chore(deps): bump esbuild from 0.21.5 to removed in the npm_and_yarn group across 1 directory - #1
Open
dependabot[bot] wants to merge 1 commit into
Open
Conversation
dependabot
Bot
added
dependencies
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Free Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/npm_and_yarn-53cbaf2a5b
branch
from
August 2, 2026 20:38
ef28638 to
eeaf193
Compare
coderhd
added a commit
that referenced
this pull request
Aug 13, 2026
…membership auth Address PR review findings #8-#11 and the spec/doc review items #1-#7. - indexPage now delegates all writes to the sync_page_graph rpc function: delete/insert of page_links and page_tags plus the pages update happen in one transaction, serialized per page with a row lock (finding #8). The function is server-only (EXECUTE revoked from PUBLIC/anon/authenticated). - deletePage also removes the mapped legacy documents row so deleted pages cannot stay reachable through legacy fallback or storage (finding #9). - verifyUserRole reads live document_members grants for mapped pages whose page_members backfill is stale after legacy grants/revocations, matching the can_access_page RLS helper (finding #10). - select_page_links policy is now from-only via can_access_page(from_page_id) instead of OR-of-both-endpoints, closing the private-title enumeration leak (finding #11). - Fix latent plpgsql ambiguity (42702) in can_access_page and can_access_document_storage: user_id collided with the *_members.user_id columns, breaking every RLS evaluation for authenticated users. Found during live verification. - Spec: add 6.2 blank line, correct Obsidian pricing row (as-of Aug 2026, obsidian.md/pricing), align page_links/page_tags contract with the implemented schema, fix Plugin API horizon contradiction, add capability model to 8.2, rewrite section 7 with workspace subscriptions and seats, retire bundled credits everywhere (all BYOK/BYOL).
coderhd
added a commit
that referenced
this pull request
Aug 13, 2026
* feat: upgrade Tiptap to v3 and add Table, Syntax Highlighting, Notion Drag Handle, Markdown Paste & Premium DOCX/PDF Export * fix: resolve client bundle module dependencies and add turbopack fallback for next.config * fix: restore node built-in resolution for server prerendering in next.config.mjs * fix: replace html-to-docx with browser-native docx package to resolve Turbopack bundling error * fix: resolve duplicate Tiptap extension warnings and update StarterKit named import * fix: align @tiptap/extension-collaboration and @tiptap/extension-collaboration-cursor to 2.26.2 to resolve ySyncPluginKey mismatch crash * test: add getUserAICredits to db mock in editor-formatting test * test: set NODE_OPTIONS memory limit in package.json test script * fix: intercept paste event in editorProps to parse markdown text into rich blocks instead of codeblock * fix: set parsed markdown content when pasting into blank editor * feat: implement secure storage RLS policies and track version creators in database * chore: upgrade Tiptap collaboration extensions to version 3.x * feat: move code block language selector to a floating absolute overlay positioned relative to the active code block * feat: implement collaborative cursor tracking and refactor editor synchronization logic * feat: integrate Google Analytics, track local sync status, and add persistent selection unit tests * disable undoRedo in StarterKit configuration across the editor workspace and persistence tests * refactor: centralize storage RLS logic, implement Google Analytics component, and improve editor export UX and markdown handling. * fix: use live editor instance in handlePaste so markdown parsing works on bare paste The editor is recreated when [ydoc, provider] deps change (async collab setup), leaving editorProps closures like handlePaste bound to a stale, destroyed editor whose extension storage is empty. As a result the markdown parser was never found, the handler returned false, and pasting with Cmd+V (which carries text/html) fell through to ProseMirror's default handling and inserted the content as a code block. Pasting with Paste-and-Match-Style worked only because it carries no html and went through tiptap-markdown's plain-text hook on the live editor. Keep a stable ref to the live editor and read storage/commands from it. Also extract the paste classification into lib/markdown-paste.ts with unit coverage for markdown vs code-block vs default decisions. * fix: refetch dashboard documents on session re-auth and show retryable error state * fix: refine markdown paste detection and ref sync after code review - Assign editorRef after commit via useLayoutEffect instead of mutating it during render, preserving handlePaste's live-editor behavior. - Classify pipe-delimited content as a table only when a valid GFM delimiter row is present; pipe-operator code pastes as a code block. - Recognize ATX headings with up to three leading spaces. - Add regression tests for pipe-operator code, valid tables, and indented headings. * fix: show loading during dashboard retry, guard against stale fetches, and require matching table cells - Set loading state before retrying document fetch so the error view is replaced by the loader. - Guard fetchDocuments state updates by request identity so an older in-flight request cannot overwrite a newer result. - Require the header and delimiter rows of a pasted GFM table to have matching cell counts; mismatched rows paste as a code block. - Add tests for retry loading, stale-request handling, and mismatched table detection. * fix: apply CodeRabbit auto-fixes Fixed 1 file(s) based on 2 unresolved review comments. Co-authored-by: CodeRabbit <noreply@coderabbit.ai> * docs: add global PKM & AI-native office suite strategy design * docs: fix current-state accuracy in strategy spec * docs: revise free-tier AI to per-user free-key on-ramp, drop managed key path * docs: add docs subdomain & community section to strategy spec * docs: add migration & lock-in reversal section to strategy spec * docs: add P1 pages-graph foundation implementation plan * feat(db): add pages-graph schema with backfill and RLS * feat(graph): add wikilink and tag extractors * fix(graph): satisfy eslint no-useless-escape in link and tag regexes * feat(graph): index page links, tags and searchable text * feat(graph): add client service layer for workspaces, pages and graph queries * feat(sync): cut over auth and saves to pages with legacy fallback and graph indexing * fix(graph): harden pages save error handling and anon public access * fix(graph): bridge fetchPageBacklinks embed cast through unknown for type check * fix(graph): transactional page indexing, mapped-page delete and live membership auth Address PR review findings #8-#11 and the spec/doc review items #1-#7. - indexPage now delegates all writes to the sync_page_graph rpc function: delete/insert of page_links and page_tags plus the pages update happen in one transaction, serialized per page with a row lock (finding #8). The function is server-only (EXECUTE revoked from PUBLIC/anon/authenticated). - deletePage also removes the mapped legacy documents row so deleted pages cannot stay reachable through legacy fallback or storage (finding #9). - verifyUserRole reads live document_members grants for mapped pages whose page_members backfill is stale after legacy grants/revocations, matching the can_access_page RLS helper (finding #10). - select_page_links policy is now from-only via can_access_page(from_page_id) instead of OR-of-both-endpoints, closing the private-title enumeration leak (finding #11). - Fix latent plpgsql ambiguity (42702) in can_access_page and can_access_document_storage: user_id collided with the *_members.user_id columns, breaking every RLS evaluation for authenticated users. Found during live verification. - Spec: add 6.2 blank line, correct Obsidian pricing row (as-of Aug 2026, obsidian.md/pricing), align page_links/page_tags contract with the implemented schema, fix Plugin API horizon contradiction, add capability model to 8.2, rewrite section 7 with workspace subscriptions and seats, retire bundled credits everywhere (all BYOK/BYOL). --------- Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: CodeRabbit <noreply@coderabbit.ai>
Bumps the npm_and_yarn group with 1 update in the / directory: [esbuild](https://github.com/evanw/esbuild). Removes `esbuild` --- updated-dependencies: - dependency-name: esbuild dependency-version: 0.28.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/npm_and_yarn-53cbaf2a5b
branch
from
August 14, 2026 21:00
eeaf193 to
cf13acc
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the npm_and_yarn group with 1 update in the / directory: esbuild.
Removes
esbuild