784">#35784</a>, thanks <a href="https://github.com/huang-julien"><code>@huang-julien</code></a>!</li> <li>Test: Fix Illegal invocation when reading prototype.focus - <a href="https://redirect.github.com/storybookjs/storybook/pull/35528">#35528</a>, thanks <a href="https://github.com/FrancoKaddour"><code>@FrancoKaddour</code></a>!</li> </ul> <h2>10.5.7</h2> <ul> <li>Angular: Serve ancestor node_modules for addon-vitest in browser mode - <a href="https://redirect.github.com/storybookjs/storybook/pull/35600">#35600</a>, thanks <a href="https://github.com/brandonroberts"><code>@brandonroberts</code></a>!</li> <li>Refactor: Update getVersionedPackages method to handle non-Storybook packages correctly - <a href="https://redirect.github.com/storybookjs/storybook/pull/35769">#35769</a>, thanks <a href="https://github.com/valentinpalkovic"><code>@valentinpalkovic</code></a>!</li> </ul> <h2>10.5.6</h2> <ul> <li>Dependencies: Pin <code>@testing-library/jest-dom</code> to <code>6.9.1</code> - <a href="https://redirect.github.com/storybookjs/storybook/pull/35614">#35614</a>, thanks <a href="https://github.com/ndelangen"><code>@ndelangen</code></a>!</li> <li>ESLint Plugin: Add plugin meta and document oxlint usage - <a href="https://redirect.github.com/storybookjs/storybook/pull/35655">#35655</a>, thanks <a href="https://github.com/yannbf"><code>@yannbf</code></a>!</li> <li>Vue: Skip docgen for module ids carrying a query - <a href="https://redirect.github.com/storybookjs/storybook/pull/35598">#35598</a>, thanks <a href="https://github.com/seanogdev"><code>@seanogdev</code></a>!</li> </ul> <h2>10.5.5</h2> <ul> <li>CLI: Update AI setup instructions to msw-storybook-addon v3 - <a href="https://redirect.github.com/storybookjs/storybook/pull/35512">#35512</a>, thanks <a href="https://github.com/yannbf"><code>@yannbf</code></a>!</li> <li>Core: Upgrade <code>ws</code> to fix security advisories - <a href="https://redirect.github.com/storybookjs/storybook/pull/35584">#35584</a>, thanks <a href="https://github.com/ndelangen"><code>@ndelangen</code></a>!</li> <li>ReactNative: Telemetry framework detection fix - <a href="https://redirect.github.com/storybookjs/storybook/pull/35560">#35560</a>, thanks <a href="https://github.com/ndelangen"><code>@ndelangen</code></a>!</li> <li>SyntaxHighlighter: Fix PrismJS dark mode mismatch - <a href="https://redirect.github.com/storybookjs/storybook/pull/35541">#35541</a>, thanks <a href="https://github.com/hxy-asdw"><code>@hxy-asdw</code></a>!</li> <li>TanStack: Preserve explicit route ids on pathful clones - <a href="https://redirect.github.com/storybookjs/storybook/pull/35499">#35499</a>, thanks <a href="https://github.com/unpunnyfuns"><code>@unpunnyfuns</code></a>!</li> <li>TanStack: Resolve mock redirects through Vite's resolver - <a href="https://redirect.github.com/storybookjs/storybook/pull/35501">#35501</a>, thanks <a href="https://github.com/unpunnyfuns"><code>@unpunnyfuns</code></a>!</li> <li>TanStack: Respect routeOverrides component overrides in stories - <a href="https://redirect.github.com/storybookjs/storybook/pull/35497">#35497</a>, thanks <a href="https://github.com/unpunnyfuns"><code>@unpunnyfuns</code></a>!</li> </ul> <h2>10.5.4</h2> <ul> <li>ReactNative: Telemetry framework detection fix - <a href="https://redirect.github.com/storybookjs/storybook/pull/35560">#35560</a>, thanks <a href="https://github.com/ndelangen"><code>@ndelangen</code></a>!</li> <li>SyntaxHighlighter: Fix PrismJS dark mode mismatch - <a href="https://redirect.github.com/storybookjs/storybook/pull/35541">#35541</a>, thanks <a href="https://github.com/hxy-asdw"><code>@hxy-asdw</code></a>!</li> </ul> <h2>10.5.3</h2> <ul> <li>Dependencies: Upgrade TypeScript to 6.0.3 - <a href="https://redirect.github.com/storybookjs/storybook/pull/34971">#34971</a>, thanks <a href="https://github.com/valentinpalkovic"><code>@valentinpalkovic</code></a>!</li> </ul> <h2>10.5.2</h2> <ul> <li>TanStack: Fix createServerFn validator mock - <a href="https://redirect.github.com/storybookjs/storybook/pull/35185">#35185</a>, thanks <a href="https://github.com/sjh9714"><code>@sjh9714</code></a>!</li> <li>TanStack: Support pathless layout routes (id-only) in story routing - <a href="https://redirect.github.com/storybookjs/storybook/pull/35465">#35465</a>, thanks <a href="https://github.com/unpunnyfuns"><code>@unpunnyfuns</code></a>!</li> <li>Tanstack-react: Add missing Hydrate export - <a href="https://redirect.github.com/storybookjs/storybook/pull/35111">#35111</a>, thanks <a href="https://github.com/arun-357"><code>@arun-357</code></a>!</li> <li>Tanstack-react: Keep JSX-only component references during dead-code elimination - <a href="https://redirect.github.com/storybookjs/storybook/pull/35206">#35206</a>, thanks <a href="https://github.com/yatishgoel"><code>@yatishgoel</code></a>!</li> <li>Vitest: Fix coverage toggle crash on Vite 6 by clearing closed Vitest instance on restart - <a href="https://redirect.github.com/storybookjs/storybook/pull/35461">#35461</a>, thanks <a href="https://github.com/yannbf"><code>@yannbf</code></a>!</li> </ul> <h2>10.5.1</h2> <ul> <li>Angular-Vite: Drop <code>@angular/platform-browser-dynamic</code> peer dependency - <a href="https://redirect.github.com/storybookjs/storybook/pull/35457">#35457</a>, thanks <a href="https://github.com/valentinpalkovic"><code>@valentinpalkovic</code></a>!</li> <li>Angular-Vite: Widen TypeScript peer dependency range to support TypeScript 6 - <a href="https://redirect.github.com/storybookjs/storybook/pull/35455">#35455</a>, thanks <a href="https://github.com/valentinpalkovic"><code>@valentinpalkovic</code></a>!</li> <li>Core: Include chromatic packages in ecosystem identifier - <a href="https://redirect.github.com/storybookjs/storybook/pull/35170">#35170</a>, thanks <a href="https://github.com/yannbf"><code>@yannbf</code></a>!</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/storybookjs/storybook/commit/6ef7d1ae816ebd5fb8bf84b8dec7d4a92410d73c"><code>6ef7d1a</code></a> Bump version from "10.5.7" to "10.5.8" [skip ci]</li> <li><a href="https://github.com/storybookjs/storybook/commit/647e982151f1bb4e15163b0d2a31c5a1022efda3"><code>647e982</code></a> Merge pull request <a href="https://github.com/storybookjs/storybook/tree/HEAD/code/frameworks/react-vite/issues/35743">#35743</a> from storybookjs/norbert/revive-34415-file-aware-ts...</li> <li><a href="https://github.com/storybookjs/storybook/commit/7c6fb3a5ecf4495d73de6d70f802251934e079bd"><code>7c6fb3a</code></a> Bump version from "10.5.6" to "10.5.7" [skip ci]</li> <li><a href="https://github.com/storybookjs/storybook/commit/43f2316559b30948d9ef724e5cb3140ddeca8867"><code>43f2316</code></a> Merge pull request <a href="https://github.com/storybookjs/storybook/tree/HEAD/code/frameworks/react-vite/issues/35490">#35490</a> from storybookjs/valentin/remove-tsconfig-baseurl</li> <li><a href="https://github.com/storybookjs/storybook/commit/3126f0a14a351e971679f61cd0bd5609d086ed57"><code>3126f0a</code></a> Bump version from "10.5.5" to "10.5.6" [skip ci]</li> <li><a href="https://github.com/storybookjs/storybook/commit/05a52b7a888c6b85c3f8aa6765ed9a0a69a79e4c"><code>05a52b7</code></a> Bump version from "10.5.4" to "10.5.5" [skip ci]</li> <li><a href="https://github.com/storybookjs/storybook/commit/3327dc44697304275e28ceaa2cd34d9bede4e333"><code>3327dc4</code></a> Bump version from "10.5.3" to "10.5.4" [skip ci]</li> <li><a href="https://github.com/storybookjs/storybook/commit/9ac273930a49ad33b6a331f1f36dc472f5c36054"><code>9ac2739</code></a> Bump version from "10.5.2" to "10.5.3" [skip ci]</li> <li><a href="https://github.com/storybookjs/storybook/commit/b4b00f27662caf7328330b5ab47e9b903218f43a"><code>b4b00f2</code></a> Merge pull request <a href="https://github.com/storybookjs/storybook/tree/HEAD/code/frameworks/react-vite/issues/34971">#34971</a> from storybookjs/valentin/upgrade-typescript-6</li> <li><a href="https://github.com/storybookjs/storybook/commit/518f711cb367d8df184be22f1fab9a218b2743df"><code>518f711</code></a> Bump version from "10.5.1" to "10.5.2" [skip ci]</li> <li>Additional commits viewable in <a href="https://github.com/storybookjs/storybook/commits/v10.5.8/code/frameworks/react-vite">compare view</a></li> </ul> </details> <br /> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Priya Raman <priya@paperclip.ing> Co-authored-by: Paperclip <noreply@paperclip.ing> |