Joooye_34
fd9a7f6aad
chore: remove unused blocksuite deps in e2e ( #5717 )
2024-01-26 05:55:13 +00:00
LongYinan
af45b93d26
chore: bump up husky version to v9 ( #5694 )
...
[](https://renovatebot.com )
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [husky](https://togithub.com/typicode/husky ) | [`^8.0.3` -> `^9.0.0`](https://renovatebot.com/diffs/npm/husky/8.0.3/9.0.6 ) | [](https://docs.renovatebot.com/merge-confidence/ ) | [](https://docs.renovatebot.com/merge-confidence/ ) | [](https://docs.renovatebot.com/merge-confidence/ ) | [](https://docs.renovatebot.com/merge-confidence/ ) |
---
### Release Notes
<details>
<summary>typicode/husky (husky)</summary>
### [`v9.0.6`](https://togithub.com/typicode/husky/releases/tag/v9.0.6 )
[Compare Source](https://togithub.com/typicode/husky/compare/v9.0.5...v9.0.6 )
- docs: add favicon by [@​rakleed](https://togithub.com/rakleed ) in [https://github.com/typicode/husky/pull/1354 ](https://togithub.com/typicode/husky/pull/1354 )
- chore: apply editorconfig to code only by [@​typicode](https://togithub.com/typicode ) in [https://github.com/typicode/husky/pull/1355 ](https://togithub.com/typicode/husky/pull/1355 )
- docs: update install script to mjs and fix CI checks by [@​starnayuta](https://togithub.com/starnayuta ) in [https://github.com/typicode/husky/pull/1357 ](https://togithub.com/typicode/husky/pull/1357 )
- Fix unbound variable by [@​typicode](https://togithub.com/typicode ) in [https://github.com/typicode/husky/pull/1359 ](https://togithub.com/typicode/husky/pull/1359 )
### [`v9.0.5`](https://togithub.com/typicode/husky/releases/tag/v9.0.5 )
[Compare Source](https://togithub.com/typicode/husky/compare/v9.0.4...v9.0.5 )
- docs: update path to startup files by [@​ManuelRauber](https://togithub.com/ManuelRauber ) in [https://github.com/typicode/husky/pull/1350 ](https://togithub.com/typicode/husky/pull/1350 )
- fix: init error by [@​typicode](https://togithub.com/typicode ) in [https://github.com/typicode/husky/pull/1353 ](https://togithub.com/typicode/husky/pull/1353 )
### [`v9.0.4`](https://togithub.com/typicode/husky/releases/tag/v9.0.4 )
[Compare Source](https://togithub.com/typicode/husky/compare/v9.0.3...v9.0.4 )
- fix: init create dir before by [@​typicode](https://togithub.com/typicode ) in [https://github.com/typicode/husky/pull/1348 ](https://togithub.com/typicode/husky/pull/1348 )
- refactor: simplify by [@​typicode](https://togithub.com/typicode ) in [https://github.com/typicode/husky/pull/1349 ](https://togithub.com/typicode/husky/pull/1349 )
- fix: init not working on pnpm [#​1334](https://togithub.com/typicode/husky/issues/1334 ) by [@​rozbo](https://togithub.com/rozbo ) in [https://github.com/typicode/husky/pull/1347 ](https://togithub.com/typicode/husky/pull/1347 )
### [`v9.0.3`](https://togithub.com/typicode/husky/releases/tag/v9.0.3 )
[Compare Source](https://togithub.com/typicode/husky/compare/v9.0.2...v9.0.3 )
- docs: fix link by [@​typicode](https://togithub.com/typicode ) in [https://github.com/typicode/husky/pull/1340 ](https://togithub.com/typicode/husky/pull/1340 )
- chore: fix links in issue template by [@​julien-f](https://togithub.com/julien-f ) in [https://github.com/typicode/husky/pull/1341 ](https://togithub.com/typicode/husky/pull/1341 )
- fix: add scripts field if not present by [@​chalkygames123](https://togithub.com/chalkygames123 ) in [https://github.com/typicode/husky/pull/1338 ](https://togithub.com/typicode/husky/pull/1338 )
- docs: changelog link by [@​typicode](https://togithub.com/typicode ) in [https://github.com/typicode/husky/pull/1343 ](https://togithub.com/typicode/husky/pull/1343 )
- fix: insert final newline by [@​chalkygames123](https://togithub.com/chalkygames123 ) in [https://github.com/typicode/husky/pull/1339 ](https://togithub.com/typicode/husky/pull/1339 )
- fix: fix git hooks path on windows by [@​rozbo](https://togithub.com/rozbo ) in [https://github.com/typicode/husky/pull/1346 ](https://togithub.com/typicode/husky/pull/1346 )
### [`v9.0.2`](https://togithub.com/typicode/husky/releases/tag/v9.0.2 )
[Compare Source](https://togithub.com/typicode/husky/compare/v9.0.1...v9.0.2 )
#### What's Changed
- fix: exit code by [@​gergelypap](https://togithub.com/gergelypap ) in [https://github.com/typicode/husky/pull/1336 ](https://togithub.com/typicode/husky/pull/1336 )
- docs: typo by [@​chalkygames123](https://togithub.com/chalkygames123 ) in [https://github.com/typicode/husky/pull/1337 ](https://togithub.com/typicode/husky/pull/1337 )
#### New Contributors
- [@​gergelypap](https://togithub.com/gergelypap ) made their first contribution in [https://github.com/typicode/husky/pull/1336 ](https://togithub.com/typicode/husky/pull/1336 )
**Full Changelog**: https://github.com/typicode/husky/compare/v9.0.1...v9.0.2
### [`v9.0.1`](https://togithub.com/typicode/husky/releases/tag/v9.0.1 )
[Compare Source](https://togithub.com/typicode/husky/compare/v8.0.3...v9.0.1 )
<p align="center">
Kicking off the year with an exciting update!
