Account for every update in PR 2759 using its complete original graph and the already verified official serializer metadata, rather than carrying the old security override into Solid 1.9.16. Lock both runtime edges to 1.6.8, preserve every security override and add installed-version checks that reject stale offline graphs. Acquisition and fresh exact-graph qualification remain required before integration.
Contract-Neutral: Compatible patch/tooling refresh within existing rendering, security and serialization contracts; no new surface or authority, and all security floors, strict audit and consumer checks remain required.
Change-source: pulse-maintainer
Use officially verified Seroval 1.6.3, postcss-selector-parser 7.1.6 and source-map-js 1.2.2 without lowering any other security floor. Preserve the existing plugin peer and complete graph, document the intentional Solid and typography overrides, and add nested-copy floors plus actual consumer compatibility controls. Exact acquired-graph source, build and browser validation still requires fresh-launch selection.
Change-source: pulse-maintainer
Own the six-package npm-minor-patch refresh from Pulse #2352 on current main. Preserve the Tailwind 4/jscpd 5 graph and existing advisory floors, raise the accepted node/icon/tooling versions, keep every typescript-eslint helper aligned, and exercise the real Prettier dollar-variable Markdown regression. Exact graph acquisition, full source checks and representative icon browser proof remain required before integration.
Change-source: pulse-maintainer
GHSA-vfj7-8cjw-p6xm affects every braces release and has no fix, so the
required frontend audit failed with seven high findings on any pull
request that changes the dependency graph. Tailwind CSS 3 (chokidar,
fast-glob, micromatch) and jscpd 4 (@jscpd/finder, fast-glob) were the
only paths in, both dev-only, and no override can remove braces from
fast-glob or micromatch. Tailwind CSS 4.3.3 through @tailwindcss/vite and
jscpd 5.4.0 leave none; npm audit over the full graph reports zero.
The stylesheet keeps the v3 rendering. It pins the v3 palette (inlined,
so opacity modifiers compile to static colors), font stacks and line
heights, keeps v3's cascade order by placing former component and
unlayered rules around the generated utilities, and restores v3 hover on
touch devices, gray-200 default borders, the 3px blue ring, placeholder
color, button cursor, table-cell padding and the space-* and divide-*
child selectors. The 900/950 shades Pulse overrode with 25% alpha are
opaque now and their callers say /25, because v4 multiplies an opacity
modifier into a translucent color instead of replacing it. Opacity
modifiers on var() colors that v3 never generated are removed.
Utility order changed from lexical to numeric, so a few caller overrides
that silently lost in v3 would start to win. Touch targets keep their
authored 44px phone size (the Machines row stays 32px); cosmetic
overrides v3 never applied are removed, and overrides it did apply use
the important suffix.
Contract-Neutral: Tailwind CSS 4 migration for GHSA-vfj7-8cjw-p6xm: utility class renames and stylesheet compatibility, no subsystem contract change
Dependabot npm-minor-patch #2189 raises @types/node 26.6.1 -> 26.6.2 in frontend-modern and tests/integration, but Canonical Governance blocks the manifest/lock change for a missing deployment-installability contract entry and frontend dependency security proof. The portal frontend part of the same group is a separate ws override refresh that needs a portal bundle decision and is owned separately, so it is not carried here.
Carry the frontend-modern and tests/integration @types/node 26.6.2 bump with a Current State contract entry and a dependencySecurity floor raise. @types/node is a dev-only declaration package and does not enter the shipped bundle; @playwright/test stays pinned at 1.56.1, so browser-test parity is unchanged. The frontend-modern offline dependency snapshot is bound to 26.6.1, so npm ci --offline cannot resolve the 26.6.2 tarball in this assignment; a host dependency acquisition is required before the suite can run against the new lockfile.
Change-source: pulse-maintainer
Dependabot's npm-minor-patch group (#2138) bumps frontend-modern and tests/integration but is blocked by Canonical Governance, which requires the deployment-installability contract update and the frontend dependency security proof in the same commit. The portal frontend in the same group is split out: it needs a portal bundle rebuild and is owned separately.
Carry the frontend-modern manifest/lock bump (dompurify 3.4.15, highlight.js 11.12.0, solid-js 1.9.15, @types/node 26.6.1, typescript-eslint 8.70.0, autoprefixer 10.6.1, eslint-plugin-solid 0.18.0, postcss 8.5.28, prettier 3.9.8, vite-plugin-solid 2.11.14, vite-plugin-sri-gen 1.7.4) and the tests/integration @types/node 26.6.1 bump with a Current State contract entry and dependencySecurity floor assertions. @playwright/test stays pinned at 1.56.1, so browser-test parity is unchanged.
