Repository navigation
chore(upstream): sync triaged upstream PRs, #117 fix and dependency updates - #7
Closed
juancarlosm wants to merge 17 commits into
Closed
juancarlosm wants to merge 17 commits into
juancarlosm wants to merge 17 commits into
Conversation
Browser sessions were fixed at 12 hours. Operators who put the app behind an identity provider with a longer session (Cloudflare Access, AuthKit) had people clicking "Sign in" twice a day for no security gain. Add sessionLifetimeHours to the shared cloud deployment input and ARTIFACT_SERVER_SESSION_LIFETIME_HOURS to the runtime environment. It takes an integer from 1 through 720 and defaults to 12, so existing installations keep their behavior. The Cloudflare, AWS, GCP, Helm and Compose packages pass it through; the session cookie expiry follows it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
AWS replaced global-bundle.pem on 2026-09-29, so every OCI image build failed with a digest mismatch.
AWS replaced global-bundle.pem once more on 2026-10-14, so the checksum pinned on 2026-10-09 fails the OCI image build with a digest mismatch. The new bundle holds 114 certificates, all Amazon RDS root CAs.
Discovery validation normalized the issuer by stripping trailing slashes, then passed that value to jwtVerify, which compares `iss` exactly. An issuer such as Authentik, which publishes and signs `https://idp.example/application/o/app/`, failed every browser login with IDENTITY_PROVIDER_FAILURE and every MCP access token with 401. Token checks now use the issuer exactly as discovery publishes it, as OIDC Core 3.1.3.7 requires. The provider name stays normalized, so existing member bindings keep matching. The advertised authorization server metadata now carries the published issuer too. Fixes plannotator#117. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Renumber the grant migration after the fork's review-mode migration, which already holds slot 12 on Postgres (0012_artifact_review_mode), SQLite 13 and D1 10. The upload grant takes Postgres 0013, SQLite 14 and D1 11; downgrade tests start from the revision just below it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Keep the fork's review-mode initialization beside the Markdown source view, and route the Markdown preview's mode toggle through changeHtmlAnnotateMode so manual choices survive refreshes. MDV-001-F failed two runs in three on the unmodified PR: Review can request the preview lease more than once while loading, so failing only the first request sometimes let a later one succeed. The test now fails every lease until the reviewer retries. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Take the newest version each open plannotator/artifact-server dependabot PR proposes (plannotator#97-plannotator#122), with grouped plannotator#120 superseding the single-package bumps it overlaps, and the four GitHub Actions pins. Held at current versions until ackstorm/artifact-server#6: - effect and @effect/* stay on 4.0.0-rc.115; 4.0.5 removes APIs in use. - oxlint stays on 1.78.0; 1.88.0 adds rules that fail 132 call sites. - alchemy stays on beta.79; beta.81 requires effect 4.0 stable. - @cloudflare/nimbus-docs stays on 0.11.0; 0.18.1 needs an interactive migration before the site builds. - @plannotator/ui stays on 0.31.0; 0.53.0 breaks fragment-link scrolling in the Review sandbox (MDV-001-B, CMT-022-B, CMT-022-F). Undici moves from 7.29.0 to 7.29.1 and 7.30.1. The macOS socket patch still applies unchanged, so it is carried to both versions. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The dependency update rewrote the typebox peer range along with the devDependency pin. Peers stay a compatibility range. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…-mode upgrade The review-mode upgrade test deleted only migration row 12, leaving the upload grant at 13 and a gapped, divergent history that also broke every later test sharing the database. Roll back to schema 11 so 12 and 13 re-apply in order. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Author
|
Moved to ackstorm/artifact-server#12: this fork cannot run GitHub Actions, so the maintained line now lives in a non-fork repository. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This brings the upstream plannotator/artifact-server pull requests chosen in triage into the fork, adds our own fix for upstream issue plannotator#117, and applies the open dependabot updates.
Changes
90a6f1a7…).0013_staged_upload_grant, SQLite 14, D1 11. Review mode stays at Postgres 12, SQLite 13, D1 10, which is what's already deployed.Not taken: plannotator#94 (superseded by plannotator#93), plannotator#82 (superseded by our review-mode defaults), plannotator#114 (the content domain must stay a separate site), plannotator#86 (deferred), plannotator#68 (not applicable). plannotator#88, plannotator#95 and plannotator#111 are tracked as ackstorm/artifact-server#6, ackstorm/artifact-server#9 and ackstorm/artifact-server#8.
Held at current versions (plannotator#6)
effectand@effect/*stay on4.0.0-rc.115;4.0.5removes APIs in use.oxlintstays on1.78.0;1.88.0adds rules that fail 132 call sites.alchemystays on beta.79; beta.81 needs effect 4.0 stable.@cloudflare/nimbus-docsstays on0.11.0;0.18.1needs an interactive migration before the site builds.@plannotator/uistays on0.31.0;0.53.0breaks fragment-link scrolling in the Review sandbox. A bisect isolated it.Undici moves to 7.29.1 and 7.30.1. The macOS socket patch still applies unchanged, so it is carried to both.
Related Issues
Refs ackstorm/artifact-server#6, ackstorm/artifact-server#7, ackstorm/artifact-server#8, ackstorm/artifact-server#9, ackstorm/artifact-server#11
Test Plan
Run locally on this machine:
main.Not run locally:
test:compact-compose,test:external-storage-compose,verify:helm. They build the multi-arch OCI image with SBOM attestations, which needs a buildx container builder and arm64 emulation this machine doesn't have. CI runs them.Local timing and perf evidence is not committed, because it comes from a single laptop run.
Rollout
After merge, CI publishes
ghcr.io/ackstorm/artifact-server:v0.1.2-ackstorm.N. Deploy that image first. Then remove the upload-URL rewriting fromartifact-mcp-bridgein gitops: the old bridge keeps working against the new server, but the new bridge breaks uploads against the old one. Postgres applies0013_staged_upload_granton top of the deployed schema 12.🤖 Generated with Claude Code