Bump golang.org/x/crypto from 0.36.0 to 0.45.0 in /server in the go_modules group across 1 directory - #2
Closed
dependabot[bot] wants to merge 15 commits into
Closed
Conversation
This plugin enables voice messaging in Mattermost with full support for: - Desktop (Web, Electron app) - iOS (Safari 14.3+) - Android (Chrome) Key features: - MediaRecorder API for universal browser support - Pause/Resume functionality during recording - WebM/Opus audio format for optimal quality and size - Responsive UI that works on mobile devices - Server-side file upload and post creation Technical stack: - Server: Go with Mattermost plugin API - Webapp: React/TypeScript with MediaRecorder API - Build system: Makefile with cross-platform compilation This solves the limitation of existing voice plugins that only work on desktop by using modern web standards supported in mobile browsers.
Major enhancements to the cross-platform media messaging plugin: Voice messaging improvements: - Added beautiful audio player with waveform visualization - Playback speed control (1x, 1.25x, 1.5x, 2x) - Progress bar with seek functionality - Slash command /voice to quickly open recorder Video messaging (NEW): - Full video recording with live preview from webcam - Support for pause/resume during recording - VP9 codec for optimal quality/size ratio - Slash command /video to quickly open recorder - Video clip player for playback Security enhancements: - File validation with magic number checking - Size limits (50MB audio, 100MB video) - Channel permission verification - MIME type validation Technical additions: - Unit tests for server-side validation - WebSocket events for slash commands - Support for multiple media formats All features work across desktop, web, iOS, and Android platforms.
…ar video - Fixed go.mod: removed replace directive, updated module path - Updated plugin.json name to "Voice & Video Clips" - Added peerDependencies for React in package.json - Added css-loader and style-loader dependencies - Added .nvmrc for Node v20 - Redesigned video_clip_player.tsx as 240px circular Telegram-style with SVG progress ring and overlay controls - Updated video_recorder_button.tsx with circular preview and square aspect ratio (1:1) for circular display
Bug fixes: - Fix TestIsValidMediaFile to use correct function name and params - Fix duplicate var declaration in plugin.go handleUpload - Add proper error handling for duration parsing - Fix memory leak in video_recorder_button.tsx (URL.revokeObjectURL) CI/CD: - Add GitHub Actions workflow for build, test, lint, release - Add golangci-lint configuration - Generate go.sum for reproducible builds - Generate package-lock.json for webapp
Bumps the go_modules group with 3 updates in the /server directory: [golang.org/x/crypto](https://github.com/golang/crypto), [golang.org/x/net](https://github.com/golang/net) and google.golang.org/protobuf. Updates `golang.org/x/crypto` from 0.20.0 to 0.35.0 - [Commits](golang/crypto@v0.20.0...v0.35.0) Updates `golang.org/x/net` from 0.21.0 to 0.38.0 - [Commits](golang/net@v0.21.0...v0.38.0) Updates `google.golang.org/protobuf` from 1.32.0 to 1.33.0 --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-version: 0.35.0 dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/net dependency-version: 0.38.0 dependency-type: indirect dependency-group: go_modules - dependency-name: google.golang.org/protobuf dependency-version: 1.33.0 dependency-type: indirect dependency-group: go_modules ... Signed-off-by: dependabot[bot] <support@github.com>
- Remove all console.log/error statements from production code - Add fallback WebSocket event handlers for compatibility - Remove unused fileInfo parameter from VoiceClipPlayer - Remove unused fileInfo parameter from VideoClipPlayer - Add comments for play() catch blocks (autoplay policy)
iOS Safari fixes: - Add isIOS() detection for platform-specific behavior - Use MP4/AAC codec on iOS (VP9/WebM not supported) - Use MP4/H.264 for video on iOS Safari - Simplified getUserMedia constraints for iOS - Add isPauseResumeSupported() - iOS doesn't support pause/resume - Hide pause/resume buttons on iOS Safari Cross-platform improvements: - Add getVideoMimeType() with proper codec fallbacks - Fix file extensions to match actual MIME type - Use correct extension (.mp4 on iOS, .webm on desktop) - Add touch event support for audio progress bar seeking - Mobile-responsive modal sizing Codec priority: - Desktop: VP9 > VP8 > H.264 - iOS: H.264/AAC only - Audio: Opus on desktop, AAC on iOS