</p>
<p align="center">
<img src="https://github.com/typicode/husky/assets/5502029/457ab087-e935-4196-b99f-601ecf37f263 " height="400px" alt="" />
</p>
#### TLDR;
Improved user experience and a (even) smaller package size while packing in more features!
#### 👋 By the Way
**I'm available for remote work** (Front-end/Back-end mainly JS/TS but open to other stacks Rails, Go, Elixir). You can contact me at my mail: typicode at gmail 🙂
#### Introducing `husky init`
Adding husky to a project is now easier than ever. Although the installation process was straightforward, it often required consulting the documentation.
##### v8
```shell
npm pkg set scripts.prepare="husky install"
npm run prepare
npx husky add .husky/pre-commit "npm test"
```
##### v9
```shell
npx husky init
```
#### Adding a New Hook
Adding a hook is now as simple as creating a file. This can be accomplished using your favorite editor, a script or a basic `echo` command.
##### v8
```shell
npx husky add .husky/pre-commit "npm test"
git add --chmod=+x .husky/pre-commit # On Windows
```
##### v9
```shell
echo "npm test" > .husky/pre-commit
```
#### Further Size Reduction
`v8` was already the most compact Git hooks manager at approximately `6kB`.
`v9` takes this a step further, reducing the size to just `3kB`, likely making it the smallest devDependency in your toolkit.
**To give you an idea of how small it is, the biggest file in the project is the MIT license 😄 **
#### More to Come
Additional features are in the pipeline for `v9`. Stay tuned 🙌
#### Other Changes
- **Enhanced security** with CI and npm `--provenance` for safer publishing.
- Added **`$XDG_CONFIG_HOME`** support. Move `~/.huskyrc` to `~/.config/husky/init.sh` for centralized configuration.
- **Fixed permission issue for Windows-created hooks**; they no longer need to be executable.
- Removed `husky install`. Use `husky` or `husky some/dir` for the same functionality (deprecation notice to be added).
- Modified behavior when `.git` is missing; it now triggers a warning instead of failure.
- Replaced `HUSKY_DEBUG=1` with `HUSKY=2` for debugging.
- Updated the Husky API for module usage.
- Transitioned to `ESM` for module usage.
- Dropped support for Node 14 and 16.
- Revamped docs.
#### How to Migrate
`v9` is backward compatible with `v8`, allowing you to freely upgrade and migrate your hooks later.
`package.json`
```diff
{
"scripts": {
- "prepare": "husky install"
+ "prepare": "husky"
}
}
```
`.husky/pre-commit`
```diff
- #!/usr/bin/env sh
- . "$(dirname -- "$0")/_/husky.sh"
npm test
```
</details>
---
### Configuration
📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/ ). View repository job log [here](https://developer.mend.io/github/toeverything/AFFiNE ).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4xMzUuMCIsInVwZGF0ZWRJblZlciI6IjM3LjEzNS4wIiwidGFyZ2V0QnJhbmNoIjoiY2FuYXJ5In0=-->
2024-01-26 02:53:34 +00:00
LongYinan
59788aa334
chore: bump up @reforged/maker-appimage version to v4 ( #5709 )
...
[](https://renovatebot.com )
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [@reforged/maker-appimage](https://togithub.com/SpacingBat3/ReForged ) | [`^3.3.1` -> `^4.0.0`](https://renovatebot.com/diffs/npm/@reforged%2fmaker-appimage/3.3.1/4.0.0 ) | [](https://docs.renovatebot.com/merge-confidence/ ) | [](https://docs.renovatebot.com/merge-confidence/ ) | [](https://docs.renovatebot.com/merge-confidence/ ) | [](https://docs.renovatebot.com/merge-confidence/ ) |
---
### Release Notes
<details>
<summary>SpacingBat3/ReForged (@​reforged/maker-appimage)</summary>
### [`v4.0.0`](1657b03766...f829e7a9541657b03766...f829e7a95445d28765c2...1657b0376645d28765c2...1657b03766📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/ ). View repository job log [here](https://developer.mend.io/github/toeverything/AFFiNE ).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4xMzUuMCIsInVwZGF0ZWRJblZlciI6IjM3LjEzNS4wIiwidGFyZ2V0QnJhbmNoIjoiY2FuYXJ5In0=-->
2024-01-26 02:41:08 +00:00
DarkSky
fdffe90892
fix: consume blob stream correctly ( #5706 )
...
- use correctly endpoint in r2
- consume blob stream correctly
2024-01-25 10:59:53 +00:00
LongYinan
db3891ba33
chore: bump up @blocksuite/icons version to v2.1.43 ( #5702 )
...
[](https://renovatebot.com )
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [@blocksuite/icons](https://togithub.com/toeverything/icons ) | [`2.1.42` -> `2.1.43`](https://renovatebot.com/diffs/npm/@blocksuite%2ficons/2.1.42/2.1.43 ) | [](https://docs.renovatebot.com/merge-confidence/ ) | [](https://docs.renovatebot.com/merge-confidence/ ) | [](https://docs.renovatebot.com/merge-confidence/ ) | [](https://docs.renovatebot.com/merge-confidence/ ) |
---
### Release Notes
<details>
<summary>toeverything/icons (@​blocksuite/icons)</summary>
### [`v2.1.43`](fe902db67e...13299f7edefe902db67e...13299f7ede📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/ ). View repository job log [here](https://developer.mend.io/github/toeverything/AFFiNE ).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4xMzUuMCIsInVwZGF0ZWRJblZlciI6IjM3LjEzNS4wIiwidGFyZ2V0QnJhbmNoIjoiY2FuYXJ5In0=-->
2024-01-25 08:56:39 +00:00
Cats Juice
e7307d969c
chore(core): remove journal experimental flag ( #5698 )
2024-01-25 05:33:57 +00:00
Joooye_34
bd8c7751db
chore: update base version to 0.12.0 ( #5695 )
2024-01-25 05:17:35 +00:00
Cats Juice
9aa421d5e1
fix(core): modify journal page title today style, add weekday tag ( #5687 )
...
fix [TOV-434](https://linear.app/affine-design/issue/TOV-434/修改-journal-中-「today」的字体大小和日期-title-大小 )
<picture>
<source media="(prefers-color-scheme: dark)" srcset="https://github.com/toeverything/AFFiNE/assets/39363750/ac0ab085-5ff7-4d27-a0b1-11d97fdd8074 ">
<img width="100%" alt="" src="https://github.com/toeverything/AFFiNE/assets/39363750/3b311130-ded2-4651-badd-65dd059b7bc5 ">
</picture>
2024-01-24 13:07:20 +00:00
Cats Juice
3f96b9778f
fix(core): change journal header week-date-picker's max-width ( #5688 )
...
Fix [TOV-444](https://linear.app/affine-design/issue/TOV-444/修改-journal-date-picker-max-width )
2024-01-24 12:54:34 +00:00
JimmFly
ad1521fd81
feat(core): adjust member order ( #5685 )
...
close #5686
`Owner >> Unaccepted > Admin > Write > Read`
This algorithm contains two parts: firstly, it calculates the weight of the Member (calculateWeight), and then, it uses set weights to sort the Members (useMembers).
In the calculateWeight part, the computation of the weight involves three primary factors:
1. **Permission Level**: The `Owner` is given the highest weight of `4`, followed by `Admin` with a weight of `3`, then `Write` with a weight of `2`, and finally, `Read`, with a weight of `1`.
2. **Acceptance Status**: `Unaccepted` members have a higher weight, this weight is `1`.
3. The weight corresponding to the permission level, if the member does not exist, this weight is 0.
These three `factors` are stored in the factors array and then processed through the reduce function for weighted sum calculation. Among them, `factor * Math.pow(10, arr.length - 1 - index)` means the more significant weight factors (i.e., the earlier factors) will be assigned a higher value.
Sorting rules are primarily based on the weight values obtained from the calculateWeight function. If the weights are identical, it then sorts by name, here assuming the weight of the name being `null` is the highest. If the names are not `null`, they are sorted alphabetically.
