This repository was archived by the owner on Jul 14, 2026. It is now read-only.
Repository navigation
chore: update changelog - #13911
Closed
owncloud-calens-bot[bot] wants to merge 89 commits into
Closed
chore: update changelog#13911owncloud-calens-bot[bot] wants to merge 89 commits into
owncloud-calens-bot[bot] wants to merge 89 commits into
Conversation
…dOS (#13816) * fix(web-app-pdf-viewer): [OCISDEV-878] display open button on iOS/iPadOS On iOS/iPadOS, we now display a button to open the PDF file in the browser instead of the native PDF viewer. This is a workaround to avoid issues with the native PDF viewer on iOS/iPadOS. Signed-off-by: Lukas Hirt <info@hirt.cz> * test(web-app-pdf-viewer): add unit tests Signed-off-by: Lukas Hirt <info@hirt.cz> --------- Signed-off-by: Lukas Hirt <info@hirt.cz>
chore: update translations from transifex
The MFA expiry worker and broadcast channel were initialized unconditionally at startup. Now they are lazily created only when the vault capability is enabled and a session duration is configured, preventing the expiry warning from firing when vault mode is off. Also replaced `self` with `globalThis` in the worker as SonarQube was flagging the deprecated `self` reference.
When opening the vault for the first time, the user is redirected to an external IdP for 2FA. Upon returning, the OIDC callback URL contains no vault context, causing the regular theme to be applied instead of the vault theme. We now also check the stored post-login redirect URL during the OIDC callback to correctly detect vault mode. Signed-off-by: Lukas Hirt <info@hirt.cz>
…a-dialog-only-when-vault-is-enabled fix: gate MFA expiry dialog on vault capability
…13835) The space header image did not have explicit width and height causing the image to overflow its container. Adding explicit width and height with values of 100% makes sure that the image stays within the boundaries of the container. Signed-off-by: Lukas Hirt <info@hirt.cz>
* chore: bump version to 12.4.0 * chore: use whitelisted calens version
…y-workflow ci: create nightly workflow and extract build/e2e into reusable workf…
chore: update translations from transifex
Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup) from 5.0.0 to 6.0.8. - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](pnpm/action-setup@fc06bc1...0e279bb) --- updated-dependencies: - dependency-name: pnpm/action-setup dependency-version: 6.0.8 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…3834) The topbar logo was not visible in Firefox because the SVG files lacked explicit `width` and `height` attributes. Firefox requires these attributes to establish intrinsic dimensions when loading SVGs via `<img>`; without them it renders the image as 0×0. Chrome infers the dimensions from `viewBox` alone. Signed-off-by: Lukas Hirt <info@hirt.cz>
chore: update translations from transifex
* fix(e2e): [OCISDEV-843] Use correct listType for search results after pressing Enter * fix(e2e): [OCISDEV-843] Keeps resourcePage.searchList as the correct listType * fix(e2e): [OCISDEV-843] Using the filesList fix for listType
Co-authored-by: owncloud-calens-bot[bot] <276982735+owncloud-calens-bot[bot]@users.noreply.github.com>
…ching and cancel button visibility (#13843) Clear previous theme's custom properties before applying the new theme so old values don't persist. Treat empty token strings as unset by removing the property instead of setting it to blank. Also fix the cancel button in the password protected folder modal being invisible against the dark action bar background.