Change-source: pulse-maintainer
Dependabot #2099 bumps @types/node 20.19.43 to 26.5.1 in frontend-modern, but the PR is blocked twice: Frontend tsc fails with TS2550 on .at() (26 removed the compatibility polyfill), and Canonical Governance blocks the package.json/lock change for a missing deployment-installability contract update and frontend dependency security proof.
Carry the bump with its required governance artifacts in one commit. tsconfig already declares the ES2022 lib (95db35b6c3), which the source's .at() usage needs; this adds the manifest and lock bump (matching tests/integration, which already pins @types/node ^26.5.1), a Completion Obligations entry, and a dependencySecurity proof that keeps the manifest range, the locked @types/node/undici-types versions and the declared lib in step. Verified offline: the guard passes and the proof test passes.
Change-source: pulse-maintainer
Use patched Vitest/coverage 4.1.11 and js-yaml 4.3.2. Adapt constructor mocks, callable mock types and explicit call-history cleanup for Vitest 4 without weakening assertions or audit gates.
Change-source: pulse-maintainer
Remove duplicate keyboard and disclosure semantics from static data-table rows across the platform surfaces. Preserve whole-row pointer convenience while leaving focus, accessible naming and expanded state on each existing native disclosure button.
The populated TrueNAS browser check also exposed an invalid combobox role on inline-only search completion, so keep it as a native textbox with aria-autocomplete.
Change-source: pulse-maintainer
Contract-Neutral: Accessibility semantics and regression coverage only; no product or API boundary changed
Any *_SPEC.md, *_PLAN.md, or *_CONTRACT.md under docs/ must now carry a
Status: line (or a ## Status section) in its header, enforced by the
pre-push lint. A spec, plan, or contract is a record of a decision, not
demand; the 2026-09-01 Home wall case showed what happens when a stale
handoff spec reads as a current signal. Subsystem contract markdown is
governed separately and is not scanned.
The commercial cancellation/reactivation e2e test plan gets the one
missing line so the existing set passes.
Offline guard for the pulseapp.io class: any domain-shaped token
containing 'pulse' in published surfaces (root markdown, docs and
mirrors, non-test frontend src and Go source) must be pulserelay.pro,
1mk.app, or a documented placeholder. Catches the invented
security@pulseapp.io / docs.pulseapp.io (10 months as the published
security contact, bouncing every disclosure) and the pulse.app
OpenRouter referer fixed in b1240c6ca. Runs in npm run lint, so the
pre-push hook enforces it.
Contract-Neutral: Customer-facing punctuation cleanup only; no API, lifecycle, policy, or subsystem behavior changed. The owning frontend copy contract and lint enforcement are updated.
The pre-commit frontend formatter resolved prettier at
REPO_ROOT/frontend-modern/node_modules/.bin/prettier, where REPO_ROOT is
derived from the script's own path. In a linked worktree that is the
worktree root, which never runs npm install, so prettier_bin() returned
None and the formatter silently returned 0. Every frontend commit made
from a Claude or Codex agent worktree skipped formatting entirely, and
the drift accumulated in already-committed files until someone ran
`make format` and picked up 14 files of unrelated churn.
The skip path's comment claimed "CI's prettier check still catches drift
that slips through here." No such check existed -- nothing under
.github/workflows referenced prettier -- so there was no backstop at all.
- Fall back to the primary worktree's node_modules, resolved via
`git rev-parse --git-common-dir`, and say so in the hook output so a
version mismatch between the two checkouts stays visible.
- Add the whole-tree "Check frontend formatting" step to the frontend CI
job that the comment already promised. Staged-only formatting cannot
see drift in untouched files; this can.
- Pin prettier exactly. "^3.3.0" let the tracked package-lock.json land
on 3.9.5 while the gitignored pnpm-lock.yaml resolved 3.9.6, so CI and
the dev machine were free to run different formatters.
- Resolve the test suite's prettier the same way, so its two real
coverage tests stop silently skipping in worktrees.
Contract-Neutral: devDependency prettier version pin plus pre-commit/CI formatter tooling; no runtime, API, or deployment-surface delta
Dependabot alert 137 (low). Fixes a CUSTOM_ELEMENT_HANDLING hook-policy
bypass upstream; Pulse does not enable CUSTOM_ELEMENT_HANDLING so the
bump is hygiene, not an active exposure. Verified vite build, bundle
budget, and the AI chat vitest suite that exercises the sanitizer.
Contract-Neutral: Dependabot alert 137 GHSA-c2j3-45gr-mqc4: patch-level dompurify 3.4.11->3.4.12 security bump in frontend-modern; no dev-runtime orchestration, manifest-floor, or build-chunking behavior changed, contract already governs security lockfile bumps generically; dev-runtime proof artifacts are inapplicable to a frontend dependency version pin
Bump vite ^6.4.2 to ^6.4.3 and pin patched transitives via overrides
(@babel/core ^7.29.6, js-yaml ^4.2.0). Clears 4 Dependabot alerts (2 high,
1 medium, 1 low). npm audit reports 0 vulnerabilities; npm ci, vite build,
vitest (6830 tests), and bundlesize all green.
Also gitignore stray pnpm artifacts. npm is canonical here (CI and the
production Dockerfile both use npm ci from package-lock.json); nothing
consumes pnpm. The unused pnpm-lock.yaml and pnpm-workspace.yaml were
removed separately this cycle and only ever produced Dependabot noise (13
alerts). Ignoring them stops the pair creeping back in, as happened after
the earlier cac5be2ca removal.
OpenCode syntax-highlights code in the transcript; Pulse rendered
fenced blocks as flat text. Assistant answers are full of shell
commands, configs, and query output, so add highlight.js with an
infra grammar set (bash, json, yaml, ini, sql, dockerfile, nginx):
- Lazy-loaded into its own vendor-highlight chunk; the entry chunk
stays clean and the chunk only downloads with the rest of the
preloaded app shell.
- Highlighting runs over the sanitized DOM after the turn settles, so
generated spans never pass through DOMPurify, streaming morphs are
never fought, and the class allowlist stays closed to the model. The
single carve-out is marked's fence-language hint, pattern-pinned to
language-x on <code> only.
- Token palette maps hljs classes to theme colors readable on the
dark prose-pre background both app themes share.
Per-block copy is intentionally not added: OpenCode has none, and the
answer-level copy already exists.
Bumps frontend-modern DOMPurify from ^3.4.0 / 3.4.0 to ^3.4.1 / 3.4.1 and PostCSS from ^8.4.0 / 8.5.6 to ^8.5.13 / 8.5.13.
Keeps pulse/v6-release aligned with the default-branch Dependabot fixes for GHSA-39q2-94rc-95cp and GHSA-qx2v-qp2m-jg93.
Verification: npm ci, npm audit --audit-level=moderate, npm run type-check, npm run build, npm run lint, status_audit.py --check, registry_audit.py --check from the canonical workspace. Full npm test remains red on origin/pulse/v6-release with the same targeted baseline failures unrelated to these dependency changes.
The advisory covers an ADD_TAGS form bypass of FORBID_TAGS. Pulse uses
an ALLOWED_TAGS allowlist in frontend-modern/src/components/AI/aiChatUtils.ts
and never combines ADD_TAGS with FORBID_TAGS, so we were not actually
exposed, but staying on the patched line keeps the Dependabot surface
clean.
- Updates eslint to v9.20.0 to resolve Dependabot alert #50
- Migrates config to flat format (eslint.config.js)
- Updates typescript-eslint and eslint-plugin-solid
- Fixes lint error in UnifiedBackups.tsx
Override seroval to ^1.4.1 to fix 8 high-severity vulnerabilities:
- Remote Code Execution via JSON Deserialization
- Prototype Pollution via JSON Deserialization
- Denial of Service via Array/RegExp serialization
seroval is a transitive dependency from solid-js which pins ~1.3.0.
- Fix Storage.tsx using number priorities instead of string literals
- Move husky configuration to repository root for proper git hook support
- Add package.json/lock.json to root (un-ignore in .gitignore)
- Configure pre-push hook to run type-check before push
Adds husky with a pre-push hook that runs type-check before allowing
pushes. This catches the TypeScript errors locally that were causing
repeated CI failures and email spam.
Skip with: git push --no-verify
- Add DOMPurify sanitization for AI chat markdown rendering (XSS fix)
- Configure DOMPurify to add target=_blank and rel=noopener to links
- Update system prompt to align with command approval policy
- Clarify safe vs destructive commands in prompt
- Improve patrol auto-fix mode guidance with safe operation list
- Add verification requirements for auto-fix actions
- Update observe-only mode to be clearer about read-only restrictions
- Add AI service with Anthropic, OpenAI, and Ollama providers
- Add AI chat UI component with streaming responses
- Add AI settings page for configuration
- Add agent exec framework for command execution
- Add API endpoints for AI chat and configuration
- Add comprehensive test coverage for alerts package with 285+ new tests
- Implement ThresholdsTable component with metric thresholds display
- Enhance Alerts page UI with improved layout and metric filtering
- Add frontend component tests for Alerts page and ThresholdsTable
- Set up Vitest testing infrastructure for SolidJS components
- Improve config persistence with better validation
- Expand discovery tests with 333+ test cases
- Update API, configuration, and Docker monitoring documentation
pulse-triage[bot]