2024-01-24 12:44:01 +00:00
liuyi
0f67c683c9
fix(server): add metrics missing attributes ( #5682 )
2024-01-24 08:06:34 +00:00
JimmFly
25897dc404
feat(workspace): add blob and storage limit ( #5535 )
...
close TOV-343 AFF-508 TOV-461 TOV-460 TOV-419
Add `isOverCapacity ` status to detect if blob usage exceeds limits.
Add `onCapacityChange` and `onBlobSet` to monitor if the storage or blob exceeds the capacity limit.
Global modals `LocalQuotaModal` and `CloudQuotaModal` have been added, with the upload size of the blob being limited within the modal components.
The notification component has been adjusted, now you can pass in `action` click events and `actionLabel` .
2024-01-24 07:34:51 +00:00
Chen
c566952e09
feat: bump blocksuite ( #5673 )
2024-01-24 15:13:12 +08:00
liuyi
151a53c575
fix(server): disable payment module requirements temporarily ( #5683 )
2024-01-24 03:17:21 +00:00
Peng Xiao
a687e7c0ed
fix(core): workspace feature should be workspace specific ( #5677 )
...
fix TOV-429
2024-01-24 03:07:51 +00:00
Peng Xiao
994ab96688
fix(playground): storybook story load issue ( #5672 )
...
Since the properties adapter now depends on whenLoaded status of the ydoc, we may need to explicitly mark doc as emit if the workspace is created without using a provider.
2024-01-24 02:56:07 +00:00
Peng Xiao
c2a978f0f2
fix: create page button offset issue on non-windows desktop app ( #5669 )
...
fix TOV-428
2024-01-24 02:56:04 +00:00
Peng Xiao
f62b67de61
fix(core): should set lang when locale changes ( #5679 )
...
this + https://github.com/toeverything/design/pull/110 should fix #5591
fix TOV-457
Reason: HTML requires `lang` to be set to render the correct CJK glyphs.
https://heistak.github.io/your-code-displays-japanese-wrong
<img width="692" alt="image" src="https://github.com/toeverything/AFFiNE/assets/584378/1d350219-5157-42cb-8e98-76d92d55b41e ">
2024-01-24 02:43:22 +00:00
Peng Xiao
65b538ee45
chore: bump @toeverything/theme ( #5680 )
2024-01-24 02:43:19 +00:00
Joooye_34
fecf055867
ci: check yarn dedupe in ci lint stage ( #5678 )
2024-01-23 12:41:50 +00:00
DarkSky
8bbe2e3bb1
feat: use custom image/preview link ( #5584 )
...
dep toeverything/blocksuite#5969
2024-01-23 08:53:57 +00:00
liuyi
62169c59c8
fix(server): del staled update count cache if unmatch ( #5674 )
2024-01-23 08:19:29 +00:00
Cats Juice
8300df4a26
fix(core): correct typo in onboarding 'get start' ( #5666 )
2024-01-23 04:54:22 +00:00
Cats Juice
6c8621bdcd
chore(core): bump @toeverything/theme, add cssVar use case ( #5667 )
2024-01-23 04:39:07 +00:00
LongYinan
021105c115
chore: bump up @blocksuite/icons version to v2.1.42 ( #5668 )
...
[](https://renovatebot.com )
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [@blocksuite/icons](https://togithub.com/toeverything/icons ) | [`2.1.41` -> `2.1.42`](https://renovatebot.com/diffs/npm/@blocksuite%2ficons/2.1.41/2.1.42 ) | [](https://docs.renovatebot.com/merge-confidence/ ) | [](https://docs.renovatebot.com/merge-confidence/ ) | [](https://docs.renovatebot.com/merge-confidence/ ) | [](https://docs.renovatebot.com/merge-confidence/ ) |
---
### Release Notes
<details>
<summary>toeverything/icons (@​blocksuite/icons)</summary>
### [`v2.1.42`](fdca7d8e2e...fe902db67efdca7d8e2e...fe902db67e📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/ ). View repository job log [here](https://developer.mend.io/github/toeverything/AFFiNE ).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4xMzUuMCIsInVwZGF0ZWRJblZlciI6IjM3LjEzNS4wIiwidGFyZ2V0QnJhbmNoIjoiY2FuYXJ5In0=-->
2024-01-23 04:27:58 +00:00
Peng Xiao
ecdb5b3407
fix(core): properties adapter reactivitiy issue ( #5661 )
2024-01-23 01:41:44 +00:00
Peng Xiao
03b60a63cd
fix: remove incorrect commit ( #5660 )
2024-01-23 01:41:39 +00:00
Cats Juice
45cc75a814
ci(component): deploy ui storybook ( #5655 )
2024-01-22 10:25:33 +00:00
Cats Juice
35e7b41ca8
fix(component): adjust the style of Switch to match the design ( #5636 )
...
