Repository navigation
[stable-0.1] Backport fixes and dependency updates - #393
Merged
Merged
Conversation
The custom renderBuiltUrl emitted a bare OC.filePath(), which a minified top-level function named OC can shadow. With the viewer library bundled, lazy chunks then fail to load wherever this app's copy of the viewer is the one mounted, e.g. on Nextcloud 32. @nextcloud/vite-config already emits window.OC.filePath() itself. Assisted-by: Claude Code:claude-opus-5-5 Signed-off-by: Andy Scherzinger <info@andy-scherzinger.de> (cherry picked from commit 2ed84e2) Signed-off-by: Andy Scherzinger <info@andy-scherzinger.de>
The toast was handed the Error object, which made it throw and hid the actual error. Assisted-by: Claude Code:claude-opus-5-5 Signed-off-by: Andy Scherzinger <info@andy-scherzinger.de> (cherry picked from commit ef8dc65) Signed-off-by: Andy Scherzinger <info@andy-scherzinger.de>
Signed-off-by: Nextcloud bot <bot@nextcloud.com> (cherry picked from commit 2bada0d) Signed-off-by: Andy Scherzinger <info@andy-scherzinger.de>
vite-plugin-static-copy only copied src/viewer.js to js/viewer.js, and pulled in chokidar 3 with braces, which GHSA-vfj7-8cjw-p6xm affects in every version. A small inline plugin emits the file instead and watches it in watch mode. Assisted-by: Claude Code:claude-opus-5-5 (cherry picked from commit 4ab6970) Signed-off-by: Andy Scherzinger <info@andy-scherzinger.de>
The hoisted vue and @vue/server-renderer stayed at 3.5.33, which GHSA-g2v6-rqmx-r4w6 affects (fixed in 3.5.42), because they require each other at the exact same version and npm audit fix cannot move the pair. Re-resolve them and dedupe, as #387 did on main. The vue peer dependency stays, as this branch still renders the viewer component. Assisted-by: Claude Code:claude-opus-5-5 Signed-off-by: Andy Scherzinger <info@andy-scherzinger.de>
The viewer and public share entries import mindmap.js, which was still built as the entry files_mindmap-mindmap.mjs, whose name never changes. The server lets browsers cache it for six months and the import carries no version, so after an update browsers could keep running the old file next to the new entries. Nothing loads it as an entry, so build it as a normal chunk, whose name carries a content hash. Same fix as #392 on main. Assisted-by: Claude Code:claude-opus-5-5 Signed-off-by: Andy Scherzinger <info@andy-scherzinger.de>
This was referenced Oct 19, 2026
1 task done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backports to
stable-0.1, the maintenance branch for Nextcloud 32–35.stable-0.1starts at6e6d991, the lastmaincommit before the viewer library migration (#375): v0.1.3 plus dependency, CI and translation updates.Picked from
main:2ed84e2fix(build): resolve chunk URLs through window.OC (from fix(viewer): migrate to @nextcloud/viewer for Nextcloud 36 #375). The customrenderBuiltUrlemitted a bareOC.filePath(), which a minified top-levelfunction OCin a bundle can shadow.ef8dc65fix(viewer): show the message when opening a mind map fails (from fix(viewer): migrate to @nextcloud/viewer for Nextcloud 36 #375). The toast was handed theErrorobject and threw.4ab6970build: drop vite-plugin-static-copy (build: drop vite-plugin-static-copy #388). Clears the high-severitybraceschain. The lockfile was regenerated instead of cherry-picked.2bada0dfix(l10n): translations from Transifex.mindmap.jsstatically from the fixed-namefiles_mindmap-mindmap.mjs, which browsers may cache for six months.vueand@vue/server-rendererto 3.5.44, the equivalent of fix(deps): lift vue to 3.5.44 and drop unused Vue dependencies #387. Thevuepeer dependency and@vue/test-utilsstay, because this branch still renders the Vue viewer component.Not picked:
@nextcloud/viewer, the custom element, the init script split, the viewer bumps, the dark theme, the editor startup fix andmax-version36. Also its refactors that only make sense with it: removingpublic.jsand the stylesheet, and theOCP\Serverchange in the template, which is only needed on 36.main.npm auditgoes from 17 vulnerabilities (5 high) to 12 (6 low, 6 moderate). Vitest (93 tests), lint and the build pass. The version stays at 0.1.3, so the next 0.1.x release needs its own bump.🤖 AI (if applicable)