chore(release): promote release to master#42047
Open
appsmith-smithes[bot] wants to merge 36 commits into
Open
Conversation
## Summary Batch security update via resolutions/version bumps. ### Resolved alerts - Resolves #675 — js-yaml → ^3.15.0 (medium severity) No code changes — version bumps and resolutions only. /ok-to-test tags="@tag.All" <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/28928697841> > Commit: 5cb7fa9 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=28928697841&attempt=2" target="_blank">Cypress dashboard</a>. > Tags: `@tag.All` > Spec: > <hr>Wed, 08 Jul 2026 10:53:52 UTC <!-- end of auto-generated comment: Cypress test results --> Co-authored-by: appsmith-smithes[bot] <appsmith-smithes[bot]@users.noreply.github.com>
## Description > [!TIP] > _Add a TL;DR when the description is longer than 500 words or extremely technical (helps the content, marketing, and DevRel team)._ > > _Please also include relevant motivation and context. List any dependencies that are required for this change. Add links to Notion, Figma or any other documents that might be relevant to the PR._ Fixes https://linear.app/appsmith/issue/APP-15377/removal-of-controller-layer > [!WARNING] > _If no issue exists, please create an issue first, and check with the maintainers if the issue is valid._ ## Automation /ok-to-test tags="@tag.Git" ### 🔍 Cypress test results <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/28963240802> > Commit: d0bdd99 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=28963240802&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.Git` > Spec: > <hr>Wed, 08 Jul 2026 17:58:38 UTC <!-- end of auto-generated comment: Cypress test results --> ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [ ] No <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Revert** * Removed the Git management endpoints from the application, including connect/disconnect, branch operations, commit/push/pull, merge checks, import flows, protected branch settings, and auto-commit controls. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary CE `release` currently **does not compile**. PR #41968 ("git controller delete") removed `GitControllerCE` but left its orphaned subclass `GitController`, which still `extends GitControllerCE` / imports the deleted class — the **only** remaining reference: ``` GitController.java: cannot find symbol — class GitControllerCE ``` This deletes the legacy `GitController` shell, completing the removal. It had no routes of its own (just `@RequestMapping(Url.GIT_URL)` + `extends GitControllerCE` + a constructor); the git API is served by the newer `git/controllers` layer — `GitApplicationController` (`GIT_APPLICATION_URL`, owns `create-ref`) and `GitArtifactController` (`GIT_ARTIFACT_URL`). **EE already removed this shell in #9281 and runs without it**, so this brings CE in line with the intended end state. ## Verification A local build is blocked by toolchain (server requires JDK 25), but the deletion is confirmed safe by: - **No code references the concrete `GitController` class** anywhere (Spring component-scan controller, referenced by nobody). - **EE `release` already compiles and passes `server-unit-tests` without this class** — a real compile proof from a JDK-25 environment. ## Note on CI Ironically, this PR's own `server-unit-tests` reports green **without compiling**, because the `changed-files` path gate misses the server-file deletion and skips the Build step (the same false-pass that let #41968 break `release`). That gate defect is real but **separate** — being handled in its own change. `fetch-depth` was investigated and ruled out as the cause. <!-- This is an auto-generated comment: Cypress test results --> > [!WARNING] > Tests have not run on the HEAD 32da40d yet > <hr>Thu, 09 Jul 2026 15:24:24 UTC <!-- end of auto-generated comment: Cypress test results --> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
**Linear:** [APP-15350](https://linear.app/appsmith/issue/APP-15350) ## Summary Defense-in-depth hardening of the Docker image. The bundled internal services are bound to the loopback interface (`127.0.0.1`) by default so they only accept connections from within the container and are not reachable over the container's bridge network interface. ## Changes - **RTS** (`server.ts`): bind the RTS listener to `127.0.0.1`. - **Backend server** (`application-ce.properties`): default `server.address` to `127.0.0.1` (overridable via `APPSMITH_SERVER_ADDRESS`). - **Redis** (`entrypoint.sh`): add `bind 127.0.0.1 -::1` to the generated Redis config. These services are internal to the image and are fronted by the in-container Caddy proxy, so they do not need to listen on the container's external interfaces. ## Testing All services continue to be reached through the existing in-container proxy paths. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * RTS server now binds to an explicit configured host by defaulting to loopback (`127.0.0.1`) and using the configured RTS port. * App server now defaults to loopback (`127.0.0.1`) unless overridden by `APPSMITH_SERVER_ADDRESS`. * Redis now listens only on loopback (`127.0.0.1`/`::1`) by default for safer local-only access. * **Documentation** * Updated Docker documentation to reflect **Caddy** supervision and restart examples instead of **Nginx**. <!-- end of auto-generated comment: release notes by coderabbit.ai --> <!-- This is an auto-generated comment: Cypress test results --> > [!WARNING] > Tests have not run on the HEAD d685989 yet > <hr>Wed, 08 Jul 2026 14:59:26 UTC <!-- end of auto-generated comment: Cypress test results --> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…nset (GHSA-xfc5-796c-7hr9) (#41964) ## What The `/actuator/**` management endpoints are protected by HTTP Basic auth that compares the supplied password against `APPSMITH_INTERNAL_PASSWORD`. That variable defaults to an empty string when unset (`application-ce.properties`: `appsmith.internal.password=${APPSMITH_INTERNAL_PASSWORD:}`), so the check `"".equals("")` succeeds for any request sending empty Basic Auth credentials — granting the `INTERNAL` authority and bypassing authentication on the actuator endpoints. This guards the comparison so an unset/empty configured password never authenticates any caller. All `/actuator/**` requests then return `401` until an operator explicitly sets `APPSMITH_INTERNAL_PASSWORD`. ## Why it matters - On a default deployment the exposed actuator surface is `prometheus` and `metrics` (per `application-ee.properties`), plus `health` on CE — so the practical pre-fix impact is unauthenticated read access to operational metrics, not secrets. - Impact escalates if an operator widens `management.endpoints.web.exposure.include` (e.g. to include `env`/`heapdump`). - Ref: GHSA-xfc5-796c-7hr9 (and duplicate GHSA-8pr2-629w-7q87). ## Change Single-file change in `SecurityConfig.internalWebFilterChain`. No new imports (uses `String.isEmpty()`), so the hunk applies cleanly to EE via the hourly sync. ## Testing - Before: `curl -u 'anyuser:' https://<host>/actuator/prometheus` → `200` - After: same request → `401`; `200` only when `APPSMITH_INTERNAL_PASSWORD` is set and matched. 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved access handling for internal actuator endpoints when basic authentication credentials are empty or missing. * Prevented empty or unset internal passwords from being treated as a valid match, so requests now correctly follow the unauthenticated path when no valid credentials are configured. <!-- end of auto-generated comment: release notes by coderabbit.ai --> <!-- This is an auto-generated comment: Cypress test results --> > [!WARNING] > Tests have not run on the HEAD 2b58fc3 yet > <hr>Wed, 08 Jul 2026 02:34:56 UTC <!-- end of auto-generated comment: Cypress test results --> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
## Summary Batch security update via resolutions/version bumps. ### Resolved alerts - Resolves #660 — ws → ^8.21.0 (transitive npm dep bumped via resolutions; addresses DoS vulnerability) ### Skipped - #676 echarts → 6.1.0 (major bump 5.x → 6.x, skip) - #654 @opentelemetry/core → 2.8.0 (major bump 1.x → 2.x, skip) No code changes — resolutions entry only. /ok-to-test tags="@tag.All" <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/28990538280> > Commit: b30be0e > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=28990538280&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.All` > Spec: > <hr>Thu, 09 Jul 2026 04:08:54 UTC <!-- end of auto-generated comment: Cypress test results --> Co-authored-by: appsmith-smithes[bot] <appsmith-smithes[bot]@users.noreply.github.com>
## Description A potential corruption of repo is a possible when git in memory feature is active and git repo is cached in redis, A sanity check has been placed for git operations when repository is downloaded from Redis. It checks - Presence of .git folder - Compares checksum of repo with branch key Fixes #https://linear.app/appsmith/issue/APP-15285/git-connection-issue-persists-for-appsmith-treasury-app ## Automation /ok-to-test tags="@tag.Git" ### 🔍 Cypress test results <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/29080326412> > Commit: 6cbf5a2 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=29080326412&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.Git` > Spec: > <hr>Fri, 10 Jul 2026 08:54:58 UTC <!-- end of auto-generated comment: Cypress test results --> ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [ ] No <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved reliability when loading cached Git data by verifying repository integrity and branch information before continuing. * Automatically clears invalid cached data and stops the download if the repository looks corrupted or incomplete. * Added checks for missing Git metadata, missing branches, and mismatched commit data. * **Tests** * Added coverage for Git repository sanity checks, including valid repositories and several invalid repository states. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
…tities during import (#41972) ## Problem Creating a git branch (`create-ref`) imports the exported artifact, and the import reconciles entities against **all sibling branches** via `getExistingResourcesInOtherBranchesFlux`. Both the `ActionCollection` and `NewAction` implementations fetched **full documents** across every branch `applicationId` with no projection, pulling the heavy `unpublished*/published*` action bodies for thousands of entities in a single transaction. For git-connected apps with many branches this can exceed Mongo's `transactionLifetimeLimitSeconds`, aborting the transaction with `TransactionExceededLifetimeLimitSeconds` and making branch operations fail. Observed in a customer environment: an `applicationId $in [~120 ids]` read on `actionCollection` returning ~15k documents (~400 MB, ~27 KB/doc) inside the import transaction, killed at 60s. ## Fix Pass a field projection (`id, baseId, applicationId, gitSyncId, policies`) instead of `null` so only the fields the import actually consumes are loaded. This mirrors the existing `NewPage` import path, which already projects exactly these fields for the same other-branches lookup. ## Why this is safe The sibling-branch objects are **read-only** during import: only `gitSyncId` (the lookup map key) and `baseId`/`id` (base-id resolution) are consumed downstream, and these objects are never mutated or written back to Mongo. Projecting away the heavy body fields cannot cause data loss. ## Automation /ok-to-test tags="@tag.ImportExport" ## Scope - `ActionCollectionApplicationImportableServiceCEImpl.getExistingResourcesInOtherBranchesFlux` - `NewActionApplicationImportableServiceCEImpl.getExistingResourcesInOtherBranchesFlux` `ModuleInstanceApplicationImportableServiceImpl` has the same `null`-projection pattern and will be addressed separately. <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/29083663032> > Commit: 162f736 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=29083663032&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.ImportExport` > Spec: > <hr>Fri, 10 Jul 2026 10:03:20 UTC <!-- end of auto-generated comment: Cypress test results --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved branch import reliability by restricting lookups to only the fields required for matching and resolution, instead of loading full documents. * This reduces unnecessary data retrieval and processing during cross-branch comparisons, making imports more efficient and consistent. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: sondermanish <manish@appsmith.com>