closes #5635
2024-01-22 10:14:32 +00:00
Joooye_34
fccdf8ede7
feat: bump blocksuite ( #5642 )
...
f0c45fd...4e2c95a
2024-01-22 08:37:32 +00:00
Peng Xiao
0ed26f51af
feat(core): adopt editor features for journal ( #5638 )
2024-01-22 08:25:31 +00:00
Peng Xiao
f41b7d7e71
feat(component): react wrapper for blocksuite editor ( #5606 )
...
A React wrapper for blocksuite editor from title/meta/doc/edgless fragments.
This PR only **clones** the `AffineEditorContainer`'s existing behavior and make it easier for extension in affine later.
fix TOV-315
### Some core issues:
A customized version of `createComponent` from `@lit/react`. The [existing and solutions in the community](https://github.com/lit/lit/issues/4435 ) does not work well in our case.
Alternatively in this PR the approach we have is to create web component instances in React lifecycle and then append them to DOM. However this make it hard to wrap the exported Lit component's using React and therefore we will have an additional wrapper tag for the wrapped web component.
To mitigate the migration issue on using React instead of Lit listed on last day, we now use [a proxy to mimic the wrapped React component](https://github.com/toeverything/AFFiNE/pull/5606/files#diff-5b7f0ae7b52a08739d50e78e9ec803c26ff3d3e5437581c692add0de12d3ede5R142-R183 ) into an `AffineEditorContainer` instance.
2024-01-22 08:25:29 +00:00
Peng Xiao
735e1cb117
feat(core): page info adapter for journal ( #5561 )
...
Page info adapter + schema.
Adapted for journal features.
2024-01-22 08:25:27 +00:00
LongYinan
8b92cc0cae
chore: decrease the instances count on gcp ( #5658 )
2024-01-22 08:02:26 +00:00
LongYinan
3de6424a65
fix(server): missing google oauth in auth providers ( #5656 )
2024-01-22 08:02:24 +00:00
liuyi
e516e0db23
refactor(server): plugin modules ( #5630 )
...
- [x] separates modules into `fundamental`, `core`, `plugins`
- [x] optional modules with `@OptionalModule` decorator to install modules with requirements met(`requires`, `if`)
- [x] `module.contributesTo` defines optional features that will be enabled if module registered
- [x] `AFFiNE.plugins.use('payment', {})` to enable a optional/plugin module
- [x] `PaymentModule` is the first plugin module
- [x] GraphQLSchema will not be generated for non-included modules
- [x] Frontend can use `ServerConfigType` query to detect which features are enabled
- [x] override existing provider globally
2024-01-22 07:40:28 +00:00
DarkSky
ae8401b6f4
feat: skip update quota if same as latest activated quota ( #5631 )
2024-01-22 06:50:05 +00:00
LongYinan
fb93f59aea
chore: bump up vite version to v5.0.12 [SECURITY] ( #5648 )
...
[](https://renovatebot.com )
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [vite](https://vitejs.dev ) ([source](https://togithub.com/vitejs/vite/tree/HEAD/packages/vite )) | [`5.0.6` -> `5.0.12`](https://renovatebot.com/diffs/npm/vite/5.0.6/5.0.12 ) | [](https://docs.renovatebot.com/merge-confidence/ ) | [](https://docs.renovatebot.com/merge-confidence/ ) | [](https://docs.renovatebot.com/merge-confidence/ ) | [](https://docs.renovatebot.com/merge-confidence/ ) |
### GitHub Vulnerability Alerts
#### [CVE-2024-23331](https://togithub.com/vitejs/vite/security/advisories/GHSA-c24v-8rfc-w8vw )
### Summary
[Vite dev server option](https://vitejs.dev/config/server-options.html#server-fs-deny ) `server.fs.deny` can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows.
This bypass is similar to https://nvd.nist.gov/vuln/detail/CVE-2023-34092 -- with surface area reduced to hosts having case-insensitive filesystems.
### Patches
Fixed in vite@5.0.12, vite@4.5.2, vite@3.2.8, vite@2.9.17
### Details
Since `picomatch` defaults to case-sensitive glob matching, but the file server doesn't discriminate; a blacklist bypass is possible.
See `picomatch` usage, where `nocase` is defaulted to `false`: https://github.com/vitejs/vite/blob/v5.1.0-beta.1/packages/vite/src/node/server/index.ts#L632
By requesting raw filesystem paths using augmented casing, the matcher derived from `config.server.fs.deny` fails to block access to sensitive files.
### PoC
**Setup**
1. Created vanilla Vite project using `npm create vite@latest` on a Standard Azure hosted Windows 10 instance.
- `npm run dev -- --host 0.0.0.0`
- Publicly accessible for the time being here: http://20.12.242.81:5173/
2. Created dummy secret files, e.g. `custom.secret` and `production.pem`
3. Populated `vite.config.js` with
```javascript
export default { server: { fs: { deny: ['.env', '.env.*', '*.{crt,pem}', 'custom.secret'] } } }
```
**Reproduction**
1. `curl -s http://20.12.242.81:5173/@​fs// `
- Descriptive error page reveals absolute filesystem path to project root
2. `curl -s http://20.12.242.81:5173/@​fs/C:/Users/darbonzo/Desktop/vite-project/vite.config.js `
- Discoverable configuration file reveals locations of secrets
3. `curl -s http://20.12.242.81:5173/@​fs/C:/Users/darbonzo/Desktop/vite-project/custom.sEcReT `
- Secrets are directly accessible using case-augmented version of filename
**Proof**
### Impact
**Who**
- Users with exposed dev servers on environments with case-insensitive filesystems
**What**
- Files protected by `server.fs.deny` are both discoverable, and accessible
---
### Release Notes
<details>
<summary>vitejs/vite (vite)</summary>
### [`v5.0.12`](https://togithub.com/vitejs/vite/releases/tag/v5.0.12 )
[Compare Source](https://togithub.com/vitejs/vite/compare/v5.0.11...v5.0.12 )
Please refer to [CHANGELOG.md](https://togithub.com/vitejs/vite/blob/v5.0.12/packages/vite/CHANGELOG.md ) for details.
### [`v5.0.11`](https://togithub.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small5011-2024-01-05-small )
[Compare Source](https://togithub.com/vitejs/vite/compare/v5.0.10...v5.0.11 )
- fix: don't pretransform classic script links ([#​15361](https://togithub.com/vitejs/vite/issues/15361 )) ([19e3c9a](https://togithub.com/vitejs/vite/commit/19e3c9a )), closes [#​15361](https://togithub.com/vitejs/vite/issues/15361 )
- fix: inject `__vite__mapDeps` code before sourcemap file comment ([#​15483](https://togithub.com/vitejs/vite/issues/15483 )) ([d2aa096](https://togithub.com/vitejs/vite/commit/d2aa096 )), closes [#​15483](https://togithub.com/vitejs/vite/issues/15483 )
- fix(assets): avoid splitting `,` inside base64 value of `srcset` attribute ([#​15422](https://togithub.com/vitejs/vite/issues/15422 )) ([8de7bd2](https://togithub.com/vitejs/vite/commit/8de7bd2 )), closes [#​15422](https://togithub.com/vitejs/vite/issues/15422 )
- fix(html): handle offset magic-string slice error ([#​15435](https://togithub.com/vitejs/vite/issues/15435 )) ([5ea9edb](https://togithub.com/vitejs/vite/commit/5ea9edb )), closes [#​15435](https://togithub.com/vitejs/vite/issues/15435 )
- chore(deps): update dependency strip-literal to v2 ([#​15475](https://togithub.com/vitejs/vite/issues/15475 )) ([49d21fe](https://togithub.com/vitejs/vite/commit/49d21fe )), closes [#​15475](https://togithub.com/vitejs/vite/issues/15475 )
- chore(deps): update tj-actions/changed-files action to v41 ([#​15476](https://togithub.com/vitejs/vite/issues/15476 )) ([2a540ee](https://togithub.com/vitejs/vite/commit/2a540ee )), closes [#​15476](https://togithub.com/vitejs/vite/issues/15476 )
### [`v5.0.10`](https://togithub.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small5010-2023-12-15-small )
[Compare Source](https://togithub.com/vitejs/vite/compare/v5.0.9...v5.0.10 )
- fix: omit protocol does not require pre-transform ([#​15355](https://togithub.com/vitejs/vite/issues/15355 )) ([d9ae1b2](https://togithub.com/vitejs/vite/commit/d9ae1b2 )), closes [#​15355](https://togithub.com/vitejs/vite/issues/15355 )
- fix(build): use base64 for inline SVG if it contains both single and double quotes ([#​15271](https://togithub.com/vitejs/vite/issues/15271 )) ([1bbff16](https://togithub.com/vitejs/vite/commit/1bbff16 )), closes [#​15271](https://togithub.com/vitejs/vite/issues/15271 )
### [`v5.0.9`](https://togithub.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small509-2023-12-14-small )
[Compare Source](https://togithub.com/vitejs/vite/compare/v5.0.8...v5.0.9 )
- fix: htmlFallbackMiddleware for favicon ([#​15301](https://togithub.com/vitejs/vite/issues/15301 )) ([c902545](https://togithub.com/vitejs/vite/commit/c902545 )), closes [#​15301](https://togithub.com/vitejs/vite/issues/15301 )
- fix: more stable hash calculation for depsOptimize ([#​15337](https://togithub.com/vitejs/vite/issues/15337 )) ([2b39fe6](https://togithub.com/vitejs/vite/commit/2b39fe6 )), closes [#​15337](https://togithub.com/vitejs/vite/issues/15337 )
- fix(scanner): catch all external files for glob imports ([#​15286](https://togithub.com/vitejs/vite/issues/15286 )) ([129d0d0](https://togithub.com/vitejs/vite/commit/129d0d0 )), closes [#​15286](https://togithub.com/vitejs/vite/issues/15286 )
- fix(server): avoid chokidar throttling on startup ([#​15347](https://togithub.com/vitejs/vite/issues/15347 )) ([56a5740](https://togithub.com/vitejs/vite/commit/56a5740 )), closes [#​15347](https://togithub.com/vitejs/vite/issues/15347 )
- fix(worker): replace `import.meta` correctly for IIFE worker ([#​15321](https://togithub.com/vitejs/vite/issues/15321 )) ([08d093c](https://togithub.com/vitejs/vite/commit/08d093c )), closes [#​15321](https://togithub.com/vitejs/vite/issues/15321 )
- feat: log re-optimization reasons ([#​15339](https://togithub.com/vitejs/vite/issues/15339 )) ([b1a6c84](https://togithub.com/vitejs/vite/commit/b1a6c84 )), closes [#​15339](https://togithub.com/vitejs/vite/issues/15339 )
- chore: temporary typo ([#​15329](https://togithub.com/vitejs/vite/issues/15329 )) ([7b71854](https://togithub.com/vitejs/vite/commit/7b71854 )), closes [#​15329](https://togithub.com/vitejs/vite/issues/15329 )
- perf: avoid computing paths on each request ([#​15318](https://togithub.com/vitejs/vite/issues/15318 )) ([0506812](https://togithub.com/vitejs/vite/commit/0506812 )), closes [#​15318](https://togithub.com/vitejs/vite/issues/15318 )
- perf: temporary hack to avoid fs checks for /[@​react-refresh](https://togithub.com/react-refresh ) ([#​15299](https://togithub.com/vitejs/vite/issues/15299 )) ([b1d6211](https://togithub.com/vitejs/vite/commit/b1d6211 )), closes [#​15299](https://togithub.com/vitejs/vite/issues/15299 )
### [`v5.0.8`](https://togithub.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small508-2023-12-12-small )
[Compare Source](https://togithub.com/vitejs/vite/compare/v5.0.7...v5.0.8 )
- perf: cached fs utils ([#​15279](https://togithub.com/vitejs/vite/issues/15279 )) ([c9b61c4](https://togithub.com/vitejs/vite/commit/c9b61c4 )), closes [#​15279](https://togithub.com/vitejs/vite/issues/15279 )
- fix: missing warmupRequest in transformIndexHtml ([#​15303](https://togithub.com/vitejs/vite/issues/15303 )) ([103820f](https://togithub.com/vitejs/vite/commit/103820f )), closes [#​15303](https://togithub.com/vitejs/vite/issues/15303 )
- fix: public files map will be updated on add/unlink in windows ([#​15317](https://togithub.com/vitejs/vite/issues/15317 )) ([921ca41](https://togithub.com/vitejs/vite/commit/921ca41 )), closes [#​15317](https://togithub.com/vitejs/vite/issues/15317 )
- fix(build): decode urls in CSS files (fix [#​15109](https://togithub.com/vitejs/vite/issues/15109 )) ([#​15246](https://togithub.com/vitejs/vite/issues/15246 )) ([ea6a7a6](https://togithub.com/vitejs/vite/commit/ea6a7a6 )), closes [#​15109](https://togithub.com/vitejs/vite/issues/15109 ) [#​15246](https://togithub.com/vitejs/vite/issues/15246 )
- fix(deps): update all non-major dependencies ([#​15304](https://togithub.com/vitejs/vite/issues/15304 )) ([bb07f60](https://togithub.com/vitejs/vite/commit/bb07f60 )), closes [#​15304](https://togithub.com/vitejs/vite/issues/15304 )
