Repository navigation
Sync main with develop (release 0.17.2) - #199
Merged
Merged
Conversation
Bumps the minor-and-patch group in /frontend with 1 update: [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react). Updates `lucide-react` from 1.47.0 to 1.48.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.48.0/packages/lucide-react) --- updated-dependencies: - dependency-name: lucide-react dependency-version: 1.48.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the development-updates group with 1 update in the /frontend directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Updates `vite` from 8.3.0 to 8.3.1 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.3.1/packages/vite) --- updated-dependencies: - dependency-name: vite dependency-version: 8.3.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…dvisories (#196) npm audit fix bumps the transitive dev dependency brace-expansion past 5.0.11, fixing three DoS advisories (GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7, GHSA-6j4f-fj2g-mc7p). Lockfile-only change.
… with 3 updates (#193) * chore(deps-backend)(deps): bump the minor-and-patch group Bumps the minor-and-patch group in /backend with 3 updates: [uvicorn](https://github.com/Kludex/uvicorn), [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) and [coverage](https://github.com/coveragepy/coveragepy). Updates `uvicorn` from 0.53.0 to 0.54.0 - [Release notes](https://github.com/Kludex/uvicorn/releases) - [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md) - [Commits](Kludex/uvicorn@0.53.0...0.54.0) Updates `sqlalchemy` from 2.0.54 to 2.1.1 - [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases) - [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst) - [Commits](https://github.com/sqlalchemy/sqlalchemy/commits) Updates `coverage` from 7.16.1 to 7.16.2 - [Release notes](https://github.com/coveragepy/coveragepy/releases) - [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst) - [Commits](coveragepy/coveragepy@7.16.1...7.16.2) --- updated-dependencies: - dependency-name: uvicorn dependency-version: 0.54.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: sqlalchemy dependency-version: 2.1.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: coverage dependency-version: 7.16.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com> * fix(deps): require sqlalchemy[asyncio] extra for SQLAlchemy 2.1 SQLAlchemy 2.1 no longer installs greenlet by default, which broke sqlalchemy.ext.asyncio at import time. Use the asyncio extra and update docs/REQUIREMENTS.md accordingly. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: 0verwrite <31691645+overwrite00@users.noreply.github.com>
…omation (#198) * fix(ci): use the workflow token for PR and issue edits in project automation The step ran every gh command with GH_PROJECT_TOKEN, a token scoped to Projects, so assignee, reviewer and label edits failed on every pull request. Their errors were discarded by 2>/dev/null and replaced by a generic 'skipped' message, so the failure went unnoticed. Use the workflow's own token (the permissions block already grants it issues/pull-requests write) for repository edits and keep the PAT only for the Projects mutation. Failures are now reported as warnings with gh's error message, and the reviewer request is skipped when the author is the assignee, which GitHub rejects. * fix(ci): assign Dependabot PRs natively and skip edits its token cannot make GitHub gives Dependabot-triggered workflows a read-only GITHUB_TOKEN, so the assignee, reviewer and label edits cannot work for its pull requests and would only produce warnings on every run. Dependabot PRs had never been assigned. Set assignees in dependabot.yml for all three ecosystems (labels were already set there) and make the workflow skip those edits for Dependabot authors with an explicit message. Adding the PR to the Project is unchanged.
…rom .msg files (#197) * test: add synthetic .msg fixture and enable the .msg parsing test test_msg_parsing_via_email_parser looked for samples/sample.msg, a gitignored directory, so it was skipped everywhere including CI. Add a deterministic synthetic fixture (reserved example domains only) with a generator script, point the test at it with real assertions, and add a check that the committed binary matches the generator output. * fix(msg): extract recipients, transport headers and RTF-only bodies from .msg files python-oxmsg exposes recip.email_address, not .email, and Properties has no .get(), so recipients and the raw transport headers were always empty for every .msg. Both failures were swallowed by bare except clauses. As a result SPF/DKIM/DMARC, Message-ID and the Received chain were never extracted and header scoring ran without authentication data. _parse_msg also copied only 6 of the 18 header-derived ParsedEmail fields. - read recipients and headers with the correct API, drop the bare excepts and report failures through MsgFields.errors - copy every header-derived field via _MSG_HEADER_DERIVED_FIELDS, guarded by a test that fails when a new ParsedEmail field is left unclassified - make the RTF-only path work: the RTFDE import was wrong and its ImportError was reported as 'not installed'; add MS-OXRTFCP decompression and use DeEncapsulator - install RTFDE (optional, LGPL) in the CI test job so its end-to-end test runs - bump version to 0.17.2 and update CHANGELOG, README and docs * docs: note native Dependabot assignment in the 0.17.2 changelog
github-actions
Bot
added
scope:backend
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Release 0.17.2, a bugfix release. Full details are in the
[0.17.2]section ofCHANGELOG.md..msgparsing fixed (fix(msg): extract recipients, transport headers and RTF-only bodies from .msg files #197): recipients, SPF/DKIM/DMARC,Message-ID, theReceivedchain and the other transport-header fields were silently dropped for every.msg(wrong python-oxmsg API usage hidden by bareexcept:clauses, and only 6 of 18 header-derived fields were copied). RTF-only bodies (Outlook 97-2003) can now be recovered with the optional RTFDE package. Synthetic.msgfixture and tests added; version bumped to 0.17.2.dependabot.yml.asyncioextra, uvicorn 0.54.0, coverage 7.16.2 (chore(deps-backend)(deps): bump the minor-and-patch group in /backend with 3 updates #193); lucide-react 1.48.0 (chore(deps-frontend)(deps): bump lucide-react from 1.47.0 to 1.48.0 in /frontend in the minor-and-patch group #194); Vite 8.3.1 (chore(deps-frontend)(deps-dev): bump vite from 8.3.0 to 8.3.1 in /frontend in the development-updates group across 1 directory #195);brace-expansion5.0.12 resolving three high-severity dev-dependency advisories (fix(deps-frontend): update brace-expansion to resolve high severity advisories #196).Test plan
developmain..developreviewed: 17 files, no unrelated changesMerge
Merge with a regular merge commit, not squash, to keep
mainanddevelophistory aligned.