[pull] main from rmyndharis:main - #119
Merged
Merged
Conversation
Several API examples and test fixtures carried values copied from a live account rather than placeholders: a group invite code that also reaches the published schema, a phone number and its paired privacy id in a script docblock, and an ingress secret in a dashboard unit test. Each is replaced with a synthetic value of the same shape, matching the conventions the surrounding examples already use, and openapi.json is regenerated rather than hand-edited. Replacing them here does not undo the earlier publication; the invite code and the secret still need to be rotated at the source. A catalog helper's comment also opened with a label that carries no meaning for a reader. The note itself is unchanged.
The band that swaps the chat panes ended at 888px, one pixel short. The room is `viewport - 646` and the composer needs 244px, so the first viewport where two panes fit is 890, not 889. At exactly 889px with the navigation expanded the two-pane layout was kept and one pixel column of the send button fell outside the panel's clip. The measurement that set the old bound compared the button against the layout's border box, but `overflow: hidden` clips at the padding box and the layout carries a 1px border, so every threshold derived that way was low by one. The same correction applies to the two figures the changelog quotes for the earlier fix: the clip started below 1015px rather than 1014px, and on phones at 403 CSS px rather than 402.
chore: use synthetic values in examples and fixtures
fix(dashboard): extend the narrow band to the width it still clipped
chore(release): v0.23.1
The v0.23.1 image scan failed on linux/arm64 with 33 HIGH findings: eleven Chromium ids across chromium, chromium-common and chromium-sandbox. amd64 was clean, and the asymmetry is structural rather than incidental. Chrome for Testing publishes no linux-arm64 build, so amd64 uses CfT while arm64 installs Debian's chromium; only the arm64 image carries the package the findings are against. The build is not stale. It fetched from bookworm-security with no cached apt layer and installed 151.0.7922.137-1~deb12u1, the newest that exists. Trivy names 151.0.7922.169-1~deb12u1 as fixed, and the security mirror's own package index still serves .137 for both architectures, so there is nothing to upgrade to and a rebuild changes nothing. Eight of the eleven are code execution in the renderer and none are neutralised by running with --no-sandbox, unlike the earlier batch. The note in the file states that plainly rather than talking it down. Drop all eleven once bookworm ships 151.0.7922.169 and re-run the scan without them.
ci(release): accept the unfixed arm64 Chromium CVEs in the image scan
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )