Repository navigation
release: website e27f3c3 to production - #132
Merged
Merged
Conversation
- show every canvas tile unconditionally; drop URL-synced filter state - simplify hero to title and lead
- Hero and dataset nets draw a still frame instead of animating - Spinners slow down rather than stop; pulses and pings are disabled - Nets restart when the motion preference changes
- dragging a line/vertical bar card's height sets its plot ratio - ratio persists with the conversation, shares and embeds - resize grip clamps height to the view's height range
- Show the resize grip on read-only share pages; sizes aren't saved - Keep a card's own height until the drag moves a whole cell vertically
- Download Data and Download Image leave the ⋮ menu for their own menu - Readers reported not finding downloads inside the kebab menu
- record sdk and spec-kit commits beside the client tarball - fail when the vendoring commit subject names a different sdk hash - fetch full history in CI so the check can read the git log
Bumps [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) from 1.7.4 to 1.7.7. - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.7.7/packages/better-auth) --- updated-dependencies: - dependency-name: better-auth dependency-version: 1.7.7 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [nodemailer](https://github.com/nodemailer/nodemailer) from 10.0.10 to 10.1.4. - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v10.0.10...v10.1.4) --- updated-dependencies: - dependency-name: nodemailer dependency-version: 10.1.4 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Search sends question text to TypeSafe's Jev as well as to Gemini: production routes every query's binding to Jev, with Gemini as its fallback. The page named only Gemini. The connector receives the data requests an assistant sends, which name the data, places and years and can carry the question in the assistant's words, and those go to Gemini and Jev too. The page said it receives "the question". It also leaves out that exported files sit behind a public link that does not expire.
next 16.3.0 is open to the remote code execution flaws in image optimisation (AVIF and SVG) and next/og ImageResponse, image optimisation SSRF, and the self-hosted SSG/ISR cache poisoning advisories. 16.4.4 clears all 26 open next alerts and pulls sharp 0.35.5, which clears the two sharp alerts. eslint-config-next moves with it. No source or config change is needed.
16.4.5 is Next's November security release, which its 16.4.4 notes announce as fixing seven medium vulnerabilities. Only next's own packages move.
* fix(deps): bump mermaid and the Cloud SQL connector, refresh transitives mermaid 12.3.0 pulls dompurify 3.4.17 and katex 0.18, and @google-cloud/cloud-sql-connector 1.12.1 pulls @grpc/grpc-js 1.14.7. An in-range refresh moves qs, fast-uri, svgo, source-map-js, js-yaml, postcss-selector-parser and brace-expansion to their patched releases. * fix(studio): strip a label's trailing dots in linear time withEllipsis ran /(…|\.\.\.|\.)+$/, which backtracks exponentially on a long run of dots followed by another character: 50 dots took 3.3 s and 60 did not finish. A backward scan strips the same characters. The test covers 200,000 dots. ci.yml and deploy.yml grant contents: read at the top level, so jobs without their own block no longer get the default token scope. * refactor(studio): remove the local share stack Shares live in dfo-apis, so liveShare.ts, liveShareResults.ts and shareWrites.ts had no production caller. Their tests go with them, as do the liveBackend.ts exports only they used (the frame refresh, render and export calls). shortId, flagged for biased random ids, goes with shareWrites.ts. liveBackend.test.ts covers readComponent's id guard and its transport errors. The share and share_card_result tables stay; db/migrate-shares.ts still reads share, and dropping either from db/schema.ts would make db:generate emit a DROP.
…prove-ci-vendor-sdk ci: check vendored client provenance against git history
…d-download-icon feat(studio): move card downloads to a button beside the pin
…cessiblity-fixes Feature/accessiblity fixes
…-gallery-filter refactor(gallery): remove filters, search and count from hero
…size-charts Feature/resize charts
ChatGPT's app directory asks for a terms-of-service URL. ONE's terms of use are the Terms and Conditions section of its privacy policy page, so /terms redirects to that section, as /privacy redirects to the policy.
Bumps [esbuild](https://github.com/evanw/esbuild) from 0.25.12 to 0.28.1. - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2025.md) - [Commits](evanw/esbuild@v0.25.12...v0.28.1) --- updated-dependencies: - dependency-name: esbuild dependency-version: 0.28.1 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…its id (#124) captureSnapshot followed the poll paths the Datasets API returned, on the server. It now checks the operation id against OPERATION_SHAPE and polls /api/datasets/operations/<id> on every round, through operationPath in operationPoll.ts, which shareDownload.ts and PreparingDownload.tsx share. Refs #79
…dule defines (#125) render.tsx read boardStyles.handle after the class left Whiteboard.module.scss, so every card carried an empty span. missingClasses in stateClasses.ts now checks every Styles read against the compiled class maps, and generate refuses a film that fails it. An activity turn line without the step class now throws instead of yielding no hooks. Closes #95
Footer titles and links use net-light #ececdb, 7.71:1 on the charcoal face and 5.50:1 over the world-map lines axe measures them against. deriveTheme now floors caption and muted at 4.5:1 against the card face, darkening within the colour's own hue, so the default caption stays a cool grey (#727779 on white). ShowcaseCards derives its theme against its own cream face instead of overriding --th-card afterwards. axe reports no colour-contrast violations on the home page. Closes #35
Brings in the Share dialog's current snapshot copy in hub/build/share.md and the upstream page and roadmap changes since the last pin. Closes #79
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Releases website at
e27f3c3to production, cut onrelease/2026-11-06: nineteen pull requests.d054523, so the Roadmap page lists its first released Platform and AI tools entries. chore(docs): sync the dfo-docs corpus at f3e9b90 #129 moved it tof3e9b90for the Share dialog copy inhub/build/share.md./termsto the Terms and Conditions section of ONE's privacy policy.share_card_resulttable with migration0024_drop_share_card_resultand removes the deadlive_unavailablerefusal.Nothing depends on another repository's release. Migration 0024 drops
share_card_result, which nothing in production has read since #77, so the drop is safe in this release, which also carries #119.After the deploy, OAuth sign-ins and magic links started before it fail under better-auth 1.7.7, so anyone mid-sign-in starts again.
Testing: CI passed on #131, the last pull request in the release. The production deploy waits for approval.