Release: merge development into beta#67
Open
github-actions[bot] wants to merge 84 commits into
Open
Conversation
release: Promote external-source installs + PAT + discovery to main
… SourceBinding Two findings from Clyde Barcode's full-branch security audit on PR #29 (see #32 for the tracking issue, the verdict comments on PR #29, and the dogfood context). 1. SSRF defence-in-depth — ExternalReleaseInstallerService.php authenticatedDownload() and verifyChecksum() fetched URLs from the GitHub API browser_download_url field without 'nextcloud' => ['allow_local_address' => false]. A malicious release in a trusted-source-listed repo could redirect the download to an internal address, forwarding the PAT Bearer token. PatValidator already sets this option correctly — mirrored the pattern in both methods. (OWASP A10:2021) 2. Path-traversal guard — SourceBinding.php The constructor accepted any string for owner/repo. fnmatch in TrustedSourceList lets `*` match `/`, so `ConductionNL/../../../x` passes the allowlist. Adding preg_match validation to the constructor rejects invalid characters at the boundary; charset matches GitHub's own owner/repo rules (alphanumerics, dot, dash, underscore). (CWE-22 / OWASP A01:2021) Both fixes mirror Conduction's existing patterns in the same app and do not introduce new dependencies. Bounded mechanical changes, no behaviour change for legitimate inputs. Bundles 31 SPDX header additions + the gate-9 #[NoAdminRequired] batch removal from Juan Claude van Damme's earlier review run (commit 1cc7df9 on the pr-branch ref) in the same PR.
chore(quality): apply Hydra full-branch review findings — SPDX, gate-9, SSRF, path-traversal
…pdates Bumps the npm_and_yarn group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `7.3.1` | `7.3.3` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.12` | `1.1.14` | | [picomatch](https://github.com/micromatch/picomatch) | `4.0.3` | `4.0.4` | | [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `2.3.2` | | [picomatch](https://github.com/micromatch/picomatch) | `4.0.2` | `4.0.4` | | [axios](https://github.com/axios/axios) | `1.13.5` | `1.16.0` | | [dompurify](https://github.com/cure53/DOMPurify) | `3.3.1` | `3.4.2` | | [flatted](https://github.com/WebReflection/flatted) | `3.3.3` | `3.4.2` | | [immutable](https://github.com/immutable-js/immutable-js) | `4.3.5` | `4.3.8` | | [lodash](https://github.com/lodash/lodash) | `4.17.23` | `4.18.1` | | [postcss](https://github.com/postcss/postcss) | `8.5.6` | `8.5.14` | | [yaml](https://github.com/eemeli/yaml) | `2.8.2` | `2.8.4` | Updates `vite` from 7.3.1 to 7.3.3 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v7.3.3/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v7.3.3/packages/vite) Updates `brace-expansion` from 1.1.12 to 1.1.14 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.14) Updates `picomatch` from 4.0.3 to 4.0.4 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@4.0.3...4.0.4) Updates `picomatch` from 2.3.1 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@4.0.3...4.0.4) Updates `picomatch` from 4.0.2 to 4.0.4 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@4.0.3...4.0.4) Updates `axios` from 1.13.5 to 1.16.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.13.5...v1.16.0) Updates `dompurify` from 3.3.1 to 3.4.2 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.3.1...3.4.2) Updates `flatted` from 3.3.3 to 3.4.2 - [Commits](WebReflection/flatted@v3.3.3...v3.4.2) Updates `follow-redirects` from 1.15.11 to 1.16.0 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.11...v1.16.0) Updates `immutable` from 4.3.5 to 4.3.8 - [Release notes](https://github.com/immutable-js/immutable-js/releases) - [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md) - [Commits](immutable-js/immutable-js@v4.3.5...v4.3.8) Updates `lodash` from 4.17.23 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.23...4.18.1) Updates `postcss` from 8.5.6 to 8.5.14 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.6...8.5.14) Updates `yaml` from 2.8.2 to 2.8.4 - [Release notes](https://github.com/eemeli/yaml/releases) - [Commits](eemeli/yaml@v2.8.2...v2.8.4) --- updated-dependencies: - dependency-name: vite dependency-version: 7.3.3 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.14 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 4.0.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 4.0.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: axios dependency-version: 1.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: dompurify dependency-version: 3.4.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: flatted dependency-version: 3.4.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-version: 1.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: immutable dependency-version: 4.3.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.18.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.14 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: yaml dependency-version: 2.8.4 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
