Skip to content

v1.1.0-alpha.3

Pre-release
Pre-release

Choose a tag to compare

View all tags
@Jaggob Jaggob released this 09 Jun 09:25
· 207 commits to main since this release
v1.1.0-alpha.3
40df27f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Third public-review release. Builds on v1.1.0-alpha.2 with security hardening, a browser end-to-end test suite, and a deep static-analysis / tech-debt pass. No user-facing feature changes since alpha.2.

  • Security hardening
    • Etherpad API key stored as sensitive app config (masked in occ/diagnostics instead of clear text).
    • External-pad framing now requires an explicit trusted-origin allowlist (no implicit CSP frame-src).
    • Snapshot HTML sanitised client-side with DOMPurify before rendering.
  • Internal changes — Etherpad HTTP via Nextcloud's IClientService; shared pad-sync frontend module; MIME registration removed from the per-request Application constructor; legacy RetryPendingDeleteJob shim retired in favour of the tiered Hot/Warm/Cold jobs; dead-code removal.
  • Tests & tooling — Playwright end-to-end suite (23 browser tests against live Nextcloud + Etherpad); Psalm static analysis enabled in CI with the baseline burned down to zero real type issues plus findUnusedCode; CI guards for stale js/ assets and version metadata consistency.

See CHANGELOG.md for the complete list of changes.

Not for production yet. This is a pre-release for testing and review.

Assets 3
Loading