Release: merge development into beta - #1601
Merged
Merged
Conversation
…1599) * fix(l10n): backfill 5,240 .js-only strings into .json, then generate All 37 browser catalogues were stale here, so the fix looked like the one applied to dossiq, openregister, filinq and pipelinq: port keepiq's generator and rebuild. RUNNING IT FIRST WOULD HAVE DELETED 5,240 TRANSLATIONS. The generator treats .json as the sole source; in this app l10n/*.js carried 5,240 keys that l10n/*.json never had. Same trap opencatalogi#1132 hit at 21,662. My original sanity check could not see it. It asked whether any .js ended up with FEWER keys than its .json, never the reverse, which is the only direction this fails in. I caught opencatalogi on an insertions-vs-deletions diff, then went back and re-checked every app I had already changed this way: dossiq had silently dropped 631 real translations (Belarusian, Bulgarian and 33 other locales) and openregister 15. Both fixed before merge. So the order inverts: backfill every .js-only pair into its locale .json first, generate second. The assertion is now the right one. Comparing every rebuilt .js against its pre-change version: keys DROPPED = 0. Not a count comparison — literally no key present before is absent now. nl.js goes from 1,247 to 1,410 keys and de.js from 871 to 1,011, all additions. Adds `l10n:build` and `check:l10n-js`. KNOWN, NOT FIXED HERE: `check:l10n` fails on development (472 unused keys) and reports 664 after this change. The 192 difference is real: regenerating en.js from en.json restores keys that were missing from the browser catalogue, and they have no t() call. A related gap is that this checker does not know manifest strings exist, so translating the nav or a tour registers as UNUSED — I prototyped teaching it (it then reports 91 MISSING manifest strings, a real finding) and reverted it, because changing an already-failing check's semantics belongs in its own PR rather than riding along with a catalogue fix. * fix(l10n): translate the 98 untranslated manifest strings The catalogue fix in the previous commit made the browser able to READ Dutch. This gives it Dutch to read. 98 strings: the nav, the gateway and connection surfaces, the run and trace dashboards, and the whole getting-started tour. Integration terminology in Dutch is half loanwords, and pretending otherwise makes labels nobody recognises. So the split is deliberate: Translated: Consumers -> Afnemers, Connections -> Koppelingen, Deliveries -> Afleveringen, Dry run -> Proefrun, Source -> Bron, Objects -> Objecten Kept: Gateway, Flows, Traces, Webhooks, Cloud events, CloudEvent, Circuit breaker, Dead Letters, API, CSV/JSON/Excel "Dead Letters" in particular stays: it is the name of the queue on screen, and the tour sentence about it only makes sense if the words match what the user will click. The tour's diagnostic sentences keep their point rather than their word order. "An empty run plus a full dead-letter queue is a mapping problem, not a connection problem" becomes "Een lege run met een volle dead-letterwachtrij wijst op een mappingprobleem, niet op een koppelingsprobleem" — the whole value of that line is telling someone where NOT to look. Verified: 0 manifest strings left without Dutch, keys DROPPED = 0, nl.js registers under "integriq" with 1,508 keys and resolves "Consumers" -> "Afnemers", check:l10n-js PASS.
github-actions
Bot
requested review from
Rem-Dam,
SudoThijn,
WilcoLouwerse,
bbrands02,
remko48,
rjzondervan and
rubenvdlinde
as code owners
August 27, 2026 08:43
…1603) gate-98 (repair-step-registration) found this: the class exists in lib/Repair/ and is named nowhere in appinfo/info.xml, so Nextcloud has never run it on any instance. What that costs is money reading as null. OpenRegister does not store an object as a JSON blob keyed by property name - each schema property is a real snake_cased COLUMN in the per-schema shard table. On schema sync MagicMapper ADDS a column when the name is absent and NEVER renames; there is not a single RENAME COLUMN in openregister. So renaming `bedrag` to `amount` in the register leaves the money sitting in `bedrag` while every read looks at `amount` and finds null. No error, no data loss, and invisible to a test suite that asserts against fixtures rather than migrated rows. For this app those columns carry invoice, subsidy, payroll and tax amounts. This is the same shape as the unregistered subsidie migration found in dossiq today: a class that exists is not a class that runs, and the half that complied - a complete, careful, well-documented implementation - is exactly what makes it look finished. Placed after InitializeRegister, so the register sync has already added the English columns by the time it runs, and before RemoveRetiredCronJobs which must stay last. Safe to register rather than rewrite: the step is non-destructive and idempotent by its own contract. A column is renamed only when the old one exists and the new one does not; where MagicMapper has already added an empty new column the data is copied and the old column is LEFT IN PLACE, so the change is reversible; two sources targeting one destination are REFUSED rather than merged; nothing is deleted; a re-run is a no-op. Not added to <install>: a fresh install has no Dutch columns to rename. Also unblocks #1600, which could not merge while this gate was red.
…1604) This app already has the generator and the `check:l10n-js` script; it just never ran them in CI. That is the whole difference between an app that stays translated and one that quietly stops. Adding a key to l10n/<locale>.json and forgetting the .js is invisible without this check: the server renders Dutch, the browser renders English, and every other check passes. `l10n/<locale>.json` is read server-side by PHP; the browser only ever sees `OC.L10N.register(...)` from `l10n/<locale>.js`, loaded as a script tag. Measured across the fleet today: the apps running this check had zero drift, while the four without it had accumulated 142, 329, 257 and 1,090 unreachable entries between them. Same code, same generator. The check was the difference. It also caught a translation PR that merged green having changed nothing a browser loads, which is how the whole thing started. Appended to the existing frontend-checks list rather than replacing it, so every check this repo already runs still runs. Verified before pushing: the workflow YAML still parses, and `node scripts/build-l10n-js.js --check` exits 0 on this tree, so the new leg is green on arrival rather than red for someone else to clean up.
gate-98 caught it: the step exists in lib/Repair/ and was never named in appinfo/info.xml, so Nextcloud has never run it. A class that exists is not a class that runs. Its own getName() says what is at stake — 'Move openconnector data from the Dutch columns to the English ones'. Every instance that predates the column rename is still holding that data where the English-column readers do not look, and nothing has ever moved it. post-migration only: a fresh install has no Dutch columns to move, and the step is idempotent either way. Verified: info.xml parses, and the FQCN in the <step> entry matches the class's namespace and name exactly — a registration naming a class that does not resolve is the same silent no-op wearing a different hat. Part of a fleet-wide sweep for this defect class: 4 apps had an unregistered repair step (opencatalogi, integriq, filinq, shillinq). Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
Contributor
Author
Quality Report — ConductionNL/integriq @
|
| Check | PHP | Vue | Security | License | Tests |
|---|---|---|---|---|---|
| lint | ⏭️ | ||||
| phpcs | ⏭️ | ||||
| phpmd | ⏭️ | ||||
| psalm | ⏭️ | ||||
| phpstan | ⏭️ | ||||
| phpmetrics | ⏭️ | ||||
| eslint | ⏭️ | ||||
| stylelint | ⏭️ | ||||
| build | ⏭️ | ||||
| composer | ⏭️ | ⏭️ | |||
| npm | ⏭️ | ⏭️ | |||
| app:check-code | ⏭️ | ||||
| info.xml | ⏭️ | ||||
| REUSE | ⏭️ | ||||
| PHPUnit | ❌ | ||||
| Newman | ❌ | ||||
| Playwright | ❌ | ||||
| Hydra gates | ❌ |
Quality workflow — 2026-08-27 12:15 UTC
Download the full PDF report from the workflow artifacts.
* fix(deps): development cannot npm install
* fix(deps): rebase the lock on development's, not a from-scratch resolve
The previous commit deleted package-lock.json before installing. That
turns a five-package pin into a full re-resolution: on pipelinq it moved
172 package versions, added 64 and removed 132, when five were intended.
One of those unintended moves broke boot. dexie went 4.4.4 -> 4.4.5, and
@conduction/nextcloud-vue's published dist BUNDLES its own dexie copy, so
the app loaded two and Dexie throws at module load:
pageerror: Two different versions of Dexie loaded in the same app:
4.4.5 and 4.4.4
The E2E boot gate caught it -- "the bundle loaded but rendered nothing" --
while build, lint, stylelint and unit tests were all green. A passing
build says nothing about whether the app mounts.
Starting from development's lock and letting npm move only what the
manifest forces cuts the change to 85/17/46 and leaves dexie alone.
Control: development's own E2E run is 309 passed / 1 failed with no
dexie pageerror and no boot-gate failure, so the breakage was mine.
---------
Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
#1600) The PHPUnit cell that runs the coverage ratchet fails with "scripts/coverage-guard.php predates merge-base comparison (it does not report the 'against' capability)". That message names a plausible cause rather than the measured one, but the underlying fact is simple: this copy is the 17,288-byte version and the workflow is written against the 35,733-byte canonical one, which additionally reports `deletion-neutral`. Without that capability, deleting well-tested dead code still reads as a coverage drop. Measured across the 21-app fleet: 8 apps already carry the canonical copy and their ratchets run and report normally; 11 carry a stale variant. This is vendored-copy drift, the same shape as the six drifted app-manifest schemas. Copied verbatim from ConductionNL/.github at quality-config/coverage-guard.php rather than patched locally. Reimplementing a gate has cost us before: a hand-rolled version found 1 finding where the real gate found 13.
Contributor
Author
Quality Report — ConductionNL/integriq @
|
| Check | PHP | Vue | Security | License | Tests |
|---|---|---|---|---|---|
| lint | ✅ | ||||
| phpcs | ✅ | ||||
| phpmd | ✅ | ||||
| psalm | ✅ | ||||
| phpstan | ✅ | ||||
| phpmetrics | ✅ | ||||
| eslint | ✅ | ||||
| stylelint | ✅ | ||||
| build | ✅ | ||||
| build | ✅ | ||||
| check-specs | ✅ | ||||
| test-l10n | ✅ | ||||
| format | ✅ | ||||
| check-schema-l10n | ✅ | ||||
| check-l10n-js | ✅ | ||||
| composer | ✅ | ✅ 145/145 | |||
| npm | ✅ | ✅ 551/551 | |||
| app:check-code | ⏭️ | ||||
| info.xml | ✅ | ||||
| REUSE | ❌ | ||||
| PHPUnit | ✅ | ||||
| Newman | ✅ | ||||
| Playwright | ✅ | ||||
| Hydra gates | ✅ |
Quality workflow — 2026-08-27 14:05 UTC
Download the full PDF report from the workflow artifacts.
Untracked: build.log changed.tsv inst.log lint.log stylelint.log test_unit.log
Contributor
Author
Quality Report — ConductionNL/integriq @
|
| Check | PHP | Vue | Security | License | Tests |
|---|---|---|---|---|---|
| lint | ✅ | ||||
| phpcs | ✅ | ||||
| phpmd | ✅ | ||||
| psalm | ✅ | ||||
| phpstan | ✅ | ||||
| phpmetrics | ✅ | ||||
| eslint | ✅ | ||||
| stylelint | ✅ | ||||
| build | ✅ | ||||
| build | ✅ | ||||
| check-specs | ✅ | ||||
| test-l10n | ✅ | ||||
| format | ✅ | ||||
| check-schema-l10n | ✅ | ||||
| check-l10n-js | ✅ | ||||
| composer | ✅ | ