Gustavo Madeira Santana
4c52731051
fix(ci): parse quoted pnpm snapshot keys
2026-04-14 21:15:43 -04:00
Gustavo Madeira Santana
da43277cc9
fix(ci): make pnpm audit hook dependency-free
2026-04-14 21:12:26 -04:00
Vincent Koc
55ee327981
fix(ci): replace retired pnpm audit hook
2026-04-15 01:10:07 +01:00
Vincent Koc
0329ec40db
ci(tests): split agentic node shard into three lanes
2026-04-15 00:55:41 +01:00
Peter Steinberger
5ed9016914
fix: narrow a2ui bundle hash inputs
2026-04-15 00:46:40 +01:00
Vincent Koc
f1c2be7d32
fix(ci): slim build-artifacts dist producer
2026-04-15 00:13:01 +01:00
Vincent Koc
58d0c179d7
fix(ci): split agentic node shard by runtime shape
2026-04-14 23:22:08 +01:00
Gustavo Madeira Santana
82a2db71e8
refactor(qa): split Matrix QA into optional plugin ( #66723 )
...
Merged via squash.
Prepared head SHA: 27241bd089
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com >
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com >
Reviewed-by: @gumadeiras
2026-04-14 16:28:57 -04:00
Vincent Koc
fdbb0fb561
fix(ci): trim dist fanout from source-only node shards
2026-04-14 20:52:18 +01:00
Peter Steinberger
1795a426c9
fix: prune stale root chunks before rebuilds
2026-04-14 15:19:31 +01:00
Frank Yang
d86527d8c6
fix(whatsapp): harden Baileys media upload hotfix ( #65966 )
...
Merged via squash.
Prepared head SHA: b5db59b8fe
Co-authored-by: frankekn <4488090+frankekn@users.noreply.github.com >
Co-authored-by: frankekn <4488090+frankekn@users.noreply.github.com >
Reviewed-by: @frankekn
2026-04-14 21:34:23 +08:00
Peter Steinberger
1277294293
test: drop removed agent scope suppression
2026-04-13 20:49:39 -07:00
Peter Steinberger
0eebb49fef
test: enforce npm pack budget in install smoke
2026-04-14 04:05:12 +01:00
Peter Steinberger
44da6d2e90
build: prune runtime dependency type declarations
2026-04-14 03:17:46 +01:00
Peter Steinberger
224cbd9ff6
chore(release): prepare 2026.4.14 beta
2026-04-14 03:06:46 +01:00
Gustavo Madeira Santana
b5dcc11273
plugins: trim staged runtime cargo
2026-04-13 18:10:40 -04:00
Vincent Koc
ea25cf2595
fix(ci): unblock discord boundary typing
2026-04-13 22:37:24 +01:00
Vincent Koc
21ca387eda
fix(ci): verify bundled plugin runtime deps
2026-04-13 11:09:13 +01:00
Peter Steinberger
ad7f605a6d
fix(plugins): tolerate bundled peer resolution
2026-04-13 00:20:52 +01:00
Peter Steinberger
d77360c076
fix(plugins): restore missing native runtime deps
2026-04-13 00:20:52 +01:00
Peter Steinberger
e4841d767d
test: stabilize loaded full-suite checks
2026-04-12 11:52:56 -07:00
Peter Steinberger
512bf8d365
fix: make A2UI hash ordering deterministic
2026-04-12 11:41:24 -07:00
Nimrod Gutman
c247e36664
feat(test): use host-aware local full-suite defaults ( #65264 )
...
* feat(test): use host-aware local full-suite defaults
* fix(test): remove undefined local profile host info
2026-04-12 12:46:20 +03:00
Vincent Koc
812e493ef5
fix(lint): skip heavy-check lock for extra metadata commands
2026-04-12 05:39:34 +01:00
Vincent Koc
33929c477c
fix(lint): skip heavy-check lock for oxlint metadata
2026-04-12 05:37:52 +01:00
Peter Steinberger
6709589117
test: harden npm install docker smoke
2026-04-11 21:36:45 -07:00
Vincent Koc
d62279a9b2
fix(tsgo): skip heavy-check lock for metadata commands
2026-04-12 05:35:52 +01:00
Vincent Koc
95e7af3213
fix(lint): skip heavy-check lock for explicit oxlint files
2026-04-12 05:32:52 +01:00
Vincent Koc
c05cf3493a
fix(test): skip heavy-check lock for scoped tooling targets
2026-04-12 05:28:43 +01:00
Vincent Koc
2069c85b34
fix(test): skip heavy-check lock for scoped tooling runs
2026-04-12 05:25:48 +01:00
Vincent Koc
0acfa47e08
fix(tooling): commit hook-restaged file contents
2026-04-12 05:19:56 +01:00
Vincent Koc
69be261a87
fix(tooling): add committer help output
2026-04-12 05:15:26 +01:00
Vincent Koc
97b0846746
fix(tooling): add fast mode to committer helper
2026-04-12 05:10:36 +01:00
Vincent Koc
fbac18a1fc
test(tooling): share bundled channel entry scan
2026-04-12 04:53:48 +01:00
Vincent Koc
ccf29464db
test(scripts): share ios fixture setup
2026-04-12 04:51:18 +01:00
Vincent Koc
329bba6cca
fix(test): include vitest lane labels in timeout logs
2026-04-12 04:39:25 +01:00
Vincent Koc
f466435529
fix(test): add opt-in vitest no-output watchdog
2026-04-12 04:32:03 +01:00
Peter Steinberger
788c37a6c2
chore(release): prepare 2026.4.11-beta.1
2026-04-11 16:10:13 +01:00
Peter Steinberger
a8284e39de
build(canvas): stabilize a2ui bundle inputs
2026-04-11 14:19:25 +01:00
Vincent Koc
2d4209c1bf
test(ci): align node shard check names
2026-04-11 12:03:16 +01:00
Vincent Koc
7899f5c5ce
fix(dev): throttle local tsgo by default
2026-04-11 11:56:23 +01:00
Vincent Koc
9e2e4cde19
ci(test): align node lane names with boundary split
2026-04-11 00:36:06 +01:00
Tak Hoffman
f16a66fa43
fix: release local heavy-check locks on success
2026-04-10 17:05:26 -05:00
Peter Steinberger
59925c1a74
chore: update dependencies and oxc tooling
2026-04-10 19:28:42 +01:00
Peter Steinberger
be9bef32df
perf: cache local tsgo checks
2026-04-10 17:06:28 +01:00
Peter Steinberger
e9fb4c7f93
perf: skip tsgo declaration transforms
2026-04-10 15:52:07 +01:00
Peter Steinberger
2ccb5cff22
test: move Vitest configs under test
2026-04-10 13:44:51 +01:00
Peter Steinberger
64f2b20963
test: isolate sharding default env
2026-04-10 13:43:25 +01:00
Peter Steinberger
e462e531ad
test: keep runtime staging fallback assertion on symlink path
2026-04-10 09:57:27 +01:00
Davanum Srinivas
08ae021d1f
fix(qqbot): guard image-size probe against SSRF ( #63495 )
...
* fix(qqbot): replace raw fetch in image-size probe with SSRF-guarded fetchRemoteMedia
Replace the bare fetch() in getImageSizeFromUrl() with fetchRemoteMedia()
from the plugin SDK, closing the blind SSRF via markdown image dimension
probing (GHSA-2767-2q9v-9326).
fetchRemoteMedia options: maxBytes 65536, maxRedirects 0, generic
public-network-only SSRF policy (no hostname allowlist, blocks
private/reserved/loopback/link-local/metadata IPs after DNS resolution).
Also fixes the repo-root resolution in scripts/lib/ts-guard-utils.mjs
which caused lint:tmp:no-raw-channel-fetch to miss extension files
entirely. The guard now walks up to .git instead of hardcoding two parent
traversals, and the allowlist is refreshed with all pre-existing raw
fetch callsites that became visible.
* fix(qqbot): guard image-size probe against SSRF (#63495 ) (thanks @dims)
---------
Co-authored-by: sliverp <870080352@qq.com >
2026-04-09 16:48:04 +08:00