mirror of
https://github.com/ankitects/anki.git
synced 2026-09-10 14:38:10 -04:00
dependabot/uv/gitpython-3.1.59
12501 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
dependabot[bot]
|
fee46e1100 |
chore(deps): bump gitpython from 3.1.57 to 3.1.59
Bumps [gitpython](https://github.com/gitpython-developers/GitPython) from 3.1.57 to 3.1.59. - [Release notes](https://github.com/gitpython-developers/GitPython/releases) - [Changelog](https://github.com/gitpython-developers/GitPython/blob/main/CHANGES) - [Commits](https://github.com/gitpython-developers/GitPython/compare/3.1.57...3.1.59) --- updated-dependencies: - dependency-name: gitpython dependency-version: 3.1.59 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
Caleb_Meadows
|
0842216571 |
fix: preserve FSRS unlock timeout across mounts (#5536)
## Linked issue (required) Fixes #5516 ## Summary / motivation (required) Make the existing FSRS parameter unlock timing API available before the parameter editor is mounted, and retain the host's chosen timeout when FSRS is disabled and enabled again. Register the API and store its timeout in the component's module script; keep click tracking local to each editor instance. ## Steps to reproduce (required, use N/A if not applicable) 1. Open the deck-options page with FSRS disabled. 2. In that page's JavaScript console, run `anki.setParameterUnlockClickTimeoutMs(1000)`. 3. Before this fix, the call throws `TypeError: anki.setParameterUnlockClickTimeoutMs is not a function`. ## How to test (required) ### Checklist (minimum) - [x] I ran `just check` locally. - [x] I added a browser regression for the changed behavior. ### Details - The regression failed on the original implementation at the pre-mount setter call and passes with the fix. - It checks configuration before the first mount, retention across remounts, updates while absent and present, the three-click gate, the default timeout, and reset after page reload. Playwright's clock controls the click intervals. - `just test-ts`: 61 tests passed. - `just test-e2e`: 27 tests passed, using the repository's disposable Anki harness. - `just check`: passed, including 572 Rust tests and the Python, formatting, lint, and type checks. - The Qt checks emitted an audio-thread warning (`mw` was `None` in `qt/aqt/sound.py`); all 93 Qt tests passed and `just check` exited successfully. ## Before / after behavior (optional) Before: the API exists only after the editor mounts, and mounting a new editor resets the timeout to 500 ms. After: the API exists when the deck-options JavaScript loads, and the selected timeout lasts for the page's lifetime. ## Risk / compatibility / migration (optional) Existing API names, the 500 ms default, and the three-click requirement are preserved. Click counts and pending timers remain local to each editor. No stored data or scheduling behavior changes. ## UI evidence (required for visual changes; otherwise N/A) N/A. ## Scope - [x] This PR is focused on one change. Developed with assistance from Codex. |
||
|
Fernando Lins
|
bfad9474d4 |
test: cover the decks service layer (#5514)
## Linked issue Closes #5383 ## Summary / motivation `rslib/src/decks/service.rs`: the Protobuf entry point for all deck operations, it had 0% test coverage. This PR adds a golden `#[cfg(test)]` suite that exercises the happy path, error paths, boundary cases, and key invariants of the `DecksService` layer and its proto↔domain conversions. No production code was changed: the module is a thin routing/conversion layer with no logic that warranted refactoring. Testing at this boundary is additive rather than duplicative: `reparent_decks`, `remove_decks_and_child_decks` and the proto↔domain conversions had no direct unit tests before. Coverage of `decks/service.rs` goes from **0% → ~99.7% of lines** ## How to test ### Details - `just check` passes (fmt, clippy, rust_test, and the rest of the suite). - Run just this module: `cargo test -p anki decks::service::tests`. - Coverage inspected with `just test-rust --coverage --html` - `decks/service.rs` reports ~99.7% line coverage. Scenarios covered: - proto↔domain conversions: full-field `Deck` round trip for both kinds, `missing kind → InvalidInput`, `FilteredDeckForUpdate` field preservation and `config: None → default`. - create/retrieve, update (common + kind-specific persistence), rename with descendant cascade, delete + card removal, reparent (incl. `new_parent == 0`). - name/tree listing: `include_filtered`, empty vs non-empty default skipping, child-name filtering, `deck_tree` counts by `now`, legacy tree JSON. - current deck, collapsed-scope isolation, legacy JSON paths (incl. `preserve_usn_and_mtime`), and filtered-deck build. - Error paths assert the specific `AnkiError` variant (`NotFound` / `InvalidInput`), not just `is_err()`. |
||
|
Abdo
|
39a36fc47c |
test: Improve coverage of notes service (#5509)
## Linked issue Closes #5386 ## Summary This increases test coverage of `rslib/src/notes/service.rs` and some related modules (`rslib/src/adding.rs` and `rslib/src/notes/mod.rs`). ## How to test Run `just test-rust --coverage --html` and view coverage reports. |
||
|
Abdo
|
b758186f25 |
fix: Add compatibility shims for AnkiPackageImporter/AnkiPackageExporter (#5547)
## Linked issue Closes #5541 ## Summary Add compatibility wrappers for AnkiPackageImporter/AnkiPackageExporter to redirect the calls to the new APIs. This is intended as a temporary compatibility workaround for the [AnkiConnect](https://ankiweb.net/shared/info/2055492159) add-on, not as a general wrapper for all removed APIs. ## Steps to reproduce (before) Install AnkiConnect and confirm it fails at startup due to the removed `anki.importing` and `anki.exporting` modules. ## How to test (after) Export a sample apkg and run this script in the same directory to test AnkiConnect's importPackage/exportPackage APIs. ```python import json import urllib.request from pathlib import Path def request(action, **params): return {'action': action, 'params': params, 'version': 6} def invoke(action, **params): payload = json.dumps(request(action, **params)).encode('utf-8') response = json.load(urllib.request.urlopen(urllib.request.Request('http://127.0.0.1:8765', payload))) if len(response) != 2: raise Exception('response has an unexpected number of fields') if 'error' not in response: raise Exception('response is missing required error field') if 'result' not in response: raise Exception('response is missing required result field') if response['error'] is not None: raise Exception(response['error']) return response['result'] result = invoke('importPackage', path=str(Path(__file__).parent / 'sample.apkg')) assert result is True decks = invoke('deckNamesAndIds') deck_to_export = next(name for name in decks if name != 'Default') result = invoke('exportPackage', deck=deck_to_export, path=str(Path(__file__).parent / 'exported.apkg'), includeSched=True) assert result is True ``` |
||
|
Abdo
|
43482ea2ae |
feat: Set up fault handler (#5546)
## Linked issue Closes #5542 ## Summary This sets up Python's faulthandler to write tracebacks to the crash.log file in the base folder. ## How to test - Revert #5537 - Run the stress test linked in #5534 on Windows: `out/pyenv/Scripts/python.exe stress_webviews.py`. - Anki should crash after a few iterations and you should see some tracebacks in the out/stress_base/crash.log file. |
||
|
Abdo
|
9f71d0e832 |
feat: Update to Briefcase 0.4.5 (#5545)
## Linked issue Closes #5369 ## Summary This updates to Briefcase 0.4.5 for some improvements: - Fix signal handling (#5369). - Pin Python support packages and stub binaries to known hashes (https://github.com/beeware/briefcase/issues/2980). - Use uv for setting up the Briefcase environment and installing dependencies (https://github.com/beeware/briefcase/issues/2231). ## Steps to reproduce (before) Confirm #5369 is fixed using the example code in the linked forum post. ## How to test (after) - Run `./ninja installer` to test the build. - Run Python tests: `just test-py`. - Test the CI build artifacts: https://github.com/ankitects/anki/actions/runs/34235392781 |
||
|
Abdo
|
b484b79165 |
chore: Update browser compatibility database (#5520)
## Linked issue Closes #5361 ## Summary This bumps `eslint-plugin-compat` and the transitive dependency `browser-compat-data` for up-to-date data for the [browserslist](https://www.npmjs.com/package/browserslist) check. ## Steps to reproduce #5343 is failing with the error `DragEvent is not supported in iOS Safari 14.5-14.8 compat/compat` but this is not accurate according to [MDN](https://developer.mozilla.org/en-US/docs/Web/API/DragEvent#browser_compatibility) and [caniuse.com](https://caniuse.com/?search=DragEvent). The issue was that we're using an outdated compatibility database. The update also uncovered an unrelated compatibility issue with `crypto.randomUUID`, which we started using in the editor in #4384 - this function does not meet our minimum Chrome version set in package.json, which we cannot update yet [^1], so the fix is to revert #4384. ## How to test Run `./ninja check`. [^1]: AnkiMobile [targets iOS 15.4]( |
||
|
a.r
|
a389f00409 |
fix: relax CSP for untrusted media to load its own presentation (#5525)
## Linked issue (required) Closes #4898. ## Summary / motivation (required) Untrusted media embedded via `<object>`/`<iframe>` (e.g. an SVG) is a document of its own, so unlike media shown in an `<img>`, it needs to fetch the presentation it ships with — for example a stylesheet, image, or font sitting beside it in the media folder. Our CSP previously blocked all of that. This PR relaxes `UNTRUSTED_MEDIA_CSP` in `qt/aqt/mediasrv.py` to allow `style-src`, `img-src`, `font-src`, and `media-src` from `'self'` only. None of these can execute code, and `'self'` keeps requests within the media server, so a card still can't phone home. `script-src`, `connect-src`, `object-src`, and `frame-src` remain `'none'`. Relaxing the sandbox to permit same-origin resource loads had a side effect: with site isolation enabled, Chromium puts an opaque-origin document in its own process and never delivers the hover-out event to it, leaving `:hover` stuck on for an embedded SVG once the mouse passes over it. QtWebEngine disables site isolation by default so this was latent for most users, but it's reproducible on Qt 6.11 with `QTWEBENGINE_CHROMIUM_FLAGS=--site-per-process --enable-features=IsolateSandboxedIframes`. The second commit fixes this by adding `allow-same-origin` to the `sandbox` directive, keeping the embedded document in-process. Scripting stays blocked both by the sandbox (no `allow-scripts`) and by `script-src 'none'`, so media still can't make use of the origin. Full discussion and background: https://github.com/ankitects/anki/issues/4898 ## Steps to reproduce (required, use N/A if not applicable) 1. Add a card with an SVG that references an external stylesheet/image/font in the same media folder (e.g. via `<?xml-stylesheet?>` or `<image href="...">`). 2. Display the card — before this fix, the referenced resources fail to load because the CSP blocks them. 3. With `QTWEBENGINE_CHROMIUM_FLAGS=--site-per-process --enable-features=IsolateSandboxedIframes` set and only the first commit applied, hover over the embedded SVG and move the mouse away — `:hover` styling stays stuck on. ## How to test (required) ### Checklist (minimum) - [x] I ran `./ninja check` or an equivalent relevant check locally. - [x] I added or updated tests when the change is non-trivial or behavior changed. ### Details - `qt/tests/test_mediasrv.py`: unit tests asserting the new CSP directives (`style-src`, `img-src`, `font-src`, `media-src` limited to `'self'`; `sandbox` includes `allow-same-origin`; no directive allows remote origins). - `qt/tests/qwebengine_csp_smoke.py`: manual QtWebEngine smoke test extended to load an SVG with a same-origin stylesheet/image and a script tag, and to assert the embedded document stays same-origin (`contentDocument` accessible) and that a remote stylesheet reference is never fetched. Run manually with `python qt/tests/qwebengine_csp_smoke.py`. ## Before / after behavior (optional) Before: untrusted media couldn't load co-located stylesheets/images/fonts, and (unrelated to the CSP relaxation but fixed alongside it) embedded SVGs could get stuck showing `:hover` styling under site isolation. After: untrusted media can load passive same-origin resources it ships with; scripting and remote network access remain fully blocked; embedded documents stay same-origin so hover state clears correctly. ## Risk / compatibility / migration (optional) Low risk — the CSP is still deny-by-default for scripts, remote origins, and network connections. Only same-origin passive resource loading is newly permitted. ## UI evidence (required for visual changes; otherwise N/A) N/A ## Scope - [x] This PR is focused on one change (no unrelated edits). --------- Co-authored-by: Abdo <abdo@abdnh.net> |
||
|
Abdo
|
445b835e36 |
Fix webview crash in unhook() by using weak references (#5537)
## Linked issue Closes #5534 ## Summary #5255 attached AnkiWebView's destroyed signal to a closure, which apparently made it possible for Python's garbage collector (which Anki triggers manually via a timer) to clean up the closure before the destroyed signal is emitted, then Qt tries to call the destroyed closure and causes a crash. The solution here is to avoid using the destroyed signal and instead clean up hooks on the next call when the webview is destroyed. Same as #5234 but with the difference that the callbacks are wrapped in weak references so they don't prevent the webview from being garbage collected. ## Steps to reproduce (before) Run the stress_webviews.py script attached to the issue. I could reproduce the crash after two iterations. ## How to test (after) Run the stress test and confirm it completes all iterations without crashes. |
||
|
Zaveshaa
|
5edc31694f |
fix: rename markdown deck description label (#5489)
## Linked issue Fixes #5481 ## Summary / motivation The deck description checkbox is currently labelled "Anki 2.1.41+ handling". The version reference is long outdated — 2.1.41 came out more than five years ago, so the label just looks confusing to users. This renames it to plain "Markdown", which actually describes what the option does. I also dropped the matching hint line about "Markdown will appear as text on Anki 2.1.40 and below", since the whole point of the old label was to warn about that version, and it's no longer relevant. ## Steps to reproduce N/A ## How to test 1. Open a deck's options. 2. Open the description editor via the Description button. 3. Confirm the checkbox is labelled "Markdown" and the tooltip no longer mentions 2.1.40. ### Checklist - [ ] I ran `./ninja check` or an equivalent relevant check locally. (String-only change; verified by inspecting the generated UI strings and existing tests still passing.) - [ ] I added or updated tests when the change is non-trivial or behavior changed. (String rename, no test changes needed.) ## Before / after behavior Before: checkbox labelled "Anki 2.1.41+ handling", tooltip mentions Anki 2.1.40. After: checkbox labelled "Markdown", tooltip only explains markdown/HTML handling. ## Risk / compatibility / migration N/A — UI string only. ## UI evidence String-only change. UI is verified by the string descriptions above; happy to add a screenshot if preferred. ## Scope - [x] This PR is focused on one change (no unrelated edits). |
||
|
dependabot[bot]
|
20c475f110 |
chore(deps): bump browserslist from 4.24.2 to 4.28.8 (#5508)
Bumps [browserslist](https://github.com/browserslist/browserslist) from 4.24.2 to 4.28.8. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/browserslist/browserslist/releases">browserslist's releases</a>.</em></p> <blockquote> <h2>4.28.8</h2> <ul> <li>Fixed <code>including kaios</code> in baseline queries (by <a href="https://github.com/Jaybhade"><code>@Jaybhade</code></a>).</li> </ul> <h2>4.28.7</h2> <ul> <li>Improved parsing performance.</li> <li>Fixed unbounded memory growth (by <a href="https://github.com/alanturing881"><code>@alanturing881</code></a>).</li> <li>Fixed prototype write issue (by <a href="https://github.com/alanturing881"><code>@alanturing881</code></a>).</li> </ul> <h2>4.28.6</h2> <ul> <li>Fixed Electron version queries (by <a href="https://github.com/spokodev"><code>@spokodev</code></a>).</li> </ul> <h2>4.28.5</h2> <ul> <li>Fixed <code>></code> and <code>>=</code> queries (by <a href="https://github.com/spokodev"><code>@spokodev</code></a>).</li> </ul> <h2>4.28.4</h2> <ul> <li>Fixed <code>SyntaxError</code> regression of 4.28.3.</li> </ul> <h2>4.28.3</h2> <ul> <li>Fixed baseline query case-insensitivity (by <a href="https://github.com/swwind"><code>@swwind</code></a>).</li> </ul> <h2>4.28.2</h2> <ul> <li>Fix prototype pollution (by <a href="https://github.com/chluo1997"><code>@chluo1997</code></a>).</li> </ul> <h2>4.28.1</h2> <ul> <li>Removed Baseline warning since we have it own warning.</li> </ul> <h2>4.27.0</h2> <ul> <li>Added <code>BROWSERSLIST_TRACE_WARNING</code> environment variable.</li> </ul> <h2>4.26.3</h2> <ul> <li>Fixed <code>throwOnMissing</code> with <code>extends</code> query (by <a href="https://github.com/alexander-akait"><code>@alexander-akait</code></a>).</li> </ul> <h2>4.26.2</h2> <ul> <li>Fixed <code>baseline-browser-mapping</code> version requirement.</li> </ul> <h2>4.26.1</h2> <ul> <li>Updated Firefox ESR.</li> </ul> <h2>4.26.0</h2> <ul> <li>Added Baseline queries (by <a href="https://github.com/tonypconway"><code>@tonypconway</code></a>).</li> </ul> <h2>4.25.4</h2> <ul> <li>Fixed Windows support for custom stats (by <a href="https://github.com/torgeilo"><code>@torgeilo</code></a>).</li> </ul> <h2>4.25.3</h2> <ul> <li>Fixed ReDoS (by <a href="https://github.com/ericcornelissen"><code>@ericcornelissen</code></a>).</li> </ul> <h2>4.25.2</h2> <ul> <li>Fixed Node.js <code>--permission</code> support (by <a href="https://github.com/broofa"><code>@broofa</code></a>).</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md">browserslist's changelog</a>.</em></p> <blockquote> <h2>4.28.8</h2> <ul> <li>Fixed <code>including kaios</code> in baseline queries (by <a href="https://github.com/Jaybhade"><code>@Jaybhade</code></a>).</li> </ul> <h2>4.28.7</h2> <ul> <li>Improved parsing performance.</li> <li>Fixed unbounded memory growth (by <a href="https://github.com/alanturing881"><code>@alanturing881</code></a>).</li> <li>Fixed prototype write issue (by <a href="https://github.com/alanturing881"><code>@alanturing881</code></a>).</li> </ul> <h2>4.28.6</h2> <ul> <li>Fixed Electron version queries (by <a href="https://github.com/spokodev"><code>@spokodev</code></a>).</li> </ul> <h2>4.28.5</h2> <ul> <li>Fixed <code>></code> and <code>>=</code> queries (by <a href="https://github.com/spokodev"><code>@spokodev</code></a>).</li> </ul> <h2>4.28.4</h2> <ul> <li>Fixed <code>SyntaxError</code> regression of 4.28.3.</li> </ul> <h2>4.28.3</h2> <ul> <li>Fixed baseline query case-insensitivity (by <a href="https://github.com/swwind"><code>@swwind</code></a>).</li> </ul> <h2>4.28.2</h2> <ul> <li>Fix prototype pollution (by <a href="https://github.com/chluo1997"><code>@chluo1997</code></a>).</li> </ul> <h2>4.28.1</h2> <ul> <li>Removed Baseline warning since we have it own warning.</li> </ul> <h2>4.48.0</h2> <ul> <li>Added <code>firefox >= esr</code> query support (by <a href="https://github.com/SethFalco"><code>@SethFalco</code></a>).</li> <li>Fixed docs (by <a href="https://github.com/SethFalco"><code>@SethFalco</code></a>).</li> </ul> <h2>4.27.0</h2> <ul> <li>Added <code>BROWSERSLIST_TRACE_WARNING</code> environment variable.</li> </ul> <h2>4.26.3</h2> <ul> <li>Fixed <code>throwOnMissing</code> with <code>extends</code> query (by <a href="https://github.com/alexander-akait"><code>@alexander-akait</code></a>).</li> </ul> <h2>4.26.2</h2> <ul> <li>Fixed <code>baseline-browser-mapping</code> version requirement.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
jamesliuai
|
9e32ad8849 |
fix: refresh reviewer toolbar background after theme changes (#5241)
## Linked issue (required) Fixes #5240 ## Summary / motivation (required) During review, the top toolbar copies the main reviewer webview's computed background so that the card background continues behind the toolbar. When the theme changes, the webviews update their theme classes, but the toolbar's copied inline `background` remains unchanged. This leaves the top of the reviewer using the previous theme's background. This PR clears the stale inline background when the theme changes and schedules it to be copied again after the webviews have queued their theme-class updates. The additional behavior is limited to the review screen. Tests cover refreshing the background during review and ensuring that the background-copying behavior is not triggered on other screens. This is narrower than the general live-theme issue addressed by #1471 and #1497. The reviewer toolbar's computed-background behavior was introduced later as part of #2262. ## Steps to reproduce (required, use N/A if not applicable) 1. Start Anki and open **Preferences**. 2. Set **Theme** to **Light**. 3. Ensure **Minimalist mode** and **Hide top bar during review** are disabled. 4. Close Preferences and start reviewing a deck. 5. While the question side of a card is displayed, reopen Preferences. 6. Change **Theme** from **Light** to **Dark**. 7. Close Preferences without showing the answer or moving to another card. 8. Observe that the reviewer changes to the dark theme, but the background behind the top toolbar remains light. The issue can also be reproduced in the opposite direction, and when Anki follows the system theme while the operating system changes between light and dark appearance. ## How to test (required) ### Checklist (minimum) - [x] I ran `just check` locally. - [x] I added or updated tests when the change is non-trivial or behavior changed. ### Details Automated testing: - `just fmt` - `just test-py` - `just check` Manual testing: 1. Launched the fixed build with `just run`. 2. Repeated the reproduction steps above. 3. Confirmed that the top toolbar background immediately matches the rest of the reviewer after switching from light to dark. 4. Repeated the test from dark to light. 5. Confirmed that changing themes outside the reviewer continues to behave as before. ## Before / after behavior (optional) Before: the reviewer updates to the new theme, but the background behind the top toolbar retains the previous theme's color. After: the top toolbar background is recalculated after the theme changes and matches the rest of the reviewer. ## Risk / compatibility / migration (optional) Low risk. The change only adds theme-change handling to `TopWebView` while Anki is in the review state. It calls the existing base theme-change handler and reuses the existing background-copying method. ## UI evidence (required for visual changes; otherwise N/A) ### Light to dark **Before** <img width="400" alt="image" src="https://github.com/user-attachments/assets/a04bb77b-5a34-459e-896c-d00a66601b83" /> **After** <img width="400" alt="Screenshot 2026-07-30 at 13 52 49" src="https://github.com/user-attachments/assets/481871b5-a4bb-43bc-8cbc-8400c447fae3" /> ### Dark to light **Before** <img width="400" alt="image" src="https://github.com/user-attachments/assets/9a94f926-f4fc-440c-8f63-7a94feae9e71" /> **After** <img width="400" alt="Screenshot 2026-07-30 at 13 52 39" src="https://github.com/user-attachments/assets/c48a32d3-da0c-4593-b751-cdcd8a0487f6" /> ## Scope - [x] This PR is focused on one change (no unrelated edits). |
||
|
Asuka Minato
|
b9d69a0abd |
bump fsrs to 6.6.2 (#5494)
closes #5495 |
||
|
Luc Mcgrady
|
9f2e75d215 |
Fix: Change deck modifies all cards in deck (#5500)
fixes #5414
The DeckIdsWithoutChildren search is not surrounded by parentheses.
