mirror of
https://github.com/Unleash/unleash.git
synced 2026-09-10 06:05:47 +00:00
perf/dependent-features-join
16311 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Jaanus
|
2a4be6ae96 |
perf: avoid OR-join on dependent_features in feature search
The dependency lookup joined dependent_features with an OR predicate (parent = features.name OR child = features.name). Postgres cannot hash an OR join condition, so it planned a nested loop with a BitmapOr index probe per outer row -- and the outer side is the already fanned-out row set, so it probed once per (feature x environment x tag x strategy x segment) row rather than once per feature. Replacing the OR with a UNION ALL derived table makes the predicate a plain equality, which plans as a merge join. Measured on a seeded dataset of 20k flags (18k active) x 5 environments, 120k strategies, 30k tags and 800 dependencies: shared buffer hits 9,796,910 -> 15,105 (648x fewer) query time ~16.4s -> ~3.6s (4.5x faster) Row multiplicity and the resulting dependency value are unchanged: verified with EXCEPT ALL in both directions across the whole features table, and by the existing feature search and dependent features e2e suites. |
||
|
Mikhail Alabugin
|
f50c86c538 |
docs: fix dead Code Kitchen podcast link in README (#12579)
The Code Kitchen podcast episode link is dead — Fireside's episode-share
feature is gone (`share.fireside.fm` 404s entirely). The episode
("Feature flags with Unleash", with Egil and Ivar Østhus) is live on the
podcast's site, which embeds the identical Fireside episode id in its
player: `https://divanv.com/podcast/` (HTTP 200).
|
||
|
Fredrik Strand Oseberg
|
edc7c2988a |
feat: make the winning survey deterministic across page loads
Guarantee survey order |
||
|
Alexandra
|
316e898206 |
fix: cross-project variant overwrite
Issue: A project member may be able to overwrite another project's feature environment variants and payloads because the target feature is not properly bound to the project authorization scope. Fix: All variant mutation paths should validate if feature belongs to project Intends to fix both [EG-4687](https://linear.app/unleash/issue/EG-4687/cross-project-environment-variants-overwrite-ghsa-639f-52mg-grrc) and [EG-4685](https://linear.app/unleash/issue/EG-4685/cross-project-overwrite-via-variants-batch-ghsa-v6pr-g426-4xc4) |
||
|
renovate[bot]
|
a7efb00777 |
chore(deps): update dependency nodemailer to v9.0.6 (#12606)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [nodemailer](https://nodemailer.com/) ([source](https://redirect.github.com/nodemailer/nodemailer)) | [`9.0.5` → `9.0.6`](https://renovatebot.com/diffs/npm/nodemailer/9.0.5/9.0.6) |  |  | --- ### Release Notes <details> <summary>nodemailer/nodemailer (nodemailer)</summary> ### [`v9.0.6`](https://redirect.github.com/nodemailer/nodemailer/blob/HEAD/CHANGELOG.md#906-2026-08-27) [Compare Source](https://redirect.github.com/nodemailer/nodemailer/compare/v9.0.5...v9.0.6) ##### Bug Fixes - **addressparser:** recover the addr-spec from an angle-addr holding whitespace ([e989a22](https://redirect.github.com/nodemailer/nodemailer/commit/e989a22ca4f5161929bf37be8fb07de635016fa7)) - harden copies of user supplied keys and URL fetching ([2f667f4](https://redirect.github.com/nodemailer/nodemailer/commit/2f667f4272cb2d7cb479b2e3903ab10600fc0eae)) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Madrid) - Branch creation - "after 7pm every weekday,before 5am every weekday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/Unleash/unleash). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC42MS4zIiwidXBkYXRlZEluVmVyIjoiNDQuNjEuMyIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
ad21c7d26c |
chore(deps): update dependency @testing-library/react to v16.3.3 (#12605)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@testing-library/react](https://redirect.github.com/testing-library/react-testing-library) | [`16.3.2` → `16.3.3`](https://renovatebot.com/diffs/npm/@testing-library%2freact/16.3.2/16.3.3) |  |  | --- ### Release Notes <details> <summary>testing-library/react-testing-library (@​testing-library/react)</summary> ### [`v16.3.3`](https://redirect.github.com/testing-library/react-testing-library/releases/tag/v16.3.3) [Compare Source](https://redirect.github.com/testing-library/react-testing-library/compare/v16.3.2...v16.3.3) ##### Bug Fixes - Avoid act() re-entrant when dispatching events ([#​1468](https://redirect.github.com/testing-library/react-testing-library/issues/1468)) ([20ce75f](https://redirect.github.com/testing-library/react-testing-library/commit/20ce75f2907ca0e5c5a8ae595c0e9a4e368c7800)) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Madrid) - Branch creation - "after 7pm every weekday,before 5am every weekday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/Unleash/unleash). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC42MS4zIiwidXBkYXRlZEluVmVyIjoiNDQuNjEuMyIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
Gastón Fournier
|
cdbfd34825 |
feat: strenghten the requirement around appName (#11628)
## About the changes This PR prevents malformed client registrations with an empty `appName` from reaching scheduled persistence and producing warnings such as `Failed to register clients The query is empty`. Validation now reflects whether an endpoint handles one application or an aggregate of independent applications: single-application requests are rejected at the API boundary, while malformed entries in an aggregated Edge payload are ignored without discarding unrelated data. ## Validation strategy ### Single-application routes - `POST /api/client/metrics` requires a non-empty `appName` in its OpenAPI schema. Validation happens before instance registration, so malformed registrations do not enter the scheduled persistence buffer. - `POST /api/client/register` uses the same non-empty OpenAPI constraint. Empty names were already rejected by the downstream registration schema; this moves the rejection to the API boundary. - `POST /api/frontend/client/register` is unchanged. It does not persist client registrations through this path. ### Aggregated bulk route `POST /api/client/metrics/bulk` can carry applications, usage metrics, impact metrics, and seen tokens from multiple downstream clients. The request schema still requires `appName` to be present on application and usage-metric entries. After envelope validation, the controller: - skips application entries whose `appName` is falsey; - skips app-associated usage metrics whose `appName` is falsey; - continues processing valid applications, usage metrics, impact metrics, and seen tokens; - returns success when the remaining work succeeds. This prevents one malformed Edge entry from determining the result of otherwise independent work in the same payload. ### Scheduled-persistence guard `ClientInstanceService.bulkAdd()` also filters registrations with a falsey `appName` before constructing application and instance upserts. This avoids empty upsert queries for all-invalid batches and prevents malformed entries in mixed batches from being persisted. |
||
|
Mateusz Prusaczyk
|
0429c292c9 |
fix(flag-status): no tooltip on healthy and unknown flag status
# Description Follow-up to #1692. The `–` shown for a healthy flag came with a dotted underline and a "No issues detected" tooltip. The underline invites a hover that then explains nothing. It absorbs attention unnecessarily. - **`ok`** — still shows `–`, now as plain text: no tooltip, no dotted underline. - **`unknown`** (no lifecycle data) — shows `N/A` instead of `–`, also without a tooltip or underline. Every other status keeps its tooltip unchanged. Discussed in [this Slack thread](https://unleash-internal.slack.com/archives/C046LV6HH6W/p1788432907560119?thread_ts=1788429793.320939&cid=C046LV6HH6W). # Implementation note `FeatureStatusText.description` is renamed to `tooltip`, and its absence now means "render no tooltip" rather than "fall back to the label". The two statuses that relied on that fallback for their truncated labels — `milestone` and `noProductionEnvironments` — now set `tooltip` explicitly, so their rendering is unchanged. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|
Øystein Lorentzen Vesth
|
75a42cef56 |
feat(integrations): surface project-scoped Slack integrations in project settings
[Linear project](https://linear.app/unleash/project/integrations-slack-integration-project-level-284041fa76da/overview) Flag: `slackIntegrationProjectLevel` **Description** Adds an Integrations tab under project settings, behind the slackIntegrationProjectLevel flag. A Slack integration appears there when the project is the only one it sends events to; instance-wide and shared ones stay on /integrations. Reuses ConfiguredIntegrations for the list, made scope-aware via useOptionalPathParam. Integrations can be created and edited from either place, with the projects selector hidden in a project since the scope is implied. No new endpoints, permissions or schema changes, writes still go through the existing addon API behind CREATE_ADDON/UPDATE_ADDON. Kept the possibility of adding the api key on project settings since you must have UPDATE/CREATE_ADDON permission anyways, and it just creates a integration similar to what is already in integrations. This PR does not really fix the "*Then each project/team that wants an own integration so it looks like slack is set up x times which can lead to some confusion.*" mentioned in the linear issue. --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|
Mateusz Prusaczyk
|
367b3295a3 |
feat(strategies): simpler strategy setup - part 1 : add a flag and placeholder screen
[Related ticket](https://linear.app/unleash/project/ux-make-flag-setup-options-simpler-81f10792c2d5/overview) Simpler strategy flow - this is just a first step - define a flag and create a dummy placeholder --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|
Gergo Kekesi
|
122c21982b |
feat(tracking): track project access journeys
- Assign, role-change and remove emit the full lifecycle via `useMutationTracking` - Role names captured (comma-joined), `groupName` for group targets only — user identities never emitted - Opened intents at the assign button and row edit icon; the form's Cancel button emits its `cancel-button` dismissal (it bypasses the modal's own dismiss path) - `PermissionIconButton` Link mode accepts `onClick` to allow tracking alongside navigation |
||
|
Gergo Kekesi
|
7804942a5a |
feat(tracking): track project settings journeys
- Project archive/delete emit opened at the button, submitted at dialog confirm, succeeded/failed on settle via `useMutationTracking` - General settings save emits the full lifecycle with changed-field booleans - Link template deletion and settings sub-menu navigation tracked - **Live-series change:** `project-navigation` eventType values switch from tab titles (`'Change requests'`, `'Event log'`, …) to tab ids (`'change-request'`, `'logs'`, …), and the previously mis-guarded `'Overview'` rows stop entirely (the old `tab.title !== 'Flags'` guard never matched) — dashboards keyed on the old values need updating - Stacked on #1562; the shared mutation-tracking hook comes from #1576 (foundations) |
||
|
Gergo Kekesi
|
1186f04744 |
feat(tracking): track flag row actions and lifecycle
- Stale-toggle, delete, revive and archive journeys emit the full
lifecycle via `useMutationTracking`, with flag `name` on every row
- `FeatureArchiveDialog` gained
`onArchiveStart`/`onArchiveError`/`tracking` seams — archive was
previously silent on the project list and had no action axis on the
feature view
- Clone tracked as an opened intent on both surfaces; favorites and
lifecycle uncomplete tracked with names
- name-copied clipboard row carries the flag name
- The archive dialogs **are** tagged for dismissal tracking in this
branch: both `FeatureArchiveDialog` call sites carry `tracking={{ event:
'flag-actions', type: 'archived' }}`. Mark-completed remains untagged.