- fix(ssr): check esm file with normal file path ([#​15307](https://togithub.com/vitejs/vite/issues/15307 )) ([1597170](https://togithub.com/vitejs/vite/commit/1597170 )), closes [#​15307](https://togithub.com/vitejs/vite/issues/15307 )
### [`v5.0.7`](https://togithub.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small507-2023-12-08-small )
[Compare Source](https://togithub.com/vitejs/vite/compare/v5.0.6...v5.0.7 )
- fix: suppress terser warning if minify disabled ([#​15275](https://togithub.com/vitejs/vite/issues/15275 )) ([3e42611](https://togithub.com/vitejs/vite/commit/3e42611 )), closes [#​15275](https://togithub.com/vitejs/vite/issues/15275 )
- fix: symbolic links in public dir ([#​15264](https://togithub.com/vitejs/vite/issues/15264 )) ([ef2a024](https://togithub.com/vitejs/vite/commit/ef2a024 )), closes [#​15264](https://togithub.com/vitejs/vite/issues/15264 )
- fix(html): skip inlining icon and manifest links ([#​14958](https://togithub.com/vitejs/vite/issues/14958 )) ([8ad81b4](https://togithub.com/vitejs/vite/commit/8ad81b4 )), closes [#​14958](https://togithub.com/vitejs/vite/issues/14958 )
- chore: remove unneeded condition in getRealPath ([#​15267](https://togithub.com/vitejs/vite/issues/15267 )) ([8e4655c](https://togithub.com/vitejs/vite/commit/8e4655c )), closes [#​15267](https://togithub.com/vitejs/vite/issues/15267 )
- perf: cache empty optimizer result ([#​15245](https://togithub.com/vitejs/vite/issues/15245 )) ([8409b66](https://togithub.com/vitejs/vite/commit/8409b66 )), closes [#​15245](https://togithub.com/vitejs/vite/issues/15245 )
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/ ). View repository job log [here](https://developer.mend.io/github/toeverything/AFFiNE ).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4xMzUuMCIsInVwZGF0ZWRJblZlciI6IjM3LjEzNS4wIiwidGFyZ2V0QnJhbmNoIjoiY2FuYXJ5In0=-->
2024-01-20 13:36:05 +00:00
JimmFly
353b27d796
refactor(component): adapt the questionnaire component to the desktop client ( #5514 )
...
close TOV-240
Windows desktop:
<img width="1145" alt="image" src="https://github.com/toeverything/AFFiNE/assets/102217452/6b12a6bd-c020-4d02-a366-e97e1afd1e10 ">
MacOS desktop:
<img width="1187" alt="image" src="https://github.com/toeverything/AFFiNE/assets/102217452/9a3c909c-b283-4ddc-a187-3db12b26a7f5 ">
Web:
<img width="1438" alt="image" src="https://github.com/toeverything/AFFiNE/assets/102217452/e8e04258-9275-470d-a3f8-5d18f5b29eb3 ">
2024-01-19 10:07:18 +00:00
LongYinan
fa8655e43e
style: apply prefer-node-protocol lint rule ( #5627 )
...
it makes it perfectly clear that the package is a Node.js builtin module.
2024-01-19 03:47:08 +00:00
LongYinan
9d28eb530a
feat: upgrade electron and playwright ( #5632 )
2024-01-19 03:16:06 +00:00
LongYinan
cf2ad141ea
chore: upgrade perfsee sdk ( #5629 )
...
packages version info are missing: https://perfsee.com/projects/perfsee/bundle/1346?tab=packages
2024-01-19 10:58:36 +08:00
HeJiachen-PM
dc68ffd127
docs: update readme ( #5637 )
2024-01-19 02:02:25 +00:00
Cats Juice
351f1b73b4
feat(core): add journal entrance for app-sidebar ( #5579 )
2024-01-18 14:40:35 +00:00
Cats Juice
65bcdcafde
feat(core): add experimental flag for journal ( #5578 )
2024-01-18 14:05:17 +00:00
Cats Juice
f4b26a16f8
feat(core): journal sidebar conflict block ( #5574 )
2024-01-18 14:05:15 +00:00
Cats Juice
7aaec3ad51
feat(core): add daily count for journal sidebar ( #5559 )
2024-01-18 12:54:44 +00:00
JimmFly
a7e8664959
fix(core): reserve space for the editor scrollbar ( #5625 )
...
Because the space for the scroll bar on the right is reserved, in order to make the editor symmetrical, padding corresponding to the width of the scroll bar is added to the left.
2024-01-18 12:44:27 +00:00
Cats Juice
70ea1e5ef8
feat(core): journal sidebar dater-picker navigation ( #5558 )
2024-01-18 12:34:23 +00:00
Cats Juice
496dc588be
feat(core): journal extension loader ( #5557 )
2024-01-18 09:27:56 +00:00