…elopment) (#39) Stand up the journeydoc docs surface for App Versions. The app is in development; this PR provides the brand landing page and a tutorial skeleton anchored on the version-management / external-sources / pat-management specs, so app-versions.conduction.nl resolves to a real Docusaurus site while the admin UI matures. - docs/ tree copied from nextcloud-app-template's canonical scaffold (Docusaurus + @conduction/docusaurus-preset 2.6.1, en-only i18n, custom prism + mermaid themes, brand-theme swizzles) - landing page: version-rows glyph, NL-Conduction tagline corrected off the info.xml summary (NOT the stale 'scaffold/template' framing that lives on conduction-website's apps-catalog), three token-built mock panels (Installed apps + current version, Available versions per source, Recent rollbacks), 'In development' hero status - intro.md rewritten to describe what App Versions actually does (multi-source version picker, rollback or pin, audit-trailed) and links the four canonical specs on GitHub - user track collapses to a single 'who is this for?' pointer page (App Versions is admin-only); admin track gets three intent-stating pages mapped to specs: 01 first launch, 02 rollback (version-management), 03 connect a GitHub source (external-sources + pat-management) - documentation.yml: triggers on [documentation] only (canonical post-revert deploy model), cname app-versions.conduction.nl - CNAME static + docusaurus.config url / editUrl / GitHub link all point at app-versions
Defense against supply-chain attacks (e.g. shai-hulud, nx-style compromised publishes) by blocking install of any package version published less than 24h ago. - .npmrc: new; `min-release-age=1` (npm 11.5+ native; older npm ignores it) - .github/dependabot.yml: add `cooldown.default-days: 1` to the existing npm entry, with @conduction/* excluded so first-party releases reach this repo immediately For release-day consumption of fresh @conduction/* deps, use `npm install --min-release-age=0 @conduction/pkg@x.y.z`.
- Add 1200x630 brand OG card with the app's wordmark. - Set themeConfig.image to reference the new card. - Correct llms.txt docs links to /docs/intro + /api.
Drop the local docs/scripts/validate-ai-baseline.mjs copy and call the bin command shipped by @conduction/docusaurus-preset >=3.5.0 instead. Why: keeps the validator in one place across the fleet. Future check additions ship via a preset bump rather than 17 parallel PRs. Validator behaviour is identical (same 8 universal checks).
Preset 3.6.0 ships the traditional-SEO baseline (sitemap lastmod, drops priority/changefreq per Google 2026 guidance, fixes the legal- link 404s on subdomain footers, adds searchConsoleVerification opt). The lockfile bump uses --min-release-age=0 per .npmrc cooldown override (required for fresh @conduction/* releases under the 24h supply-chain cooldown).
Preset 3.6.0 shipped with a JSDoc parse bug (literal */ inside backticks closed the comment early). 3.6.1 fixed it; this lockfile bump pulls the patched version so the Documentation workflow's npm ci succeeds and the deploy finally fires with the AI baseline.
…d) (#54) 3.7.0's 90% sitemap-lastmod threshold was too strict; Docusaurus auto-generated routes don't have source mtime. 3.7.1 lowers to 50% (still catches preset-wrap regressions, tolerates the realistic mix of markdown content + auto-routes).
…icle + IndexNow) (#56) 3.8.0 adds: - BreadcrumbList JSON-LD on marketing pages via <DetailHero> - TechArticle JSON-LD on docs pages via DocItem/Content swizzle - IndexNow plugin (sites need to set indexnow.key to enable Bing pings) Pure lockfile bump; package.json range ^3.7.0 already satisfies.
3.9.0 adds a hard-fail validator check for TechArticle JSON-LD on docs pages, on top of the swizzle that ships the schema (3.8.0). Pure lockfile bump; package.json range ^3.7.0 already satisfies.
Brings the composer require.php constraint in line with the runtime the container + CI already use (PHP 8.3). Drops formal support for PHP 8.1 and 8.2. Several vendor packages (e.g. azjezz/psl@4.3.0) use PHP 8.3 typed class constants, making the codebase functionally 8.3-only already. Part of the fleet-wide PHP 8.3 sweep.
Aligns the composer platform pin with the runtime constraint
('require.php' bumped to ^8.3 fleet-wide yesterday). Keeps composer's
resolver consistent — it'll pick package versions assuming PHP 8.3 is
the target runtime, which matches what the container (PHP 8.3.30) and
CI matrices already use.
Part of the fleet-wide PHP 8.3 sweep.
…ling (#65) Aligns appinfo/info.xml with the fleet canonical: - <php min-version="8.3"> — matches the composer require.php constraint (^8.3 fleet-wide) - <nextcloud min-version="28" max-version="34"> — converge the fleet on one NC support range - <licence>agpl</licence> — fix the casing/value drift (fleet had agpl / eupl / EUPL-1.2 / AGPL-3.0-or-later — 4 spellings). Stays on "agpl" workaround per the EUPL store-listing pattern; switch to "EUPL-1.2" once NC 34 is the fleet floor (ConductionNL/.github#98). Per-app fields (<id>, <name>, <description>, <version>, etc.) are preserved. Drift surfaced in https://github.com/ConductionNL/nextcloud-app-template/blob/development/docs/fleet-drift-deeper.md#4-appinfoinfoxml--significant-drift
Per the fleet drift research in [nextcloud-app-template/docs/fleet-drift-deeper.md §3](https://github.com/ConductionNL/nextcloud-app-template/blob/development/docs/fleet-drift-deeper.md#3-ci-workflows-githubworkflowsyml), app-versions carried 14 workflows — almost all legacy / one-off predecessors of the canonical fleet set. Deletes 12 legacy workflows: - block-unconventional-commits.yml, fixup.yml - lint-eslint.yml, lint-info-xml.yml, lint-php-cs.yml, lint-php.yml, lint-stylelint.yml (folded into code-quality.yml) - node.yml, npm-audit-fix.yml - psalm-matrix.yml (folded into code-quality.yml) - update-nextcloud-ocp-approve-merge.yml, update-nextcloud-ocp-matrix.yml Adds 9 canonical workflows from the template: - branch-protection.yml, code-quality.yml, issue-triage.yml, openspec-sync.yml, pull-request-lint-check.yaml, release-beta.yml, release-stable.yml, spec-validation.yml, sync-to-beta.yml Keeps: - documentation.yml (already canonical) - openapi.yml (upstream Nextcloud org workflow, out of fleet scope)
Maps all 70 uncovered Controller/Service/Listener methods to the four existing capability specs (version-management, external-sources, pat-management, app-discovery) via @SPEC docblock tags. No new REQs were needed — the specs already describe every method's behaviour. Drives gate-16 spec-coverage to 0 uncovered backend methods.
Contributor
Author
Quality Report — ConductionNL/app-versions @
|
| Check | PHP | Vue | Security | License | Tests |
|---|---|---|---|---|---|
| lint | ❌ | ||||
| phpcs | ❌ | ||||
| phpmd | ❌ | ||||
| psalm | ❌ | ||||
| phpstan | ❌ | ||||
| phpmetrics | ❌ | ||||
| eslint | ❌ | ||||
| stylelint | ❌ | ||||
| composer | ❌ | ❌ | |||
| npm | ✅ | ✅ 282/282 | |||
| PHPUnit | ⏭️ | ||||
| Newman | ⏭️ | ||||
| Playwright | ⏭️ |
Quality workflow — 2026-05-25 20:11 UTC
Download the full PDF report from the workflow artifacts.
Contributor
Author
Quality Report — ConductionNL/app-versions @
|
| Check | PHP | Vue | Security | License | Tests |
|---|---|---|---|---|---|
| lint | ✅ | ||||
| phpcs | ✅ | ||||
| phpmd | ❌ | ||||
| psalm | ❌ | ||||
| phpstan | ❌ | ||||
| phpmetrics | ❌ | ||||
| eslint | ❌ | ||||
| stylelint | ❌ | ||||
| composer | ✅ | ✅ 7/7 | |||
| npm | ✅ | ✅ 282/282 | |||
| PHPUnit | ⏭️ | ||||
| Newman | ⏭️ | ||||
| Playwright | ⏭️ |
Quality workflow — 2026-05-25 23:49 UTC
Download the full PDF report from the workflow artifacts.
added 4 commits
May 29, 2026 09:09
…-flight checks, finalize recovery' (#14) from feat/10/install-failure-diagnostics into development
…straction' (#16) from feat/12/codeberg-forge-support into development
…into development # Conflicts: # CHANGELOG.md
…-ui' into development # Conflicts: # lib/Controller/ApiController.php
# Conflicts: # docs/docusaurus.config.js # docs/intro.md # docs/package-lock.json # docs/package.json # docs/src/pages/index.js # docs/static/CNAME # docs/static/llms.txt # docs/tutorials/admin/01-admin-settings.md # docs/tutorials/user/01-first-launch.md # img/app-store.svg
…d of raw kind in versions-source label
…pp explanation - Move the tab buttons inside a persistent bordered well that wraps all tab panels; the well chrome stays in place when switching tabs. The page heading sits above it and the apps panel no longer nests a second bordered box. - Show a live status note (spinner + text) while available versions are fetched after picking an app, and clear the previous app's source/ installed-version lines so no stale data shows during the fetch. - Apps list now carries isShipped; a store miss for a shipped app (e.g. activity, nextcloud_announcements) explains that the app is bundled with the server release instead of the generic 'not available' error.