|
||
|
Zaveshaa
|
0218af9bef |
Hide FSRS-only sort orders in filtered deck dialog when FSRS is disabled (#5407)
Fixes #5397. Selecting ascending/descending retrievability (or relative overdueness) for a filtered deck while FSRS is disabled raises a `SQLITE` error, because `build_retrievability_query()` returns an empty order fragment without FSRS (`order by , fnvhash(...)`), and the overdueness expression reads FSRS memory state regardless. As suggested in the issue by Luc, this hides those three orders in the filtered deck dialog when FSRS is off, the same way deck options already handles review order. The combo box rows are mapped through the list of actually offered orders instead of assuming row == enum value, so stored configs stay valid. If a stored config references one of the hidden orders (e.g. FSRS was turned off after it was built), the dialog falls back to Random rather than showing a broken selection. I checked that the mapping round-trips correctly with FSRS on and off, including the fallback path. |
||
|
llama
|
d83596149c |
fix: add cache-bust to load_sveltekit_page for stats (#5486)
## Linked issue (required)
Closes #5485
## Summary / motivation (required)
Reproduced, bisected to
|
||
|
Fernando Lins
|
4214dc5ee0 |
fix(ci): correct paginate mapFn in prune-coverage-cache workflow (#5504)
## Linked issue Fixes #5501 ## Summary / motivation `github.paginate` hoists the `actions_caches` array directly onto `response.data` for `getActionsCacheList`, so the `mapFn` returning `response.data.actions_caches` yielded `undefined`. That produced `[undefined]`, bypassing the `length === 0` guard and crashing on `keep.key` (`TypeError: Cannot read properties of undefined`). Fixed by returning `response.data`. ## Steps to reproduce 1. A `CI` run completes on `main` and triggers the prune workflow. 2. The `prune` job fails with `TypeError: Cannot read properties of undefined (reading 'key')`. ## How to test ### Details Reproduced against the real API with the same octokit `paginate`: old mapFn → `[undefined]` → crash; new mapFn → real caches array → works. The `workflow_run` trigger only fires on `main`, so it can't be exercised from a branch/PR. |
||
|
Carlos Mendez
|
5a58c8516f |
feat: improved error message for CSV import (#5484)
<!-- Title (for the Pull Request title field at the top): Use a short prefix so the change type is obvious. You do not need to repeat it in the body below. Examples: - fix: — bugfix - feat: — feature - refactor: — internal change without user-facing feature - docs: — documentation only - chore: — tooling, CI, deps, build housekeeping - test: — tests only --> ## Linked issue (required) <!-- Fixes #123 / Closes #123 --> Fixes #4346 ## Summary / motivation (required) <!-- What this PR does and why. For larger changes, add enough context for reviewers. --> Improves the CSV import error experience for empty or invalid CSV files. Previously, the import error page exposed an HTTP status code and did not provide a clear way for the user to dismiss the error and return to the main Anki window. Changes: - displays the import error without exposing the HTTP status code - adds an "Okay" button to dismiss the error - use Anki frontend RPC architecture to close the active import dialog - handles CSV import loader errors with a try/catch and displays them through the shared ErrorPage component The solution uses the existing `ImportDialog.reject()` path so the dialog box performs normal clean up before closing. This implementation was inspired by the previous discussion and earlier work in #4383. Thank you @medProgAyat and @josod827. Your discussion and implementations were a great assest to helping me solve and implement a solution. ## Steps to reproduce (required, use N/A if not applicable) <!-- Steps to reproduce: how to trigger the bug in the broken state (the "before"). - Mainly for bugfixes; - For bugs: numbered steps before the fix. For non-bugs: write N/A. - use N/A for features, refactors, docs, chore, etc. --> 1. open Anki and click on import button 2. select a empty csv 3. error page should open ## How to test (required) <!--- How to test: how you verified the change (checks, unit tests, manual steps, edge cases — the "after" or general validation). ---> ### Checklist (minimum) - [ x] I ran `./ninja check` or an equivalent relevant check locally. - [ ] I added or updated tests when the change is non-trivial or behavior changed. ### Details <!-- Commands, manual steps, edge cases, and what you observed --> Manual testing: 1. Imported an empty CSV file. 2. Confirmed the custom error page is displayed. 3. Confirmed the HTTP status code is not displayed to the user. 4. Confirmed clicking the "Okay" button closes the import dialog and returns to the main Anki window. 5. Imported a valid CSV file and confirmed the normal CSV import flow still works. ## Before / after behavior (optional) <!-- For bugfixes: behavior before vs after. For other types: N/A or a short note. --> Before: - Empty CSV imports display an error without a clear dismissal action. - Development error output may include the HTTP status code. After: - The error is displayed through the shared error UI. - The user can click "Okay" to close the import dialog. - The close action is handled through a frontend RPC. ## Risk / compatibility / migration (optional) <!-- Breaking changes, rollout notes, or N/A for small / low-risk PRs --> Low risk. The change is limited to CSV import error handling and the import dialog close path. ## UI evidence (required for visual changes; otherwise N/A) <!-- Screenshot or short video --> before: <img width="800" height="800" alt="image" src="https://github.com/user-attachments/assets/4fe77689-3ebd-4a98-9bd9-4916214bbb29" /> after: <img width="788" height="818" alt="image" src="https://github.com/user-attachments/assets/8451f465-894a-4f52-a11b-459fc6840326" /> ## Scope - [x ] This PR is focused on one change (no unrelated edits). |
||
|
趙子賢
|
ce26e216f1 |
fix: only attach handler to add-on's root logger (#5497)
<!-- Title (for the Pull Request title field at the top): Use a short prefix so the change type is obvious. You do not need to repeat it in the body below. Examples: - fix: — bugfix - feat: — feature - refactor: — internal change without user-facing feature - docs: — documentation only - chore: — tooling, CI, deps, build housekeeping - test: — tests only --> ## Linked issue (required) Fixes #5487. ## Summary / motivation (required) <!-- What this PR does and why. For larger changes, add enough context for reviewers. --> When deriving a child logger from an add-on logger, both of them got `TimedRotatingFileHandler` attached to the loggers handler. This makes log messages duplicated in log file and cause `PermissionError: [WinError 32]` when rotating log files on Windows. To solve this issue, the new `get_logger` only attaches `TimedRotatingFileHandler` to the add-on logger (`addon.name`), not the child one (`addon.name.child`). Besides, when a child logger is created with `logging.getLogger("addon.name.child")`, the add-on logger (`addon.name`) is created if not existed. The add-on logger becomes the one and only logger that has `TimedRotatingFileHandler` handler down the hierarchy from itself. I also fixes a minor bug of `module` variable. In the previous implementation, the `module` only contained part of the module name if the name contained `addon.`. I use `removeprefix` to solve it. ## Steps to reproduce (required, use N/A if not applicable) <!-- Steps to reproduce: how to trigger the bug in the broken state (the "before"). - Mainly for bugfixes; - For bugs: numbered steps before the fix. For non-bugs: write N/A. - use N/A for features, refactors, docs, chore, etc. --> `Anki2/addons21/test_logger/__init__.py`: ```python from aqt.addons import AddonManager logger = AddonManager.get_logger(__name__) child_logger = logger.getChild("child") child_logger.info("This info messages is duplicated in log file.") ``` When the log file is rotated on Windows, it raises `PermissionError: [WinError 32]`. Please check #5487 for detailed bug report. ## How to test (required) <!--- How to test: how you verified the change (checks, unit tests, manual steps, edge cases — the "after" or general validation). ---> ### Checklist (minimum) - [x] I ran `./ninja check` or an equivalent relevant check locally. - [x] I added or updated tests when the change is non-trivial or behavior changed. ### Details <!-- Commands, manual steps, edge cases, and what you observed --> Just create a test add-on to check this behavior as the "Steps to reproduce" above. ## Before / after behavior (optional) <!-- For bugfixes: behavior before vs after. For other types: N/A or a short note. --> ### Before 1. When deriving a child logger from an add-on logger, both of them got `TimedRotatingFileHandler` attached to the loggers handler. The log messages duplicated in log file and cause `PermissionError: [WinError 32]` when rotating log files on Windows. 2. If the logger name contains `addon.`, characters after `addon.` are stripped. ### After 1. When an add-on logger is created no matter it is an add-on logger (`addon.name`) or a child logger (`addon.name.child`), the add-on logger is created with `TimedRotatingFileHandler` handler, and the child logger is created as a normal logger. ## UI evidence (required for visual changes; otherwise N/A) N/A ## Scope - [x] This PR is focused on one change (no unrelated edits). |
||
|
Fernando Lins
|
4aa9c08369 |
fix(ci): prevent silent skip of PR coverage-regression check on evicted baseline (#5480)
## Linked issue Fixes #5418 ## Summary / motivation Every push to `main` creates a new `coverage-baseline-linux-<sha>` cache entry. Without a pruning step, these entries accumulate until GitHub's LRU eviction removes old ones. When the baseline a PR needs has been evicted, `check-coverage-regression.py` silently skips the check instead of failing, which could mask genuine coverage regressions. Two changes together close the gap: 1. **`prune-coverage-cache.yml`**: a new workflow triggered by `workflow_run` on every successful CI run on `main`. It keeps exactly one `coverage-baseline-linux-*` cache (the one just created) and deletes all older entries via the GitHub Actions API. With a single, always-fresh entry, eviction becomes practically impossible. 2. **`check-coverage-regression.py`**: turns the silent "no baseline — skipping" path into an explicit failure (`exit 2`). If somehow a baseline is still absent, the check now surfaces the problem visibly instead of passing silently. ## Steps to reproduce 1. Allow several pushes to `main` to accumulate `coverage-baseline-linux-*` cache entries until GitHub evicts the most recent one. 2. Open a PR: `check-coverage-regression.py` prints `no baseline — skipping` and exits 0, even if coverage dropped. ## How to test ### Details - After merging, verify via **Actions → Prune coverage baseline caches** that the job runs after a `CI` completion on `main` and leaves exactly one `coverage-baseline-linux-*` entry (`gh cache list -R ankitects/anki --key coverage-baseline-linux-`). - Confirm that a PR with a missing baseline now receives exit code 2 (visible failure) instead of exit code 0. ## Before / after behavior **Before:** evicted baseline → `check-coverage-regression.py` skips silently, coverage regressions go undetected. **After:** only one baseline exists at a time (no eviction risk); if it is somehow absent, the script exits with code 2 and the CI step fails visibly. |
||
|
Abdo
|
af3bd9d052 |
test: Improve test coverage of notes.py and tags.py (#5412)
## Linked issue Closes #5388 ## Summary This adds tests for notes.py and tags.py, increasing test coverage above the target 80%. ## How to test Run `just test-py --coverage --html` and inspect the coverage report. |
||
|
dependabot[bot]
|
c03a747a19 |
chore(deps): bump brace-expansion from 1.1.16 to 1.1.18 (#5479)
Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.16 to 1.1.18. <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
llama
|
38f3603d1f |
fix: avoid re-loading mathjax (#5416)
## Linked issue (required) Closes: #5415 ## Summary / motivation (required) The template editor and previewer were still eagerly loading mathjax, which lazy loading didnt account for, which this pr fixes ## Steps to reproduce (required, use N/A if not applicable) See linked issue ## How to test (required) Card content for cards with and without mathjax are visible in the template editor and previewer again ### Checklist (minimum) - [x] I ran `./ninja check` or an equivalent relevant check locally. - [ ] I added or updated tests when the change is non-trivial or behavior changed. ## Scope - [x] This PR is focused on one change (no unrelated edits). |
||
|
llama
|
7412627f90 |
fix: explicitly specify qmenu arrow width (#5475)
## Linked issue (required) Closes: #5420 ## Summary / motivation (required) I looked at 6.11.1's changelog and think its due to [QTBUG-144914's fix]( |
||
|
Luc Mcgrady
|
709689209b |
fix: constant font size for simulator graph (#5099)
<!-- Title (for the Pull Request title field at the top): Use a short prefix so the change type is obvious. You do not need to repeat it in the body below. Examples: - fix: — bugfix - feat: — feature - refactor: — internal change without user-facing feature - docs: — documentation only - chore: — tooling, CI, deps, build housekeeping - test: — tests only --> ## Linked issue (required) <!-- Fixes #123 / Closes #123 / Refs #123 --> closes #4168 ## Summary / motivation (required) This PR makes it so that the font size of the text in the simulator graph is consistent no matter how large the graph is. ## How to test (required) Resize the graph in the simulator modals and the font size should remain consistent ### Checklist (minimum) - [X] I ran `./ninja check` or an equivalent relevant check locally. - [ ] I added or updated tests when the change is non-trivial or behavior changed. ### Details <!-- Commands, manual steps, edge cases, and what you observed --> ## Before / after behavior (optional) <!-- For bugfixes: behavior before vs after. For other types: N/A or a short note. --> ## Risk / compatibility / migration (optional) <!-- Breaking changes, rollout notes, or N/A for small / low-risk PRs --> ## UI evidence (required for visual changes; otherwise N/A) <!-- Screenshot or short video --> Before: [Screencast_20260703_204727.webm](https://github.com/user-attachments/assets/fe918dfb-18f1-4102-bc15-2ea48ad56b97) After: [Screencast_20260703_204516.webm](https://github.com/user-attachments/assets/c8a8db4c-6d3c-4868-b1a4-a03d81b91036) ## Scope - [X] This PR is focused on one change (no unrelated edits). --------- Co-authored-by: Lee Doughty <32392044+leedoughty@users.noreply.github.com> |
||
|
Luc Mcgrady
|
608fa0b19c |
Fix: Ignore cards reviewed before settable to future values (#5294)
closes #5284 > (self quote) As I see it. I can't think of a use for setting the ignore_reviews_before value in the future. It also seems to result in undefined behaviour so I think we should prevent it from being set like that. --------- Co-authored-by: Fernando Lins <1887601+fernandolins@users.noreply.github.com> |
||
|
Abdo
|
657ff481a3 |
chore: Avoid setting default isLegacy in the editor (#5403)
https://github.com/ankitects/anki/pull/5330#discussion_r3851488284 |
||
|
Fernando Lins
|
a7f3ffb63a |
PoC: evaluate SonarCloud as a code quality and coverage tool (#4996)
## Linked issue Closes #4995 ## Summary / motivation Bedges available: [](https://sonarcloud.io/summary/new_code?id=ankitects_anki) [](https://sonarcloud.io/summary/new_code?id=ankitects_anki) [](https://sonarcloud.io/summary/new_code?id=ankitects_anki) [](https://sonarcloud.io/summary/new_code?id=ankitects_anki) [](https://sonarcloud.io/summary/new_code?id=ankitects_anki) [](https://sonarcloud.io/summary/new_code?id=ankitects_anki) [](https://sonarcloud.io/summary/new_code?id=ankitects_anki) **[SONAR DASHBOARD](https://sonarcloud.io/project/overview?id=ankitects_anki)** Integrates SonarCloud into the CI pipeline as a proof of concept to evaluate whether it surfaces actionable quality and security insights for this codebase. Changes: - Added `sonar-project.properties` configuring sources (`pylib`, `qt`, `ts`, `rslib`) and coverage report paths - Extended `tools/coverage/coverage-py` (and `.bat`) to emit `coverage.xml` (Cobertura) - Extended `tools/coverage/coverage-ts` (and `.bat`) to emit `lcov.info` via the V8 provider - Extended `tools/coverage/coverage-rust` (and `.bat`) to emit `lcov.info` via `cargo-llvm-cov report` - Added a `SonarCloud Scan` step to the `check-linux` CI job, running after all checks pass and before the build cache is saved ## How to test ### Details **1. Install sonar-scanner** ```bash brew install sonar-scanner ``` **2. Generate and configure a token** Go to [sonarcloud.io](https://sonarcloud.io/) → My Account → Security → Generate Token Copy the generated token and export it in your shell: ``` export SONAR_TOKEN=your_token_here ``` **3. Generate coverage reports** ``` just test --coverage ``` Expected output files: - out/coverage/python-pylib/coverage.xml - out/coverage/python-qt/coverage.xml - out/coverage/typescript/lcov.info - out/coverage/rust/lcov.info **4. Run the scanner manually** ``` sonar-scanner ``` Results will appear in the SonarCloud dashboard To test coverage generation locally: ```bash just coverage # verify files exist: # out/coverage/python-pylib/coverage.xml # out/coverage/python-qt/coverage.xml # out/coverage/typescript/lcov.info # out/coverage/rust/lcov.info ``` |
||
|
dependabot[bot]
|
2bf602d575 |
chore(deps): bump the npm-minor-patch group across 1 directory with 13 updates (#5309)
Bumps the npm-minor-patch group with 13 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@floating-ui/dom](https://github.com/floating-ui/floating-ui/tree/HEAD/packages/dom) | `1.7.6` | `1.8.0` | | [@playwright/test](https://github.com/microsoft/playwright) | `1.60.0` | `1.62.1` | | [@sveltejs/kit](https://github.com/sveltejs/kit/tree/HEAD/packages/kit) | `2.60.1` | `2.70.3` | | [@types/bootstrap](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/bootstrap) | `5.2.10` | `5.2.11` | | [caniuse-lite](https://github.com/browserslist/caniuse-lite) | `1.0.30001799` | `1.0.30001809` | | [dprint](https://github.com/dprint/dprint) | `0.54.0` | `0.56.0` | | [esbuild](https://github.com/evanw/esbuild) | `0.28.1` | `0.28.2` | | [prettier](https://github.com/prettier/prettier) | `3.8.3` | `3.9.6` | | [sass](https://github.com/sass/dart-sass) | `1.99.0` | `1.102.0` | | [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) | `5.55.7` | `5.56.9` | | [svelte-check](https://github.com/sveltejs/language-tools) | `4.4.8` | `4.7.6` | | [svelte-preprocess](https://github.com/sveltejs/svelte-preprocess) | `6.0.3` | `6.0.5` | | [tsx](https://github.com/privatenumber/tsx) | `4.22.0` | `4.23.12` | Updates `@floating-ui/dom` from 1.7.6 to 1.8.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/floating-ui/floating-ui/releases">@floating-ui/dom's releases</a>.</em></p> <blockquote> <h2><code>@floating-ui/dom</code><a href="https://github.com/1"><code>@1</code></a>.8.0</h2> <h3>Minor Changes</h3> <ul> <li>feat: add <code>'layoutViewport'</code> string option to <code>rootBoundary</code>. Unlike the visual <code>'viewport'</code> boundary, it remains stable while pinch-zooming or when a mobile software keyboard is open, and unlike a manually passed <code>Rect</code> of the documentElement's client size, it accounts for space reserved by <code>scrollbar-gutter: stable</code>.</li> </ul> <h3>Patch Changes</h3> <ul> <li>fix: remove redundant passive options from scroll listeners</li> <li>fix: support explicit <code>undefined</code> for optional properties with <code>exactOptionalPropertyTypes</code></li> <li>fix(autoUpdate): update immediately instead of waiting for the 1s <code>layoutShift</code> refresh throttle when the reference moved during an observer refresh</li> <li>fix(getClippingRect): correct clipping-ancestor filtering for fixed-position elements</li> <li>perf(dom): reduce bundle size and skip redundant per-call work in positioning utilities</li> <li>fix(getViewportRect): account for <code>scrollbar-gutter: stable both-edges</code> reserved space</li> <li>fix(getViewportRect): don't overflow past a left-side document scrollbar</li> <li>fix(platform): don't throw in <code>getClientRects</code> when a virtual element without a <code>getClientRects</code> method is used with the <code>inline()</code> middleware</li> <li>fix(autoUpdate): refresh layout shift observer on root resize</li> <li>Update dependencies: <code>@floating-ui/core@1.8.0</code>, <code>@floating-ui/utils@0.2.12</code></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/floating-ui/floating-ui/blob/master/packages/dom/CHANGELOG.md">@floating-ui/dom's changelog</a>.</em></p> <blockquote> <h2>1.8.0</h2> <h3>Minor Changes</h3> <ul> <li>feat: add <code>'layoutViewport'</code> string option to <code>rootBoundary</code>. Unlike the visual <code>'viewport'</code> boundary, it remains stable while pinch-zooming or when a mobile software keyboard is open, and unlike a manually passed <code>Rect</code> of the documentElement's client size, it accounts for space reserved by <code>scrollbar-gutter: stable</code>.</li> </ul> <h3>Patch Changes</h3> <ul> <li>fix: remove redundant passive options from scroll listeners</li> <li>fix: support explicit <code>undefined</code> for optional properties with <code>exactOptionalPropertyTypes</code></li> <li>fix(autoUpdate): update immediately instead of waiting for the 1s <code>layoutShift</code> refresh throttle when the reference moved during an observer refresh</li> <li>fix(getClippingRect): correct clipping-ancestor filtering for fixed-position elements</li> <li>perf(dom): reduce bundle size and skip redundant per-call work in positioning utilities</li> <li>fix(getViewportRect): account for <code>scrollbar-gutter: stable both-edges</code> reserved space</li> <li>fix(getViewportRect): don't overflow past a left-side document scrollbar</li> <li>fix(platform): don't throw in <code>getClientRects</code> when a virtual element without a <code>getClientRects</code> method is used with the <code>inline()</code> middleware</li> <li>fix(autoUpdate): refresh layout shift observer on root resize</li> <li>Update dependencies: <code>@floating-ui/core@1.8.0</code>, <code>@floating-ui/utils@0.2.12</code></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
Abdo
|
202a70f2fa |
CI: Remove RELEASE_TOKEN GHA secret (#5372)
## Linked issue A follow-up to #5273 ## Summary / motivation #5273 replaced the prepare-release.yml workflow with a script that can be run locally, which removed the need for the RELEASE_TOKEN personal access token. This removes the last usage of the token for creating the draft release, which was not necessary in any case as the default `github.token` has the necessary permissions to create releases. ## Before / after behavior - The release author will now be `github-actions[bot]` instead of @andrewsanchez - Some release events won't fire, but we don't rely on any at the moment: https://github.com/orgs/community/discussions/16244 |
||
|
Abdo
|
8e1c571bd1 |
docs: Document the anki-audio package (#5411)
Some notes about updating the `anki-audio` package. |
||
|
Abdo
|
c3188ebb67 |
docs: Fix broken links in dev docs (#5410)
## Linked issue Closes #5335 Closes #5350 ## Summary Fix broken links in docs/ by replacing relative links (`./linux.md`) with absolute ones (`/developers/linux`). ## How to test Confirm all internal links in docs/ work |
||
|
dependabot[bot]
|
a0efdd7827 |
chore(deps): bump starlette from 1.0.0 to 1.3.1 (#5194)
Bumps [starlette](https://github.com/Kludex/starlette) from 1.0.0 to 1.3.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Kludex/starlette/releases">starlette's releases</a>.</em></p> <blockquote> <h2>Version 1.3.1</h2> <h2>What's Changed</h2> <ul> <li>Use <code>StarletteDeprecationWarning</code> instead of <code>DeprecationWarning</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3119">Kludex/starlette#3119</a></li> <li>Enforce <code>max_fields</code> and <code>max_part_size</code> in <code>FormParser</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3329">Kludex/starlette#3329</a></li> <li>Enforce <code>FormParser</code> limits in parser callbacks by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3331">Kludex/starlette#3331</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.3.0...1.3.1">https://github.com/Kludex/starlette/compare/1.3.0...1.3.1</a></p> <h2>Version 1.3.0</h2> <h2>What's Changed</h2> <ul> <li>Clamp oversized suffix ranges in <code>FileResponse</code> by <a href="https://github.com/jiyujie2006"><code>@jiyujie2006</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3307">Kludex/starlette#3307</a></li> <li>Catch <code>OSError</code> alongside <code>MultiPartException</code> when closing temp files by <a href="https://github.com/N3XT3R1337"><code>@N3XT3R1337</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3191">Kludex/starlette#3191</a></li> <li>Add <code>httpx2</code> to the <code>full</code> extra by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3323">Kludex/starlette#3323</a></li> <li>Adjust testclient typing and warnings by <a href="https://github.com/waketzheng"><code>@waketzheng</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3322">Kludex/starlette#3322</a></li> <li>Fix IndexError in URL.replace() on a URL with no authority by <a href="https://github.com/LeSingh1"><code>@LeSingh1</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3317">Kludex/starlette#3317</a></li> <li>Annotate URLPath protocol parameter with Literal by <a href="https://github.com/Chang-LeHung"><code>@Chang-LeHung</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3285">Kludex/starlette#3285</a></li> <li>avoid collapsing exception groups from user code by <a href="https://github.com/graingert"><code>@graingert</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/2830">Kludex/starlette#2830</a></li> <li>Use <code>removeprefix</code> to strip weak ETag indicator in <code>is_not_modified</code> by <a href="https://github.com/gnosyslambda"><code>@gnosyslambda</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3193">Kludex/starlette#3193</a></li> <li>Build <code>request.url</code> from structured components by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3326">Kludex/starlette#3326</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/jiyujie2006"><code>@jiyujie2006</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3307">Kludex/starlette#3307</a></li> <li><a href="https://github.com/N3XT3R1337"><code>@N3XT3R1337</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3191">Kludex/starlette#3191</a></li> <li><a href="https://github.com/leestana01"><code>@leestana01</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3319">Kludex/starlette#3319</a></li> <li><a href="https://github.com/LeSingh1"><code>@LeSingh1</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3317">Kludex/starlette#3317</a></li> <li><a href="https://github.com/EmmanuelNiyonshuti"><code>@EmmanuelNiyonshuti</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3204">Kludex/starlette#3204</a></li> <li><a href="https://github.com/Chang-LeHung"><code>@Chang-LeHung</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3285">Kludex/starlette#3285</a></li> <li><a href="https://github.com/gnosyslambda"><code>@gnosyslambda</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3193">Kludex/starlette#3193</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.2.1...1.3.0">https://github.com/Kludex/starlette/compare/1.2.1...1.3.0</a></p> <h2>Version 1.2.1</h2> <h2>What's Changed</h2> <ul> <li>Use <code>httpx2</code> for type checking in the <code>testclient</code> module by <a href="https://github.com/leifwar"><code>@leifwar</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3304">Kludex/starlette#3304</a></li> <li>Add assert error for requires() when request param is not Request type by <a href="https://github.com/KeeganOP"><code>@KeeganOP</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3298">Kludex/starlette#3298</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/leifwar"><code>@leifwar</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3304">Kludex/starlette#3304</a></li> <li><a href="https://github.com/diskeu"><code>@diskeu</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3243">Kludex/starlette#3243</a></li> <li><a href="https://github.com/KeeganOP"><code>@KeeganOP</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3298">Kludex/starlette#3298</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.2.0...1.2.1">https://github.com/Kludex/starlette/compare/1.2.0...1.2.1</a></p> <h2>Version 1.2.0</h2> <h2>What's Changed</h2> <ul> <li>Support httpx2 in the test client by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3291">Kludex/starlette#3291</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.1.0...1.2.0">https://github.com/Kludex/starlette/compare/1.1.0...1.2.0</a></p> <h2>Version 1.1.0</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Kludex/starlette/blob/main/docs/release-notes.md">starlette's changelog</a>.</em></p> <blockquote> <h2>1.3.1 (June 12, 2026)</h2> <h4>Fixed</h4> <ul> <li>Enforce <code>max_fields</code> and <code>max_part_size</code> in <code>FormParser</code> <a href="https://redirect.github.com/encode/starlette/pull/3329">#3329</a>.</li> <li>Enforce <code>FormParser</code> limits in parser callbacks <a href="https://redirect.github.com/encode/starlette/pull/3331">#3331</a>.</li> </ul> <h2>1.3.0 (June 11, 2026)</h2> <h4>Added</h4> <ul> <li>Add <code>httpx2</code> to the <code>full</code> extra <a href="https://redirect.github.com/encode/starlette/pull/3323">#3323</a>.</li> <li>Annotate the <code>URLPath</code> <code>protocol</code> parameter with <code>Literal</code> <a href="https://redirect.github.com/encode/starlette/pull/3285">#3285</a>.</li> </ul> <h4>Fixed</h4> <ul> <li>Build <code>request.url</code> from structured components <a href="https://redirect.github.com/encode/starlette/pull/3326">#3326</a>.</li> <li>Clamp oversized suffix ranges in <code>FileResponse</code> <a href="https://redirect.github.com/encode/starlette/pull/3307">#3307</a>.</li> <li>Catch <code>OSError</code> alongside <code>MultiPartException</code> when closing temp files <a href="https://redirect.github.com/encode/starlette/pull/3191">#3191</a>.</li> <li>Avoid collapsing exception groups raised from user code <a href="https://redirect.github.com/encode/starlette/pull/2830">#2830</a>.</li> <li>Use <code>removeprefix</code> to strip the weak <code>ETag</code> indicator in <code>is_not_modified</code> <a href="https://redirect.github.com/encode/starlette/pull/3193">#3193</a>.</li> <li>Fix <code>IndexError</code> in <code>URL.replace()</code> on a URL with no authority <a href="https://redirect.github.com/encode/starlette/pull/3317">#3317</a>.</li> <li>Adjust <code>testclient</code> typing and warnings <a href="https://redirect.github.com/encode/starlette/pull/3322">#3322</a>.</li> </ul> <h2>1.2.1 (May 31, 2026)</h2> <h4>Fixed</h4> <ul> <li>Use <code>httpx2</code> for type checking in the <code>testclient</code> module <a href="https://redirect.github.com/encode/starlette/pull/3304">#3304</a>.</li> <li>Add assert error for <code>requires()</code> when the request parameter is not a <code>Request</code> type <a href="https://redirect.github.com/encode/starlette/pull/3298">#3298</a>.</li> </ul> <h2>1.2.0 (May 28, 2026)</h2> <h4>Added</h4> <ul> <li>Support httpx2 in the test client <a href="https://redirect.github.com/encode/starlette/pull/3291">#3291</a>.</li> </ul> <h2>1.1.0 (May 23, 2026)</h2> <h4>Added</h4> <ul> <li>Use <code>"application/octet-stream"</code> as the <code>FileResponse</code> media type fallback <a href="https://redirect.github.com/encode/starlette/pull/3283">#3283</a>.</li> </ul> <h4>Fixed</h4> <ul> <li>Only dispatch standard HTTP verbs in <code>HTTPEndpoint</code> <a href="https://redirect.github.com/encode/starlette/pull/3286">#3286</a>.</li> <li>Reject absolute paths in <code>StaticFiles.lookup_path</code> <a href="https://redirect.github.com/encode/starlette/pull/3287">#3287</a>.</li> </ul> <h2>1.0.1 (May 21, 2026)</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
4b8a194042 |
chore(deps): bump soupsieve from 2.7 to 2.8.4 (#5139)
Bumps [soupsieve](https://github.com/facelessuser/soupsieve) from 2.7 to 2.8.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/facelessuser/soupsieve/releases">soupsieve's releases</a>.</em></p> <blockquote> <h2>2.8.4</h2> <ul> <li><strong>FIX</strong>: Fix another inefficient attribute pattern (<a href="https://github.com/mauriceng98"><code>@mauriceng98</code></a>).</li> <li><strong>FIX</strong>: Limit total number of selectors processed in a pattern to prevent massive selector requests (<a href="https://github.com/mauriceng98"><code>@mauriceng98</code></a>).</li> </ul> <h2>2.8.3</h2> <ul> <li><strong>FIX</strong>: Fix inefficient attribute pattern.</li> </ul> <h2>2.8.2</h2> <ul> <li><strong>FIX</strong>: Ensure custom selectors or namespace dictionaries reject non-string keys (<a href="https://github.com/mundanevision20"><code>@mundanevision20</code></a>).</li> <li><strong>FIX</strong>: Fix handling of <code>:in-range</code> and <code>:out-of-range</code> with end of year weeks (<a href="https://github.com/mundanevision20"><code>@mundanevision20</code></a>).</li> <li><strong>FIX</strong>: Fix a potential infinite loop in the pretty printing debug function (<a href="https://github.com/mundanevision20"><code>@mundanevision20</code></a>).</li> </ul> <h2>2.8.1</h2> <ul> <li><strong>FIX</strong>: Changes in tests to accommodate latest Python HTML parser changes.</li> </ul> <h2>2.8</h2> <ul> <li><strong>NEW</strong>: Drop support for Python 3.8.</li> <li><strong>NEW</strong>: Add support for Python 3.14.</li> <li><strong>NEW</strong>: Deploy with PyPI's "Trusted Publisher".</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
2b06dd0371 |
chore(deps): bump urllib3 from 2.6.3 to 2.7.0 (#4989)
Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.6.3 to 2.7.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/releases">urllib3's releases</a>.</em></p> <blockquote> <h2>2.7.0</h2> <h2>🚀 urllib3 is fundraising for HTTP/2 support</h2> <p><a href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support">urllib3 is raising ~$40,000 USD</a> to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects <a href="https://opencollective.com/urllib3">please consider contributing financially</a> to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.</p> <p>Thank you for your support.</p> <h2>Security</h2> <p>Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.</p> <ul> <li> <p>Decompression-bomb safeguards of the streaming API were bypassed:</p> <ol> <li>When <code>HTTPResponse.drain_conn()</code> was called after the response had been read and decompressed partially. (Reported by <a href="https://github.com/Cycloctane"><code>@Cycloctane</code></a>)</li> <li>During the second <code>HTTPResponse.read(amt=N)</code> or <code>HTTPResponse.stream(amt=N)</code> call when the response was decompressed using the official <a href="https://pypi.org/project/brotli/">Brotli</a> library. (Reported by <a href="https://github.com/kimkou2024"><code>@kimkou2024</code></a>)</li> </ol> <p>See GHSA-mf9v-mfxr-j63j for details.</p> </li> <li> <p>HTTP pools created using <code>ProxyManager.connection_from_url</code> did not strip sensitive headers specified in <code>Retry.remove_headers_on_redirect</code> when redirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by <a href="https://github.com/christos-spearbit"><code>@christos-spearbit</code></a>)</p> </li> </ul> <h2>Deprecations and Removals</h2> <ul> <li>Used <code>FutureWarning</code> instead of <code>DeprecationWarning</code> for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3763">urllib3/urllib3#3763</a>)</li> <li>Removed support for end-of-life Python 3.9. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3720">urllib3/urllib3#3720</a>)</li> <li>Removed support for end-of-life PyPy3.10. (<a href="https://redirect.github.com/urllib3/urllib3/issues/4979">urllib3/urllib3#4979</a>)</li> <li>Bumped the minimum supported pyOpenSSL version to 19.0.0. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3777">urllib3/urllib3#3777</a>)</li> </ul> <h2>Bugfixes</h2> <ul> <li>Fixed a bug where <code>HTTPResponse.read(amt=None)</code> was ignoring decompressed data buffered from previous partial reads. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3636">urllib3/urllib3#3636</a>)</li> <li>Fixed a bug where <code>HTTPResponse.read()</code> could cache only part of the response after a partial read when <code>cache_content=True</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/4967">urllib3/urllib3#4967</a>)</li> <li>Fixed <code>HTTPResponse.stream()</code> and <code>HTTPResponse.read_chunked()</code> to handle <code>amt=0</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3793">urllib3/urllib3#3793</a>)</li> <li>Updated <code>_TYPE_BODY</code> type alias to include missing <code>Iterable[str]</code>, matching the documented and runtime behavior of chunked request bodies. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3798">urllib3/urllib3#3798</a>)</li> <li>Fixed <code>LocationParseError</code> when paths resembling schemeless URIs were passed to <code>HTTPConnectionPool.urlopen()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3352">urllib3/urllib3#3352</a>)</li> <li>Fixed <code>BaseHTTPResponse.readinto()</code> type annotation to accept <code>memoryview</code> in addition to <code>bytearray</code>, matching the <code>io.RawIOBase.readinto</code> contract and enabling use with <code>io.BufferedReader</code> without type errors. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3764">urllib3/urllib3#3764</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst">urllib3's changelog</a>.</em></p> <blockquote> <h1>2.7.0 (2026-05-07)</h1> <h2>Security</h2> <p>Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.</p> <ul> <li> <p>Decompression-bomb safeguards of the streaming API were bypassed:</p> <ol> <li>When <code>HTTPResponse.drain_conn()</code> was called after the response had been read and decompressed partially.</li> <li>During the second <code>HTTPResponse.read(amt=N)</code> or <code>HTTPResponse.stream(amt=N)</code> call when the response was decompressed using the official <code>Brotli <https://pypi.org/project/brotli/></code>__ library.</li> </ol> <p>See <code>GHSA-mf9v-mfxr-j63j <https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j></code>__ for details.</p> </li> <li> <p>HTTP pools created using <code>ProxyManager.connection_from_url</code> did not strip sensitive headers specified in <code>Retry.remove_headers_on_redirect</code> when redirecting to a different host. (<code>GHSA-qccp-gfcp-xxvc <https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc></code>__)</p> </li> </ul> <h2>Deprecations and Removals</h2> <ul> <li>Used <code>FutureWarning</code> instead of <code>DeprecationWarning</code> for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. (<code>[#3763](https://github.com/urllib3/urllib3/issues/3763) <https://github.com/urllib3/urllib3/issues/3763></code>__)</li> <li>Removed support for end-of-life Python 3.9. (<code>[#3720](https://github.com/urllib3/urllib3/issues/3720) <https://github.com/urllib3/urllib3/issues/3720></code>__)</li> <li>Removed support for end-of-life PyPy3.10. (<code>[#4979](https://github.com/urllib3/urllib3/issues/4979) <https://github.com/urllib3/urllib3/issues/4979></code>__)</li> <li>Bumped the minimum supported pyOpenSSL version to 19.0.0. (<code>[#3777](https://github.com/urllib3/urllib3/issues/3777) <https://github.com/urllib3/urllib3/issues/3777></code>__)</li> </ul> <h2>Bugfixes</h2> <ul> <li>Fixed a bug where <code>HTTPResponse.read(amt=None)</code> was ignoring decompressed data buffered from previous partial reads. (<code>[#3636](https://github.com/urllib3/urllib3/issues/3636) <https://github.com/urllib3/urllib3/issues/3636></code>__)</li> <li>Fixed a bug where <code>HTTPResponse.read()</code> could cache only part of the response after a partial read when <code>cache_content=True</code>.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
381d6b98d3 |
chore(deps): bump postcss from 8.5.10 to 8.5.24 (#5271)
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.10 to 8.5.24. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/postcss/postcss/releases">postcss's releases</a>.</em></p> <blockquote> <h2>8.5.24</h2> <ul> <li>Preserve the BOM after the processing (by <a href="https://github.com/hdimer"><code>@hdimer</code></a>).</li> </ul> <h2>8.5.23</h2> <ul> <li>Do not load source map without <code>opts.from</code> for security reasons.</li> </ul> <h2>8.5.22</h2> <ul> <li>Fixed custom property losing semicolon before a comment (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> </ul> <h2>8.5.21</h2> <ul> <li>Fixed childless at-rule losing semicolon before comment (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> <li>Fixed docs (by <a href="https://github.com/isker"><code>@isker</code></a>).</li> </ul> <h2>8.5.20</h2> <ul> <li>Fixed missing space if <code>AtRule#params</code> is set after (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> <li>Fixed mixing AST error on warnings (by <a href="https://github.com/MahinAnowar"><code>@MahinAnowar</code></a>).</li> </ul> <h2>8.5.19</h2> <ul> <li>Fixed cleaning <code>before</code> for new nodes inserted to <code>Root</code> (by <a href="https://github.com/MahinAnowar"><code>@MahinAnowar</code></a>).</li> </ul> <h2>8.5.18</h2> <ul> <li>Restricted loading previous source maps file to the <code>opts.from</code> folder for security reasons (use <code>unsafeMap: true</code> to disable the check).</li> </ul> <h2>8.5.17</h2> <ul> <li>Fixed <code>Maximum call stack size exceeded</code> error.</li> <li>Fixed Prototype hijacking for <code>postcss.fromJSON()</code>.</li> <li>Fixed <code>Input#origin()</code> for unmapped end position (by <a href="https://github.com/chatman-media"><code>@chatman-media</code></a>).</li> </ul> <h2>8.5.16</h2> <ul> <li>Fixed <code>Input#origin()</code> position (by <a href="https://github.com/mizdra"><code>@mizdra</code></a>).</li> <li>Fixed <code>raws</code> after rehydrating a JSON AST (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> <li>Fixed putting parent-less node in <code>nodes</code> of new node (by <a href="https://github.com/MahinAnowar"><code>@MahinAnowar</code></a>).</li> <li>Fixed computing <code>offset</code> in <code>positionBy()</code> (by <a href="https://github.com/greymoth-jp"><code>@greymoth-jp</code></a>).</li> <li>Fixed <code>rangeBy()</code> on <code>index: 0</code> (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> </ul> <h2>8.5.15</h2> <ul> <li>Fixed declaration parsing performance (by <a href="https://github.com/homanp"><code>@homanp</code></a>).</li> </ul> <h2>8.5.14</h2> <ul> <li>Fixed custom syntax regression (by <a href="https://github.com/43081j"><code>@43081j</code></a>).</li> </ul> <h2>8.5.13</h2> <ul> <li>Fixed <code>postcss-scss</code> commend regression.</li> </ul> <h2>8.5.12</h2> <ul> <li>Fixed reading any file via user-generated CSS.</li> <li>Added <code>opts.unsafeMap</code> to disable checks.</li> </ul> <h2>8.5.11</h2> <ul> <li>Fixed nested brackets parsing performance (by <a href="https://github.com/offset"><code>@offset</code></a>).</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/postcss/postcss/blob/main/CHANGELOG.md">postcss's changelog</a>.</em></p> <blockquote> <h2>8.5.24</h2> <ul> <li>Preserve the BOM after the processing (by <a href="https://github.com/hdimer"><code>@hdimer</code></a>).</li> </ul> <h2>8.5.23</h2> <ul> <li>Do not load source map without <code>opts.from</code> for security reasons.</li> </ul> <h2>8.5.22</h2> <ul> <li>Fixed custom property losing semicolon before a comment (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> </ul> <h2>8.5.21</h2> <ul> <li>Fixed childless at-rule losing semicolon before comment (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> <li>Fixed docs (by <a href="https://github.com/isker"><code>@isker</code></a>).</li> </ul> <h2>8.5.20</h2> <ul> <li>Fixed missing space if <code>AtRule#params</code> is set after (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> <li>Fixed mixing AST error on warnings (by <a href="https://github.com/MahinAnowar"><code>@MahinAnowar</code></a>).</li> </ul> <h2>8.5.19</h2> <ul> <li>Fixed cleaning <code>before</code> for new nodes inserted to <code>Root</code> (by <a href="https://github.com/MahinAnowar"><code>@MahinAnowar</code></a>).</li> </ul> <h2>8.5.18</h2> <ul> <li>Restricted loading previous source maps file to the <code>opts.from</code> folder for security reasons (use <code>unsafeMap: true</code> to disable the check).</li> </ul> <h2>8.5.17</h2> <ul> <li>Fixed <code>Maximum call stack size exceeded</code> error.</li> <li>Fixed Prototype hijacking for <code>postcss.fromJSON()</code>.</li> <li>Fixed <code>Input#origin()</code> for unmapped end position (by <a href="https://github.com/chatman-media"><code>@chatman-media</code></a>).</li> </ul> <h2>8.5.16</h2> <ul> <li>Fixed <code>Input#origin()</code> position (by <a href="https://github.com/mizdra"><code>@mizdra</code></a>).</li> <li>Fixed <code>raws</code> after rehydrating a JSON AST (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> <li>Fixed putting parent-less node in <code>nodes</code> of new node (by <a href="https://github.com/MahinAnowar"><code>@MahinAnowar</code></a>).</li> <li>Fixed computing <code>offset</code> in <code>positionBy()</code> (by <a href="https://github.com/greymoth-jp"><code>@greymoth-jp</code></a>).</li> <li>Fixed <code>rangeBy()</code> on <code>index: 0</code> (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> </ul> <h2>8.5.15</h2> <ul> <li>Fixed declaration parsing performance (by <a href="https://github.com/homanp"><code>@homanp</code></a>).</li> </ul> <h2>8.5.14</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
4a705a12e6 |
chore(deps): bump gitpython from 3.1.49 to 3.1.57 (#5268)
Bumps [gitpython](https://github.com/gitpython-developers/GitPython) from 3.1.49 to 3.1.57. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/gitpython-developers/GitPython/releases">gitpython's releases</a>.</em></p> <blockquote> <h2>3.1.57 - Security and Fixes</h2> <h2>What's Changed</h2> <ul> <li>Merge gitdb and smmap into the GitPython repository by <a href="https://github.com/Byron"><code>@Byron</code></a> in <a href="https://redirect.github.com/gitpython-developers/GitPython/pull/2179">gitpython-developers/GitPython#2179</a></li> <li>build(deps): bump actions/setup-python from 6 to 7 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/gitpython-developers/GitPython/pull/2185">gitpython-developers/GitPython#2185</a></li> <li>build(deps): bump the pre-commit group with 2 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/gitpython-developers/GitPython/pull/2186">gitpython-developers/GitPython#2186</a></li> <li>Bump Vampire/setup-wsl from 6.0.0 to 7.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/gitpython-developers/GitPython/pull/2124">gitpython-developers/GitPython#2124</a></li> <li>Render protected Traversable methods in the reference by <a href="https://github.com/pick7"><code>@pick7</code></a> in <a href="https://redirect.github.com/gitpython-developers/GitPython/pull/2192">gitpython-developers/GitPython#2192</a></li> <li>Use standard prefixes for parsed patch diffs by <a href="https://github.com/pick7"><code>@pick7</code></a> in <a href="https://redirect.github.com/gitpython-developers/GitPython/pull/2191">gitpython-developers/GitPython#2191</a></li> <li>Honor kill_after_timeout with output streams by <a href="https://github.com/pick7"><code>@pick7</code></a> in <a href="https://redirect.github.com/gitpython-developers/GitPython/pull/2189">gitpython-developers/GitPython#2189</a></li> <li>Redact Authorization extra headers from command errors by <a href="https://github.com/pick7"><code>@pick7</code></a> in <a href="https://redirect.github.com/gitpython-developers/GitPython/pull/2188">gitpython-developers/GitPython#2188</a></li> <li>Improve RemoteProgress parse return typing by <a href="https://github.com/pick7"><code>@pick7</code></a> in <a href="https://redirect.github.com/gitpython-developers/GitPython/pull/2187">gitpython-developers/GitPython#2187</a></li> <li>Adopt basedpyright with a legacy baseline by <a href="https://github.com/Byron"><code>@Byron</code></a> in <a href="https://redirect.github.com/gitpython-developers/GitPython/pull/2194">gitpython-developers/GitPython#2194</a></li> <li>Block unsafe Git file and URL options by <a href="https://github.com/Byron"><code>@Byron</code></a> in <a href="https://redirect.github.com/gitpython-developers/GitPython/pull/2193">gitpython-developers/GitPython#2193</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/pick7"><code>@pick7</code></a> made their first contribution in <a href="https://redirect.github.com/gitpython-developers/GitPython/pull/2192">gitpython-developers/GitPython#2192</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/gitpython-developers/GitPython/compare/3.1.56...3.1.57">https://github.com/gitpython-developers/GitPython/compare/3.1.56...3.1.57</a></p> <h2>3.1.56 - SECURITY</h2> <h2>What's Changed</h2> <ul> <li>Add support for Python 3.15 by <a href="https://github.com/hugovk"><code>@hugovk</code></a> in <a href="https://redirect.github.com/gitpython-developers/GitPython/pull/2183">gitpython-developers/GitPython#2183</a></li> <li>fix: reject unsafe output options in Commit.count by <a href="https://github.com/Byron"><code>@Byron</code></a> in <a href="https://redirect.github.com/gitpython-developers/GitPython/pull/2184">gitpython-developers/GitPython#2184</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/gitpython-developers/GitPython/compare/3.1.55...3.1.56">https://github.com/gitpython-developers/GitPython/compare/3.1.55...3.1.56</a></p> <h2>3.1.55 - Security</h2> <h2>What's Changed</h2> <ul> <li>fix: prevent environment expansion in remote URLs by <a href="https://github.com/Byron"><code>@Byron</code></a> in <a href="https://redirect.github.com/gitpython-developers/GitPython/pull/2181">gitpython-developers/GitPython#2181</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/gitpython-developers/GitPython/compare/3.1.54...3.1.55">https://github.com/gitpython-developers/GitPython/compare/3.1.54...3.1.55</a></p> <h2>3.1.54 - Security</h2> <h2>What's Changed</h2> <ul> <li>Harden unsafe Git option validation by <a href="https://github.com/Byron"><code>@Byron</code></a> in <a href="https://redirect.github.com/gitpython-developers/GitPython/pull/2180">gitpython-developers/GitPython#2180</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/gitpython-developers/GitPython/compare/3.1.53...3.1.54">https://github.com/gitpython-developers/GitPython/compare/3.1.53...3.1.54</a></p> <h2>3.1.53 - Security</h2> <h2>What's Changed</h2> <ul> <li>feat(submodule): add deinit method to Submodule (<a href="https://redirect.github.com/gitpython-developers/GitPython/issues/2014">#2014</a>) by <a href="https://github.com/mvanhorn"><code>@mvanhorn</code></a> in <a href="https://redirect.github.com/gitpython-developers/GitPython/pull/2129">gitpython-developers/GitPython#2129</a></li> <li>typing: introduce sensible basedpyright defaults by <a href="https://github.com/Byron"><code>@Byron</code></a> in <a href="https://redirect.github.com/gitpython-developers/GitPython/pull/2174">gitpython-developers/GitPython#2174</a></li> <li>fix: make <code>submodule.update()</code> after <code>submodule.deinit()</code> work by <a href="https://github.com/Byron"><code>@Byron</code></a> in <a href="https://redirect.github.com/gitpython-developers/GitPython/pull/2175">gitpython-developers/GitPython#2175</a></li> <li>Fix commit hooks respecting core.hooksPath by <a href="https://github.com/Siesta0217"><code>@Siesta0217</code></a> in <a href="https://redirect.github.com/gitpython-developers/GitPython/pull/2159">gitpython-developers/GitPython#2159</a></li> <li>fix: validate config section delimiters by <a href="https://github.com/Byron"><code>@Byron</code></a> in <a href="https://redirect.github.com/gitpython-developers/GitPython/pull/2176">gitpython-developers/GitPython#2176</a></li> </ul> <h2>New Contributors</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
244aaf13d9 |
chore(deps): bump ws from 8.20.1 to 8.21.0 (#5027)