…ll (#41975) ## Problem `GitUtilsTest.isRepoPrivate` intermittently fails in CI with `expected: false`. The test asserted against **real** URLs — including `github.com/appsmithorg/appsmith` — and `GitUtils.isRepoPrivate` performs a **live HTTP GET** against the repo URL (2xx ⇒ public, otherwise/error ⇒ private) with a **2-second timeout**: ```java return WebClientUtils.create(remoteHttpsUrl).get() .httpRequest(r -> r.getNativeRequest().responseTimeout(Duration.ofSeconds(2))) .exchange() .flatMap(resp -> Mono.just(!resp.statusCode().is2xxSuccessful())) .onErrorResume(t -> Mono.just(Boolean.TRUE)); // error ⇒ assume private ``` So whenever the CI runner can't reach GitHub within 2s (shared-runner rate-limits, DNS blips), the error path returns `TRUE` (private) and the `expected: false` (public) assertion fails — non-deterministically, independent of the change under test. This is almost certainly the flake behind the intermittently-red scheduled release builds too. ## Fix Make the test hermetic: mock `WebClientUtils.create` so the request hits a local `MockWebServer` instead of the internet, and assert the real branching logic deterministically — **200 ⇒ public**, **404 ⇒ private**. `WebClientUtils.create` is mocked (rather than pointing `isRepoPrivate` straight at the loopback server) because it wraps every `WebClient` in an SSRF host filter that would block a loopback address. URL-conversion coverage is untouched — `convertSshUrlToBrowserSupportedUrl` has its own dedicated test. No new dependencies (`mockwebserver` + `mockito-inline` are already test deps). Verified locally on JDK 25: `Tests run: 18, Failures: 0`. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Updated repository privacy checks to use fully mocked HTTP responses instead of real network calls. * Added coverage for both accessible and inaccessible repository responses, improving test reliability and stability. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
…go replica-set error (#41963) ## Description `ConnectionErrors_Spec.ts`'s "3. Mongo connection errors" test asserts the exact same toast message twice in a row (`REPLICA_SET connections should not be given a port...`) — once right after switching Connection type to "Replica set", and again right after filling in host/port. Every other repeated-message check in this same spec calls `WaitUntilAllToastsDisappear()` in between; this one didn't. Toastify doesn't reliably mount a new DOM node for an identical message while the previous instance is still visible/fading, so the second `ValidateToastMessage` call can time out waiting for `div.Toastify__toast` — intermittently, depending on exact timing. This caused a real CI failure on an unrelated release-promotion PR ([EE #9268](appsmithorg/appsmith-ee#9268) / [CE #41961](#41961)), reproduced consistently across 3 retries in that run. Fix: add the same `WaitUntilAllToastsDisappear()` call used elsewhere in this spec before the second identical-message check. ## Root cause detail From the failing run's logs: the backend correctly returned the `TEST_DATASOURCE_ERROR` action with the replica-set-port error message both times (confirmed via the intercepted `@testDatasource` XHR), so this is a test-timing issue, not a backend regression. ## Test plan - [ ] `ConnectionErrors_Spec.ts` passes reliably in CI (no test-plugin infra changes required, so no server-side test coverage needed) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Improved regression coverage for MongoDB connection error handling. * Added a wait for error notifications to clear before continuing through the rest of the validation flow, making the test more reliable. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Description CE PR for the EE pr appsmithorg/appsmith-ee#9294 - This Pr is about removal of removal of commonGitService interface and its implementation - It also deletes some of existing test cases which has been successfully migrated/duplicated with the new service. - it contains some test cases which needs to be migrated to the newer git service, hence those are disabled for now. Fixes #https://linear.app/appsmith/issue/V2-5516/removal-of-service-layer ## Automation /ok-to-test tags="@tag.Git" ### 🔍 Cypress test results ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [ ] No <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/29307122107> > Commit: f9755e5 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=29307122107&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.Git` > Spec: > <hr>Tue, 14 Jul 2026 05:12:24 UTC <!-- end of auto-generated comment: Cypress test results --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Centralized Git profile handling via the Git profile utility. * Removed deprecated Git service interfaces/implementations and related compatibility layers. * **Tests** * Removed the Git branches end-to-end integration test suite. * Added a larger Git service end-to-end test class, currently disabled. * Updated user data tests to use the consolidated Git profile utility. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary - Replaces the pod-based and individual-based CODEOWNERS rules with a single blanket rule owned by the new `@appsmithorg/core-owners` team. - `core-owners` team members: `subrata71`, `sondermanish`, `wyattwalter`, `tomjose92`, `sebastianiv21`, `amelia-c0n`. - Team has been granted `push` (write) access to this repo, which GitHub requires for a team to be a valid CODEOWNERS entry. ## Changes - `CODEOWNERS`: replaced all pod (`@appsmithorg/widgets-blocks`, `ai-agents-fe`, `ai-agents-be`, `wds-team`, `v1-be`, `v1-fe`, `git-be-reviewers`, `git-fe-reviewers`, `v1-devops`) and individual (`@riodeuno`, `@nilanshbansal`, `@sharat87`, `@abhvsn`) ownership rules with a single `* @appsmithorg/core-owners` rule. ## Test Plan - [ ] GitHub UI shows no "invalid codeowners" warning on this PR - [ ] Confirm `core-owners` team is requested as a reviewer once merged and branch protection is updated to require code owner review <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Simplified repository ownership configuration by consolidating path ownership under a single core ownership rule. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Description **TL;DR:** `<a href="mailto:...">` (and `tel:`, `ftp:`, `sms:`, `file:` links) in the Text widget rendered as broken `http://mailto:...` hrefs. The link-sanitizing helper now recognizes these safe schemes and leaves them untouched. The Text widget runs every href in its HTML through a sanitizing `LinkFilter` (`app/client/src/widgets/TextWidget/component/index.tsx`), which calls `addHttpIfMissing`. That helper had exactly one rule: if the value doesn't start with the literal string `"http"`, prepend `http://`. It was written so scheme-less links like `www.appsmith.com` don't get treated as relative URLs, but it had no concept of other protocols — so `mailto:tom@appsmith.com` failed the prefix check and came out as `http://mailto:tom@appsmith.com`. The same mangling hit `tel:`, `ftp:`, etc. The Interweave library the widget uses for rendering explicitly allows `mailto:` links, so this was purely the helper breaking them. The Table widget's HTML cell (TableWidgetV2) reuses the same filter and had the same bug. **The fix:** `addHttpIfMissing` (`app/client/src/widgets/TextWidget/component/helpers.tsx`) now recognizes an explicit scheme via a case-insensitive allowlist — `http`, `https`, `mailto`, `tel`, `ftp`, `file`, `sms`, mirroring the set already used in `utils/validation/getIsSafeURL.ts` — and leaves those values untouched. Scheme-less values still get `http://` prepended as before, and unsafe schemes like `javascript:` are still neutralized the same way they were (Interweave also refuses to render such anchors, so no XSS regression). Added `helpers.test.ts` covering safe schemes (including uppercase), scheme-less URLs, `javascript:` neutralization, and empty values. Fixes: no linked issue — fixes broken `mailto:` links reported in the Text widget. ## Automation /ok-to-test tags="@tag.All" ### 🔍 Cypress test results <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/29401331502> > Commit: 3b6b3e5 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=29401331502&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.All` > Spec: > <hr>Wed, 15 Jul 2026 09:47:27 UTC <!-- end of auto-generated comment: Cypress test results --> ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [x] No 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01PADWnYmHqjAM7nAfXzdPCQ --- _Generated by [Claude Code](https://claude.ai/code/session_01PADWnYmHqjAM7nAfXzdPCQ)_ <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved link handling by preserving explicitly supported URL schemes (including HTTP/HTTPS, email, telephone, SMS, and FTP) unchanged. * For unsupported or unsafe schemes, inputs are automatically normalized by prepending `http://` to prevent unexpected behavior. * Links without a scheme now reliably receive an `http://` prefix. * Empty inputs and already-safe links remain unchanged. * **Tests** * Added Jest coverage to verify the updated scheme-preserving and unsafe-scheme neutralization behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude <noreply@anthropic.com>
…41995) ## Summary Fixes an open redirect vulnerability (APP-15347) where an attacker could forge the `Origin` HTTP header on `POST /api/v1/login` to redirect authenticated users to an external domain. **Root cause:** `isSafeRedirectUrl()` used the client-supplied `Origin` header as both the redirect URL builder and the trust anchor. A forged `Origin: https://evil.com` passed validation because the redirect host trivially matched the Origin host (`evil.com == evil.com`). **Fix:** Introduces `getTrustedOrigin()` which cross-checks the `Origin` header against the request's `Host` / `X-Forwarded-Host` (set by the reverse proxy, not the client). All four call sites that previously read Origin directly now use this helper: - `isSafeRedirectUrl()` — no longer uses forged Origin as the validation baseline - `fulfillRedirectUrl()` — no longer prepends forged Origin to relative redirect paths - `sanitizeRedirectUrl()` — no longer uses forged Origin in the fallback URL - `getRedirectUrl()` (fork-app path) — no longer uses forged Origin for URL construction When no `Host` / `X-Forwarded-Host` is available (unusual environments without proxy headers), Origin is still trusted to preserve backward compatibility. ## Test plan - [x] Added unit test `testForgedOriginHeaderIsBlockedWhenHostDiffers` — confirms forged Origin is rejected and sanitized URL does not contain the attacker domain - [x] All 69 existing `RedirectHelperOpenRedirectTest` tests pass (0 failures, 0 errors) ## Linear ticket https://linear.app/appsmith/issue/APP-15347/security-low-open-redirect-via-improper-validation-of-origin-header-on <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **Bug Fixes** * Strengthened open-redirect protection by only trusting the `Origin` header when it matches the inbound request host (including effective port), derived from `X-Forwarded-Host`/`Host` (and forwarded port when present). * Updated redirect validation and fallback URL generation to prevent forged origin values from being used or leaked. * **Tests** * Added open-redirect regression coverage for forged `Origin` handling, proxy-style `X-Forwarded-Host` behavior, and IPv4/IPv6 same-host different-port edge cases. <!-- end of auto-generated comment: release notes by coderabbit.ai --> ## Automation /ok-to-test tags="@tag.All" <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/29393469419> > Commit: fea4a4a > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=29393469419&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.All` > Spec: > <hr>Wed, 15 Jul 2026 07:24:36 UTC <!-- end of auto-generated comment: Cypress test results -->
Users building apps in non-English languages (e.g. German) experience corrupted UI text because browsers and translation extensions see <html lang="en"> and auto-translate page content — sometimes German-to-German, sometimes misinterpreting English UI words like "Content" as the French adjective (translated to "Thrilled"). This PR fixes the problem at three layers: Immediate defence: Adds translate="no" and <meta name="google" content="notranslate"> to the app shell HTML, editor UI containers (PropertyPane tabs, App Settings), and widget iframe templates. This stops browsers from offering or performing auto-translation. Per-app language setting: Adds an "HTML Language" field to App Settings > General. App builders can enter a BCP 47 language code (e.g. de, fr, ja) that gets persisted as htmlLang on ApplicationDetail and applied to the published app's <html lang=""> attribute at runtime via react-helmet. Instance-level default: Adds APPSMITH_DEFAULT_HTML_LANG environment variable for self-hosted admins who want all apps on their instance to default to a specific language. Falls back gracefully to "en" when the variable is not set. ## Description > [!TIP] > _Add a TL;DR when the description is longer than 500 words or extremely technical (helps the content, marketing, and DevRel team)._ > > _Please also include relevant motivation and context. List any dependencies that are required for this change. Add links to Notion, Figma or any other documents that might be relevant to the PR._ Fixes #`6642` ## Automation /ok-to-test tags="@tag.All" ### 🔍 Cypress test results <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/29444417195> > Commit: 2e8764c > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=29444417195&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.All` > Spec: > <hr>Wed, 15 Jul 2026 20:40:33 UTC <!-- end of auto-generated comment: Cypress test results --> ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [ ] No <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added an **“HTML language”** setting to General Settings (BCP 47), with validation, persistence, and an environment-configurable default. * **Behavior** * Published apps now apply the chosen (or default) HTML `lang` to the document metadata. * App pages, loading screens, and embedded/iframe content now opt out of automatic translation via `translate="no"` and Google `notranslate` where applicable. * **Tests** * Added unit tests covering HTML language input validation and normalization. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: subratadeypappu <subrata@appsmith.com> Co-authored-by: Luis Ibarra <98054342+sebastianiv21@users.noreply.github.com> Co-authored-by: Luis Ibarra <luissebastianibarrav@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
…us users [APP-15344] (#42001) ## Summary Fixes [APP-15344](https://linear.app/appsmith/issue/APP-15344): the unauthenticated `/api/v1/tenants/current` endpoint was returning internal configuration fields (Google Maps API key, license details, migration status, feature flags) to anonymous callers. This is the **CE portion** of the fix. The EE superset PR is [appsmith-ee#9305](appsmithorg/appsmith-ee#9305) (all server tests passing). **Approach:** Service-layer filtering strips post-login-only fields when the current user is anonymous, following the same pattern as APP-14994 (PR #41598). Only fields required by the login/signup page are preserved (branding, auth method flags, instance name, third-party auth list). Authenticated users receive the full unmodified response. **CE fields stripped for anonymous users:** - `googleMapsKey` (plaintext API key) - Full `license` envelope (replaced with minimal `{plan: FREE}`) - `isSignupDisabled`, `emailVerificationEnabled`, `isStrongPasswordPolicyEnabled` - `isAtomicPushAllowed`, `featuresWithPendingMigration`, `migrationStatus` - `pricingPlan` (Organization-level) **Changes:** 1. `OrganizationConfigurationCE.stripFieldsForAnonymousUser()` — strips CE config fields 2. `OrganizationServiceCEImpl.suppressFieldsForAnonymousUser()` — checks security context, calls strip if anonymous 3. `OrganizationServiceCEImpl.stripOrganizationFieldsForAnonymousUser()` — strips Organization-level fields (overridable by EE) ## Test Plan - [x] `getOrganizationConfig_AnonymousUser_StripsInternalConfiguration` — verifies sensitive fields are null - [x] `getOrganizationConfig_AnonymousUser_PreservesLoginPageFields` — verifies login-page fields remain - [x] `getOrganizationConfig_AuthenticatedUser_ExposesFullConfiguration` — no regression for authenticated users - [ ] Existing APP-14994 tests pass (instanceId/adminEmailDomainHash stripping) /ok-to-test tags="@tag.All" <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/29452470909> > Commit: 151a92e > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=29452470909&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.All` > Spec: > <hr>Wed, 15 Jul 2026 22:42:14 UTC <!-- end of auto-generated comment: Cypress test results --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Security** * Anonymous users now receive only minimal organization configuration and license details. * Sensitive settings, pricing information, and privilege-related fields are hidden from unauthenticated access. * **Bug Fixes** * Authenticated users continue to receive complete organization configuration details, including updated settings. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
…#42002) Bumps [websocket-driver](https://github.com/faye/websocket-driver-node) from 0.7.4 to 0.7.5. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/faye/websocket-driver-node/blob/main/CHANGELOG.md">websocket-driver's changelog</a>.</em></p> <blockquote> <h3>0.7.5 / 2026-06-04</h3> <ul> <li>Close a draft-75/76 connection if a length header grows to exceed the configured max length</li> <li>Fail the connection if a message is larger than the configured max length after extension processing</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/faye/websocket-driver-node/commit/5d6a9aaf5f019007d917bd9ddc7eeb775c86cc1f"><code>5d6a9aa</code></a> Bump version to 0.7.5</li> <li><a href="https://github.com/faye/websocket-driver-node/commit/c55679a5b18251dd0a55d18a0cc6a4fd8822b92f"><code>c55679a</code></a> Fail the connection if a message is larger than the configured max length aft...</li> <li><a href="https://github.com/faye/websocket-driver-node/commit/5b197ca874dab58e96cacad8a3c256797d804680"><code>5b197ca</code></a> Close a draft-75/76 connection if a length header grows to exceed the configu...</li> <li><a href="https://github.com/faye/websocket-driver-node/commit/fc93a48f879d0fd4a77c687a4a19c4328613df65"><code>fc93a48</code></a> Test on Node v22, v24, and v26</li> <li><a href="https://github.com/faye/websocket-driver-node/commit/2e82d3464d294bdd11202657208636e667212335"><code>2e82d34</code></a> Test on recent versions of Node</li> <li><a href="https://github.com/faye/websocket-driver-node/commit/e4962db9940ad1a8cf6fe8328d3b81c3f8c37479"><code>e4962db</code></a> Switch from Travis CI to GitHub Actions</li> <li><a href="https://github.com/faye/websocket-driver-node/commit/3f2f9b70a8ae999b4657d26316a5d45b7caea679"><code>3f2f9b7</code></a> Travis update: cache npm modules, remove sudo, run on Node 15</li> <li>See full diff in <a href="https://github.com/faye/websocket-driver-node/compare/0.7.4...0.7.5">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/appsmithorg/appsmith/network/alerts). </details> <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/29494564049> > Commit: fc27630 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=29494564049&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.All` > Spec: > <hr>Thu, 16 Jul 2026 12:33:00 UTC <!-- end of auto-generated comment: Cypress test results --> ## Automation /ok-to-test tags="@tag.All" Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…rk address (#41985) ## What Adds a defense-in-depth SSRF protection so a user-defined datasource cannot connect to the Appsmith instance's own network address. ## Why The SSRF host filter (`RestrictedHostFilter`) intentionally allows private-network (RFC 1918 / site-local) addresses so that legitimate customer datasources on private networks keep working. In a typical Docker/Kubernetes deployment the instance's own routable address is itself a private/site-local address, so it falls inside that allowed range. As a hardening measure, this change blocks that one target — the instance's own address — without restricting the rest of the private network. ## How - Registers the instance's own hostname(s) at startup (from the local hostname and the `HOSTNAME` environment variable) and resolves them to their current address(es), mirroring the existing internal-Redis host registration. Resolution is live per check, so an instance whose address changes stays covered with no cached-address bookkeeping. - Blocks a datasource whose target is a registered own hostname, or resolves to one of the instance's own addresses. Enforced consistently across the datasource egress paths — WebClient (REST/GraphQL/SaaS), Elasticsearch, Redis, and datasource validation — evaluating the address already resolved by each path, so no additional lookup of the user-supplied host is introduced. - Only the instance's own address(es) are affected; other private-network datasources continue to work unchanged. - Coverage is best-effort for the address(es) the registered hostname(s) resolve to (the primary, hostname-mapped address), not a full network-interface enumeration. ## Testing - Unit tests cover rejection of the own address through each enforcement entry point (raw IPv4 literal, IPv4-mapped IPv6, and hostname), confirm other private-network addresses stay allowed, and confirm the existing SSRF kill-switch still applies. Own-address resolution is injected in tests, so the suite has no external DNS dependency. - `appsmith-interfaces` module tests pass. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Security Enhancements** * Strengthened SSRF protection by blocking outbound requests that target the application’s own hostname or any resolved IP addresses associated with it. * Expanded detection to cover multiple address representations (including IPv4 literals and IPv4-mapped IPv6). * Added startup registration of the instance’s own hostname(s) and environment hostname with graceful fallback if resolution fails. * Preserved the existing allow/deny behavior for other private network targets and the SSRF bypass setting. * **Tests** * Added deterministic test coverage for own-host blocking, caching behavior, and SSRF bypass across all relevant enforcement paths. <!-- end of auto-generated comment: release notes by coderabbit.ai --> <!-- This is an auto-generated comment: Cypress test results --> > [!WARNING] > Tests have not run on the HEAD 1d3d64d yet > <hr>Mon, 13 Jul 2026 19:13:41 UTC <!-- end of auto-generated comment: Cypress test results --> --------- Co-authored-by: Claude <noreply@anthropic.com>
…nd remove unused routes (#41996) ## What Makes two unauthenticated email endpoints return a consistent response regardless of whether an account exists, and removes two unused public routes. ## Why `POST /users/forgotPassword` and `POST /users/resendEmailVerification` returned different responses for a known vs unknown email (and, for resend, also revealed verified state). This let an unauthenticated caller determine which email addresses have accounts. ## Changes - **forgotPassword** — unknown email and over-limit both return the same generic success (HTTP 200), sending no email. The per-account reset limit is unchanged. - **resendEmailVerification** — unknown, already-verified, and verification-disabled cases all return the same generic success, sending no email. Adds a per-email send limit: over the limit it still returns the generic success (so it can't be used to probe), and it fails open if the limiter is unavailable so legitimate verification emails are never blocked. - Removes two `permitAll` routes (`GET /users/invite/verify`, `PUT /users/invite/confirm`) that have no server handler. ## Testing - Controller + service tests assert identical status and body across known-under-limit / known-over-limit / known-verified / unknown / verification-disabled for both endpoints, plus the silent per-email limit and its fail-open path. - Relevant server module tests pass. Fixes https://linear.app/appsmith/issue/APP-15349/security-medium-user-enumeration-via-forgot-password <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/29493040653> > Commit: 6017e79 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=29493040653&attempt=2" target="_blank">Cypress dashboard</a>. > Tags: `@tag.All` > Spec: > <hr>Thu, 16 Jul 2026 19:50:33 UTC <!-- end of auto-generated comment: Cypress test results --> ## Automation /ok-to-test tags="@tag.All" --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Bumps [echarts](https://github.com/apache/echarts) from 5.4.2 to 6.1.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/apache/echarts/releases">echarts's releases</a>.</em></p> <blockquote> <h2>6.1.0</h2> <ul> <li>[Feature] [axis] Support <code>dataMin</code> and <code>dataMax</code> option for calculating a nice axis extent. <a href="https://redirect.github.com/apache/echarts/pull/20838">#20838</a> (<a href="https://github.com/Justin-ZS">Justin-ZS</a>, <a href="https://github.com/Ovilia">Ovilia</a>)</li> <li>[Feature] [axis] Comprehensively enable all types of axis (i.e., <code>"value"</code>/<code>"time"</code>/<code>"category"</code>/<code>"log"</code>) to render series (typically <code>"bar"</code>/<code>"pictorialBar"</code>/<code>"candlestick"</code>/<code>"boxplot"</code>) without overflow (including the case <code>"category"</code> axis with <code>boundaryGap: false</code>); provide <code>containShape</code> option; provide some corresponding <code>clip</code> option. <a href="https://github.com/apache/echarts/commit/dbfaf6a73">dbfaf6a73</a> <a href="https://github.com/apache/echarts/commit/fe932a2aa">fe932a2aa</a> <a href="https://github.com/apache/echarts/commit/3973b21ee">3973b21ee</a> (<a href="https://github.com/100pah">100pah</a>) <a href="https://redirect.github.com/apache/echarts/pull/21511">#21511</a> (<a href="https://github.com/akashsonune">Akash Sonune</a>)</li> <li>[Feature] [axis] Automatically exclude non-positive series data values on <code>"log"</code> axis. <a href="https://github.com/apache/echarts/commit/dedc5dc18">dedc5dc18</a> (<a href="https://github.com/100pah">100pah</a>)</li> <li>[Feature] [axis] Enable <code>axisLabel.formatter</code> to receive its index for working with <code>customValues</code>. <a href="https://redirect.github.com/apache/echarts/pull/21220">#21220</a> <a href="https://redirect.github.com/apache/echarts/pull/21432">#21432</a> (<a href="https://github.com/szymonpachucki">Szymon Pachucki</a>, <a href="https://github.com/Ovilia">Ovilia</a>, <a href="https://github.com/plainheart">plainheart</a>)</li> <li>[Feature] [line] Add <code>triggerEvent</code> option for more control over mouse event. <a href="https://redirect.github.com/apache/echarts/pull/21001">#21001</a> (<a href="https://github.com/sjcobb">Steven Cobb</a>, <a href="https://github.com/plainheart">plainheart</a>)</li> <li>[Feature] [pie] Add <code>tangential-noflip</code> rotation mode to keep labels tangential without flipping. <a href="https://redirect.github.com/apache/echarts/pull/21258">#21258</a> (<a href="https://github.com/MC-YCY">春秋半夏</a>, <a href="https://github.com/Ovilia">Ovilia</a>)</li> <li>[Feature] [gauge] <code>progress.color</code> supports <code>'auto'</code>. <a href="https://redirect.github.com/apache/echarts/pull/21224">#21224</a> (<a href="https://github.com/StNimmerlein">StNimmerlein</a>, <a href="https://github.com/Ovilia">Ovilia</a>)</li> <li>[Feature] [radar] Add <code>clockwise</code> option. <a href="https://redirect.github.com/apache/echarts/pull/21143">#21143</a> (<a