### Live-series change: `feature-lifecycle` / `uncomplete`
This is a breaking shape change for any existing chart or query on that
series. `uncomplete` previously emitted a single row on success with no
`action` property. It now emits a `submitted` row on every attempt plus
a `succeeded` or `failed` row, so the series gains an `action` axis and
roughly doubles in row count (tripling on the failure path, which also
carries the request-failure properties). Anything counting raw
`uncomplete` rows as "successful uncompletes" must now filter on `action
= 'succeeded'`.
|
||
|
Gergo Kekesi
|
5a568d4ebe |
feat(tracking): track context field journeys
- Context field create/edit/delete emit the full mutation lifecycle via `useMutationTracking` with `name`, exact `legalValuesCount`, stickiness and changed-field booleans - Delete icon emits `opened`; dialogs carry dismissal `tracking` props --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|
Mateusz Prusaczyk
|
8fb8bc4c32 |
fix: Feature status tooltip
# Description [Related Linear ticket](https://linear.app/unleash/project/ux-small-improvements-tooltip-for-status-in-flags-overview-7bf140e7e3e1/overview) [Related docs](https://docs.getunleash.io/concepts/feature-flags#flag-status) Add a tooltip which provides more context to the status. A complete table of statuses, labels and descriptions | Stage | Condition | Label | Tooltip description | | --- | --- | --- | --- | | _any_ | `lifecycle` is missing | `–` | We are lacking data about this flag | | initial (define) | Any non-production environment is enabled | No traffic | A non-production environment is enabled | | initial (define) | No non-production environment has strategies | No strategies | No strategies in non-production environment | | initial (define) | No non-production environment has enabled strategies | No enabled strategies | All strategies in non-production environments are disabled | | initial (define) | Non-prod strategies exist and are enabled, but no non-production environment is enabled | Paused* 👇 | All non-production environments are disabled | | pre-live (develop) | No environment at all is enabled | Paused | No environment enabled | | pre-live (develop) | At least one environment is enabled | `–` | No issues detected | | live (production) / completed (cleanup) | No production environments exist | No production environments | _(none — tooltip falls back to the label)_ | | live (production) / completed (cleanup) | Multiple production environments, none enabled | Paused | Production environments are disabled | | live (production) / completed (cleanup) | Multiple production environments, some but not all enabled | In {n} out of {total} production environments | Enabled in: {env1, env2, …} | | live (production) / completed (cleanup) | First production environment has no strategies | No strategies | No strategies added in the production environment | | live (production) / completed (cleanup) | First production environment is disabled | Paused | Production environments are disabled | | live (production) / completed (cleanup) | First production environment is in a named milestone | Milestone: {name} ({order} of {total}) | _(none — tooltip falls back to the label)_ | | live (production) / completed (cleanup) | First production environment is in an unnamed milestone | Milestone {order} of {total} | _(none — tooltip falls back to the label)_ | | live (production) / completed (cleanup) | Production is enabled, has strategies, no milestones | `–` | No issues detected | | archived (archived) | Always — no archived-specific branch exists | `–` | No issues detected | *see below: **key change to discuss** - previously the initial state didn't have a fall-through case (the "else"). Now it has and goes to pause. To be discussed whether that makes sense. E.g. it may happen if you have a flag - in define phase - development env is disabled - production env is enabled # UI changes ## Before <img width="1620" height="1230" alt="Screenshot 2026-09-03 at 08 57 35" src="https://github.com/user-attachments/assets/de46bb0e-76b4-452c-8220-7b96c5f3030d" /> ## After <img width="1245" height="436" alt="Screenshot 2026-09-02 at 16 18 53" src="https://github.com/user-attachments/assets/ceae8c74-07c2-441b-9af2-bee34b92d1ad" /> <img width="1240" height="465" alt="Screenshot 2026-09-02 at 16 18 51" src="https://github.com/user-attachments/assets/8c7dd2c8-62e2-4a7a-a514-c3b22b26105b" /> |
||
|
Gergo Kekesi
|
e3f25356cf |
feat(tracking): track segment journeys
- Segment create/edit/delete emit the full mutation lifecycle via `useMutationTracking` with `name`/`id` and constraint shape (contextName/operator/valueCount + `constraintValuesCount` total) — constraint values stay counts - `viaChangeRequest` marks the CR route; edit rows carry changed-field booleans |
||
|
Gergo Kekesi
|
96941df3fd |
feat(tracking): mutation tracking hook and form template events
- `useMutationTracking`: one hook enforcing the mutation lifecycle vocabulary (opened/submitted/succeeded/failed), route-derived `scope` and `eventType` on every row — the convergence target the whole stack shares - `FormTemplate` emits `docs-opened` (target href, auto path) on every form's documentation link and `api-command-copied` (clipboard settle) on the curl snippet — one emit site covers every create/edit form - Dismissal-hook and provider touch-ups ride along - Root of the tracking stack |
||
|
renovate[bot]
|
5c06c74a06 |
chore(deps): update dependency js-yaml to v4.3.2 (#12604)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [js-yaml](https://redirect.github.com/nodeca/js-yaml) | [`4.3.1` → `4.3.2`](https://renovatebot.com/diffs/npm/js-yaml/4.3.1/4.3.2) |  |  | --- ### Release Notes <details> <summary>nodeca/js-yaml (js-yaml)</summary> ### [`v4.3.2`](https://redirect.github.com/nodeca/js-yaml/compare/4.3.1...4.3.2) [Compare Source](https://redirect.github.com/nodeca/js-yaml/compare/4.3.1...4.3.2) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Madrid) - Branch creation - "after 7pm every weekday,before 5am every weekday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/Unleash/unleash). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC41Ny4zIiwidXBkYXRlZEluVmVyIjoiNDQuNTcuMyIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
irstavr
|
3db0a1516e |
feat(login): add user-agent in login/logout events - EG-4692
### Issue Customer needs the `User-Agent` header present in the login/logout events we replicate to S3. Access logs already have it, login events didn't. ### In this PR: Behind a new Feature Flag 'UNLEASH_EXPERIMENTAL_LOGIN_HISTORY_USER_AGENT', the login and logout events now record the `User-Agent` header of the request that triggered them. It shows up in the login history API, the CSV download, and the S3 export, but it's hidden in the login history UI. (As requested) As `User-Agent` is an optional header, the field is nullable. a client that sends none still gets a null field. Same for old login events that do not support this change. All four providers (simple, SAML, OIDC auth and the logout middleware) hand the `request` itself (with the user-agent) to `LoginHistoryService.create()` instead of just the IP as it was till now. Everything else happens in `resolveUserAgent()` in the service: -strips non-printable characters -trims to 512 chars -and skips the whole thing when the flag is off ### Notes For the review, some extra caveats alongside: -drop the `user-agent` (and not only the `ip`) when we retry on a db-failure -added a trimming of escape chars for the CSV export that was missing ### Testing Run `$ UNLEASH_EXPERIMENTAL_LOGIN_HISTORY_USER_AGENT=true pnpm dev:enterprise` navigated to `localhost:4242/api/admin/logins` 📸 we now see the "user-agent" info in the events object <img width="1113" height="836" alt="Screenshot 2026-09-02 at 14 55 44" src="https://github.com/user-attachments/assets/1b99cd44-6aba-4cbe-842a-215f827e4e8f" /> it is still not visible on the UI, on the login history <img width="1376" height="591" alt="Screenshot 2026-09-02 at 14 58 36" src="https://github.com/user-attachments/assets/231b87d1-6925-4231-ace9-ad3f2ded8747" /> but part of the CSV downloaded file: <img width="1419" height="581" alt="Screenshot 2026-09-02 at 14 59 22" src="https://github.com/user-attachments/assets/f3688456-91e7-4e26-a575-e97e214583f4" /> Co-Authored-By: irstavr <irstavr@gmail.com> |
||
|
Fredrik Strand Oseberg
|
296e99f92c |
feat: cap how often an ignored survey is shown
The runner records one impression per survey per page load; a survey shown 3 times without being submitted or closed stops appearing. An ignored card must not nag forever, but one glance shouldn't burn it either. Malformed impression storage fails open, matching the other frequency-control keys. |
||
|
Øystein Lorentzen Vesth
|
d5ac679d16 | chore: Adds Slack integration project level flag -> slackIntegrationProjectLevel | ||
|
Krzysztof (Kris) Kula
|
82725ceddb | update sanitize-html to 2.17.7 | ||
|
Krzysztof (Kris) Kula
|
6ea3527810 |
chore: close project onboarding when it's done
I think we were showing the project setup for too long. This change should be trying to close it for you more actively. <img width="1421" height="256" alt="Screenshot 2026-09-01 at 16 37 13" src="https://github.com/user-attachments/assets/9519b89c-97a8-4f48-81ce-3fed6088775d" /> |
||
|
Krzysztof (Kris) Kula
|
e5d33a64b7 |
update browserlist
https://github.com/Unleash/unleash/security/dependabot for OSS and Enterprise |