Bumps [ws](https://github.com/websockets/ws) from 8.20.1 to 8.21.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/websockets/ws/releases">ws's releases</a>.</em></p> <blockquote> <h2>8.21.0</h2> <h1>Features</h1> <ul> <li>Introduced the <code>maxBufferedChunks</code> and <code>maxFragments</code> options (2b2abd45).</li> </ul> <h1>Bug fixes</h1> <ul> <li>Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).</li> </ul> <p>A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a <code>ws</code> server or client due to OOM.</p> <pre lang="js"><code>import { WebSocket, WebSocketServer } from 'ws'; <p>const wss = new WebSocketServer({ port: 0 }, function () { const data = Buffer.alloc(1); const options = { fin: false }; const { port } = wss.address(); const ws = new WebSocket(<code>ws://localhost:${port}</code>);</p> <p>ws.on('open', function () { (function send() { ws.send(data, options, function (err) { if (err) return; send(); }); })(); });</p> <p>ws.on('error', console.error); ws.on('close', function (code, reason) { console.log(<code>client close - code: ${code} reason: ${reason.toString()}</code>); }); });</p> <p>wss.on('connection', function (ws) { ws.on('error', console.error); ws.on('close', function (code, reason) { console.log(<code>server close - code: ${code} reason: ${reason.toString()}</code>); }); }); </code></pre></p> <p>The vulnerability was responsibly disclosed and fixed by <a href="https://github.com/Nadav0077">Nadav Magier</a>.</p> <p>In vulnerable versions, the issue can be mitigated by lowering the value of the <code>maxPayload</code> option if possible.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
923e976d31 |
chore(deps): bump quinn-proto from 0.11.14 to 0.11.16 (#5221)
Bumps [quinn-proto](https://github.com/quinn-rs/quinn) from 0.11.14 to 0.11.16. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/quinn-rs/quinn/releases">quinn-proto's releases</a>.</em></p> <blockquote> <h2>quinn-proto-0.11.16</h2> <h2>What's Changed</h2> <ul> <li>0.11.x: upgrade dependencies by <a href="https://github.com/djc"><code>@djc</code></a> in <a href="https://redirect.github.com/quinn-rs/quinn/pull/2707">quinn-rs/quinn#2707</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
924ccf4257 |
chore(deps): bump form-data from 4.0.4 to 4.0.6 (#5200)
Bumps [form-data](https://github.com/form-data/form-data) from 4.0.4 to 4.0.6. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/form-data/form-data/blob/master/CHANGELOG.md">form-data's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/form-data/form-data/compare/v4.0.5...v4.0.6">v4.0.6</a> - 2026-06-12</h2> <h3>Commits</h3> <ul> <li>[Fix] escape CR, LF, and <code>"</code> in field names and filenames <a href=" |
||
|
dependabot[bot]
|
a2301c1aa5 |
chore(deps): bump svgo from 3.3.3 to 3.3.4 (#5195)
Bumps [svgo](https://github.com/svg/svgo) from 3.3.3 to 3.3.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/svg/svgo/releases">svgo's
releases</a>.</em></p>
<blockquote>
<h2>v3.3.4</h2>
<h2>What's Changed</h2>
<h3>Security</h3>
<ul>
<li><a
href="https://svgo.dev/docs/plugins/removeScripts/">removeScriptElement</a>,
remove JavaScript URIs case-insensitively and make
<code><script></code> handling namespace aware. By <a
href="https://github.com/SethFalco"><code>@SethFalco</code></a></li>
</ul>
<h2>Support</h2>
<p>SVGO v3 is not officially supported, please consider upgrading to
SVGO v4 instead. We've backported this fix as there are security
implications, but there is no commitment to do this for more complex
changes in future.</p>
<p>Consider reading our <a
href="https://svgo.dev/docs/migrations/migration-from-v3-to-v4/">Migration
Guide from v3 to v4</a> which should ease the process.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="
|
||
|
dependabot[bot]
|
6c7f9f2030 |
chore(deps): bump immutable from 5.1.5 to 5.1.9 (#5191)
Bumps [immutable](https://github.com/immutable-js/immutable-js) from 5.1.5 to 5.1.9. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/immutable-js/immutable-js/releases">immutable's releases</a>.</em></p> <blockquote> <h2>v5.1.9</h2> <h2>What's Changed</h2> <ul> <li>fix(List): preserve undefined values when grown past 32 elements by <a href="https://github.com/spokodev"><code>@spokodev</code></a> / <a href="https://github.com/jdeniau"><code>@jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2235">immutable-js/immutable-js#2235</a> (originated from <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2230">immutable-js/immutable-js#2230</a> )</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/immutable-js/immutable-js/compare/v5.1.8...v5.1.9">https://github.com/immutable-js/immutable-js/compare/v5.1.8...v5.1.9</a></p> <h2>v5.1.8</h2> <h2>What's Changed</h2> <ul> <li>fix(List): guard oversized bounds in setListBounds. Fixes CVE <a href="https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735">https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735</a></li> <li>perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE <a href="https://github.com/immutable-js/immutable-js/security/advisories/GHSA-xvcm-6775-5m9r">https://github.com/immutable-js/immutable-js/security/advisories/GHSA-xvcm-6775-5m9r</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/immutable-js/immutable-js/compare/v5.1.7...v5.1.8">https://github.com/immutable-js/immutable-js/compare/v5.1.7...v5.1.8</a></p> <h2>v5.1.7</h2> <h2>What's Changed</h2> <ul> <li>fix(Repeat): lastIndexOf returned size instead of size - 1 by <a href="https://github.com/chatman-media"><code>@chatman-media</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2227">immutable-js/immutable-js#2227</a></li> </ul> <h2>internal</h2> <ul> <li>Backport tests from 6.x branch by <a href="https://github.com/jdeniau"><code>@jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2199">immutable-js/immutable-js#2199</a></li> <li>fix(IndexedCollection): <code>has(index)</code> on a lazy <code>Seq</code> of unknown size now checks index existence instead of searching for a value equal to the index by <a href="https://github.com/jdeniau"><code>@jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2203">immutable-js/immutable-js#2203</a></li> <li>Better type for reduce if not ininitial value is given by <a href="https://github.com/jdeniau"><code>@jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2205">immutable-js/immutable-js#2205</a></li> <li>Backport test from <a href="https://redirect.github.com/immutable-js/immutable-js/issues/2193">#2193</a> by <a href="https://github.com/jdeniau"><code>@jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2207">immutable-js/immutable-js#2207</a></li> <li>backport tests from 6.x by <a href="https://github.com/jdeniau"><code>@jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2213">immutable-js/immutable-js#2213</a></li> <li>Firefox link to non-French page by <a href="https://github.com/jdeniau"><code>@jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2219">immutable-js/immutable-js#2219</a></li> <li>Bump esbuild and <code>@size-limit/preset-small-lib</code> by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2217">immutable-js/immutable-js#2217</a></li> <li>backport tests from <a href="https://redirect.github.com/immutable-js/immutable-js/issues/2210">#2210</a> by <a href="https://github.com/jdeniau"><code>@jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2214">immutable-js/immutable-js#2214</a></li> <li>Bump shell-quote from 1.8.2 to 1.8.4 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2211">immutable-js/immutable-js#2211</a></li> <li>Bump <code>@tootallnate/once</code> from 2.0.0 to 2.0.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2190">immutable-js/immutable-js#2190</a></li> <li>Bump minimatch from 9.0.5 to 9.0.9 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2189">immutable-js/immutable-js#2189</a></li> <li>Bump <code>@codemirror/theme-one-dark</code> from 6.1.2 to 6.1.3 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2168">immutable-js/immutable-js#2168</a></li> <li>Bump form-data from 4.0.5 to 4.0.6 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2220">immutable-js/immutable-js#2220</a></li> <li>Bump typescript-eslint from 8.33.0 to 8.61.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2222">immutable-js/immutable-js#2222</a></li> <li>Bump <code>@rollup/plugin-commonjs</code> from 28.0.2 to 29.0.3 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2224">immutable-js/immutable-js#2224</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/chatman-media"><code>@chatman-media</code></a> made their first contribution in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2227">immutable-js/immutable-js#2227</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/immutable-js/immutable-js/compare/v5.1.6...v5.1.7">https://github.com/immutable-js/immutable-js/compare/v5.1.6...v5.1.7</a></p> <h2>v5.1.6</h2> <h2>What's Changed</h2> <ul> <li>fix(reverseFactory): read reversedSequence.size in __iterator instead of this by <a href="https://github.com/jdeniau"><code>@jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2196">immutable-js/immutable-js#2196</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md">immutable's changelog</a>.</em></p> <blockquote> <h2>5.1.9</h2> <ul> <li>fix(List): a <code>List</code> grown past 32 elements while all its values are <code>undefined</code> no longer reads those values back as <code>null</code> (affected <code>get</code>, iteration, <code>toArray</code>, <code>equals</code> and <code>hashCode</code>)</li> </ul> <h2>5.1.8</h2> <ul> <li>fix(List): guard oversized bounds in setListBounds. Fixes CVE <a href="https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735">https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735</a></li> <li>perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE <a href="https://github.com/immutable-js/immutable-js/security/advisories/GHSA-xvcm-6775-5m9r">https://github.com/immutable-js/immutable-js/security/advisories/GHSA-xvcm-6775-5m9r</a></li> </ul> <h2>4.3.9</h2> <ul> <li>fix(List): guard oversized bounds in setListBounds. Fixes CVE <a href="https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735">https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735</a></li> <li>perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE <a href="https://github.com/immutable-js/immutable-js/security/advisories/GHSA-xvcm-6775-5m9r">https://github.com/immutable-js/immutable-js/security/advisories/GHSA-xvcm-6775-5m9r</a></li> </ul> <h2>5.1.7</h2> <ul> <li>fix(Repeat): lastIndexOf returned size instead of size - 1 by <a href="https://github.com/chatman-media"><code>@chatman-media</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2227">immutable-js/immutable-js#2227</a>. Fixes CVE <a href="https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw">CVE-2026-29063 </a></li> <li>fix(IndexedCollection): <code>has(index)</code> on a lazy <code>Seq</code> of unknown size now checks index existence instead of searching for a value equal to the index <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2203">#2203</a></li> <li>[TypeScript]: <code>reduce</code>/<code>reduceRight</code> without an initial value now infer the result type from the collection's values when the reducer returns a value (e.g. <code>list.reduce((a, b) => a + b)</code> infers <code>number</code>), matching <code>Array#reduce</code>. Previously an explicit type argument was required. <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2205">#2205</a></li> </ul> <h2>5.1.6</h2> <ul> <li>fix(reverseFactory): read <code>reversedSequence.size</code> in <code>__iterator</code> instead of this <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2196">#2196</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
a9683a92e6 |
chore(deps): bump brace-expansion from 1.1.12 to 1.1.16 (#5179)
Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.12 to 1.1.16. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/juliangruber/brace-expansion/releases">brace-expansion's releases</a>.</em></p> <blockquote> <h2>v1.1.15</h2> <ul> <li>Backport v5.0.6 change to v1 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/111">#111</a>) 0b09384</li> </ul> <hr /> <p><a href="https://github.com/juliangruber/brace-expansion/compare/v1.1.14...v1.1.15">https://github.com/juliangruber/brace-expansion/compare/v1.1.14...v1.1.15</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
6752a7fd99 |
chore(deps): bump pip from 26.1 to 26.1.2 (#5132)
Bumps [pip](https://github.com/pypa/pip) from 26.1 to 26.1.2. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pypa/pip/blob/main/NEWS.rst">pip's changelog</a>.</em></p> <blockquote> <h1>26.1.2 (2026-05-31)</h1> <h2>Bug Fixes</h2> <ul> <li>Reject <code>console_scripts</code> and <code>gui_scripts</code> entry points whose name would install a script outside the scripts directory. (<code>[#14000](https://github.com/pypa/pip/issues/14000) <https://github.com/pypa/pip/issues/14000></code>_)</li> <li>Fix installation incorrectly failing when the target path contains a doubled slash, such as with <code>pip install --root //...</code>. (<code>[#14001](https://github.com/pypa/pip/issues/14001) <https://github.com/pypa/pip/issues/14001></code>_)</li> <li>Send a consistent <code>Accept-Encoding</code> header to avoid a spurious <code>Cache entry deserialization failed</code> warning. (<code>[#14012](https://github.com/pypa/pip/issues/14012) <https://github.com/pypa/pip/issues/14012></code>_)</li> </ul> <h1>26.1.1 (2026-05-04)</h1> <h2>Bug Fixes</h2> <ul> <li>Fix issue where uninstallation left behind empty directories. Revert the removal of the adjacent <code>__pycache__</code> directory when a .py file is removed. (<code>[#13973](https://github.com/pypa/pip/issues/13973) <https://github.com/pypa/pip/issues/13973></code>_)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