href="https://github.com/daidr">Dai Xuezhou</a>, <a href="https://github.com/Ovilia">Ovilia</a>)</li> <li>[Feature] [candlestick] [dataZoom] Add <code>cursor</code> option for <code>candlestick</code> series and add <code>cursorGrab</code> option & <code>cursorGrabbing</code> for <code>'inside'</code> dataZoom. <a href="https://redirect.github.com/apache/echarts/pull/21558">#21558</a> (<a href="https://github.com/diysimon">zuming</a>, <a href="https://github.com/Ovilia">Ovilia</a>, <a href="https://github.com/100pah">100pah</a>)</li> <li>[Feature] [scatter] [effectScatter] [geo] Enable <code>clip</code> option on <code>"scatter"</code>/<code>"effectScatter"</code> on <code>geo</code>. <a href="https://github.com/apache/echarts/commit/417592289">417592289</a> (<a href="https://github.com/100pah">100pah</a>)</li> <li>[Feature] [visualMap] Add <code>seriesTargets</code> option for multiple series-dimension mappings. <a href="https://redirect.github.com/apache/echarts/pull/20703">#20703</a> (<a href="https://github.com/Justin-ZS">Justin-ZS</a>, <a href="https://github.com/plainheart">plainheart</a>)</li> <li>[Feature] [matrix] Support <code>matrix.x/y.length</code> for conveniently creating a headless matrix without composing an array. <a href="https://redirect.github.com/apache/echarts/pull/21191">#21191</a> (<a href="https://github.com/100pah">100pah</a>, <a href="https://github.com/plainheart">plainheart</a>)</li> <li>[Feature] [matrix] Add <code>triggerEvent</code> option to support triggering event on matrix cells. <a href="https://redirect.github.com/apache/echarts/pull/21390">#21390</a> (<a href="https://github.com/natsuokawai">Natsuo Kawai</a>, <a href="https://github.com/100pah">100pah</a>)</li> <li>[Feature] [i18n] add Latvian(LV) translation. <a href="https://redirect.github.com/apache/echarts/pull/21546">#21546</a> (<a href="https://github.com/EPoikans">EPoikans</a>)</li> <li>[Fix] [axis] Change and clarify the rounding error and auto-precision utils and solutions. <a href="https://github.com/apache/echarts/commit/479dcd454">479dcd454</a> (<a href="https://github.com/100pah">100pah</a>)</li> <li>[Fix] [axis] Fix chart does not work when using <code>customValues</code> with <code>formatter</code> in time axis (<code>axis.type: 'time'</code>) label. <a href="https://redirect.github.com/apache/echarts/pull/21352">#21352</a> (<a href="https://github.com/Srajan-Sanjay-Saxena">Srajan Sanjay Saxena</a>, <a href="https://github.com/plainheart">plainheart</a>)</li> <li>[Fix] [axis] Fix and clarify <code>alignTick</code> strategy, and fix <code>LogScale</code> precision. <a href="https://github.com/apache/echarts/commit/a6ab2458f">a6ab2458f</a> <a href="https://github.com/apache/echarts/commit/ffcc636fb">ffcc636fb</a> (<a href="https://github.com/100pah">100pah</a>)</li> <li>[Fix] [axis] Fix duplicate ticks when using time axis (<code>axis.type: 'time'</code>) or <code>customValues</code>, which causes jitter of <code>splitArea</code>; fix the <code>showMin/MaxLabel</code> handling of a category axis (<code>axis.type: 'category'</code>); enable a uniform <code>bandWidth</code> calculation in numeric axis (<code>axis.type: 'value' | 'time' | 'log'</code>). <a href="https://github.com/apache/echarts/commit/8de2b64fa">8de2b64fa</a> <a href="https://github.com/apache/echarts/commit/15af0db02">15af0db02</a> <a href="https://github.com/apache/echarts/commit/8ddaa5c69">8ddaa5c69</a> (<a href="https://github.com/100pah">100pah</a>)</li> <li>[Fix] [axis] Fix time axis (<code>axis.type: 'time'</code>) bug when value scale is in millisecond. <a href="https://github.com/apache/echarts/commit/40b77b464">40b77b464</a> (<a href="https://github.com/100pah">100pah</a>)</li> <li>[Fix] [bar] Fix wrong label position when bar series has a 0 width/height. <a href="https://redirect.github.com/apache/echarts/pull/21218">#21218</a> (<a href="https://github.com/Justin-ZS">Justin-ZS</a>, <a href="https://github.com/Ovilia">Ovilia</a>)</li> <li>[Fix] [scatter] Fix jitter layout does not support progressive rendering and cause chart to be frozen and potential NPE. <a href="https://redirect.github.com/apache/echarts/pull/21436">#21436</a> (<a href="https://github.com/plainheart">plainheart</a>)</li> <li>[Fix] [lines] Fix effect symbol flip on unidirectional loop end when <code>roundTrip</code> is not enabled. <a href="https://redirect.github.com/apache/echarts/pull/21320">#21320</a> (<a href="https://github.com/mynk2611">Mayank Mehta</a>, <a href="https://github.com/plainheart">plainheart</a>)</li> <li>[Fix] [candlestick] Fix candlestick render error with <code>series.encode</code> on horizontal layout. <a href="https://redirect.github.com/apache/echarts/pull/21325">#21325</a> (<a href="https://github.com/PPRAMANIK62">Purbayan Pramanik</a>, <a href="https://github.com/100pah">100pah</a>)</li> <li>[Fix] [parallel] Fix incorrect axis extent when any subsequent series has a larger value than the first. <a href="https://redirect.github.com/apache/echarts/pull/21387">#21387</a> (<a href="https://github.com/jackhickson">jackhickson</a>, <a href="https://github.com/100pah">100pah</a>)</li> <li>[Fix] [pie] Support axes extent union pie center automatically when pie is laid out on Cartesian (<code>grid</code> component). <a href="https://github.com/apache/echarts/commit/18a23a875">18a23a875</a> (<a href="https://github.com/100pah">100pah</a>)</li> <li>[Fix] [treemap] Fix treemap can not be zoomed out after a zoom-in when <code>scaleLimit</code> is specified <a href="https://redirect.github.com/apache/echarts/pull/21427">#21427</a> (<a href="https://github.com/liuyizhou">TateLiu</a>, <a href="https://github.com/100pah">100pah</a>)</li> <li>[Fix] [lines] Fix potential <code>tooltip</code> XSS vulnerability in lines series (<code>series.type: 'lines'</code>). <a href="https://redirect.github.com/apache/echarts/pull/21608">#21608</a> (<a href="https://github.com/plainheart">plainheart</a>)</li> <li>[Fix] [map] [geo] Fix the failed synchronization and visual artifacts on geo roaming and animation. <a href="https://github.com/apache/echarts/commit/417592289">417592289</a> (<a href="https://github.com/100pah">100pah</a>)</li> <li>[Fix] [tooltip] Fix <code>tooltip</code> content does not refresh when changing tooltip trigger from <code>'axis'</code> to <code>'item'</code>. <a href="https://redirect.github.com/apache/echarts/pull/20710">#20710</a> (<a href="https://github.com/Justin-ZS">Justin-ZS</a>, <a href="https://github.com/plainheart">plainheart</a>)</li> <li>[Fix] [tooltip] <code>valueFormatter</code> callback param <code>dataIndex</code> should be <code>rawDataIndex</code> rather than <code>dataZoom</code> filtered <code>dataIndex</code>. <a href="https://redirect.github.com/apache/echarts/pull/21479">#21479</a> (<a href="https://github.com/100pah">100pah</a>, <a href="https://github.com/plainheart">plainheart</a>)</li> <li>[Fix] [axisPointer] Fix <code>axisPointer</code> shadow and enable clipping - it is previously only applicable to <code>"category"</code> axis, but is buggy in numeric axis with <code>"bar"</code> series. <a href="https://github.com/apache/echarts/commit/8de2b64fa">8de2b64fa</a> (<a href="https://github.com/100pah">100pah</a>)</li> <li>[Fix] [axisPointer] Fix visual artifacts caused by failed <code>axisPointer</code> restoration. <a href="https://github.com/apache/echarts/commit/56a32c0bb">56a32c0bb</a> (<a href="https://github.com/100pah">100pah</a>)</li> <li>[Fix] [hoverLayer] Fix visual artifacts arisen on hover layer. <a href="https://redirect.github.com/ecomfe/zrender/pull/1151">zrender#1151</a> <a href="https://github.com/apache/echarts/commit/933585126">933585126</a> (<a href="https://github.com/100pah">100pah</a>)</li> <li>[Fix] [marker] Fix <code>marker</code> fails to render with <code>dataset</code> and <code>encode</code>. <a href="https://redirect.github.com/apache/echarts/pull/21439">#21439</a> (<a href="https://github.com/plainheart">plainheart</a>, <a href="https://github.com/100pah">100pah</a>).</li> <li>[Fix] [dataZoom] Fix wrong position of the <code>dataZoom</code> when the <code>series</code> has only one data point. <a href="https://redirect.github.com/apache/echarts/pull/21196">#21196</a> (<a href="https://github.com/alesmit">alesmit</a>, <a href="https://github.com/Ovilia">Ovilia</a>)</li> <li>[Fix] [dataZoom] Fix <code>dataZoom</code> bug that data info disappears when dragging released; fix <code>dataZoom</code> dragging cursor style. <a href="https://github.com/apache/echarts/commit/64305a4b8">64305a4b8</a> (<a href="https://github.com/100pah">100pah</a>)</li> <li>[Fix] [dataZoom] Apply a better auto-precision method; fix unexpected behaviors when <code>dataZoom</code> controls axes with <code>alignTicks: true</code>. <a href="https://github.com/apache/echarts/commit/d168bf237">d168bf237</a> (<a href="https://github.com/100pah">100pah</a>)</li> <li>[Fix] [dataZoom] Fix <code>AxisProxy</code> can not be cleared when <code>dataZoom</code> option changed; fix related <code>onZero</code> behaviors. <a href="https://github.com/apache/echarts/commit/52ceb924a">52ceb924a</a> <a href="https://github.com/apache/echarts/commit/2e82d33c3">2e82d33c3</a> (<a href="https://github.com/100pah">100pah</a>)</li> <li>[Fix] [areaStyle] Fix <code>areaStyle</code> render error when dimension name is empty string. <a href="https://redirect.github.com/apache/echarts/pull/21219">#21219</a> (<a href="https://github.com/Justin-ZS">Justin-ZS</a>, <a href="https://github.com/Ovilia">Ovilia</a>)</li> <li>[Fix] [sunburst] Fix root node label may not be centered. <a href="https://redirect.github.com/apache/echarts/pull/21306">#21306</a> (<a href="https://github.com/akashsonune">Akash Sonune</a>, <a href="https://github.com/Ovilia">Ovilia</a>)</li> <li>[Fix] [matrix] Fix matrix label formatter does not work. <a href="https://redirect.github.com/apache/echarts/pull/21410">#21410</a> (<a href="https://github.com/Justin-ZS">Justin-ZS</a>, <a href="https://github.com/Ovilia">Ovilia</a>)</li> <li>[Fix] [toolbox] Fix <code>emphasis</code> color is the same as the default color. <a href="https://redirect.github.com/apache/echarts/pull/21384">#21384</a> (<a href="https://github.com/Ovilia">Ovilia</a>) <a href="https://github.com/apache/echarts/commit/b094f987d">b094f987d</a> (<a href="https://github.com/100pah">100pah</a>)</li> <li>[Fix] [toolbox] Fix the <code>dataView</code> component does not fit the dark mode. <a href="https://redirect.github.com/apache/echarts/pull/21176">#21176</a> (<a href="https://github.com/notthistrain">notthistrain</a>, <a href="https://github.com/Ovilia">Ovilia</a>)</li> <li>[Fix] [progressive] Fix progressive rendering issues. <a href="https://github.com/apache/echarts/commit/91a60fc76">91a60fc76</a> (<a href="https://github.com/100pah">100pah</a>)</li> <li>[Fix] [labelLine] Fix <code>labelLine.smooth</code> can not be reset. <a href="https://redirect.github.com/apache/echarts/pull/21425">#21425</a> (<a href="https://github.com/fanwww">fanwww</a>, <a href="https://github.com/plainheart">plainheart</a>)</li> <li>[Fix] [graphic] Fix stroke corner gap due to not closing path in <code>roundRect</code> helper. <a href="https://redirect.github.com/ecomfe/zrender/pull/1155">zrender#1155</a> (<a href="https://github.com/plainheart">plainheart</a>)</li> <li>[Fix] [svg] Enhance SVG <code>encodeBase64</code> compatibility to make it available in more environments like Web Worker/NodeJS/Bun. <a href="https://redirect.github.com/ecomfe/zrender/pull/1145">zrender#1145</a> (<a href="https://github.com/plainheart">plainheart</a>)</li> <li>[Fix] [core] Mark <code>echarts</code> instance object as <code>raw</code> in <code>Vue</code>. <a href="https://redirect.github.com/apache/echarts/pull/21293">#21293</a> (<a href="https://github.com/plainheart">plainheart</a>)</li> <li>[Fix] [chord] Add the missing export entry for chord chart. <a href="https://redirect.github.com/apache/echarts/pull/21197">#21197</a> (<a href="https://github.com/plainheart">plainheart</a>, <a href="https://github.com/Ovilia">Ovilia</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/apache/echarts/commit/c5a48f5f97d23e5379720870b8444cd05b50ffb4"><code>c5a48f5</code></a> Merge pull request <a href="https://redirect.github.com/apache/echarts/issues/21612">#21612</a> from apache/release-dev</li> <li><a href="https://github.com/apache/echarts/commit/77e5222d15690b539505eb7690b8ff53b52aab9c"><code>77e5222</code></a> release 6.1.0-rc.2</li> <li><a href="https://github.com/apache/echarts/commit/21f17bec20d42623edcd66f91cf2344d2bced6b1"><code>21f17be</code></a> fixRegression(map,geo): Resolve circular dependencies introduced by this vers...</li> <li><a href="https://github.com/apache/echarts/commit/830e8b6ec780ff24d59577c69e3bbf69f1df315e"><code>830e8b6</code></a> chore: Supplement package.json (for module cjs declaration) to source release.</li> <li><a href="https://github.com/apache/echarts/commit/ed0e2103071744cb97887757679336cec1d8dac4"><code>ed0e210</code></a> chore: Fix <code>addHeader</code> tool and add missing license headers.</li> <li><a href="https://github.com/apache/echarts/commit/cc78ada709b6028371b24f5449ad7a4dda93f992"><code>cc78ada</code></a> Merge pull request <a href="https://redirect.github.com/apache/echarts/issues/21611">#21611</a> from apache/release-dev</li> <li><a href="https://github.com/apache/echarts/commit/3f6e0125fdd8a485c59652cdf628144fcea1702f"><code>3f6e012</code></a> release: Build release.