The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Apr 27, 2026 7:18pm

PR Summary

High Risk
High risk because it modifies security/authorization paths (multipart uploads and multiple copilot tools) and changes retention-job deletion logic that can affect large-scale data cleanup if misconfigured.

Overview
Security hardening: Multipart upload follow-up calls (get-part-urls, complete, abort) are now bound to a signed uploadToken (new upload-token.ts) and initiate requires workspaceId, validates allowed contexts, and enforces workspace write/admin permissions to prevent IDOR.

Copilot/tool access fixes: Adds stricter workspace scoping and write checks across copilot tools (credential manage, restore resource, job logs, knowledge base ops, table ops, workflow folder mutations) to avoid cross-workspace access.

Retention + executor improvements: Cleanup jobs now use new chunked SELECT/DELETE utilities (selectRowsByIdChunks, chunkedBatchDelete) to avoid large IN (...) timeouts and to align external side effects (S3/chat cleanup) with the exact rows deleted. Streaming execution handling is reworked to avoid TransformStream memory issues on Bun by assembling full content after drain and exposing an onFullContent hook for memory persistence.

Slack canvases: Adds new Slack canvas operations (get_canvas, list_canvases, lookup_canvas_sections, delete_canvas), updates OAuth scopes/descriptions, extends block UI params/outputs, and registers new tools in the registry.

^{Reviewed by Cursor Bugbot for commit 65e17de. Configure here.}

Greptile Summary

This release patches several IDOR vulnerabilities in the copilot tools and multipart upload API, refactors cleanup jobs to chunk large workspace ID lists (avoiding Postgres statement timeouts), replaces stream.tee() with a manual ReadableStream consumer to fix a Bun memory leak, and adds four new Slack canvas operations (get_canvas, list_canvases, lookup_canvas_sections, delete_canvas). The security fixes are comprehensive and well-structured. One minor wiring gap was found in the new Slack block: the channel filter for list_canvases is defined in the tool but never populated from the block, making it inaccessible despite PR #4307 intending to expose it.

Confidence Score: 4/5

Safe to merge; security fixes are well-implemented and the one functional gap (list_canvases channel filter) is non-critical.

All findings are P2; security patches are thorough with no observed regressions. The only issue is the missing channel wiring for list_canvases, which is a feature gap not a breakage.

apps/sim/blocks/blocks/slack.ts — list_canvases case is missing the channel parameter wiring.

Important Files Changed

Sequence Diagram

sequenceDiagram
    participant Client
    participant MultipartAPI as /api/files/multipart
    participant TokenModule as upload-token.ts
    participant Storage as S3/Blob

    Client->>MultipartAPI: POST ?action=initiate {fileName, workspaceId, context}
    MultipartAPI->>MultipartAPI: getUserEntityPermissions(userId, workspace)
    MultipartAPI->>Storage: initiateMultipartUpload()
    Storage-->>MultipartAPI: {uploadId, key}
    MultipartAPI->>TokenModule: signUploadToken({uploadId, key, userId, workspaceId, context})
    TokenModule-->>MultipartAPI: uploadToken (HMAC-signed)
    MultipartAPI-->>Client: {uploadId, key, uploadToken}

    Client->>MultipartAPI: POST ?action=get-part-urls {uploadToken, partNumbers}
    MultipartAPI->>TokenModule: verifyUploadToken(uploadToken)
    TokenModule-->>MultipartAPI: payload (userId, key, uploadId, context)
    MultipartAPI->>MultipartAPI: assert payload.userId === session.userId
    MultipartAPI->>Storage: getPartUrls(key, uploadId, partNumbers)
    Storage-->>MultipartAPI: presignedUrls
    MultipartAPI-->>Client: {presignedUrls}

    Client->>Storage: PUT parts directly via presigned URLs

    Client->>MultipartAPI: POST ?action=complete {uploadToken, parts}
    MultipartAPI->>TokenModule: verifyUploadToken(uploadToken)
    MultipartAPI->>Storage: completeMultipartUpload(key, uploadId, parts)
    Storage-->>MultipartAPI: {location, path, key}
    MultipartAPI-->>Client: {success, location, path, key}

_{Reviews (1): Last reviewed commit: "fix(retention-job): add chunking strateg..." | Re-trigger Greptile}