The sanitizer allowlist added in 4c31a8134 strips all of KaTeX's markup,
leaving only the flat text of each formula. We now typeset math after
sanitizing instead of loosening the allowlist for spans and styles.
rustls-webpki 0.103.16 and webpki-roots 1.0.10 are the first releases
with the fixes for RUSTSEC-2026-0382 and RUSTSEC-2026-0381, but are
still in the cooldown. We reviewed their diffs against upstream and
allow them until they're old enough.
mermaid 11 pins katex ^0.16, which is affected by GHSA-238p-pmpm-9mq7.
Like desktop, we now depend on katex directly and override mermaid's
copy, instead of jumping to mermaid 12.
Also takes vitest 4.1.12 a few hours before it clears the cooldown.
Makes explorer and desktop sibling projects, as proposed in ADR 1.
This commit only moves files; paths in CI, scripts and docs are fixed
in the following commits.
Most copy-pasting between the two front-ends happens in UI code. These
propose making explorer and desktop siblings and sharing code from
source, without an npm workspace for now.
/raw/<rid>/archive/<ref> passed the git2 error from
resolve_reference_from_short_name straight through, so a typo in the
branch name or a commit SHA in place of a ref yielded a 500. Map
ErrorCode::NotFound to 404 like we already do for the object lookup.
Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
The patch and issue list topbars decided whether to show filter labels
from the viewport width, which ignores the sidebar. With the search
input open, the filters left it almost no room, and in narrower
windows the actions were pushed past the window edge.
Make the topbar a size container and show filter labels based on its
own width. While searching, collapse inactive filters to icons and give
the input a fixed width. When there is still not enough room, the
filters scroll and fade out at the clipped edge.
Fixes: 0d6def4600
When users block web fonts, code was rendered in the browser's default
sans-serif font because the JetBrains Mono code font tokens had no
generic fallback. Add `monospace` as a fallback so code stays
monospaced.
Fixes: 8942cea33a
Opening a comment link expands the revision the comment is in, even if
the link is opened while already on the page, and scrolls to it.
This also fixes scrolling to URL fragments that aren't valid CSS
selectors, such as comment ids starting with a digit.
A peer with a bad connection kept reconnecting and re-announcing all
its seeded repos, ~27k SeedDiscovered/SeedDropped events per hour on
my node. Every event triggered a meili upsert until meilisearch sat
at 100% cpu and its task queue timed out.
Seed events only affect the seedingCount ranking field and the
periodic rescan updates that anyway, so drop them. Collect the
remaining events and reindex each touched repo once every 30s
(RADICLE_SEARCH_BATCH_SECS).
The redaction reason sits in a collapsed accordion, so the test failed
consistently against a local httpd. Only local runs execute the release
tests, which is why it went unnoticed.
Support /raw/<rid>/archive/<ref>.tar.zst next to the existing tar,
tar.gz and zip formats. Git has no builtin zstd tar format, so
register one via tar.tar.zst.command. Needs the zstd binary in PATH.
Emoji in code blocks were missing from both the rendered code and the
copied text. twemoji replaces them with images, but highlighting and the
copy button work from the block's text content, which leaves images out.
We now turn the images back into text first.
ghcr.io/drips-network/ryph-universal is no longer pullable, which fails
every environment build; quay.io/ryph/ryph-universal:1 is the same
image's public home.
Every patch saved its own Rust caches, up to 3 GB per patch, which
pushed the repo past GitHub's 10 GB cache limit and evicted the ones
master builds rely on. Patches now restore master's caches, and
line-table-only debug info keeps the builds and caches smaller.
Vitest's Rolldown picked up the root tsconfig.json, which extends a
package only the explorer installs, so the tests failed to start when
only desktop's dependencies were installed.
Desktop's GitHub workflows are already prefixed `desktop-`. With both
projects in one repo, the prefix shows which project a workflow or
Buildkite step belongs to.
Rūdolfs Ošiņš