</li> <li><a href="https://github.com/apache/echarts/commit/d69405f83fe2be367beb0ff1e08b49380d6485c6"><code>d69405f</code></a> chore: Add missing headers.</li> <li><a href="https://github.com/apache/echarts/commit/6998ed02fcfe39aafcefc47f4fb4822b36b0642d"><code>6998ed0</code></a> release: Upgrade npm version.</li> <li><a href="https://github.com/apache/echarts/commit/8cb374b15ca842e057812715caf73acf17649a5b"><code>8cb374b</code></a> fix(build): Fix build commands.</li> <li>Additional commits viewable in <a href="https://github.com/apache/echarts/compare/5.4.2...6.1.0">compare view</a></li> </ul> </details> <details> <summary>Install script changes</summary> <p>This version adds <code>prepare</code> script that runs during installation. Review the package contents before updating.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/appsmithorg/appsmith/network/alerts). </details> <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/29167090074> > Commit: 81949ce > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=29167090074&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.All` > Spec: > <hr>Sat, 11 Jul 2026 21:51:35 UTC <!-- end of auto-generated comment: Cypress test results --> ## Automation /ok-to-test tags="@tag.All" Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…ility in copy modal (#42007) ## Description This PR fixes two issues in the CopyEntityToAppModal component: 1. **Dropdown positioning**: Dropdowns in the modal were being portaled outside the modal container, causing them to be blocked by the Radix Dialog's scroll event blocking. Added `getPopupContainer` configuration to all Select components to render dropdowns inside the modal instead. 2. **Conditional datasource note**: The datasource credentials note was being shown for all entity types, but it only applies to queries. Added a conditional check to hide the note when copying JS objects, which don't have datasources. ### Changes Made **CopyEntityToAppModal.tsx:** - Added `getPopupContainerInModal` helper function to keep dropdown content within the modal - Applied `getPopupContainer={getPopupContainerInModal}` to workspace, application, and page Select components - Wrapped the datasource note in a conditional that only renders for non-JS_OBJECT entity types **CopyEntityToAppModal.test.tsx:** - Refactored mock setup to use a mutable `mockEntityType` variable for test flexibility - Updated `beforeEach` to reset `mockEntityType` to "ACTION" - Added test case verifying the datasource note appears when copying a query - Added test case verifying the note is hidden when copying a JS object ## Test Plan The changes are covered by new unit tests that verify: - The datasource note displays for query entities - The datasource note is hidden for JS object entities Existing tests continue to pass, confirming no regression in other functionality. ## Automation /ok-to-test tags="@tag.Sanity" ### 🔍 Cypress test results <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/29553745147> > Commit: 863dc46 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=29553745147&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.Sanity` > Spec: > <hr>Fri, 17 Jul 2026 04:38:25 UTC <!-- end of auto-generated comment: Cypress test results --> ## Communication - [ ] Yes - [x] No https://claude.ai/code/session_01LCyDSjroZwWqhkBdfd19Sq ## Summary by CodeRabbit * **Bug Fixes** * Improved dropdown behavior in the copy dialog so menus remain contained within the modal. * Updated the informational datasource note to appear only for applicable entity types. * Added coverage for entity-specific messaging and existing target selection behavior. --------- Co-authored-by: Claude <noreply@anthropic.com>
## Description CE counterpart Remove the legacy `GitExecutor` abstraction and implementations, migrating the remaining file utility and handler paths to their direct replacements. Update affected server and git tests, including disabling coverage that relies on the removed executor layer. This is a refactor with no intended user-facing behavior change. Fixes https://linear.app/appsmith/issue/V2-5517/removal-of-jgitcontroller-layer-ie-git-executor-abstraction-and ## Automation /ok-to-test tags="@tag.Git" ### 🔍 Cypress test results <!-- leave this section untouched — CI auto-populates it --> ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [ ] No Made with [Cursor](https://cursor.com) ## Summary by CodeRabbit * **Changes** * Removed legacy Git “save/reconstruct” flows for application-level references, consolidating Git behavior around artifact/resource-based persistence. * Updated repo saving to use the new artifact save path, with feature-flagged handling of “keep working directory changes.” * Continued symlink hardening after clone, now with more flexible extensibility. * **Testing** * Removed or revised Git executor and file-format migration tests to match the updated Git workflow and interfaces. <!-- end of auto-generated comment: release notes by coderabbit.ai --> <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/29568880309> > Commit: 7010b86 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=29568880309&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.Git` > Spec: > <hr>Fri, 17 Jul 2026 09:27:02 UTC <!-- end of auto-generated comment: Cypress test results --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Security** * Improved repository checkout protection by removing malicious symbolic links after cloning. * **Improvements** * Streamlined Git-backed artifact saving and synchronization. * Updated file persistence to use the newer artifact exchange format. * Simplified application export and migration flows. * **Compatibility** * Retained validation for supported repository file formats. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
….id, letting any user make another workspace's private datasource publicly (unauthenticated) executable (GHSA-fhgw-q2jf-8fq7) (#42018) ## Description fix(security): Action create/update trusts client-supplied datasource.id, letting any user make another workspace's private datasource publicly (unauthenticated) executable (GHSA-fhgw-q2jf-8fq7) <!-- Smithes will fill from commit messages --> ### Vulnerability | Field | Value | |-------|-------| | **GHSA** | [GHSA-fhgw-q2jf-8fq7](https://github.com/appsmithorg/appsmith/security/advisories/GHSA-fhgw-q2jf-8fq7) | | **CVE** | Not assigned | | **CVSS** | 9.6 (critical) | | **CWE** | CWE-862 | | **Affected component** | Action create/update trusts client-supplied datasource.id, letting any user make another workspace's private datasource publicly (unauthenticated) executable | ### Exposure Analysis <!-- Smithes will fill from triage report --> ### Fix <!-- Smithes will fill from plan --> ### CE/EE sync <!-- Smithes will fill from check_ce_ee output --> ### Disclosure > **Do not merge until advisory is ready for disclosure coordination.** > > After merge: > 1. Confirm fix is in release branch > 2. Coordinate with security team on disclosure timeline > 3. Update advisory with patched version and publish > 4. Notify reporter ## Automation /ok-to-test tags="@tag.All" ### 🔍 Cypress test results <!-- This is an auto-generated comment: Cypress test results --> > [!IMPORTANT] > 🟣 🟣 🟣 Your tests are running. > Tests running at: <https://github.com/appsmithorg/appsmith/actions/runs/29803155676> > Commit: 9c2b50c > Workflow: `PR Automation test suite` > Tags: `@tag.All` > Spec: `` > <hr>Tue, 21 Jul 2026 05:09:02 UTC <!-- end of auto-generated comment: Cypress test results --> ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [x] No --------- Co-authored-by: Smithes Security Bot <smithes-bot@appsmith.com> Co-authored-by: subrata71 <subrata@appsmith.com>
## Summary `Email_settings_Spec` fails intermittently in CI (~25-35% of runs) when it shares a duration-balanced shard with heavy specs. It's a null-handling bug in the spec's email flow, exposed under maildev/SMTP contention. ## Root cause `waitForEmail` matches an email by subject + recipient, then hands it to the test. Under contention maildev can surface an email's metadata before its HTML part is parsed, so the matched email's `.html` is `undefined`. Tests #3–#6 then do: ```js const emailHtml = email.html; // undefined const match = emailHtml.match(/.../); // TypeError, thrown inside .then() ``` That throw is an unhandled promise rejection that aborts the test (the wrapping `try/catch` is inert against async Cypress failures). Captured CI stack: `Email_settings_Spec.ts` test #4 (`To verify invite workspace email`); the same `email.html` → `.match` pattern is in tests #3, #5 and #6. ## Fix Fix it at the source rather than masking it. Add an opt-in `requireHtml` flag to `waitForEmail`: when set, a matched email whose HTML body isn't populated yet is treated as **not yet delivered**, so polling continues until the body arrives (or the existing timeout). Tests #3–#6 opt in; their email-body assertions then run for real on a complete email. (An earlier revision of this PR used `email.html || ""`, but that only stopped the crash by silently skipping the invite-link verification when the body was missing — masking the flake. Reverted in favor of the helper-level fix.) `waitForEmail` is identical in CE and EE, so this lands in CE and the hourly sync carries it to EE. The new flag is optional and defaults to current behavior, so other callers (including this spec's test #2, which reads `email.text`) are unaffected. ## Validation Attribution and the fix were verified on appsmith-ee via amplified `/ci-test-limit` runs (multiple copies of the spec downstream of a heavy git spec in one shard): the unfixed baseline reproduced the failure at the exact line above. Ref APP-15291 <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/27509234477> > Commit: 56deaca > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=27509234477&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.Email` > Spec: > <hr>Sun, 14 Jun 2026 19:36:07 UTC <!-- end of auto-generated comment: Cypress test results --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Improved email-related test robustness: four end-to-end flows (password reset, workspace invite, application invite — developer role, and application invite — view role) now explicitly require the HTML portion of delivered emails, reducing flakiness and better validating email content. * **Chores** * Updated limited-test configuration to run the client-side email regression spec during focused CI runs. <!-- end of auto-generated comment: release notes by coderabbit.ai --> ## Automation /ok-to-test tags="@tag.Email" --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
## Description
`.github/workflows/README.md` described the `ok-to-test` workflow as
"Triggered by PR comments". That trigger was retired in March 2024
(`c5c3dc4caf`) — commenting `/ok-to-test` now only returns a bot reply
saying the method is defunct. Because these docs sit next to the
workflows, they read as authoritative and actively send people down a
dead path. That happened recently on an EE PR.
The rest of the file had drifted just as far:
- Documented 14 of 66 workflow files.
- 4 of its 14 links pointed at files that no longer exist:
`build-rts.yml`, `server.yml`, `external-client-test.yml`,
`remove-old-artifacts.yml`.
- Carried stale editorial asides ("**Comment:** Useless right now...").
### Why it rotted, and what changed
The file duplicated what the YAML already states — which workflows exist
and what jobs each contains — so it drifted on every rename. What the
YAML does *not* convey is which incantation triggers CI, and that has
changed once in two years.
So the catalog is gone and the triggers stay. The new README covers:
- How to run Cypress on a PR: tags in the PR body plus the `ok-to-test`
label.
- The still-live comment-dispatched slash commands
(`/build-deploy-preview`, `/test-pw`, `/ci-test-limit`).
- Two limitations stated outright: commenting `/ok-to-test` does
nothing, and fork PRs cannot run Cypress this way at all (GitHub gives
fork PRs a read-only token and no secrets).
Net 67 lines removed, 38 added.
### Notes for review
- `README.md` is byte-identical between CE and EE, so this is CE-only
and syncs across. I verified the merge into EE `release` applies
cleanly.
- `.github/workflows/docs/integration-tests-command.md` is also stale —
a full page describing jobs for a workflow whose only remaining job is
posting the deprecation notice. It is **not** touched here: it differs
by one line between CE and EE, and deleting it in CE produces a
modify/delete conflict that would block the sync pipeline. Folded into
the follow-up instead.
- The underlying problem — that fork PRs cannot run Cypress at all — is
out of scope and tracked separately.
Fixes https://linear.app/appsmith/issue/APP-15709
## Automation
/ok-to-test tags=""
### 🔍 Cypress test results
<!-- This is an auto-generated comment: Cypress test results -->
> [!CAUTION]
> If you modify the content in this section, you are likely to disrupt
the CI result for your PR.
<!-- end of auto-generated comment: Cypress test results -->
## Communication
Should the DevRel and Marketing teams inform users about this change?
- [ ] Yes
- [x] No
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated CI workflow documentation with instructions for manually
triggering Cypress tests on pull requests.
* Added guidance on viewing results, re-running or canceling tests, and
limitations for pull requests from forks.