- Add isFirefox() detection function - Fix isPauseResumeSupported() to check MediaRecorder existence first - Fix getVideoMimeType() to return empty string instead of hardcoded fallback - Prioritize OGG/Opus codecs for Firefox (better Linux support) - Prioritize VP8 over VP9 for Firefox video recording - Add try-catch blocks for pause/resume in MediaRecorderWrapper - Handle empty mimeType in getFileExtensionForMimeType()
Waveform Visualizer: - Fix memory leak by tracking MediaElementSource connection - Add proper AudioContext cleanup on unmount - Use deterministic pattern instead of Math.random() for static waveform Server: - Add .mp3 and .aac to allowed audio extensions - Add magic number validation for MP3 (ID3/frame sync) and AAC (ADTS) - Update error message to include new formats Tests: - Add test cases for MP3 and AAC file validation
Server configuration: - Add MaxAudioFileSize, MaxVideoFileSize (in MB) - Add MaxVideoDuration (separate from audio) - Add AudioBitrate, VideoBitrate (in kbps) - Add AllowedAudioFormats, AllowedVideoFormats (configurable) - Use config values for file size and duration validation - Return all settings via /api/v1/config endpoint Plugin settings UI (plugin.json): - Add dropdowns for audio/video bitrate selection - Add number inputs for file sizes and durations - Add text inputs for allowed formats - Organize settings with clear descriptions Client-side: - Create config_service.ts for fetching and caching config - Update audio_recorder.ts to accept dynamic bitrate - Update voice_recorder_button to use config (bitrate, max duration, auto-stop) - Update video_recorder_button to use config (bitrate, max duration, auto-stop) Settings available in System Console > Plugins > Voice & Video Clips: - Maximum audio/video duration - Maximum file sizes - Preferred formats (WebM, OGG, MP4) - Audio bitrate (64-256 kbps) - Video bitrate (500-4000 kbps) - Allowed file extensions - Waveform visualization toggle
- Add internationalization with 12 languages (auto-detects system language) - Add cartoon "pulk" notification sounds for voice/video messages - Create comprehensive English documentation in doc/ folder - Update README.md to English with links to detailed docs - Integrate translations into voice and video recorder components Languages: en, ru, de, fr, es, pt, zh, ja, ko, it, nl, pl
…ver/go_modules-345a13660d Bump the go_modules group across 1 directory with 3 updates
- Replace build.yml with standardized ci.yml and auto-release.yml - Update GitHub Actions to latest versions with pinned SHAs - Add lint job with golangci-lint - Set version to 0.4.0 - Add .golangci.yml configuration - Handle all json.Encode error returns for errcheck compliance
Bumps the go_modules group with 1 update in the /server directory: [golang.org/x/crypto](https://github.com/golang/crypto). Updates `golang.org/x/crypto` from 0.36.0 to 0.45.0 - [Commits](golang/crypto@v0.36.0...v0.45.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-version: 0.45.0 dependency-type: indirect dependency-group: go_modules ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Contributor
Author
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
dependabot
Bot
deleted the
dependabot/go_modules/server/go_modules-dd7da38a6b
branch
May 3, 2026 22:28
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the go_modules group with 1 update in the /server directory: golang.org/x/crypto.
Updates
golang.org/x/cryptofrom 0.36.0 to 0.45.0Commits
4e0068cgo.mod: update golang.org/x dependenciese79546essh: curb GSSAPI DoS risk by limiting number of specified OIDsf91f7a7ssh/agent: prevent panic on malformed constraint2df4153acme/autocert: let automatic renewal work with short lifetime certsbcf6a84acme: pass context to requestb4f2b62ssh: fix error message on unsupported cipher79ec3a5ssh: allow to bind to a hostname in remote forwarding122a78fgo.mod: update golang.org/x dependenciesc0531f9all: eliminate vet diagnostics0997000all: fix some commentsDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.