Release 2026.21 - #374
Merged
Merged
Release 2026.21#374
Conversation
Bumps [flatted](https://github.com/WebReflection/flatted) from 3.3.3 to 3.4.2. - [Commits](WebReflection/flatted@v3.3.3...v3.4.2) --- updated-dependencies: - dependency-name: flatted dependency-version: 3.4.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [node-forge](https://github.com/digitalbazaar/forge) from 1.3.3 to 1.4.0. - [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md) - [Commits](digitalbazaar/forge@v1.3.3...v1.4.0) --- updated-dependencies: - dependency-name: node-forge dependency-version: 1.4.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [picomatch](https://github.com/micromatch/picomatch) from 2.3.1 to 2.3.2. - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) --- updated-dependencies: - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [follow-redirects](https://github.com/follow-redirects/follow-redirects) from 1.15.11 to 1.16.0. - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.11...v1.16.0) --- updated-dependencies: - dependency-name: follow-redirects dependency-version: 1.16.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
- Gemfile + Gemfile.lock: declares fastlane ~> 2.232 dependency - fastlane/Appfile: app identity and team defaults - fastlane/Matchfile: points match at mieweb/mobile-signing repo - fastlane/Fastfile: single ios_dev lane (setup_ci → match → gym → pilot) - .github/workflows/test-ios-fastlane.yml: workflow_dispatch-only test workflow - .gitignore: add fastlane generated output paths
workflow_dispatch is only surfaced in Actions UI when the file exists on the default branch — scoped push trigger bypasses this
Co-authored-by: Copilot <copilot@github.com>
Bumps [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) from 5.4.2 to 5.7.1. - [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases) - [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md) - [Commits](NaturalIntelligence/fast-xml-parser@v5.4.2...v5.7.1) --- updated-dependencies: - dependency-name: fast-xml-parser dependency-version: 5.7.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
- Replace inline Fastlane setup with uses: mieweb/sharedactions/ios@v1 - Remove local fastlane/Fastfile, Appfile, Matchfile (now in sharedactions repo) - Remove Gemfile + Gemfile.lock (action manages its own Ruby/gems) - Drop standalone Setup Ruby step from workflow
Replaces 85-line workflow with a single reusable workflow call. All signing secrets via secrets: inherit. Only app-specific inputs remain.
Bumps [axios](https://github.com/axios/axios) from 1.13.5 to 1.15.2. - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.13.5...v1.15.2) --- updated-dependencies: - dependency-name: axios dependency-version: 1.15.2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [fast-xml-builder](https://github.com/NaturalIntelligence/fast-xml-builder) from 1.0.0 to 1.2.0. - [Changelog](https://github.com/NaturalIntelligence/fast-xml-builder/blob/main/CHANGELOG.md) - [Commits](https://github.com/NaturalIntelligence/fast-xml-builder/commits/v1.2.0) --- updated-dependencies: - dependency-name: fast-xml-builder dependency-version: 1.2.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.0 to 3.1.2. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.0...v3.1.2) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [@protobufjs/utf8](https://github.com/dcodeIO/protobuf.js) from 1.1.0 to 1.1.1. - [Release notes](https://github.com/dcodeIO/protobuf.js/releases) - [Changelog](https://github.com/protobufjs/protobuf.js/blob/master/CHANGELOG.md) - [Commits](protobufjs/protobuf.js@protobufjs-cli-v1.1.0...protobufjs-cli-v1.1.1) --- updated-dependencies: - dependency-name: "@protobufjs/utf8" dependency-version: 1.1.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [protobufjs](https://github.com/protobufjs/protobuf.js) from 7.5.4 to 7.5.8. - [Release notes](https://github.com/protobufjs/protobuf.js/releases) - [Changelog](https://github.com/protobufjs/protobuf.js/blob/protobufjs-v7.5.8/CHANGELOG.md) - [Commits](protobufjs/protobuf.js@protobufjs-v7.5.4...protobufjs-v7.5.8) --- updated-dependencies: - dependency-name: protobufjs dependency-version: 7.5.8 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Closes #366 The Approve/Reject action buttons rendered on Android push notifications did nothing when tapped. Tapping them would open the app and surface the in-app modal, requiring the user to tap Approve again — defeating the purpose of the inline buttons. Root causes: - FCM action payload used { id } but @havesource/cordova-plugin-push v7 requires { callback }; the named events (push.on('approve'/'reject')) were never registered. - saveUserNotificationHistory returned the mongo _id from insertAsync instead of the generated notificationId field, so the value embedded in the FCM payload could not be looked up by notifications.handleResponse. - The biometric login path only set a Session var without calling Meteor.loginWithToken, so this.userId was null on subsequent method calls (notifications.handleResponse failed silently). - The in-app modal opened from multiple paths (Tracker.autorun, resume handler) that didn't know an action was already in flight from the tray. - notifications.handleResponse accepted any action string and had no authentication or ownership check. Changes: - server/main.js: pre-create NotificationHistory and embed userId + notificationId in the FCM data payload; require this.userId, verify ownership, validate action with Match.OneOf, enforce device ownership; issue a stamped login token from users.loginWithBiometric. - server/firebase.js: switch action format to { callback, foreground } for cordova-plugin-push v7 compatibility. - client/mobile/push-notifications.js: register push.on('approve'/'reject') handlers; pass userId/notificationId/deviceUUID; treat result.success === false as failure; clear in-flight flag and stale pendingNotification after the call settles. - client/mobile/src/ui/hooks/useNotificationHandler.js: gate modal-opening paths on actionPerformedFromTray flag; new tracker on trayActionResult to flash the success modal or fall back to the actions modal on error. - client/mobile/src/ui/Login.jsx: call Meteor.loginWithToken after biometric so the DDP session has a real userId. - utils/api/notificationHistory.js: return the generated notificationId (not mongo _id) from notificationHistory.insert. - tests/main.js: update tests for the new return value and invoke notifications.handleResponse with a simulated authenticated context.
Bump DashboardHeader z-index from z-10 to z-50 and add isolate to create its own stacking context. The welcome banner avatar (relative z-10) was painting over the header on scroll because both shared the same z-index and DOM order favored the banner. Closes #365
- Clear result-modal setTimeout on unmount/close via ref (useNotificationHandler)
- Treat null notificationId from saveUserNotificationHistory as hard error
- Mark notification history as timeout when FCM Promise.all fails
- Push createdUser _id (not username) into testUserIds for proper cleanup
- Drop redundant validateSessionWithRetry wrapper in cold-start tray path
- Stop clearing actionPerformedFromTray in push.on('notification'); let the
sendUserAction callback own the lifecycle so in-flight tray actions can't
reopen the modal
chore(deps): bump axios from 1.13.5 to 1.15.2
…parser-5.7.1 chore(deps): bump fast-xml-parser from 5.4.2 to 5.7.1
…directs-1.16.0 chore(deps): bump follow-redirects from 1.15.11 to 1.16.0
…-2.3.2 chore(deps): bump picomatch from 2.3.1 to 2.3.2
…e-1.4.0 chore(deps): bump node-forge from 1.3.3 to 1.4.0
….4.2 chore(deps-dev): bump flatted from 3.3.3 to 3.4.2
Removes [webpack-dev-server](https://github.com/webpack/webpack-dev-server). It's no longer used after updating ancestor dependency [@rspack/cli](https://github.com/web-infra-dev/rspack/tree/HEAD/packages/rspack-cli). These dependencies need to be updated together. Removes `webpack-dev-server` Updates `@rspack/cli` from 1.7.6 to 2.0.3 - [Release notes](https://github.com/web-infra-dev/rspack/releases) - [Commits](https://github.com/web-infra-dev/rspack/commits/v2.0.3/packages/rspack-cli) --- updated-dependencies: - dependency-name: webpack-dev-server dependency-version: dependency-type: indirect - dependency-name: "@rspack/cli" dependency-version: 2.0.3 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
fix(css): prevent sticky header from being overlapped by welcome banner
…8e848ed chore(deps): bump webpack-dev-server and @rspack/cli
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.6 to 8.5.15. - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.6...8.5.15) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.15 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
fix(android): make notification tray Approve/Reject buttons functional
….5.15 chore(deps-dev): bump postcss from 8.5.6 to 8.5.15
Resolves peer dependency conflict where @rspack/cli@2.0.3 requires @rspack/core@^2.0.0-0 but the project had @rspack/core@^1.7.1.
fix: upgrade @rspack/core and @rspack/plugin-react-refresh to v2
Appends github.run_number to the base version from mobile-config.js to ensure unique CFBundleVersion on every TestFlight upload.
This reverts commit d3415ca.
Fix/ios version bump
…rsion Apple requires CFBundleShortVersionString to be max 3 segments (X.Y.Z). Use ios-CFBundleVersion preference to set the build number independently using the GitHub run number for uniqueness.
fix: set CFBundleVersion separately instead of modifying marketing ve…
The mieweb ldapjs fork uses msg.constructor.name to derive event names in the LDAP search response handler. When rspack minifies the bundle, class names become empty strings, causing: TypeError: Cannot read properties of undefined (reading 'toLowerCase') at ldapjs/lib/client/client.js (messageCallback) Fix: configure rspack minimizer to keep class names intact. Also reverts the temporary uncaughtException handler added for diagnosis.
The mieweb ldapjs fork uses msg.constructor.name to derive event names in the LDAP search response handler. When rspack minifies the bundle, class names become empty strings, causing: TypeError: Cannot read properties of undefined (reading 'toLowerCase') at ldapjs/lib/client/client.js (messageCallback) Fix: configure rspack minimizer to keep class names intact. Also reverts the temporary uncaughtException handler added for diagnosis.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.