…me-csrf fix(web-pkg): [OCISDEV-777] validate postMessage origin in embed mode…
Co-authored-by: owncloud-calens-bot[bot] <276982735+owncloud-calens-bot[bot]@users.noreply.github.com>
Co-authored-by: owncloud-translations-bot[bot] <274778013+owncloud-translations-bot[bot]@users.noreply.github.com>
… updates (#13897) Bumps the minor-and-patch group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [pnpm/action-setup](https://github.com/pnpm/action-setup) | `6.0.8` | `6.0.9` | | [actions/setup-node](https://github.com/actions/setup-node) | `6.3.0` | `6.4.0` | | [docker/login-action](https://github.com/docker/login-action) | `4.1.0` | `4.2.0` | | [docker/metadata-action](https://github.com/docker/metadata-action) | `6.0.0` | `6.1.0` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `7.1.0` | `7.2.0` | | [actionhippie/calens](https://github.com/actionhippie/calens) | `1.13.3` | `1.14.0` | Updates `pnpm/action-setup` from 6.0.8 to 6.0.9 - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](pnpm/action-setup@0e279bb...0ebf471) Updates `actions/setup-node` from 6.3.0 to 6.4.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@53b8394...48b55a0) Updates `docker/login-action` from 4.1.0 to 4.2.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@4907a6d...650006c) Updates `docker/metadata-action` from 6.0.0 to 6.1.0 - [Release notes](https://github.com/docker/metadata-action/releases) - [Commits](docker/metadata-action@030e881...80c7e94) Updates `docker/build-push-action` from 7.1.0 to 7.2.0 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@bcafcac...f9f3042) Updates `actionhippie/calens` from 1.13.3 to 1.14.0 - [Release notes](https://github.com/actionhippie/calens/releases) - [Changelog](https://github.com/actionhippie/calens/blob/master/CHANGELOG.md) - [Commits](actionhippie/calens@47874e0...e917050) --- updated-dependencies: - dependency-name: pnpm/action-setup dependency-version: 6.0.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: actions/setup-node dependency-version: 6.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: docker/login-action dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: docker/metadata-action dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: docker/build-push-action dependency-version: 7.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: actionhippie/calens dependency-version: 1.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
owncloud-calens-bot
Bot
force-pushed
the
chore/changelog-update
branch
from
June 26, 2026 09:56
e334b3b to
bea84e9
Compare
|
|
owncloud-calens-bot
Bot
force-pushed
the
chore/changelog-update
branch
from
June 26, 2026 09:56
bea84e9 to
83086ad
Compare
…appear (#13884) The "search list" assertions poll getDisplayedResourcesFromSearch, which only re-reads the global search dropdown DOM. The dropdown is populated by a single, debounced query (see `watch(term)` in SearchBar.vue) issued once when the search step runs. If a resource is still being indexed by tika at that moment, it never appears in the dropdown, and re-reading the same one-shot result list can never surface it — so the 30s poll dead-waits and times out. This is the root cause behind OCISDEV-843. The previous fixes worked around it for the single Unicode `strängéनेपालीName` case (extra sleeps, then moving that one assertion to the full results page / files list), but ~18 other `searchList` assertions still poll the one-shot dropdown and remain latently flaky. Re-issue the search on every poll iteration for the search list: clear and re-fill the existing keyword. Clearing forces a term change so the debounced watcher re-runs the query even for the same keyword, and not reloading the page preserves the active location filter. Each poll then reflects the current index state, so resources that finish indexing after the initial query are picked up. Signed-off-by: David Walter <david.walter@kiteworks.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
owncloud-calens-bot
Bot
force-pushed
the
chore/changelog-update
branch
2 times, most recently
from
June 26, 2026 09:59
f373698 to
4a25abb
Compare
DeepDiver1975
left a comment
DeepDiver1975
left a comment
Contributor
There was a problem hiding this comment.
Automated maintainer review (Claude Code agent).
LGTM — this is a calens-generated changelog regeneration. The diff touches only CHANGELOG.md: it adds the [12.4.1] (2026-06-18) release section assembled from the existing unreleased fragments (plus a backfill of the [12.4.0] section) and updates the compare link. No source code, config, or fragment files are modified, so there is no functional risk — the content is mechanically derived from fragments already merged on this branch.
- mergeable=MERGEABLE, mergeStateStatus=BLOCKED (awaiting required checks/review — expected).
- changelog: this PR is the changelog update (present / n-a).
Note on the duplicate: PR #13910 carries the identical head SHA (4a25abb) and head branch (chore/changelog-update) but targets master. A 12.4.1 release changelog belongs on the release line, so #13911 (base stable-12.4) is the canonical PR; #13910 looks like a mis-based duplicate of the same regeneration and should likely be closed (or re-based) to avoid landing the 12.4.1 release section onto master.
No merge action taken (review-only).
owncloud-calens-bot
Bot
force-pushed
the
chore/changelog-update
branch
from
June 26, 2026 11:15
4a25abb to
cd0e3fd
Compare
DeepDiver1975
left a comment
DeepDiver1975
left a comment
Contributor
There was a problem hiding this comment.
Automated maintainer review (Claude Code review agent).
Scope verified — changelog-only. This PR touches exactly one file, CHANGELOG.md (+187/-3), regenerating the rendered changelog for the 12.4.2 release (and backfilling the 12.4.1 / 12.4.0 sections) from calens fragments. No source/code changes, no behavioral risk. This is the expected calens-bot output and the changelog content is correct → changelog present.
Mergeability. mergeable=MERGEABLE, mergeStateStatus=BLOCKED. The BLOCK is from the security/snyk check reporting failures (8 pre-existing dependency tests) — unrelated to this changelog-only diff; functional checks (build, check-tests-passed, changelog generation, SonarCloud, CLA, semantic-commit validation) are green. Base branch is correctly stable-12.4.
Duplicate pair note. PR #13910 carries the same head SHA (cd0e3fd) but is based on master instead of stable-12.4, and is CONFLICTING / DIRTY (84 changed files, +1111/-370) — the mis-based, non-mergeable duplicate. #13911 (this PR, base stable-12.4) is the canonical, mergeable one; #13910 should be closed in favor of this one.
Verdict: looks good as a changelog regeneration. Leaving merge to a human maintainer.
owncloud-calens-bot
Bot
force-pushed
the
chore/changelog-update
branch
2 times, most recently
from
June 29, 2026 15:28
0ed8da0 to
e84ec16
Compare
owncloud-calens-bot
Bot
force-pushed
the
chore/changelog-update
branch
from
June 29, 2026 15:29
e84ec16 to
0409920
Compare
Contributor
|
Mis-based duplicate of #13910 (same head SHA / branch 🤖 Generated with Claude Code |
owncloud-calens-bot
Bot
force-pushed
the
chore/changelog-update
branch
from
June 30, 2026 09:01
0409920 to
14db3e9
Compare
owncloud-calens-bot
Bot
force-pushed
the
chore/changelog-update
branch
2 times, most recently
from
June 30, 2026 19:06
38d323b to
60c9bf3
Compare
Co-authored-by: owncloud-translations-bot[bot] <274778013+owncloud-translations-bot[bot]@users.noreply.github.com>
owncloud-calens-bot
Bot
force-pushed
the
chore/changelog-update
branch
from
July 1, 2026 07:31
60c9bf3 to
d228462
Compare
* docs(web-app-html-editor): record Phase 1 archaeology and decisions Document how an oCIS editor app actually works before writing code: apps register by file extension (not MIME type), and AppWrapper already provides the WebDAV load/save, dirty tracking, Ctrl+S, unsaved-changes guard and error toasts. Record the editor-library, preview-sandboxing, layout and registration decisions, each citing the Phase 1 file it relies on. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: David Walter <david.walter@kiteworks.com> * feat(web-app-html-editor): scaffold package and register the app Mirror the text-editor package layout (package.json, vitest config, l10n) and add CodeMirror 6 (already resolved in the lockfile via web-pkg) as direct deps. Enable the app by adding "html-editor" to the default and sample-ocis configs; the build auto-discovers it by its web-app-* directory name. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: David Walter <david.walter@kiteworks.com> * feat(web-app-html-editor): implement editor, sandboxed preview and view modes Register for the html, htm and xhtml extensions and route through AppWrapper, so WebDAV load/save, dirty state, Ctrl+S and the unsaved-changes guard are inherited. App.vue is a thin shell that binds currentContent and emits update:currentContent; it composes a CodeMirror 6 source editor (HTML mode, themed via ODS tokens), a sandboxed srcdoc iframe preview (no allow-same-origin), and a view-mode toolbar (Editor | Split | Preview) laid out with CSS grid. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: David Walter <david.walter@kiteworks.com> * test(web-app-html-editor): unit tests for app, editor, preview and toolbar Cover the app wiring (re-emits edits, switches view mode, debounces the preview), the CodeMirror pane (renders, emits on change, applies external content), the preview pane (srcdoc, sandbox without allow-same-origin, no referrer) and the toolbar (active mode, emits changeMode). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: David Walter <david.walter@kiteworks.com> * fix(web-app-html-editor): harden preview sandboxing after security review An adversarial security review (SECURITY-REVIEW.md) confirmed the design is sound against the primary threat (a victim opening an attacker-controlled HTML file): the opaque-origin iframe plus bearer-token-in-JS auth prevent token theft, parent-origin XSS and acting as the victim. This tightens the residual low/info findings: - Reduce the iframe sandbox to "allow-scripts" only. allow-forms and allow-popups added no value for a preview but enabled zero-click phishing / external form-POST beaconing from the opaque-origin frame; dropping them removes the vector. - Inject a strict, self-contained CSP into the preview srcdoc (default-src 'none'; form-action 'none'; base-uri 'none'; inline script/style and data:/blob: only) so the preview is network-isolated and not reliant on the deployment proxy CSP. - Pause the live preview for large files until the user opts in, so a huge or hostile document cannot freeze the tab on open. - Pin the full sandbox contract (exact token set + srcdoc-not-src) in tests so a future change cannot silently loosen the one control everything depends on. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: David Walter <david.walter@kiteworks.com> * docs(changelog): add unreleased entry for the HTML editor app #13895 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: David Walter <david.walter@kiteworks.com> * fix(web-app-html-editor): drop duplicated index boilerplate SonarCloud flagged the appInfo.extensions map and the app-switcher menu-item block in index.ts as duplicated against web-app-text-editor (new-code duplication over the 3% gate). Assign the already-typed fileExtensions directly instead of re-mapping them, and drop the app-switcher launcher entry: it was copied boilerplate and is not needed for v1. Users can still create a new HTML file from the Files "New" menu via the extension's newFileMenu. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: David Walter <david.walter@kiteworks.com> * test(web-app-html-editor): drop fake timers from the preview-debounce test The shared unit-test run (vitest projects) went red on web-pkg's @vitest/web-worker tests with timeouts only after this package was added, and the symptom (worker callbacks never firing) matches fake timers being active during real-timer async. Rewrite the debounce assertion to use real timers and a short wait so this test project cannot influence timer state in the shared run. No change to behavior under test. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: David Walter <david.walter@kiteworks.com> * fix: pin vitest to a single version to unbreak web-pkg worker tests Adding the html-editor package regenerated the lockfile, which let vitest ('^4.1.5') float to 4.1.6 while @vitest/web-worker and @vitest/coverage-v8 stay pinned at 4.1.5. That resolved a second vitest@4.1.5 copy into web-pkg, so @vitest/web-worker and the test runner loaded different vitest module instances and the webWorker specs (exportAsPdfWorker, pasteWorker, restoreWorker) hung until the 5s timeout. Pin vitest to 4.1.6 via pnpm overrides so the whole workspace resolves a single vitest, matching master's (green) topology. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: David Walter <david.walter@kiteworks.com> * fix(web-app-html-editor): harden preview CSP injection and large-file guard Address review findings: - Security: wrapWithPreviewCsp() matched <head>/<html> with a raw regex, so a crafted '<!-- <head> -->' could divert the CSP <meta> into a commented-out tag and leave the rendered preview without its self-protecting CSP. Matching now skips HTML comments and injects into the first real head/html. - Security: renderLargeAnyway was never reset, so a single 'show preview anyway' opt-in permanently disabled the large-file pause; a later external content change could auto-render another large/hostile document. The guard now re-arms on every content change. - Bug: the large-content watch path cleared previewContent but left a queued debounce timer that could still render the oversized content; it is now cancelled. - Bug: opting in now renders synchronously instead of through the 250ms debounce, so the preview pane no longer mounts empty. - Cleanup: de-duplicate the 'HTML file' label/menuTitle. Adds regression tests for the comment-evasion and guard re-arm behaviour. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: David Walter <david.walter@kiteworks.com> * style(web-app-html-editor): fix prettier formatting in app.spec.ts Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: David Walter <david.walter@kiteworks.com> * fix(web-app-html-editor): address preview-CSP and editor review feedback - preview CSP: prepend the <meta> as the document's first bytes rather than inserting it into the discovered <head>. The first CSP meta wins and governs every resource after it, so prepending covers the whole document — including any element placed before a real or commented-out <head> that head-insertion left outside the policy and free to beacon. Removes the head-detection helper: a pure string prepend has no parsing logic for hostile markup to defeat. - preview CSP: allow blob: for font-src symmetrically with img-src/media-src (a blob: URL is a local, non-network source minted by the sandboxed frame and cannot exfiltrate). - editor: drop the optional-chaining accommodation for an undefined theme store; the store is always present, and the dark-mode watch now tracks a real reactive dependency. The test mock provides a real-shaped currentTheme ref and exercises the dark-mode reconfigure path. - index: enforce FILE_SIZE_LIMIT > PREVIEW_SIZE_LIMIT with a load-time assertion so the AppWrapper open limit and the preview-pause limit cannot silently disagree. - docs: record the prepend rationale and the frame self-navigation residual risk (F11) in SECURITY-REVIEW.md / DECISIONS.md. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: David Walter <david.walter@kiteworks.com> --------- Signed-off-by: David Walter <david.walter@kiteworks.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
owncloud-calens-bot
Bot
force-pushed
the
chore/changelog-update
branch
from
July 1, 2026 12:57
d228462 to
c49195e
Compare
|
Collaborator
|
Web repo is going to be archived and will no longer accept new PRs. Please, use owncloud/ocis repository instead. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated changelog update via Calens. This pull request is updated on each push to
stable-12.4— merging it will close it and a fresh one will be opened on the next change.