d9ebf2ed0d |
chore(deps): bump vite from 6.4.2 to 6.4.3 (#5026)
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 6.4.2 to 6.4.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/releases">vite's releases</a>.</em></p> <blockquote> <h2>v6.4.3</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md">vite's changelog</a>.</em></p> <blockquote> <h2><!-- raw HTML omitted -->6.4.3 (2026-06-01)<!-- raw HTML omitted --></h2> <ul> <li>fix: backport <a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22572">#22572</a>, reject windows alternate paths (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22576">#22576</a>) (<a href=" |
||
|
dependabot[bot]
|
3ca08551f1 |
chore(deps): bump esbuild from 0.28.0 to 0.28.1 (#5008)
Bumps [esbuild](https://github.com/evanw/esbuild) from 0.28.0 to 0.28.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/evanw/esbuild/releases">esbuild's releases</a>.</em></p> <blockquote> <h2>v0.28.1</h2> <ul> <li> <p>Disallow <code>\</code> in local development server HTTP requests (<a href="https://github.com/evanw/esbuild/security/advisories/GHSA-g7r4-m6w7-qqqr">GHSA-g7r4-m6w7-qqqr</a>)</p> <p>This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a <code>\</code> backslash character. It happened due to the use of Go's <code>path.Clean()</code> function, which only handles Unix-style <code>/</code> characters. HTTP requests with paths containing <code>\</code> are no longer allowed.</p> <p>Thanks to <a href="https://github.com/dellalibera"><code>@dellalibera</code></a> for reporting this issue.</p> </li> <li> <p>Add integrity checks to the Deno API (<a href="https://github.com/evanw/esbuild/security/advisories/GHSA-gv7w-rqvm-qjhr">GHSA-gv7w-rqvm-qjhr</a>)</p> <p>The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.</p> <p>Note that esbuild's Deno API installs from <code>registry.npmjs.org</code> by default, but allows the <code>NPM_CONFIG_REGISTRY</code> environment variable to override this with a custom package registry. This change means that the esbuild executable served by <code>NPM_CONFIG_REGISTRY</code> must now match the expected content.</p> <p>Thanks to <a href="https://github.com/sondt99"><code>@sondt99</code></a> for reporting this issue.</p> </li> <li> <p>Avoid inlining <code>using</code> and <code>await using</code> declarations (<a href="https://redirect.github.com/evanw/esbuild/issues/4482">#4482</a>)</p> <p>Previously esbuild's minifier sometimes incorrectly inlined <code>using</code> and <code>await using</code> declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for <code>let</code> and <code>const</code> declarations by avoiding doing it for <code>var</code> declarations, which no longer worked when more declaration types were added. Here's an example:</p> <pre lang="js"><code>// Original code { using x = new Resource() x.activate() } <p>// Old output (with --minify)<br /> new Resource().activate();</p> <p>// New output (with --minify)<br /> {using e=new Resource;e.activate()}<br /> </code></pre></p> </li> <li> <p>Fix module evaluation when an error is thrown (<a href="https://redirect.github.com/evanw/esbuild/issues/4461">#4461</a>, <a href="https://redirect.github.com/evanw/esbuild/pull/4467">#4467</a>)</p> <p>If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if <code>import()</code> or <code>require()</code> is used to import a module multiple times. The thrown error is supposed to be thrown by every call to <code>import()</code> or <code>require()</code>, not just the first. With this release, esbuild will now throw the same error every time you call <code>import()</code> or <code>require()</code> on a module that throws during its evaluation.</p> </li> <li> <p>Fix some edge cases around the <code>new</code> operator (<a href="https://redirect.github.com/evanw/esbuild/issues/4477">#4477</a>)</p> <p>Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a <code>new</code> expression (specifically an optional chain and/or a tagged template literal). The generated code for the <code>new</code> target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the <code>new</code> target in parentheses. Here is an example of some affected code:</p> <pre lang="js"><code>// Original code new (foo()`bar`)() new (foo()?.bar)() <p>// Old output<br /> new foo()<code>bar</code>();<br /> new (foo())?.bar();</p> <p></code></pre></p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/evanw/esbuild/blob/main/CHANGELOG.md">esbuild's changelog</a>.</em></p> <blockquote> <h2>0.28.1</h2> <ul> <li> <p>Disallow <code>\</code> in local development server HTTP requests (<a href="https://github.com/evanw/esbuild/security/advisories/GHSA-g7r4-m6w7-qqqr">GHSA-g7r4-m6w7-qqqr</a>)</p> <p>This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a <code>\</code> backslash character. It happened due to the use of Go's <code>path.Clean()</code> function, which only handles Unix-style <code>/</code> characters. HTTP requests with paths containing <code>\</code> are no longer allowed.</p> <p>Thanks to <a href="https://github.com/dellalibera"><code>@dellalibera</code></a> for reporting this issue.</p> </li> <li> <p>Add integrity checks to the Deno API (<a href="https://github.com/evanw/esbuild/security/advisories/GHSA-gv7w-rqvm-qjhr">GHSA-gv7w-rqvm-qjhr</a>)</p> <p>The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.</p> <p>Note that esbuild's Deno API installs from <code>registry.npmjs.org</code> by default, but allows the <code>NPM_CONFIG_REGISTRY</code> environment variable to override this with a custom package registry. This change means that the esbuild executable served by <code>NPM_CONFIG_REGISTRY</code> must now match the expected content.</p> <p>Thanks to <a href="https://github.com/sondt99"><code>@sondt99</code></a> for reporting this issue.</p> </li> <li> <p>Avoid inlining <code>using</code> and <code>await using</code> declarations (<a href="https://redirect.github.com/evanw/esbuild/issues/4482">#4482</a>)</p> <p>Previously esbuild's minifier sometimes incorrectly inlined <code>using</code> and <code>await using</code> declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for <code>let</code> and <code>const</code> declarations by avoiding doing it for <code>var</code> declarations, which no longer worked when more declaration types were added. Here's an example:</p> <pre lang="js"><code>// Original code { using x = new Resource() x.activate() } <p>// Old output (with --minify)<br /> new Resource().activate();</p> <p>// New output (with --minify)<br /> {using e=new Resource;e.activate()}<br /> </code></pre></p> </li> <li> <p>Fix module evaluation when an error is thrown (<a href="https://redirect.github.com/evanw/esbuild/issues/4461">#4461</a>, <a href="https://redirect.github.com/evanw/esbuild/pull/4467">#4467</a>)</p> <p>If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if <code>import()</code> or <code>require()</code> is used to import a module multiple times. The thrown error is supposed to be thrown by every call to <code>import()</code> or <code>require()</code>, not just the first. With this release, esbuild will now throw the same error every time you call <code>import()</code> or <code>require()</code> on a module that throws during its evaluation.</p> </li> <li> <p>Fix some edge cases around the <code>new</code> operator (<a href="https://redirect.github.com/evanw/esbuild/issues/4477">#4477</a>)</p> <p>Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a <code>new</code> expression (specifically an optional chain and/or a tagged template literal). The generated code for the <code>new</code> target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the <code>new</code> target in parentheses. Here is an example of some affected code:</p> <pre lang="js"><code>// Original code new (foo()`bar`)() new (foo()?.bar)() <p>// Old output<br /> new foo()<code>bar</code>();<br /> new (foo())?.bar();<br /> </code></pre></p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
Abdo
|
5dec1b08ca |
chore: Bump anki-audio to 0.2.3 (#5409)
## Linked issue #5363 ## Summary Bump anki-audio to 0.2.3 to include the macOS fix in #5363 published in https://github.com/ankitects/anki/actions/runs/32881525829 ## How to test Do a quick test for audio playback/recording. |
||
|
dependabot[bot]
|
0caa12eafc |
chore(ci): bump the actions group with 3 updates (#5311)
Bumps the actions group with 3 updates: [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv), [taiki-e/install-action](https://github.com/taiki-e/install-action) and [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish). Updates `astral-sh/setup-uv` from 7.6.0 to 9.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/setup-uv/releases">astral-sh/setup-uv's releases</a>.</em></p> <blockquote> <h2>v9.0.0 🌈 Change <code>prune-cache</code> default to <code>false</code></h2> <h2>Changes</h2> <p>This release disables the default cache cache pruning to ease the load on the PyPi infrastructure. Since users might experience more GitHub Actions cache usage which might result in higher costs this is marked as a breaking change. To read more on why we did this (now) you can read the detailed analysis and reasoning in <a href="https://redirect.github.com/astral-sh/setup-uv/issues/967">#967</a></p> <p>Besides this big breaking change we also have a small bugfix while building caches for linux distributions that behave a big different than the "big ones" and a speed up in version resolution by only reading the version manifest until a matching version is found saving runtime and network bandwith.</p> <h2>🚨 Breaking changes</h2> <ul> <li>Change <code>prune-cache</code> default to <code>false</code> <a href="https://github.com/charliermarsh"><code>@charliermarsh</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/967">#967</a>)</li> </ul> <h2>🐛 Bug fixes</h2> <ul> <li>fix: fall back to distribution ID when os-release has no version field <a href="https://github.com/cxzhong"><code>@cxzhong</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/961">#961</a>)</li> </ul> <h2>🚀 Enhancements</h2> <ul> <li>Speed up version client by partial response reads <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/807">#807</a>)</li> </ul> <h2>🧰 Maintenance</h2> <ul> <li>chore: update known checksums for 0.11.30 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/968">#968</a>)</li> <li>chore: update known checksums for 0.11.29 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/960">#960</a>)</li> </ul> <h2>📚 Documentation</h2> <ul> <li>docs: update version references to v8.3.2 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/949">#949</a>)</li> </ul> <h2>⬆️ Dependency updates</h2> <ul> <li>chore(deps): roll up Dependabot updates <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/970">#970</a>)</li> <li>chore(deps): roll up Dependabot updates <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/962">#962</a>)</li> </ul> <h2>v8.3.2 🌈 update known checksums for 0.11.28</h2> <h2>Changes</h2> <p>Just a maintenance release</p> <h2>🧰 Maintenance</h2> <ul> <li>chore: update known checksums for 0.11.28 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/947">#947</a>)</li> </ul> <h2>📚 Documentation</h2> <ul> <li>docs: update version references to v8.3.1 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/946">#946</a>)</li> </ul> <h2>⬆️ Dependency updates</h2> <ul> <li>chore: roll up Dependabot updates <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/948">#948</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
Sadra
|
7e84d98d49 |
docs: sync post-migration manual updates (#5393)
## Linked issue (required) Closes #5392 ## Summary / motivation (required) Ports accepted manual updates that landed in the legacy `ankitects/anki-manual` repository after the unified documentation site was created: - sync-server credential setup from `c73d6a0` - generic search-engine wording and corrected links from `d39ce8e` - multi-card cloze syntax and the corrected GNOME link from `b230826` This keeps the canonical English manual current before adding the Persian translation based on the same source revision. ## Steps to reproduce (required, use N/A if not applicable) N/A ## How to test (required) ### Checklist (minimum) - [x] Ran an equivalent documentation-focused check (`git diff --check`). - [x] Tests are not applicable to this documentation-only content sync. ### Details The six changed MDX files were parsed successfully with the Mintlify MDX parser during migration preparation. The repository's Docs Site workflow will run the authoritative Mintlify validation and accessibility checks on this PR. ## Before / after behavior (optional) The unified manual was missing several updates already accepted in the legacy manual repository. The corresponding pages now include them. ## Risk / compatibility / migration (optional) Documentation-only; no runtime behavior changes. ## UI evidence (required for visual changes; otherwise N/A) N/A ## Scope - [x] This PR is focused on one change (no unrelated edits). |