||
|
Mateusz Kwasniewski
|
7c596a77ef |
feat: analytics has info about automation type used in template
Sample json sent to plausible with new `timeAutomations` and `exposureAutomations`, counting the amount of time based and exposure based automations in the milestones:
```
{
"props": {
"eventType": "edit-template",
"template": "Canary",
"scope": "project",
"project": "payments",
"timeAutomations": 2,
"exposureAutomations": 1
}
}
```
---------
Co-authored-by: Kamala Rocci <kamala.rocci@getunleash.io>
|
||
|
Anniken Østdahl
|
810765311f |
Adjust input fields and margins (#12597)
Design adjustments made via the UX Tweak extension. Files changed: - frontend/src/component/releases/ReleasePlanTemplate/TemplateForm/TemplateForm.tsx - frontend/src/component/releases/ReleasePlanTemplate/TemplateForm/MilestoneList/MilestoneCard/MilestoneCard.tsx 🤖 Drafted from the UX Tweak extension — please review. --------- Co-authored-by: Anniken Østdahl <6595978+nikken@users.noreply.github.com> |
||
|
renovate[bot]
|
80a3d4da47 |
chore(deps): update dependency @vitejs/plugin-react to v6.1.0 (#12600)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@vitejs/plugin-react](https://redirect.github.com/vitejs/vite-plugin-react/tree/main/packages/plugin-react#readme) ([source](https://redirect.github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react)) | [`6.0.5` → `6.1.0`](https://renovatebot.com/diffs/npm/@vitejs%2fplugin-react/6.0.5/6.1.0) |  |  | --- ### Release Notes <details> <summary>vitejs/vite-plugin-react (@​vitejs/plugin-react)</summary> ### [`v6.1.0`](https://redirect.github.com/vitejs/vite-plugin-react/blob/HEAD/packages/plugin-react/CHANGELOG.md#610-2026-08-19) [Compare Source](https://redirect.github.com/vitejs/vite-plugin-react/compare/68c0cb8796ce18bd049c3d05c5210eaf0617eac0...39b31735bf79c2dd380eedaba7ed849256f92a29) ##### Add experimental native React Compiler support ([#​1419](https://redirect.github.com/vitejs/vite-plugin-react/pull/1419)) Add experimental native React Compiler support. You can use it by installing `oxc-transform-react` and enabling it via the `compiler` option: ```sh npm install -D oxc-transform-react ``` ```js import { defineConfig } from 'vite' import react from '@vitejs/plugin-react' export default defineConfig({ plugins: [ react({ compiler: true }) ] }) ``` </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Madrid) - Branch creation - "after 7pm every weekday,before 5am every weekday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/Unleash/unleash). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC40OS4wIiwidXBkYXRlZEluVmVyIjoiNDQuNDkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
ca1763351f |
chore(deps): update dependency @unleash/toolbar to v1.2.0 (#12599)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@unleash/toolbar](https://redirect.github.com/Unleash/toolbar) | [`1.1.1` → `1.2.0`](https://renovatebot.com/diffs/npm/@unleash%2ftoolbar/1.1.1/1.2.0) |  |  | --- ### Release Notes <details> <summary>Unleash/toolbar (@​unleash/toolbar)</summary> ### [`v1.2.0`](https://redirect.github.com/Unleash/toolbar/releases/tag/v1.2.0) [Compare Source](https://redirect.github.com/Unleash/toolbar/compare/v1.1.1...v1.2.0) ### What's Changed #### New features - feat: keyboard-first operation and accessibility overhaul by [@​alexcasalboni](https://redirect.github.com/alexcasalboni) in [#​63](https://redirect.github.com/Unleash/toolbar/pull/63) - fix: replace the focus trap with a tether back to the summoning element by [@​thomasheartman](https://redirect.github.com/thomasheartman) in [#​64](https://redirect.github.com/Unleash/toolbar/pull/64) - feat: announce search result counts to assistive tech by [@​thomasheartman](https://redirect.github.com/thomasheartman) in [#​66](https://redirect.github.com/Unleash/toolbar/pull/66) - Chore: move reset buttons to bottom by [@​thomasheartman](https://redirect.github.com/thomasheartman) in [#​67](https://redirect.github.com/Unleash/toolbar/pull/67) #### Dependencies updates - Bump next from 16.2.10 to 16.2.12 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​57](https://redirect.github.com/Unleash/toolbar/pull/57) - Bump next from 16.2.9 to 16.2.11 in /examples/nextjs by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​59](https://redirect.github.com/Unleash/toolbar/pull/59) - Bump brace-expansion and eslint in /examples/nextjs by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​58](https://redirect.github.com/Unleash/toolbar/pull/58) - Bump [@​angular/compiler](https://redirect.github.com/angular/compiler) from 21.2.18 to 21.2.19 in /examples/angular by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​62](https://redirect.github.com/Unleash/toolbar/pull/62) - Bump [@​angular/core](https://redirect.github.com/angular/core) from 21.2.18 to 21.2.19 in /examples/angular by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​61](https://redirect.github.com/Unleash/toolbar/pull/61) - Bump [@​angular/common](https://redirect.github.com/angular/common) from 21.2.18 to 21.2.19 in /examples/angular by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​60](https://redirect.github.com/Unleash/toolbar/pull/60) #### New Contributors - [@​thomasheartman](https://redirect.github.com/thomasheartman) made their first contribution in [#​64](https://redirect.github.com/Unleash/toolbar/pull/64) **Full Changelog**: <https://github.com/Unleash/toolbar/compare/v1.1.1...v1.2.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Madrid) - Branch creation - "after 7pm every weekday,before 5am every weekday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/Unleash/unleash). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC40OS4wIiwidXBkYXRlZEluVmVyIjoiNDQuNDkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
Gastón Fournier
|
7bc1768182 |
fix(tokens-v2): invalidate tokens when environments are deleted
## What - Replaces the V2 token environment foreign key cascade with `ON DELETE NO ACTION`. - Adds a bulk V2-token deletion path that returns the deleted tokens and writes one selector-bearing `api-token-deleted` event per token. - Runs token deletion, token deletion-event persistence, environment deletion, and the environment deletion event in the same database transaction. - Leaves cache mutation to the existing token-revision poller: once the transaction commits, each pod can observe the deletion events and evict the affected selectors. - Refactors the V2 token service factory so environment deletion can construct it with the transaction-scoped database handle. - Keeps deletion atomic: if token-event persistence or a later step fails, the environment and its tokens remain. ## Why Database cascade deletion removes token rows without producing the token-scoped events used by the cache-coherence layer. Pods could therefore continue authenticating cached tokens after an environment was deleted. Making token deletion explicit records the selectors needed by the revision poller while keeping database changes and audit events atomic. `NO ACTION` also makes mixed-version rollout fail safely: an older pod cannot delete an environment through the database cascade without producing V2 token deletion events. |
||
|
Gastón Fournier
|
81088d6cd5 |
feat(tokens-v2): synchronize token caches across pods
## TL;DR
This PR gives the two V2 token-cache implementations separate lifecycle
strategies:
- the **legacy cache keeps its full active-token refresh every minute**;
- the **single-flight cache is warmed at startup with active tokens seen
in the last six hours**, then stays read-through;
- a **10-second token-revision poll** invalidates updated and deleted
selectors in the single-flight cache across pods;
- if token-revision polling fails, authentication continues serving
cached tokens and logs the degraded coherence state.
The startup warm-up is an optimization, not a correctness requirement.
The single-flight cache can always load a token on demand.
### Active does not mean in use
The legacy token service queries and loads every active token on every
pod once per minute. In storage, "active" only means non-expired; it
does not mean the token is receiving traffic. `seenAt` usage suggests
that only a subset of those tokens is typically hot.
That full-table refresh remains the legacy tokens's coherence mechanism,
but it is a poor steady-state fit for the single-flight cache: it
preserves the existing database cost and fills the cache with tokens
that may never be read.
### Read-through with a bounded startup warm-up
When the single-flight cache is active during startup, it queries the
active-token set once and preloads only tokens whose `seenAt` is within
the last six hours. This reduces cold-start queries for recently used
tokens without turning the cache into another periodically rebuilt copy
of the complete active-token table.
After startup, the cache loads a selector when that token is presented
and coalesces concurrent misses for the same selector. Its 10-minute
sliding TTL keeps continuously hot tokens resident, so a token normally
needs one selector query per pod until it is invalidated, evicted,
expires from the cache, or the process restarts.
The cache proxy routes reads and mutations to the implementation
currently selected by `usePromiseTokenCache`. This keeps the migration
decision at the service boundary: `fetchActiveTokens()` acts only on the
legacy implementation, while `initialize()` and revision processing act
only on the read-through implementation.
### Targeted coherence across pods
The preceding transactional-events work makes each token mutation and
its audit event commit or roll back together. This PR uses that
committed token-event revision stream to keep long-lived single-flight
caches coherent across instances.
```mermaid
flowchart LR
TX[Transactional mutation service] -->|token + event in one transaction| DB[(Database)]
DB --> LOG[(Token event revisions)]
LOG -->|poll every 10s| A[Long-lived cache - pod A]
LOG -->|poll every 10s| B[Long-lived cache - pod B]
LOG -->|poll every 10s| C[Sibling service instance]
```
Each long-lived instance polls independently and advances through the
committed revision stream:
- **Create:** advance the revision without changing the cache. A newly
created credential has not previously been used, and speculative
selector misses are not treated as a meaningful coherence case.
- **Update:** invalidate the affected selector so its next use reloads
the current token from storage.
- **Delete:** invalidate the affected selector so it can no longer be
served from memory.
- **Legacy cache:** skip revision processing because its complete
active-token refresh continues to run every minute.
- **Failure behavior**: if revision polling fails, authentication
continues using the cache rather than forcing database lookups. Updated
or deleted cached tokens may remain accepted until polling recovers and
invalidates them. This prioritizes serving up-to-date feature flag
configuration over precise token validation (which is solved by
restarting the server)
The transactional mutation service remains **cache-neutral**. It is
short-lived, so changing its private cache would not update the
long-lived instance serving authentication reads. Its useful output is
the committed event, which every long-lived instance observes through
revision polling.
### Runtime cache selection
`CacheProxy` resolves the active implementation for each operation. Bulk
replacement, targeted invalidation, and normal reads therefore affect
only the cache currently selected by the feature flag.
This lets the two implementations coexist during migration without
requiring the legacy cache to seed or mirror the single-flight cache.
## Reviewer summary
The intended invariants are:
1. **The legacy cache remains a full-table cache refreshed once per
minute.**
2. **The single-flight cache receives a six-hour usage-based startup
warm-up, then grows and refreshes through real token usage.**
3. **Cache operations affect only the implementation currently selected
by the feature flag.**
4. **Revision polling invalidates updated and deleted selectors across
single-flight cache instances and pods.**
5. **Failed revision polling does not bypass the cache; coherence
recovers after the next successful poll.**
Co-authored-by: irstavr
[irini.stavrakantonaki@getunleash.io](mailto:irini.stavrakantonaki@getunleash.io)
Co-authored-by: irstavr [irstavr@gmail.com](mailto:irstavr@gmail.com)
|
||
|
Mateusz Kwasniewski
|
126b71c517 |
feat: show automations in CR release plan from template
This PR adds "Proceed to the next milestone" read only automation/progression when it exists on a template <img width="972" height="609" alt="Screenshot 2026-08-31 at 13 11 35" src="https://github.com/user-attachments/assets/fa936c93-5fa2-4f76-97ed-298612f52cf6" /> --------- Co-authored-by: Kamala Rocci <kamala.rocci@getunleash.io> |
||
|
Fredrik Strand Oseberg
|
0dac202e85 |
feat: further uxtweak survey hardening
Add latching, so that we don't change surveys based on flag order or surveys change for current users if the payload changes. |
||
|
David Leek
|
eb2e914d07 | chore: hide frontend support for semver metadata behind flag | ||
|
Fredrik Strand Oseberg
|
43a9c8bd2a |
feat: 7-day grace period between uxtweak surveys
Concluding any survey (submit or close) writes a self-expiring marker via createLocalStorage's timeToLive; useActiveSurvey shows nothing while it is present. Keeps a visitor matched by several campaigns from getting the next card the moment they finish one. Also removes a leftover debug log. Grace period is currently set to 7 days. --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> |
||
|
Krzysztof (Kris) Kula
|
f153aee009 |
Revert "chore: add back the pixel domain"
Reverts bricks-software/unleash-enterprise#1659 |
||
|
renovate[bot]
|
0f2f128806 |
chore(deps): update dependency @types/pg to v8.23.1 (#12595)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@types/pg](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/pg) ([source](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/pg)) | [`8.20.4` → `8.23.1`](https://renovatebot.com/diffs/npm/@types%2fpg/8.20.4/8.23.1) |  |  | --- ### Configuration 📅 **Schedule**: (in timezone Europe/Madrid) - Branch creation - "after 7pm every weekday,before 5am every weekday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/Unleash/unleash). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC40OS4wIiwidXBkYXRlZEluVmVyIjoiNDQuNDkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
5c6e57b7bf |
chore(deps): update dependency @slack/web-api to v7.19.0 (#12594)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@slack/web-api](https://docs.slack.dev/tools/node-slack-sdk/web-api/) ([source](https://redirect.github.com/slackapi/node-slack-sdk)) | [`7.18.0` → `7.19.0`](https://renovatebot.com/diffs/npm/@slack%2fweb-api/7.18.0/7.19.0) |  |  | --- ### Release Notes <details> <summary>slackapi/node-slack-sdk (@​slack/web-api)</summary> ### [`v7.19.0`](https://redirect.github.com/slackapi/node-slack-sdk/releases/tag/%40slack/web-api%407.19.0) [Compare Source](https://redirect.github.com/slackapi/node-slack-sdk/compare/@slack/web-api@7.18.0...@slack/web-api@7.19.0) ##### Minor Changes - [`a795b86`](https://redirect.github.com/slackapi/node-slack-sdk/commit/a795b86): feat: expand app manifest types — add `agent_view` and `assistant_view` features, recent agent events (`app_context_changed`, `assistant_thread_started`, `assistant_thread_context_changed`), optional OAuth scopes (`bot_optional`/`user_optional`), and event `metadata_subscriptions` </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Madrid) - Branch creation - "after 7pm every weekday,before 5am every weekday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/Unleash/unleash). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC40OS4wIiwidXBkYXRlZEluVmVyIjoiNDQuNDkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
ba7f16c028 |
chore(deps): update dependency fast-uri to v3.1.6 (#12593)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [fast-uri](https://redirect.github.com/fastify/fast-uri) | [`3.1.5` → `3.1.6`](https://renovatebot.com/diffs/npm/fast-uri/3.1.5/3.1.6) |  |  | --- ### Release Notes <details> <summary>fastify/fast-uri (fast-uri)</summary> ### [`v3.1.6`](https://redirect.github.com/fastify/fast-uri/compare/v3.1.5...6f970b2951fd896aa0f3a7ff28eeb6640c137d33) [Compare Source](https://redirect.github.com/fastify/fast-uri/compare/v3.1.5...v3.1.6) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Madrid) - Branch creation - "after 7pm every weekday,before 5am every weekday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/Unleash/unleash). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC40OS4wIiwidXBkYXRlZEluVmVyIjoiNDQuNDkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
f9e058002f |
chore(deps): update dependency @types/react-dom to v19.2.5 (#12592)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@types/react-dom](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/react-dom) ([source](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom)) | [`19.2.4` → `19.2.5`](https://renovatebot.com/diffs/npm/@types%2freact-dom/19.2.4/19.2.5) |  |  | --- ### Configuration 📅 **Schedule**: (in timezone Europe/Madrid) - Branch creation - "after 7pm every weekday,before 5am every weekday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/Unleash/unleash). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC40OS4wIiwidXBkYXRlZEluVmVyIjoiNDQuNDkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
Krzysztof (Kris) Kula
|
ff8a7d2bb1 |
chore: try improving delay before tour is marked as done
Trying to improve time before someone finishes the tour and the onboarding checklist marks it as done. |
||
|
Krzysztof (Kris) Kula
|
b87664ac78 |
fix: onboarding checklist in safari showing corners after drag
Fixing weird corners showing up in Safari after drag. <img width="250" height="174" alt="image" src="https://github.com/user-attachments/assets/d28d92ab-fed7-440e-b65f-b2de0af949c9" /> |
||
|
David Leek
|
d028deb02e |
chore: add semverBuildMetadata flag
This adds the semverBuildMetadata flag to Unleash |
||
|
Anniken Østdahl
|
e9019d7a57 |
Align input fields (#12591)
Feedback from Henning that we should align the input fields in project/flag creation modal with the rest of Unleash to stay consistent Files changed: - frontend/src/component/common/FormField/FormField.tsx 🤖 Drafted from the UX Tweak extension — please review. Co-authored-by: Anniken Østdahl <6595978+nikken@users.noreply.github.com> |
||
|
Gastón Fournier
|
850949655b |
feat(tokens): add flag controlling single-flight caching
## TL;DR This PR supersedes #1643 and incorporates its review feedback by extracting the cache implementations from the authentication services. It allows V1 and V2 token authentication to switch at runtime between the existing cache and `SingleFlightCache` using the disabled-by-default `usePromiseTokenCache` flag. Both implementations now live behind a shared `TokenCacheInterface`, while the authentication services remain responsible for token-specific validation. ## What changed ### Shared cache abstraction This PR introduces: - `TokenCacheInterface`, defining the operations required by token authentication; - `CacheV1`, containing the existing map and negative-throttling behavior; - `CacheV2`, adapting `SingleFlightCache`; - `CacheProxy`, selecting the active implementation from `usePromiseTokenCache` at lookup time. Both the plain-text token service and secure V2 token service now depend on this interface rather than implementing their own cache-selection and negative-cache logic. ### Runtime selection `usePromiseTokenCache` is evaluated by `CacheProxy` whenever the cache is accessed: - **Flag off:** use the existing map-based cache. - **Flag on:** use the bounded single-flight cache, coalescing concurrent database lookups for the same key. The flag remains disabled by default and can be configured with `UNLEASH_EXPERIMENTAL_USE_PROMISE_TOKEN_CACHE`. No restart is required to change the selected implementation. The two implementations intentionally keep independent state. Writes and lookups update only the currently selected cache, so enabling the new implementation begins with a cold cache. This makes its database and cache impact representative of a real rollout instead of hiding it by warming the new implementation through the legacy path. ## Authentication behavior The cache only returns a candidate token. Authentication-specific checks remain in the owning service. ### Plain-text tokens - Tokens are cached by secret. - Deprecated aliases retain a separate cache because aliases cannot be queried through the token store. - Expiry is checked before a cached token is returned. - Alias usage continues to produce the existing migration warning. ### Secure V2 tokens - Cache entries are keyed by selector, not by the complete credential. - The presented secret is verified against the stored verifier on every authentication, including cache hits. - An incorrect secret for an existing selector is an authentication failure; it does not become a separate negative-cache entry. - Expiry is checked both when loading from the database and when returning a cached entry. - Expired database records are not cached. - `seen_at` continues to be updated after successful authentication. ## Cache behavior `CacheV1` preserves the existing map-based positive cache and five-minute negative throttling. `CacheV2` provides: - single-flight database loading for concurrent misses; - a bounded positive cache; - a separately bounded negative cache with progressive retry delays; - a sliding ten-minute TTL; - a short stale-while-error window. Cache lookup metrics are emitted by each implementation, keeping cache-specific instrumentation out of the authentication services. ## Mutation and refresh behavior Token mutation services remain cache-neutral because they may be transaction-scoped and do not necessarily own the long-lived cache used for authentication. Periodic refreshes replace the V1 cache contents with the current active-token set. The V2 cache remains read-through and demand-filled. Cross-instance and cross-pod convergence remain outside this PR and are handled by the revision-driven work in #1644. ## Reviewer guide The review can be split into three layers: 1. `api-token-cache.ts`: common contract, implementation selection, cache semantics, and metrics. 2. `api-token-service.ts`: plain-text token and deprecated-alias behavior. 3. `api-token-v2-service.ts`: selector-based loading, expiry, verifier checks, and `seen_at`. The intended default remains unchanged: with `usePromiseTokenCache` disabled, authentication uses `CacheV1`. |
||
|
Krzysztof (Kris) Kula
|
bccdf46f4d |
chore: bump js-yaml to 4.3.1
4.3.1 was already in the OSS lockfile, but we need to bump it manually in enterprise |
||
|
Ivar Conradi Østhus
|
38c893793d |
chore: remove sessionInspector flag
We decided to keep the session inspector, so this removes the `sessionInspector` flag and makes the feature unconditional. ## Backend (OSS) - Removed the flag from the experimental flag union and its `UNLEASH_EXPERIMENTAL_SESSION_INSPECTOR` default, plus the `server-dev.ts` / `example.ts` configs that enabled it. - `sessionContextMiddleware` no longer takes a flag resolver — it always stamps `ip`/`userAgent` on authenticated sessions. ## Backend (enterprise) - Dropped the request-time 404 gate from `UserSessionsController` (both routes) and the `flagResolver` field. - Removed the flag-disabled e2e app and its "returns 404 when the flag is disabled" test; remaining apps start with default config. ## Frontend - `/admin/sessions` is no longer flag-gated. - `useActiveSessions` only checks for enterprise. - `SecurityBanner` always links to the session inspector (the `/admin/users` variant existed only for the flag-off case). ## Testing - `pnpm run typecheck:source` and frontend `tsc` pass; biome clean on all touched files. - The user-sessions e2e suite was not run locally (needs Postgres) — CI covers it. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01QnCX4pShjSeEVWBXiJisj5 Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|
Krzysztof (Kris) Kula
|
c1b70da2af |
chore: check billing before relaxing CSP
Relax csp rules only for PAYG - this will matter if we need to set portal ID for all production instances |
||
|
renovate[bot]
|
ac44b65ce0 |
chore(deps): update dependency @testing-library/user-event to v14.6.6 (#12590)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@testing-library/user-event](https://redirect.github.com/testing-library/user-event) | [`14.6.5` → `14.6.6`](https://renovatebot.com/diffs/npm/@testing-library%2fuser-event/14.6.5/14.6.6) |  |  | --- ### Release Notes <details> <summary>testing-library/user-event (@​testing-library/user-event)</summary> ### [`v14.6.6`](https://redirect.github.com/testing-library/user-event/releases/tag/v14.6.6) [Compare Source](https://redirect.github.com/testing-library/user-event/compare/v14.6.5...v14.6.6) ##### Bug Fixes - default pointer event pointerType to empty string instead of the string "undefined" ([#​1325](https://redirect.github.com/testing-library/user-event/issues/1325)) ([71a5475](https://redirect.github.com/testing-library/user-event/commit/71a547572e6f7793b925052c71aaabef6a443995)) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Madrid) - Branch creation - "after 7pm every weekday,before 5am every weekday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/Unleash/unleash). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC40OS4wIiwidXBkYXRlZEluVmVyIjoiNDQuNDkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
3ce087b005 |
chore(deps): update dependency @faker-js/faker to v10.6.0 (#12589)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@faker-js/faker](https://fakerjs.dev) ([source](https://redirect.github.com/faker-js/faker)) | [`10.5.0` → `10.6.0`](https://renovatebot.com/diffs/npm/@faker-js%2ffaker/10.5.0/10.6.0) |  |  | --- ### Release Notes <details> <summary>faker-js/faker (@​faker-js/faker)</summary> ### [`v10.6.0`](https://redirect.github.com/faker-js/faker/blob/HEAD/CHANGELOG.md#1060-2026-08-14) [Compare Source](https://redirect.github.com/faker-js/faker/compare/v10.5.0...v10.6.0) ##### New Locales - **locale:** add 060 Japanese mobile phone number formats ([#​3922](https://redirect.github.com/faker-js/faker/issues/3922)) ([afa272d](https://redirect.github.com/faker-js/faker/commit/afa272d468620755cbde4cae9379d342ebbd87d1)) - **locale:** add Norwegian (nb\_NO) animal module ([#​3901](https://redirect.github.com/faker-js/faker/issues/3901)) ([1232937](https://redirect.github.com/faker-js/faker/commit/123293757668b3fb2b944e343ad212f4339828c3)) - **locale:** add Norwegian (nb\_NO) food module ([#​3900](https://redirect.github.com/faker-js/faker/issues/3900)) ([bd23594](https://redirect.github.com/faker-js/faker/commit/bd23594bc6f2958fed29414f575fd5eab0b6ff9a)) - **locale:** add vehicle data for de ([#​3958](https://redirect.github.com/faker-js/faker/issues/3958)) ([974490f](https://redirect.github.com/faker-js/faker/commit/974490f652f6f0dc210ea57071ec755dab66cfe8)) - **locale:** better middle names by gender for en locale ([#​3932](https://redirect.github.com/faker-js/faker/issues/3932)) ([aba3fb1](https://redirect.github.com/faker-js/faker/commit/aba3fb1a2a18ec27c4af3f6f900ffef1bba1c698)) - **locale:** better organize first\_name by gender for en ([#​3924](https://redirect.github.com/faker-js/faker/issues/3924)) ([119386b](https://redirect.github.com/faker-js/faker/commit/119386b419039b1e266a4b0f0c303bffc92788ef)) ##### Features - introduce NumberRange type ([#​3838](https://redirect.github.com/faker-js/faker/issues/3838)) ([acd5fda](https://redirect.github.com/faker-js/faker/commit/acd5fdaf099bda7cf90c76bf0ae0a33349a54ce7)) - **phone:** mobile styles for more locales ([#​3902](https://redirect.github.com/faker-js/faker/issues/3902)) ([1107eab](https://redirect.github.com/faker-js/faker/commit/1107eab7691a73631802dffa6aa023d6212284b7)) ##### Changed Locales - **locale:** add en\_NP and change ne to Devangari ([#​3868](https://redirect.github.com/faker-js/faker/issues/3868)) ([fc788cc](https://redirect.github.com/faker-js/faker/commit/fc788cc0c502743fb2290a62104ad07dcc668beb)) - **locale:** normalize phone\_number data ([#​3518](https://redirect.github.com/faker-js/faker/issues/3518)) ([9a1cb7d](https://redirect.github.com/faker-js/faker/commit/9a1cb7d1d2622d159fe623e3f7cc593a92ef2d55)) ##### Bug Fixes - **apidocs:** scope code group tab identifiers ([#​3976](https://redirect.github.com/faker-js/faker/issues/3976)) ([3125eaf](https://redirect.github.com/faker-js/faker/commit/3125eaf85e8df1bf5ea15bdb73c0ef10bab436dd)) - **color:** give the LCH hue its full 360 degree range ([#​3978](https://redirect.github.com/faker-js/faker/issues/3978)) ([1ce5994](https://redirect.github.com/faker-js/faker/commit/1ce599462b0c04036797594c8c1b6d5bd0c91846)) - **color:** stop scaling the HSLA alpha into a percentage ([#​3979](https://redirect.github.com/faker-js/faker/issues/3979)) ([1143329](https://redirect.github.com/faker-js/faker/commit/11433295b990a8359bd5a36fed3002b33e387a56)) - groupBy handling for prototype property keys ([#​3906](https://redirect.github.com/faker-js/faker/issues/3906)) ([c898ff1](https://redirect.github.com/faker-js/faker/commit/c898ff1f90a8b74b512e8e1fca89ae1e4e738df3)) - **internet:** exclude reserved port 0 from internet.port() ([#​3948](https://redirect.github.com/faker-js/faker/issues/3948)) ([d4b35a4](https://redirect.github.com/faker-js/faker/commit/d4b35a48fa576422497257c01d10274282d82c94)) - **internet:** generate long passwords without stack overflow ([#​3946](https://redirect.github.com/faker-js/faker/issues/3946)) ([4782978](https://redirect.github.com/faker-js/faker/commit/478297849dce372664ceae13fe36c84212d374c6)) - **internet:** validate CIDR prefix length and octet range in ipv4() ([#​3933](https://redirect.github.com/faker-js/faker/issues/3933)) ([15cb8fb](https://redirect.github.com/faker-js/faker/commit/15cb8fbae9e8d5debd35e1fb144691f5517c0807)) - **locale:** exclude forbidden letter combinations from nl postcodes ([#​3888](https://redirect.github.com/faker-js/faker/issues/3888)) ([9bebe67](https://redirect.github.com/faker-js/faker/commit/9bebe676beafefd5191b2aa103401be0ebe94169)) - **locale:** only generate valid French postal codes ([#​3905](https://redirect.github.com/faker-js/faker/issues/3905)) ([711f36f](https://redirect.github.com/faker-js/faker/commit/711f36fa04235513050fdd23a5104aa05ddc47c7)) - **locale:** update nl\_BE phone number patterns ([#​3981](https://redirect.github.com/faker-js/faker/issues/3981)) ([9616076](https://redirect.github.com/faker-js/faker/commit/96160763bafee03177331f84850dc5e18216ffc3)) - **locale:** use only common surnames for zh\_CN last names ([#​3938](https://redirect.github.com/faker-js/faker/issues/3938)) ([58394eb](https://redirect.github.com/faker-js/faker/commit/58394eb2610ae8fe15ab9b1b2a17c108fd8e9749)) - **locale:** use only valid letters in en\_CA postcodes ([#​3951](https://redirect.github.com/faker-js/faker/issues/3951)) ([3b184d6](https://redirect.github.com/faker-js/faker/commit/3b184d6e52a721c227c6e9c58731bdf008f43532)) - **string:** reject refDates that a ULID timestamp cannot encode ([#​3982](https://redirect.github.com/faker-js/faker/issues/3982)) ([81717bc](https://redirect.github.com/faker-js/faker/commit/81717bc633865917e5193b6d00eefea667ecd862)) - **vehicle:** calculate VIN check digit ([#​3954](https://redirect.github.com/faker-js/faker/issues/3954)) ([a4c6757](https://redirect.github.com/faker-js/faker/commit/a4c6757fdf65c6434c862ca4f29639e8b982d7e5)) - **word:** pick nearest length for closest strategy ([#​3943](https://redirect.github.com/faker-js/faker/issues/3943)) ([42fd322](https://redirect.github.com/faker-js/faker/commit/42fd322071afc4f3e9148618127bd18148337ce5)) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Madrid) - Branch creation - "after 7pm every weekday,before 5am every weekday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/Unleash/unleash). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC40OS4wIiwidXBkYXRlZEluVmVyIjoiNDQuNDkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
5b579f42b6 |
chore(deps): update dependency @base-ui/react to v1.7.0 (#12588)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@base-ui/react](https://base-ui.com) ([source](https://redirect.github.com/mui/base-ui/tree/HEAD/packages/react)) | [`1.6.0` → `1.7.0`](https://renovatebot.com/diffs/npm/@base-ui%2freact/1.6.0/1.7.0) |  |  | --- ### Release Notes <details> <summary>mui/base-ui (@​base-ui/react)</summary> ### [`v1.7.0`](https://redirect.github.com/mui/base-ui/blob/HEAD/CHANGELOG.md#v170) [Compare Source](https://redirect.github.com/mui/base-ui/compare/v1.6.0...v1.7.0) *Aug 4, 2026* ##### General changes - Restore visible focus after keyboard close in Safari and Firefox ([#​5093](https://redirect.github.com/mui/base-ui/issues/5093)) by [@​lyzno1](https://redirect.github.com/lyzno1) - Type `render` callback props based on the rendered element ([#​5104](https://redirect.github.com/mui/base-ui/issues/5104)) by [@​atomiks](https://redirect.github.com/atomiks) - Reduce popup bundle size ([#​5233](https://redirect.github.com/mui/base-ui/issues/5233)) by [@​atomiks](https://redirect.github.com/atomiks) - Reduce store bundle size ([#​5250](https://redirect.github.com/mui/base-ui/issues/5250)) by [@​atomiks](https://redirect.github.com/atomiks) - Keep unpositioned popups at the viewport origin ([#​5299](https://redirect.github.com/mui/base-ui/issues/5299)) by [@​flaviendelangle](https://redirect.github.com/flaviendelangle) - Correct layout and passive effect timing ([#​5337](https://redirect.github.com/mui/base-ui/issues/5337)) by [@​atomiks](https://redirect.github.com/atomiks) - Remove redundant lifecycle synchronization ([#​5341](https://redirect.github.com/mui/base-ui/issues/5341)) by [@​atomiks](https://redirect.github.com/atomiks) - Prevent stale cleanup from clearing registered part IDs ([#​5340](https://redirect.github.com/mui/base-ui/issues/5340)) by [@​atomiks](https://redirect.github.com/atomiks) - Complete popup unmounting after a canceled exit transition ([#​5401](https://redirect.github.com/mui/base-ui/issues/5401)) by [@​atomiks](https://redirect.github.com/atomiks) - Fix rendered trigger ID ownership ([#​5110](https://redirect.github.com/mui/base-ui/issues/5110)) by [@​atomiks](https://redirect.github.com/atomiks) - Prevent unwanted flip with capped scrollable content ([#​5120](https://redirect.github.com/mui/base-ui/issues/5120)) by [@​atomiks](https://redirect.github.com/atomiks) - Fix `collisionPadding` off-by-one on the biased side ([#​5143](https://redirect.github.com/mui/base-ui/issues/5143)) by [@​atomiks](https://redirect.github.com/atomiks) - Reduce shared popup bundle size ([#​5192](https://redirect.github.com/mui/base-ui/issues/5192)) by [@​atomiks](https://redirect.github.com/atomiks) - Mount popup subtrees synchronously when opening in React 17 ([#​5309](https://redirect.github.com/mui/base-ui/issues/5309)) by [@​atomiks](https://redirect.github.com/atomiks) - Fix auto-resize origin for left-anchored popups ([#​5370](https://redirect.github.com/mui/base-ui/issues/5370)) by [@​sai6855](https://redirect.github.com/sai6855) - Avoid redundant re-renders during lazy flipping ([#​5372](https://redirect.github.com/mui/base-ui/issues/5372)) by [@​mdm317](https://redirect.github.com/mdm317) - Strip implementation-only types from published `.d.ts` files ([#​5165](https://redirect.github.com/mui/base-ui/issues/5165)) by [@​michaldudak](https://redirect.github.com/michaldudak) - Fix `usePreviousValue` equality comparison ([#​5264](https://redirect.github.com/mui/base-ui/issues/5264)) by [@​lyzno1](https://redirect.github.com/lyzno1) ##### Accordion - Remove the implicit `dir` attribute from `<Accordion.Root>` ([#​5117](https://redirect.github.com/mui/base-ui/issues/5117)) by [@​chuganzy](https://redirect.github.com/chuganzy) ##### Alert Dialog - Prevent `<AlertDialog.Root>` from reopening after remounting with a reused handle ([#​5109](https://redirect.github.com/mui/base-ui/issues/5109)) by [@​michaldudak](https://redirect.github.com/michaldudak) ##### Autocomplete - Respect locale when filtering ([#​5195](https://redirect.github.com/mui/base-ui/issues/5195)) by [@​atomiks](https://redirect.github.com/atomiks) - Add `input-press` to change event details ([#​5356](https://redirect.github.com/mui/base-ui/issues/5356)) by [@​chuganzy](https://redirect.github.com/chuganzy) - Add `cancel-open` to change event details ([#​5376](https://redirect.github.com/mui/base-ui/issues/5376)) by [@​chuganzy](https://redirect.github.com/chuganzy) - Reset list