* Documented supported slash commands and linked to configuration
details.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
…ross standard widgets (#41895) ## Description **TL;DR:** Adds a single platform-level `tabOrder` property, exposed in a shared **Accessibility** property-pane section for every standard (non-Anvil) widget, letting builders optionally control keyboard Tab order in fixed layout. Existing apps keep their exact current Tab behavior unless `tabOrder` is explicitly set. ### What changed - **Shared property pane plumbing** — `WidgetFactory` centrally appends one shared `Accessibility > Tab order` section to both property-pane paths (legacy `getPropertyPaneConfig` and content config) via `WidgetProvider/factory/tabOrderPropertyConfig.ts`. No per-widget config edits, no per-widget property names or validation rules. Anvil-only (`WDS_*`, `SECTION_WIDGET`, `ZONE_WIDGET`) and internal widgets (`CANVAS_WIDGET`, `SKELETON_WIDGET`, `TABS_MIGRATOR_WIDGET`) are excluded; widgets without a property pane stay untouched. - **New `TAB_ORDER_INPUT` control** (`TabOrderControl`) reusing the ADS `NumberInput`: persists only valid non-negative integers as numbers, removes the property from the DSL when cleared (blank always means Auto), never persists `""` or invalid input. Not JS-convertible (`isJSConvertible/isBindProperty/isTriggerProperty: false`), validated as `ValidationTypes.NUMBER { min: 0, natural: true }`. - **Runtime** — `PositionedContainer` renders a sanitized `data-tab-order` attribute only for valid explicit values (`0` is valid and earliest). No positive native `tabIndex` is ever used, so non-focusable widgets stay non-focusable. - **Fixed-layout tabbing** (`useWidgetFocus/tabbable.ts`) — new `sortTabbableWidgets()`: when no widget in the current scope has a valid explicit order, it delegates to the unchanged `sortWidgetsByPosition` (exact current behavior). Otherwise, explicitly ordered widgets come first ascending (duplicates tie-break by position), Auto/invalid widgets follow in existing position order, and Shift+Tab reverses the same sequence. Modal, container, JSONForm, CheckboxGroup, SwitchGroup and ButtonGroup behaviors are preserved. ### Compatibility - No DSL migration, no `LATEST_PAGE_VERSION` bump, no widget default pollution — `tabOrder` only exists in a DSL after a builder sets it. - Auto layout is intentionally unchanged: `useWidgetFocus` opts out of auto layout, so `tabOrder` is currently enforced only by the fixed-layout custom tabbing (`FlexComponent` and `layoutSystems/anvil/*` untouched). ### Security notes - No JS/eval support for the field; numeric-only non-negative integer validation at the control, and re-sanitization at every runtime read (`sanitizeTabOrder`). - Only a sanitized integer is reflected into the DOM attribute; no user-controlled selectors or HTML; invalid values are ignored and treated as Auto. ### Tests - `utils/widgetTabOrder.test.ts` — sanitizer value rules (0 valid; null/blank/decimals/negatives/NaN/Infinity/non-numeric → Auto). - `utils/hooks/useWidgetFocus/tabbable.test.ts` — all-Auto preserves position order; explicit overrides position; 0 before 1; explicit widget above/left can be next; duplicate tie-break; blank/invalid → Auto; Shift+Tab; nested container scope; modal scope; composite widgets keep native internal tabbing. - `WidgetProvider/factory/tabOrderPropertyConfig.test.ts` — unit tests plus an integration test over all registered widgets proving standard non-Anvil widgets expose exactly one identical shared property and Anvil/internal widgets expose none. - `components/propertyControls/TabOrderControl.test.tsx` — persistence semantics incl. regression that clearing returns to Auto without persisting an invalid value. - `components/designSystems/appsmith/PositionedContainer.test.tsx` — `data-tab-order` renders only for valid explicit values (including `0`), never a native `tabindex`. Fixes #37947 ## Automation /ok-to-test tags="@tag.All" ### 🔍 Cypress test results <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/29929171193> > Commit: aba0b0f > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=29929171193&attempt=2" target="_blank">Cypress dashboard</a>. > Tags: `@tag.All` > Spec: > <hr>Wed, 22 Jul 2026 20:30:36 UTC <!-- end of auto-generated comment: Cypress test results --> ## Communication Should the DevRel and Marketing teams inform users about this change? - [x] Yes - [ ] No 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added explicit `tabOrder` support for eligible widgets via a shared Accessibility property-pane section (clearable numeric input). * Introduced a tab-order overlay badge in the editor with an **Alt+T** hotkey toggle. * **Bug Fixes** * Improved keyboard navigation and reverse traversal to respect explicit/automatic tab order. * Prevented focus handling from getting stuck when no focusable target is available. * **Tests** * Expanded coverage for property-pane integration, tab-order rendering, overlay badge behavior, keyboard traversal, and numeric input interactions. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Stacey Levine <stacey@levineclan.net>
…ent (GHSA-h5qf-426x-5mv5) (#42023) Security fix. See [GHSA-h5qf-426x-5mv5](https://github.com/appsmithorg/appsmith/security/advisories/GHSA-h5qf-426x-5mv5) for full vulnerability details (restricted). ### CE/EE sync EE mirror PR: appsmithorg/appsmith-ee#9345 — **both PRs must be merged before disclosure.** CE user path (`username`) is fixed here. EE GAC UserGroup path (`@FeatureFlagged(license_gac_enabled)`) is fixed in the EE PR. ### Disclosure > **Do not merge until advisory is ready for disclosure coordination.** > > After merge: > 1. Confirm fix is in release branch on both CE and EE > 2. Coordinate with security team on disclosure timeline > 3. Update advisory with patched version and publish > 4. Notify reporter ## Automation /ok-to-test tags="@tag.Sanity" ### 🔍 Cypress test results <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/29984991856> > Commit: d87d8db > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=29984991856&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.Sanity` > Spec: > <hr>Thu, 23 Jul 2026 06:58:11 UTC <!-- end of auto-generated comment: Cypress test results --> ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [x] No --------- Co-authored-by: appsmith-smithes[bot] <appsmith-smithes[bot]@users.noreply.github.com> Co-authored-by: subrata71 <subrata@appsmith.com>
## What & why `deploy/docker/fs/opt/appsmith/templates/docker.env.sh` shipped a permissive default: ``` APPSMITH_ALLOWED_FRAME_ANCESTORS="'self' *" ``` The `*` meant every self-hosted instance allowed **any** origin to frame its published apps by default, exposing published-app viewer routes to clickjacking (UI redressing) unless an operator explicitly tightened the setting. Reported in the Astra 2026 pentest. This change stops shipping the wildcard value. The assignment is now commented out, so **fresh installs fall through to the safe `'self'` default** that `caddy-reconfigure.mjs` already applies when the variable is empty/unset. `'self'` permits only same-origin framing (the instance framing itself, e.g. the embed-settings preview) and blocks all cross-origin framing. Also: - Fixes the stale comment that wrongly claimed the default was `'none'`. - Adds `deploy/docker/tests/docker-env-defaults-test.sh` (wired into the Caddy route-tests workflow) that renders the template and asserts it ships no permissive wildcard frame-ancestors default. ## Scope Fresh-install default **value** only. The runtime fallback in `caddy-reconfigure.mjs` is unchanged, and route-matching (`@framed`/`@embeddable`) is untouched. Existing installs are handled separately (see below). ##⚠️ RELEASE NOTES / BREAKING (behavior change for NEW installs only) - **Existing installs are unchanged.** `docker.env` is generated once on first install and preserved across upgrades (`init_env_file()` regenerates it only when the file is absent), so any previously-persisted `APPSMITH_ALLOWED_FRAME_ANCESTORS` value is kept as-is. - **New installs now default to same-origin-only framing** (`'self'`). Published apps can no longer be embedded on external origins out of the box. - **Operators who want open or cross-origin embedding must set it explicitly**, either via **Admin Settings → Embed settings → "Allow embedding everywhere"** (or "Limit embedding" with a list of trusted URLs), or by setting the `APPSMITH_ALLOWED_FRAME_ANCESTORS` env var. ## Testing - New `docker-env-defaults-test.sh` passes on the updated template and fails against the old `'self' *` value (verified). Wired into `.github/workflows/caddy-routes-test.yml`. - Existing Caddy route-tests already assert `'self'` as the effective default when the var is unset/empty (specs 1 and 7) and remain green. Linear: https://linear.app/appsmith/issue/APP-15353 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Security** * Updated the default framing policy to allow embedding only from the same origin. * Removed the permissive wildcard framing default. * **Tests** * Added automated validation to prevent unsafe framing defaults from being introduced. * Integrated the validation into the continuous integration checks. <!-- end of auto-generated comment: release notes by coderabbit.ai --> ## Automation /ok-to-test tags="@tag.All" <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/29981189434> > Commit: 0c1f204 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=29981189434&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.All` > Spec: > <hr>Thu, 23 Jul 2026 06:18:05 UTC <!-- end of auto-generated comment: Cypress test results --> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
…file read/write (GHSA-fqwc-g9wm-5895) (#41993) ## Description CE port of [EE PR](appsmithorg/appsmith-ee#9250) (already merged and deployed in v2.2). Fixes a Critical (CVSS 9.9) symlink path traversal in the Git import/commit feature that allows any authenticated user to read arbitrary server files and achieve RCE via symlink tree entries (git mode 120000). **Defense-in-depth fix across all three clone paths:** - `FileUtilsCEImpl.validatePathIsWithinGitRoot` — symlink-aware real-path containment check (`toRealPath`), fails closed - `FileUtilsCEImpl.writeStringToFile` — validates the concrete file path before writing - `GitExecutorCEImpl` + `FSGitHandlerCEImpl` — post-clone symlink removal (`core.symlinks=false` + delete symlinks + re-checkout) - `git.sh` — `git config core.symlinks false` after clone in the bash/in-memory git path Fixes APP-15328 ### Vulnerability | Field | Value | |-------|-------| | **GHSA** | [GHSA-fqwc-g9wm-5895](https://github.com/appsmithorg/appsmith/security/advisories/GHSA-fqwc-g9wm-5895) | | **CVSS** | 9.9 (critical) | | **CWE** | CWE-59 (Improper Link Resolution Before File Access) | ### EE PR Merged: appsmithorg/appsmith-ee#9250 ## Automation /ok-to-test tags="@tag.Git" ### 🔍 Cypress test results <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/30015198768> > Commit: b6ee5c2 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=30015198768&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.Git` > Spec: > <hr>Thu, 23 Jul 2026 14:37:21 UTC <!-- end of auto-generated comment: Cypress test results --> ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [x] No <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Strengthened Git-root protections with symlink-aware, fail-closed validation to prevent path traversal during file/metadata writes. * Tightened action metadata saving to validate the full metadata target location before writing. * Improved post-clone symlink remediation to fail fast: cleanup is attempted and remediation failures now propagate instead of continuing. * Disabled symlink behavior during clone to avoid malicious symlink entries being checked out as symlinks. * **Tests** * Added automated coverage for symlink escape attempts and verified symlink entries are checked out as regular files. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
Bumps [axios](https://github.com/axios/axios) from 1.16.1 to 1.18.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/releases">axios's releases</a>.</em></p> <blockquote> <h2>v1.18.0 — June 13, 2026</h2> <p>This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.</p> <h2>🔒 Security Fixes</h2> <ul> <li> <p><strong>Redirect Header Safety:</strong> Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (<strong><a href="https://redirect.github.com/axios/axios/issues/10892">#10892</a></strong>)</p> </li> <li> <p><strong>URL And Request Hardening:</strong> Rejects malformed <code>http:</code> and <code>https:</code> URLs that omit <code>//</code> with <code>ERR_INVALID_URL</code>, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local <code>NO_PROXY</code> matching. (<strong><a href="https://redirect.github.com/axios/axios/issues/11000">#11000</a></strong>)</p> </li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li><strong>Status Validation:</strong> Added <code>transitional.validateStatusUndefinedResolves</code> so applications can opt in to treating <code>validateStatus: undefined</code> like the option was omitted, while <code>validateStatus: null</code> remains the explicit way to accept every status. (<strong><a href="https://redirect.github.com/axios/axios/issues/10899">#10899</a></strong>)</li> </ul> <h2>🔧 Maintenance & Chores</h2> <ul> <li> <p><strong>Documentation:</strong> Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the <code>proxy</code> request config as Node.js-only in the advanced docs. (<strong><a href="https://redirect.github.com/axios/axios/issues/10984">#10984</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10988">#10988</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10992">#10992</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10995">#10995</a></strong>)</p> </li> <li> <p><strong>Dependencies:</strong> Bumped <code>@babel/core</code>, <code>@babel/preset-env</code>, <code>@commitlint/cli</code>, <code>@commitlint/config-conventional</code>, <code>@rollup/plugin-babel</code>, <code>@rollup/plugin-commonjs</code>, <code>@vitest/browser</code>, <code>@vitest/browser-playwright</code>, <code>eslint</code>, <code>lint-staged</code>, <code>rollup</code>, <code>vitest</code>, and <code>actions/checkout</code>. (<strong><a href="https://redirect.github.com/axios/axios/issues/10989">#10989</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10996">#10996</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10997">#10997</a></strong>)</p> </li> <li> <p><strong>Release Metadata:</strong> Prepared the 1.18.0 release by updating package metadata and the runtime <code>VERSION</code> value. (<strong><a href="https://redirect.github.com/axios/axios/issues/11003">#11003</a></strong>)</p> </li> </ul> <h2>🌟 New Contributors</h2> <p>We are thrilled to welcome our new contributors. Thank you for helping improve axios:</p> <ul> <li><strong><a href="https://github.com/drori12"><code>@drori12</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10984">#10984</a></strong>)</li> <li><strong><a href="https://github.com/eyupcanakman"><code>@eyupcanakman</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10899">#10899</a></strong>)</li> <li><strong><a href="https://github.com/Adi-Beker"><code>@Adi-Beker</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10995">#10995</a></strong>)</li> </ul> <p><a href="https://github.com/axios/axios/compare/v1.17.0...v1.18.0">Full Changelog</a></p> <h2>v1.17.0 — June 1, 2026</h2> <p>This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.</p> <h2>🔒 Security Fixes</h2> <ul> <li><strong>Config Hardening:</strong> Guarded <code>socketPath</code>, <code>params</code>, and <code>paramsSerializer</code> reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (<strong><a href="https://redirect.github.com/axios/axios/issues/10901">#10901</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10922">#10922</a></strong>)</li> <li><strong>Release Publishing:</strong> Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (<strong><a href="https://redirect.github.com/axios/axios/issues/10926">#10926</a></strong>)</li> </ul> <h2>🚀 New Features</h2> <ul> <li><strong>HTTP Compression:</strong> Added Node HTTP adapter support for zstd response decompression, with <code>transitional.advertiseZstdAcceptEncoding</code> controlling whether <code>zstd</code> is advertised in <code>Accept-Encoding</code>. (<strong><a href="https://redirect.github.com/axios/axios/issues/6792">#6792</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10920">#10920</a></strong>)</li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li><strong>Authentication Handling:</strong> Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (<strong><a href="https://redirect.github.com/axios/axios/issues/10929">#10929</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10896">#10896</a></strong>)</li> <li><strong>Proxy TLS:</strong> Preserved user <code>httpsAgent</code> TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (<strong><a href="https://redirect.github.com/axios/axios/issues/10957">#10957</a></strong>)</li> <li><strong>React Native FormData:</strong> Cleared default <code>Content-Type</code> for React Native <code>FormData</code> so multipart boundaries can be generated correctly. (<strong><a href="https://redirect.github.com/axios/axios/issues/10898">#10898</a></strong>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/blob/v1.x/CHANGELOG.md">axios's changelog</a>.</em></p> <blockquote> <h2>v1.18.0 — June 13, 2026</h2> <p>This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.</p> <h2>🔒 Security Fixes</h2> <ul> <li> <p><strong>Redirect Header Safety:</strong> Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (<strong><a href="https://redirect.github.com/axios/axios/issues/10892">#10892</a></strong>)</p> </li> <li> <p><strong>URL And Request Hardening:</strong> Rejects malformed <code>http:</code> and <code>https:</code> URLs that omit <code>//</code> with <code>ERR_INVALID_URL</code>, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local <code>NO_PROXY</code> matching. (<strong><a href="https://redirect.github.com/axios/axios/issues/11000">#11000</a></strong>)</p> </li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li><strong>Status Validation:</strong> Added <code>transitional.validateStatusUndefinedResolves</code> so applications can opt in to treating <code>validateStatus: undefined</code> like the option was omitted, while <code>validateStatus: null</code> remains the explicit way to accept every status. (<strong><a href="https://redirect.github.com/axios/axios/issues/10899">#10899</a></strong>)</li> </ul> <h2>🔧 Maintenance & Chores</h2> <ul> <li> <p><strong>Documentation:</strong> Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the <code>proxy</code> request config as Node.js-only in the advanced docs. (<strong><a href="https://redirect.github.com/axios/axios/issues/10984">#10984</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10988">#10988</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10992">#10992</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10995">#10995</a></strong>)</p> </li> <li> <p><strong>Dependencies:</strong> Bumped <code>@babel/core</code>, <code>@babel/preset-env</code>, <code>@commitlint/cli</code>, <code>@commitlint/config-conventional</code>, <code>@rollup/plugin-babel</code>, <code>@rollup/plugin-commonjs</code>, <code>@vitest/browser</code>, <code>@vitest/browser-playwright</code>, <code>eslint</code>, <code>lint-staged</code>, <code>rollup</code>, <code>vitest</code>, and <code>actions/checkout</code>. (<strong><a href="https://redirect.github.com/axios/axios/issues/10989">#10989</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10996">#10996</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10997">#10997</a></strong>)</p> </li> <li> <p><strong>Release Metadata:</strong> Prepared the 1.18.0 release by updating package metadata and the runtime <code>VERSION</code> value. (<strong><a href="https://redirect.github.com/axios/axios/issues/11003">#11003</a></strong>)</p> </li> </ul> <h2>🌟 New Contributors</h2> <p>We are thrilled to welcome our new contributors. Thank you for helping improve axios:</p> <ul> <li><strong><a href="https://github.com/drori12"><code>@drori12</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10984">#10984</a></strong>)</li> <li><strong><a href="https://github.com/eyupcanakman"><code>@eyupcanakman</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10899">#10899</a></strong>)</li> <li><strong><a href="https://github.com/Adi-Beker"><code>@Adi-Beker</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10995">#10995</a></strong>)</li> </ul> <p><a href="https://github.com/axios/axios/compare/v1.17.0...v1.18.0">Full Changelog</a></p> <h2>v1.17.0 — June 1, 2026</h2> <p>This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.</p> <h2>🔒 Security Fixes</h2> <ul> <li><strong>Config Hardening:</strong> Guarded <code>socketPath</code>, <code>params</code>, and <code>paramsSerializer</code> reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (<strong><a href="https://redirect.github.com/axios/axios/issues/10901">#10901</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10922">#10922</a></strong>)</li> <li><strong>Release Publishing:</strong> Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (<strong><a href="https://redirect.github.com/axios/axios/issues/10926">#10926</a></strong>)</li> </ul> <h2>🚀 New Features</h2> <ul> <li><strong>HTTP Compression:</strong> Added Node HTTP adapter support for zstd response decompression, with <code>transitional.advertiseZstdAcceptEncoding</code> controlling whether <code>zstd</code> is advertised in <code>Accept-Encoding</code>. (<strong><a href="https://redirect.github.com/axios/axios/issues/6792">#6792</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10920">#10920</a></strong>)</li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li><strong>Authentication Handling:</strong> Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (<strong><a href="https://redirect.github.com/axios/axios/issues/10929">#10929</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10896">#10896</a></strong>)</li> <li><strong>Proxy TLS:</strong> Preserved user <code>httpsAgent</code> TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (<strong><a href="https://redirect.github.com/axios/axios/issues/10957">#10957</a></strong>)</li> <li><strong>React Native FormData:</strong> Cleared default <code>Content-Type</code> for React Native <code>FormData</code> so multipart boundaries can be generated correctly. (<strong><a href="https://redirect.github.com/axios/axios/issues/10898">#10898</a></strong>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/axios/axios/commit/2d06f96e8602c2db13b65a26340ee4a1bbc0b61f"><code>2d06f96</code></a> chore(release): prepare release 1.18.0 (<a href="https://redirect.github.com/axios/axios/issues/11003">#11003</a>)</li> <li><a href="https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2"><code>32fc489</code></a> fix: malformed http urls (<a href="https://redirect.github.com/axios/axios/issues/11000">#11000</a>)</li> <li><a href="https://github.com/axios/axios/commit/b40ce498abfa10d90b873b4fd08f520afa5d2545"><code>b40ce49</code></a> chore(deps-dev): bump the development_dependencies group with 10 updates (<a href="https://redirect.github.com/axios/axios/issues/10">#10</a>...</li> <li><a href="https://github.com/axios/axios/commit/fe964f960ecb52c3e1155b0daf7be77541956b01"><code>fe964f9</code></a> docs: mark proxy config as Node.js only (<a href="https://redirect.github.com/axios/axios/issues/10995">#10995</a>)</li> <li><a href="https://github.com/axios/axios/commit/5f229d2d1f018d1db3dab6bbe034dbf3f9041b99"><code>5f229d2</code></a> chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions ...</li> <li><a href="https://github.com/axios/axios/commit/fae9d4e7db6a858c407c75e607a071c533c5c4f6"><code>fae9d4e</code></a> docs: clarify package update PR policy (<a href="https://redirect.github.com/axios/axios/issues/10992">#10992</a>)</li> <li><a href="https://github.com/axios/axios/commit/28ab2ced820e55192806c53472ab3eb0cbb68dc2"><code>28ab2ce</code></a> chore(deps-dev): bump the development_dependencies group with 2 updates (<a href="https://redirect.github.com/axios/axios/issues/10989">#10989</a>)</li> <li><a href="https://github.com/axios/axios/commit/a8e4f13aeecc45a3b8fab3ecfd9ddb5d70fb772b"><code>a8e4f13</code></a> fix(core): keep default validateStatus when request passes undefined (<a href="https://redirect.github.com/axios/axios/issues/10899">#10899</a>)</li> <li><a href="https://github.com/axios/axios/commit/614f4552a17de757d4171ad7c3bd38c9c1025fd8"><code>614f455</code></a> docs: publish v1.17.0 release notes (<a href="https://redirect.github.com/axios/axios/issues/10988">#10988</a>)</li> <li><a href="https://github.com/axios/axios/commit/6bb12c191f5380fad321322fb90216ae0dc36985"><code>6bb12c1</code></a> fix: custom auth headers not stripped on cross-origin redirects (<a href="https://redirect.github.com/axios/axios/issues/10892">#10892</a>)</li> <li>Additional commits viewable in <a href="https://github.com/axios/axios/compare/v1.16.1...v1.18.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/appsmithorg/appsmith/network/alerts). </details> <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/30030570832> > Commit: ba44e34 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=30030570832&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.All` > Spec: > <hr>Thu, 23 Jul 2026 19:01:59 UTC <!-- end of auto-generated comment: Cypress test results --> ## Automation /ok-to-test tags="@tag.All" Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…-3jrh-7fpw) (#42034) ## Summary Resolves Dependabot alert #692 — **CRITICAL** severity. ### Vulnerability **Package:** `tar` (node-tar) **CVE:** CVE-2026-59873 | **GHSA:** GHSA-23hp-3jrh-7fpw | **Severity:** CRITICAL **Vulnerable range:** ≤ 7.5.18 **Patched version:** 7.5.19+ **Description:** A Decompression/parse DoS via unlimited input ("Gzip Bomb"). `node-tar` does not enforce a hard upper bound on total decompressed data. An attacker can craft a tiny compressed archive that expands to exhaust all available disk space, causing system-wide failure and service outage. ### Root Cause (CE vs EE Discrepancy) EE already had this fixed — it pinned `"tar": "^7.5.19"` in `resolutions`. CE had a stale hard-pin: `"tar": "7.5.16"` (the vulnerable version). ### Fix Bumped `resolutions.tar` from `"7.5.16"` → `"^7.5.19"` in `app/client/package.json`, mirroring the EE fix exactly. Lockfile updated: `tar` now resolves to `7.5.21`. **No code changes** — resolutions bump and lockfile update only. ### Diff | File | Change | |------|--------| | `app/client/package.json` | `"tar": "7.5.16"` → `"tar": "^7.5.19"` | | `app/client/yarn.lock` | `tar` entry updated from `7.5.16` → `7.5.21` | /ok-to-test tags="@tag.All" <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/30037477020> > Commit: fd67a8d > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=30037477020&attempt=2" target="_blank">Cypress dashboard</a>. > Tags: `@tag.All` > Spec: > <hr>Fri, 24 Jul 2026 04:03:03 UTC <!-- end of auto-generated comment: Cypress test results --> Co-authored-by: appsmith-smithes[bot] <appsmith-smithes[bot]@users.noreply.github.com>
Bumps [axios](https://github.com/axios/axios) from 1.16.1 to 1.18.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/releases">axios's releases</a>.</em></p> <blockquote> <h2>v1.18.0 — June 13, 2026</h2> <p>This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.</p> <h2>🔒 Security Fixes</h2> <ul> <li> <p><strong>Redirect Header Safety:</strong> Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (<strong><a href="https://redirect.github.com/axios/axios/issues/10892">#10892</a></strong>)</p> </li> <li> <p><strong>URL And Request Hardening:</strong> Rejects malformed <code>http:</code> and <code>https:</code> URLs that omit <code>//</code> with <code>ERR_INVALID_URL</code>, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local <code>NO_PROXY</code> matching. (<strong><a href="https://redirect.github.com/axios/axios/issues/11000">#11000</a></strong>)</p> </li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li><strong>Status Validation:</strong> Added <code>transitional.validateStatusUndefinedResolves</code> so applications can opt in to treating <code>validateStatus: undefined</code> like the option was omitted, while <code>validateStatus: null</code> remains the explicit way to accept every status. (<strong><a href="https://redirect.github.com/axios/axios/issues/10899">#10899</a></strong>)</li> </ul> <h2>🔧 Maintenance & Chores</h2> <ul> <li> <p><strong>Documentation:</strong> Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the <code>proxy</code> request config as Node.js-only in the advanced docs. (<strong><a href="https://redirect.github.com/axios/axios/issues/10984">#10984</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10988">#10988</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10992">#10992</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10995">#10995</a></strong>)</p> </li> <li> <p><strong>Dependencies:</strong> Bumped <code>@babel/core</code>, <code>@babel/preset-env</code>, <code>@commitlint/cli</code>, <code>@commitlint/config-conventional</code>, <code>@rollup/plugin-babel</code>, <code>@rollup/plugin-commonjs</code>, <code>@vitest/browser</code>, <code>@vitest/browser-playwright</code>, <code>eslint</code>, <code>lint-staged</code>, <code>rollup</code>, <code>vitest</code>, and <code>actions/checkout</code>. (<strong><a href="https://redirect.github.com/axios/axios/issues/10989">#10989</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10996">#10996</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10997">#10997</a></strong>)</p> </li> <li> <p><strong>Release Metadata:</strong> Prepared the 1.18.0 release by updating package metadata and the runtime <code>VERSION</code> value. (<strong><a href="https://redirect.github.com/axios/axios/issues/11003">#11003</a></strong>)</p> </li> </ul> <h2>🌟 New Contributors</h2> <p>We are thrilled to welcome our new contributors. Thank you for helping improve axios:</p> <ul> <li><strong><a href="https://github.com/drori12"><code>@drori12</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10984">#10984</a></strong>)</li> <li><strong><a href="https://github.com/eyupcanakman"><code>@eyupcanakman</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10899">#10899</a></strong>)</li> <li><strong><a href="https://github.com/Adi-Beker"><code>@Adi-Beker</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10995">#10995</a></strong>)</li> </ul> <p><a href="https://github.com/axios/axios/compare/v1.17.0...v1.18.0">Full Changelog</a></p> <h2>v1.17.0 — June 1, 2026</h2> <p>This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.</p> <h2>🔒 Security Fixes</h2> <ul> <li><strong>Config Hardening:</strong> Guarded <code>socketPath</code>, <code>params</code>, and <code>paramsSerializer</code> reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (<strong><a href="https://redirect.github.com/axios/axios/issues/10901">#10901</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10922">#10922</a></strong>)</li> <li><strong>Release Publishing:</strong> Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (<strong><a href="https://redirect.github.com/axios/axios/issues/10926">#10926</a></strong>)</li> </ul> <h2>🚀 New Features</h2> <ul> <li><strong>HTTP Compression:</strong> Added Node HTTP adapter support for zstd response decompression, with <code>transitional.advertiseZstdAcceptEncoding</code> controlling whether <code>zstd</code> is advertised in <code>Accept-Encoding</code>. (<strong><a href="https://redirect.github.com/axios/axios/issues/6792">#6792</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10920">#10920</a></strong>)</li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li><strong>Authentication Handling:</strong> Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (<strong><a href="https://redirect.github.com/axios/axios/issues/10929">#10929</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10896">#10896</a></strong>)</li> <li><strong>Proxy TLS:</strong> Preserved user <code>httpsAgent</code> TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (<strong><a href="https://redirect.github.com/axios/axios/issues/10957">#10957</a></strong>)</li> <li><strong>React Native FormData:</strong> Cleared default <code>Content-Type</code> for React Native <code>FormData</code> so multipart boundaries can be generated correctly. (<strong><a href="https://redirect.github.com/axios/axios/issues/10898">#10898</a></strong>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/blob/v1.x/CHANGELOG.md">axios's changelog</a>.</em></p> <blockquote> <h2>v1.18.0 — June 13, 2026</h2> <p>This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.</p> <h2>🔒 Security Fixes</h2> <ul> <li> <p><strong>Redirect Header Safety:</strong> Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (<strong><a href="https://redirect.github.com/axios/axios/issues/10892">#10892</a></strong>)</p> </li> <li> <p><strong>URL And Request Hardening:</strong> Rejects malformed <code>http:</code> and <code>https:</code> URLs that omit <code>//</code> with <code>ERR_INVALID_URL</code>, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local <code>NO_PROXY</code> matching. (<strong><a href="https://redirect.github.com/axios/axios/issues/11000">#11000</a></strong>)</p> </li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li><strong>Status Validation:</strong> Added <code>transitional.validateStatusUndefinedResolves</code> so applications can opt in to treating <code>validateStatus: undefined</code> like the option was omitted, while <code>validateStatus: null</code> remains the explicit way to accept every status. (<strong><a href="https://redirect.github.com/axios/axios/issues/10899">#10899</a></strong>)</li> </ul> <h2>🔧 Maintenance & Chores</h2> <ul> <li> <p><strong>Documentation:</strong> Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the <code>proxy</code> request config as Node.js-only in the advanced docs. (<strong><a href="https://redirect.github.com/axios/axios/issues/10984">#10984</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10988">#10988</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10992">#10992</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10995">#10995</a></strong>)</p> </li> <li> <p><strong>Dependencies:</strong> Bumped <code>@babel/core</code>, <code>@babel/preset-env</code>, <code>@commitlint/cli</code>, <code>@commitlint/config-conventional</code>, <code>@rollup/plugin-babel</code>, <code>@rollup/plugin-commonjs</code>, <code>@vitest/browser</code>, <code>@vitest/browser-playwright</code>, <code>eslint</code>, <code>lint-staged</code>, <code>rollup</code>, <code>vitest</code>, and <code>actions/checkout</code>. (<strong><a href="https://redirect.github.com/axios/axios/issues/10989">#10989</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10996">#10996</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10997">#10997</a></strong>)</p> </li> <li> <p><strong>Release Metadata:</strong> Prepared the 1.18.0 release by updating package metadata and the runtime <code>VERSION</code> value. (<strong><a href="https://redirect.github.com/axios/axios/issues/11003">#11003</a></strong>)</p> </li> </ul> <h2>🌟 New Contributors</h2> <p>We are thrilled to welcome our new contributors. Thank you for helping improve axios:</p> <ul> <li><strong><a href="https://github.com/drori12"><code>@drori12</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10984">#10984</a></strong>)</li> <li><strong><a href="https://github.com/eyupcanakman"><code>@eyupcanakman</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10899">#10899</a></strong>)</li> <li><strong><a href="https://github.com/Adi-Beker"><code>@Adi-Beker</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10995">#10995</a></strong>)</li> </ul> <p><a href="https://github.com/axios/axios/compare/v1.17.0...v1.18.0">Full Changelog</a></p> <h2>v1.17.0 — June 1, 2026</h2> <p>This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.</p> <h2>🔒 Security Fixes</h2> <ul> <li><strong>Config Hardening:</strong> Guarded <code>socketPath</code>, <code>params</code>, and <code>paramsSerializer</code> reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (<strong><a href="https://redirect.github.com/axios/axios/issues/10901">#10901</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10922">#10922</a></strong>)</li> <li><strong>Release Publishing:</strong> Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (<strong><a href="https://redirect.github.com/axios/axios/issues/10926">#10926</a></strong>)</li> </ul> <h2>🚀 New Features</h2> <ul> <li><strong>HTTP Compression:</strong> Added Node HTTP adapter support for zstd response decompression, with <code>transitional.advertiseZstdAcceptEncoding</code> controlling whether <code>zstd</code> is advertised in <code>Accept-Encoding</code>. (<strong><a href="https://redirect.github.com/axios/axios/issues/6792">#6792</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10920">#10920</a></strong>)</li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li><strong>Authentication Handling:</strong> Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (<strong><a href="https://redirect.github.com/axios/axios/issues/10929">#10929</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10896">#10896</a></strong>)</li> <li><strong>Proxy TLS:</strong> Preserved user <code>httpsAgent</code> TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (<strong><a href="https://redirect.github.com/axios/axios/issues/10957">#10957</a></strong>)</li> <li><strong>React Native FormData:</strong> Cleared default <code>Content-Type</code> for React Native <code>FormData</code> so multipart boundaries can be generated correctly. (<strong><a href="https://redirect.github.com/axios/axios/issues/10898">#10898</a></strong>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/axios/axios/commit/2d06f96e8602c2db13b65a26340ee4a1bbc0b61f"><code>2d06f96</code></a> chore(release): prepare release 1.18.0 (<a href="https://redirect.github.com/axios/axios/issues/11003">#11003</a>)</li> <li><a href="https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2"><code>32fc489</code></a> fix: malformed http urls (<a href="https://redirect.github.com/axios/axios/issues/11000">#11000</a>)</li> <li><a href="https://github.com/axios/axios/commit/b40ce498abfa10d90b873b4fd08f520afa5d2545"><code>b40ce49</code></a> chore(deps-dev): bump the development_dependencies group with 10 updates (<a href="https://redirect.github.com/axios/axios/issues/10">#10</a>...</li> <li><a href="https://github.com/axios/axios/commit/fe964f960ecb52c3e1155b0daf7be77541956b01"><code>fe964f9</code></a> docs: mark proxy config as Node.js only (<a href="https://redirect.github.com/axios/axios/issues/10995">#10995</a>)</li> <li><a href="https://github.com/axios/axios/commit/5f229d2d1f018d1db3dab6bbe034dbf3f9041b99"><code>5f229d2</code></a> chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions ...</li> <li><a href="https://github.com/axios/axios/commit/fae9d4e7db6a858c407c75e607a071c533c5c4f6"><code>fae9d4e</code></a> docs: clarify package update PR policy (<a href="https://redirect.github.com/axios/axios/issues/10992">#10992</a>)</li> <li><a href="https://github.com/axios/axios/commit/28ab2ced820e55192806c53472ab3eb0cbb68dc2"><code>28ab2ce</code></a> chore(deps-dev): bump the development_dependencies group with 2 updates (<a href="https://redirect.github.com/axios/axios/issues/10989">#10989</a>)</li> <li><a href="https://github.com/axios/axios/commit/a8e4f13aeecc45a3b8fab3ecfd9ddb5d70fb772b"><code>a8e4f13</code></a> fix(core): keep default validateStatus when request passes undefined (<a href="https://redirect.github.com/axios/axios/issues/10899">#10899</a>)</li> <li><a href="https://github.com/axios/axios/commit/614f4552a17de757d4171ad7c3bd38c9c1025fd8"><code>614f455</code></a> docs: publish v1.17.0 release notes (<a href="https://redirect.github.com/axios/axios/issues/10988">#10988</a>)</li> <li><a href="https://github.com/axios/axios/commit/6bb12c191f5380fad321322fb90216ae0dc36985"><code>6bb12c1</code></a> fix: custom auth headers not stripped on cross-origin redirects (<a href="https://redirect.github.com/axios/axios/issues/10892">#10892</a>)</li> <li>Additional commits viewable in <a href="https://github.com/axios/axios/compare/v1.16.1...v1.18.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/appsmithorg/appsmith/network/alerts). </details> <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/30037833847> > Commit: 24fe9a0 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=30037833847&attempt=2" target="_blank">Cypress dashboard</a>. > Tags: `@tag.All` > Spec: > <hr>Fri, 24 Jul 2026 05:50:15 UTC <!-- end of auto-generated comment: Cypress test results --> ## Automation /ok-to-test tags="@tag.All" Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
… step (#42050) ## Description The client-build job fails with `Argument list too long` on PRs with a large divergence (most recently the release-to-master promotion in EE). The "Run step if any file(s) in the client folder change" step passes `steps.changed-files-specific.outputs.all_changed_files` through an env var solely to echo it; when the list exceeds the 128KiB per-string exec limit, bash cannot be started and the job fails before doing any work. This switches the step to the file-output pattern `server-build.yml` already uses: `write_output_files: true` on the tj-actions/changed-files step, and `cat` of `.github/outputs/all_changed_files.txt` instead of the env var. The `any_changed` gating used by the rest of the workflow is unchanged. Linear: https://linear.app/appsmith/issue/APP-15724 ## Automation CI-workflow-only change; Cypress not applicable. /ok-to-test tags="" 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Improved client build workflow handling for changed-file detection. * Changed files are now consistently recorded and displayed during the build process. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
## Summary Batch security update via resolutions/version bumps. ### Resolved alerts - Resolves #707 — org.postgresql:postgresql -> 42.7.12 (CVE-2026-42198, high) - Resolves #695, #694 — webpack-dev-server -> 5.2.6 (medium) - Resolves #701, #700 — immutable -> 4.3.9 (via resolutions, high) - Resolves #689 — shell-quote -> 1.9.0 (via resolutions, high) - Resolves #688 — brace-expansion -> 1.1.16 (via resolutions, high) - Resolves #685 — protobufjs -> 7.6.5 (via resolutions, medium) - Resolves #706, #702 — fast-uri -> 3.1.4 (via resolutions, high) - Resolves #704 — svgo (2.x line) -> 2.8.3 (via resolutions, high) - Resolves #705 — svgo (3.x line) -> 3.3.4 (via resolutions, high) ### Not addressed (see report) - #654 @opentelemetry/core — requires major bump 1.x -> 2.8.0, skipped - #703 @opentelemetry/propagator-jaeger — requires major bump 1.x -> 2.9.0, skipped No code changes — version bumps and resolutions only. /ok-to-test tags="@tag.All" <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/30099141863> > Commit: 2d3ad47 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=30099141863&attempt=2" target="_blank">Cypress dashboard</a>. > Tags: `@tag.All` > Spec: > <hr>Fri, 24 Jul 2026 15:45:58 UTC <!-- end of auto-generated comment: Cypress test results --> Co-authored-by: appsmith-smithes[bot] <appsmith-smithes[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
8 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Promotes the
releasebranch intomaster.Commits included
Automation
/ok-to-test tags="@tag.All"
Communication
Should the DevRel and Marketing teams be notified?
Caution
🔴 🔴 🔴 Some tests have failed.
Workflow run: https://github.com/appsmithorg/appsmith/actions/runs/30107746760
Commit: 6c17eaa
Cypress dashboard.
Tags: @tag.All
Spec:
The following are new failures, please fix them before merging the PR:
- cypress/e2e/Regression/ClientSide/AdminSettings/Email_settings_Spec.ts
List of identified flaky tests.Fri, 24 Jul 2026 17:12:03 UTC