…eenshots - 03-github-source: real 4-step flow (trust source -> token -> bind -> pick version), Codeberg included, scope note (manages installed apps only), shipped-apps vs unpublished-apps distinction, drop the pre-implementation placeholder steps. - 01-admin-settings: drop the placeholder banner, write the real steps, add the panel overview screenshot. - 5 screenshots captured from the live admin UI (2x retina).
…eaders Archive codeberg-forge-support, improve-install-failure-diagnostics, move-to-admin-settings and surface-external-sources-ui — all four have their deliverables present in code (Forge*, EnvironmentCheck/FailureClassifier, Settings/Admin + Sections/AdminSection, Trusted/Sources/Tokens panels); only manual QA/live-instance tasks remain unchecked. Fix pre-existing malformed '## ADDED Requirements' section headers (should be '## Requirements') in main specs external-sources, pat-management, app-discovery that blocked openspec archive's MODIFIED-requirement matching, and the SHOULD->MUST keyword on version-management 'Debug Mode' requirement.
…lt + prune (2026-06-14)' (#18) from reconcile/openspec-app-versions-20260614 into development
…ons, regenerate features.json
…ealing /features 3.24.0 ships the features-page plugin that regenerates /features from openspec/specs at build; docs were pinned to a pre-plugin version.
…a-release week) Set min-release-age=0 so CI/local can npm-install freshly-published @conduction/* betas (<24h old) while we cut multiple betas per day this week. Revert to 1 afterwards.
Apply add-spdx-license-headers: add SPDX-FileCopyrightText + SPDX-License-Identifier: AGPL-3.0-or-later to all 38 lib PHP files (app-versions is genuinely AGPL, matching LICENSE/composer.json/ info.xml). Header-only; no logic change. Archives change.
…isories Apply security-advisory-correlation: App Versions now answers 'is the version I am pinned to known to be unsafe?'. - AdvisorySourceInterface + AdvisoryService correlate the installed/pinned version against advisories resolved from the app's bound source (App Store security info; forge /security-advisories via the existing PAT path — no new HTTP client, no new secret). Read-only: never installs or unpins. States: none | advisory-available | pinned-to-vulnerable, plus the nearest resolving version. - GET /api/advisories surfaces the per-app correlation; App.vue renders a per-app badge (pinned-to-vulnerable prominent) + advisory id / safe version. - AdvisoryRefreshJob (6h TimedJob) re-resolves advisories and, via AdvisoryNotifier, raises an admin NC notification for newly-affected pinned versions. AdvisoryNotifier has no installer dependency — structurally incapable of auto-update/auto-unpin. Notifier renders the notice. - Real unit tests: correlation states + nearest-resolving + end-to-end wiring (AdvisoryServiceTest), and notify/dedup/no-mutation (AdvisoryNotifierTest). 131 unit tests green on php 8.3. Archives change.
Replace the AGPL-3.0 LICENSE with EUPL-1.2 and update composer.json + info.xml. NB: per-file SPDX headers still reference AGPL-3.0 and need a follow-up sweep.
Swap AGPL-3.0-or-later -> EUPL-1.2 across all 46 lib/tests PHP headers, package.json/openapi.json/openspec configs, src/ocs.ts, docs, and the source-license-headers spec. Adds a superseded note to the archived add-spdx-license-headers proposal. Lock files (third-party dep licences) untouched.
…m chore/rename-mydash-to-launchpad into development
…hore/relicense-eupl into development
Nextcloud 34's app-management page inlines the raw app.svg and recolors it via 'fill: currentcolor' on the <svg> element. A fill carried on <path>/<style>/class beats the inherited value, so the icon rendered white-on-white and vanished from the list. Moving the fill to the <svg> element lets Nextcloud recolor the icon; visuals are unchanged everywhere the icon is shown on a dark/colored surface.
…ent, not inner nodes' (#26) from fix/app-icon-svg-level-fill into development
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated PR to sync development changes to beta for beta release.
Merging this PR will trigger the beta release workflow.