scroll position on filter ([#​5231](https://redirect.github.com/mui/base-ui/issues/5231)) by [@​atomiks](https://redirect.github.com/atomiks) - Remove dead code and deduplicate handlers ([#​5194](https://redirect.github.com/mui/base-ui/issues/5194)) by [@​atomiks](https://redirect.github.com/atomiks) - Fix listbox separator semantics ([#​5399](https://redirect.github.com/mui/base-ui/issues/5399)) by [@​sarthakmalik0810](https://redirect.github.com/sarthakmalik0810) ##### Avatar - Show `<Avatar.Fallback>` immediately when `delay={0}` ([#​5147](https://redirect.github.com/mui/base-ui/issues/5147)) by [@​chuganzy](https://redirect.github.com/chuganzy) ##### Button - Fix keyboard click handling for custom elements ([#​4838](https://redirect.github.com/mui/base-ui/issues/4838)) by [@​atomiks](https://redirect.github.com/atomiks) ##### Checkbox - Remove redundant validation input ref ([#​5188](https://redirect.github.com/mui/base-ui/issues/5188)) by [@​nami8824](https://redirect.github.com/nami8824) - Stop internal input clicks from reaching ancestors ([#​5176](https://redirect.github.com/mui/base-ui/issues/5176)) by [@​atomiks](https://redirect.github.com/atomiks) - Reduce bundle size ([#​5223](https://redirect.github.com/mui/base-ui/issues/5223)) by [@​atomiks](https://redirect.github.com/atomiks) ##### Checkbox Group - Focus invalid checkbox ([#​5216](https://redirect.github.com/mui/base-ui/issues/5216)) by [@​atomiks](https://redirect.github.com/atomiks) - Align form values with native submission ([#​5218](https://redirect.github.com/mui/base-ui/issues/5218)) by [@​atomiks](https://redirect.github.com/atomiks) - Reduce bundle size ([#​5223](https://redirect.github.com/mui/base-ui/issues/5223)) by [@​atomiks](https://redirect.github.com/atomiks) ##### Combobox - Add `input-press` to change event details ([#​5356](https://redirect.github.com/mui/base-ui/issues/5356)) by [@​chuganzy](https://redirect.github.com/chuganzy) - Add `cancel-open` to change event details ([#​5376](https://redirect.github.com/mui/base-ui/issues/5376)) by [@​chuganzy](https://redirect.github.com/chuganzy) - Stop filtering grouped items after limit ([#​5086](https://redirect.github.com/mui/base-ui/issues/5086)) by [@​lyzno1](https://redirect.github.com/lyzno1) - Remove leaky value registry ([#​5198](https://redirect.github.com/mui/base-ui/issues/5198)) by [@​atomiks](https://redirect.github.com/atomiks) - Set initial highlight in inline combobox ([#​5230](https://redirect.github.com/mui/base-ui/issues/5230)) by [@​atomiks](https://redirect.github.com/atomiks) - Return highlight to selected item on query clear ([#​5232](https://redirect.github.com/mui/base-ui/issues/5232)) by [@​atomiks](https://redirect.github.com/atomiks) - Expose `expanded` state for inline comboboxes ([#​5332](https://redirect.github.com/mui/base-ui/issues/5332)) by [@​sarthakmalik0810](https://redirect.github.com/sarthakmalik0810) - Keep portalled popup content open ([#​5334](https://redirect.github.com/mui/base-ui/issues/5334)) by [@​obeattie](https://redirect.github.com/obeattie) - Reset list scroll position on filter ([#​5231](https://redirect.github.com/mui/base-ui/issues/5231)) by [@​atomiks](https://redirect.github.com/atomiks) - Fix hovered item stealing highlight when the list scrolls in Safari ([#​5265](https://redirect.github.com/mui/base-ui/issues/5265)) by [@​arikchakma](https://redirect.github.com/arikchakma) - Inherit the disabled state from `<Combobox.Root>` in `<Combobox.Item>` ([#​5365](https://redirect.github.com/mui/base-ui/issues/5365)) by [@​chuganzy](https://redirect.github.com/chuganzy) - Widen trigger slip-out release tolerance ([#​5159](https://redirect.github.com/mui/base-ui/issues/5159)) by [@​atomiks](https://redirect.github.com/atomiks) - Remove dead code and deduplicate handlers ([#​5194](https://redirect.github.com/mui/base-ui/issues/5194)) by [@​atomiks](https://redirect.github.com/atomiks) - Fix listbox separator semantics ([#​5399](https://redirect.github.com/mui/base-ui/issues/5399)) by [@​sarthakmalik0810](https://redirect.github.com/sarthakmalik0810) ##### Composite - Fix nested list reorder detection ([#​5156](https://redirect.github.com/mui/base-ui/issues/5156)) by [@​jjenzz](https://redirect.github.com/jjenzz) - Always skip natively disabled items during list navigation ([#​5185](https://redirect.github.com/mui/base-ui/issues/5185)) by [@​atomiks](https://redirect.github.com/atomiks) - Fix scroll alignment for RTL direction in `scrollIntoViewIfNeeded` ([#​5234](https://redirect.github.com/mui/base-ui/issues/5234)) by [@​sai6855](https://redirect.github.com/sai6855) - Simplify keyboard bookkeeping ([#​5249](https://redirect.github.com/mui/base-ui/issues/5249)) by [@​atomiks](https://redirect.github.com/atomiks) ##### Dialog - Fix touch outside-press dismissal without a backdrop ([#​5096](https://redirect.github.com/mui/base-ui/issues/5096)) by [@​atomiks](https://redirect.github.com/atomiks) - Prevent `<Dialog.Root>` from reopening after remounting with a reused handle ([#​5109](https://redirect.github.com/mui/base-ui/issues/5109)) by [@​michaldudak](https://redirect.github.com/michaldudak) - Fix scroll lock handoff with external overlays ([#​4665](https://redirect.github.com/mui/base-ui/issues/4665)) by [@​atomiks](https://redirect.github.com/atomiks) - Reduce bundle size ([#​5193](https://redirect.github.com/mui/base-ui/issues/5193)) by [@​atomiks](https://redirect.github.com/atomiks) ##### Drawer - Prevent `<Drawer.Root>` from reopening after remounting with a reused handle ([#​5109](https://redirect.github.com/mui/base-ui/issues/5109)) by [@​michaldudak](https://redirect.github.com/michaldudak) - Fix unreliable swipe-to-open gestures ([#​5105](https://redirect.github.com/mui/base-ui/issues/5105)) by [@​atomiks](https://redirect.github.com/atomiks) - Fix popup flashing fully open for a frame on swipe area re-grab ([#​5112](https://redirect.github.com/mui/base-ui/issues/5112)) by [@​atomiks](https://redirect.github.com/atomiks) - Deduplicate swipe math to reduce bundle size ([#​5181](https://redirect.github.com/mui/base-ui/issues/5181)) by [@​atomiks](https://redirect.github.com/atomiks) - Fix scroll handling when focus moves while the virtual keyboard is open ([#​5179](https://redirect.github.com/mui/base-ui/issues/5179)) by [@​atomiks](https://redirect.github.com/atomiks) - Fix cross-axis scroll blocked on iOS below the touchmove slop ([#​5257](https://redirect.github.com/mui/base-ui/issues/5257)) by [@​atomiks](https://redirect.github.com/atomiks) - Fix snap point jump when pinned pointer moves leave the drag offset unchanged ([#​5308](https://redirect.github.com/mui/base-ui/issues/5308)) by [@​atomiks](https://redirect.github.com/atomiks) - Fix Shadow DOM swipe gestures ([#​5360](https://redirect.github.com/mui/base-ui/issues/5360)) by [@​atomiks](https://redirect.github.com/atomiks) ##### Field - Keep invalid state on disabled fields ([#​5116](https://redirect.github.com/mui/base-ui/issues/5116)) by [@​atomiks](https://redirect.github.com/atomiks) - Reduce bundle size ([#​5225](https://redirect.github.com/mui/base-ui/issues/5225)) by [@​atomiks](https://redirect.github.com/atomiks) - Fix `data-dirty` tracking for null-valued controls ([#​5290](https://redirect.github.com/mui/base-ui/issues/5290)) by [@​sai6855](https://redirect.github.com/sai6855) ##### Fieldset - Reduce bundle size ([#​5225](https://redirect.github.com/mui/base-ui/issues/5225)) by [@​atomiks](https://redirect.github.com/atomiks) ##### Form - Reduce bundle size ([#​5225](https://redirect.github.com/mui/base-ui/issues/5225)) by [@​atomiks](https://redirect.github.com/atomiks) - Focus the first invalid field in document order ([#​5287](https://redirect.github.com/mui/base-ui/issues/5287)) by [@​atomiks](https://redirect.github.com/atomiks) ##### Menu - Ignore pinch-zoom shifting ([#​4485](https://redirect.github.com/mui/base-ui/issues/4485)) by [@​atomiks](https://redirect.github.com/atomiks) - Cancel stale submenu hover-open when Chrome drops mouseleave ([#​5153](https://redirect.github.com/mui/base-ui/issues/5153)) by [@​atomiks](https://redirect.github.com/atomiks) - Fix exit animation not running on uncheck of item ([#​5252](https://redirect.github.com/mui/base-ui/issues/5252)) by [@​sai6855](https://redirect.github.com/sai6855) - Fix duplicate `onOpenChange` calls when closing a submenu ([#​5178](https://redirect.github.com/mui/base-ui/issues/5178)) by [@​atomiks](https://redirect.github.com/atomiks) - Fix VoiceOver announcement when opening a submenu ([#​5342](https://redirect.github.com/mui/base-ui/issues/5342)) by [@​atomiks](https://redirect.github.com/atomiks) - Propagate disabled state to items ([#​5363](https://redirect.github.com/mui/base-ui/issues/5363)) by [@​chuganzy](https://redirect.github.com/chuganzy) - Open submenus on Android TalkBack press ([#​5384](https://redirect.github.com/mui/base-ui/issues/5384)) by [@​atomiks](https://redirect.github.com/atomiks) - Prevent `<Menu.Root>` from reopening after remounting with a reused handle ([#​5149](https://redirect.github.com/mui/base-ui/issues/5149)) by [@​michaldudak](https://redirect.github.com/michaldudak) - Widen trigger slip-out release tolerance ([#​5159](https://redirect.github.com/mui/base-ui/issues/5159)) by [@​atomiks](https://redirect.github.com/atomiks) ##### Meter - Format clamped values ([#​5409](https://redirect.github.com/mui/base-ui/issues/5409)) by [@​atomiks](https://redirect.github.com/atomiks) - Reduce bundle size ([#​5224](https://redirect.github.com/mui/base-ui/issues/5224)) by [@​atomiks](https://redirect.github.com/atomiks) ##### Navigation Menu - Fix frozen menu when the open trigger unmounts ([#​5240](https://redirect.github.com/mui/base-ui/issues/5240)) by [@​DreierF](https://redirect.github.com/DreierF) - Ignore pinch-zoom shifting ([#​4485](https://redirect.github.com/mui/base-ui/issues/4485)) by [@​atomiks](https://redirect.github.com/atomiks) ##### Number Field - Fix keyboard editing with multi-character format symbols ([#​5111](https://redirect.github.com/mui/base-ui/issues/5111)) by [@​atomiks](https://redirect.github.com/atomiks) - Reduce bundle size ([#​5220](https://redirect.github.com/mui/base-ui/issues/5220)) by [@​atomiks](https://redirect.github.com/atomiks) ##### OTP Field - Keep focus on the invalid field when `autoSubmit` is blocked ([#​5089](https://redirect.github.com/mui/base-ui/issues/5089)) by [@​lyzno1](https://redirect.github.com/lyzno1) ##### Popover - Prevent `<Popover.Root>` from reopening after remounting with a reused handle ([#​5149](https://redirect.github.com/mui/base-ui/issues/5149)) by [@​michaldudak](https://redirect.github.com/michaldudak) - Reduce bundle size ([#​5193](https://redirect.github.com/mui/base-ui/issues/5193)) by [@​atomiks](https://redirect.github.com/atomiks) ##### Preview Card - Prevent `<PreviewCard.Root>` from reopening after remounting with a reused handle ([#​5149](https://redirect.github.com/mui/base-ui/issues/5149)) by [@​michaldudak](https://redirect.github.com/michaldudak) ##### Progress - Fix custom `min`/`max` semantics to match the indicator ([#​5095](https://redirect.github.com/mui/base-ui/issues/5095)) by [@​atomiks](https://redirect.github.com/atomiks) - Reduce bundle size ([#​5224](https://redirect.github.com/mui/base-ui/issues/5224)) by [@​atomiks](https://redirect.github.com/atomiks) ##### Radio Group - Remove unnecessary ARIA attributes from `<Radio.Root>` ([#​5213](https://redirect.github.com/mui/base-ui/issues/5213)) by [@​sai6855](https://redirect.github.com/sai6855) - Stop internal input clicks from reaching ancestors ([#​5176](https://redirect.github.com/mui/base-ui/issues/5176)) by [@​atomiks](https://redirect.github.com/atomiks) - Align form values with native submission ([#​5238](https://redirect.github.com/mui/base-ui/issues/5238)) by [@​atomiks](https://redirect.github.com/atomiks) - Reduce bundle size ([#​5223](https://redirect.github.com/mui/base-ui/issues/5223)) by [@​atomiks](https://redirect.github.com/atomiks) ##### Scroll Area - Fix thumb-drag divide-by-zero and per-scroll re-render ([#​5099](https://redirect.github.com/mui/base-ui/issues/5099)) by [@​atomiks](https://redirect.github.com/atomiks) - Fix scrollbar visibility during touch scrolling on iOS ([#​5157](https://redirect.github.com/mui/base-ui/issues/5157)) by [@​atomiks](https://redirect.github.com/atomiks) - Add WebKit overscroll feedback to `<ScrollArea.Thumb>` ([#​5145](https://redirect.github.com/mui/base-ui/issues/5145)) by [@​atomiks](https://redirect.github.com/atomiks) - Reduce bundle size ([#​5217](https://redirect.github.com/mui/base-ui/issues/5217)) by [@​atomiks](https://redirect.github.com/atomiks) - Prevent scroll snapping while dragging the thumb ([#​5259](https://redirect.github.com/mui/base-ui/issues/5259)) by [@​atomiks](https://redirect.github.com/atomiks) - End thumb drag when the primary button is no longer held ([#​5374](https://redirect.github.com/mui/base-ui/issues/5374)) by [@​atomiks](https://redirect.github.com/atomiks) ##### Select - Fix hovered item stealing highlight when the list scrolls in Safari ([#​5265](https://redirect.github.com/mui/base-ui/issues/5265)) by [@​arikchakma](https://redirect.github.com/arikchakma) - Inherit the disabled state from `<Select.Root>` in `<Select.Item>` ([#​5365](https://redirect.github.com/mui/base-ui/issues/5365)) by [@​chuganzy](https://redirect.github.com/chuganzy) - Widen trigger slip-out release tolerance ([#​5159](https://redirect.github.com/mui/base-ui/issues/5159)) by [@​atomiks](https://redirect.github.com/atomiks) - Do not force-mount the popup on programmatic value changes ([#​5119](https://redirect.github.com/mui/base-ui/issues/5119)) by [@​atomiks](https://redirect.github.com/atomiks) - Remove dead code and deduplicate handlers ([#​5194](https://redirect.github.com/mui/base-ui/issues/5194)) by [@​atomiks](https://redirect.github.com/atomiks) - Fix listbox separator semantics ([#​5399](https://redirect.github.com/mui/base-ui/issues/5399)) by [@​sarthakmalik0810](https://redirect.github.com/sarthakmalik0810) ##### Slider - Fix assorted issues ([#​5097](https://redirect.github.com/mui/base-ui/issues/5097)) by [@​atomiks](https://redirect.github.com/atomiks) - Reduce bundle size ([#​5222](https://redirect.github.com/mui/base-ui/issues/5222)) by [@​atomiks](https://redirect.github.com/atomiks) - Exclude the prehydration script from client bundles ([#​5003](https://redirect.github.com/mui/base-ui/issues/5003)) by [@​michaldudak](https://redirect.github.com/michaldudak) ##### Switch - Stop internal input clicks from reaching ancestors ([#​5176](https://redirect.github.com/mui/base-ui/issues/5176)) by [@​atomiks](https://redirect.github.com/atomiks) - Reduce bundle size ([#​5223](https://redirect.github.com/mui/base-ui/issues/5223)) by [@​atomiks](https://redirect.github.com/atomiks) ##### Tabs - Position pre-hydration indicator inside streamed Suspense ([#​5171](https://redirect.github.com/mui/base-ui/issues/5171)) by [@​brijeshb42](https://redirect.github.com/brijeshb42) - Exclude the prehydration script from client bundles ([#​5003](https://redirect.github.com/mui/base-ui/issues/5003)) by [@​michaldudak](https://redirect.github.com/michaldudak) - Reduce bundle size ([#​5221](https://redirect.github.com/mui/base-ui/issues/5221)) by [@​atomiks](https://redirect.github.com/atomiks) ##### Toast - Fix remaining toast timer calculation ([#​5261](https://redirect.github.com/mui/base-ui/issues/5261)) by [@​sai6855](https://redirect.github.com/sai6855) - Reduce bundle size ([#​5219](https://redirect.github.com/mui/base-ui/issues/5219)) by [@​atomiks](https://redirect.github.com/atomiks) - Render content passed through the `render` prop in `<Toast.Title>`, `<Toast.Description>`, and `<Toast.Action>` ([#​5210](https://redirect.github.com/mui/base-ui/issues/5210)) by [@​m2na7](https://redirect.github.com/m2na7) - Fix re-adding a closing toast ([#​5258](https://redirect.github.com/mui/base-ui/issues/5258)) by [@​atomiks](https://redirect.github.com/atomiks) - Fix swipe direction locking for two-axis swipes ([#​5295](https://redirect.github.com/mui/base-ui/issues/5295)) by [@​sai6855](https://redirect.github.com/sai6855) - Fix `<Toast.Provider>` prop effect ordering ([#​5338](https://redirect.github.com/mui/base-ui/issues/5338)) by [@​atomiks](https://redirect.github.com/atomiks) ##### Toggle Group - Reduce bundle size ([#​5224](https://redirect.github.com/mui/base-ui/issues/5224)) by [@​atomiks](https://redirect.github.com/atomiks) ##### Toolbar - Reduce bundle size ([#​5221](https://redirect.github.com/mui/base-ui/issues/5221)) by [@​atomiks](https://redirect.github.com/atomiks) ##### Tooltip - Prevent `<Tooltip.Root>` from reopening after remounting with a reused handle ([#​5149](https://redirect.github.com/mui/base-ui/issues/5149)) by [@​michaldudak](https://redirect.github.com/michaldudak) All contributors of this release in alphabetical order: [@​arikchakma](https://redirect.github.com/arikchakma), [@​atomiks](https://redirect.github.com/atomiks), [@​bernardobelchior](https://redirect.github.com/bernardobelchior), [@​brijeshb42](https://redirect.github.com/brijeshb42), [@​chuganzy](https://redirect.github.com/chuganzy), [@​DiegoAndai](https://redirect.github.com/DiegoAndai), [@​DreierF](https://redirect.github.com/DreierF), [@​flaviendelangle](https://redirect.github.com/flaviendelangle), [@​jjenzz](https://redirect.github.com/jjenzz), [@​lyzno1](https://redirect.github.com/lyzno1), [@​m2na7](https://redirect.github.com/m2na7), [@​mdm317](https://redirect.github.com/mdm317), [@​michaldudak](https://redirect.github.com/michaldudak), [@​nami8824](https://redirect.github.com/nami8824), [@​obeattie](https://redirect.github.com/obeattie), [@​sai6855](https://redirect.github.com/sai6855), [@​sarthakmalik0810](https://redirect.github.com/sarthakmalik0810) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Madrid) - Branch creation - "after 7pm every weekday,before 5am every weekday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/Unleash/unleash). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC40OS4wIiwidXBkYXRlZEluVmVyIjoiNDQuNDkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |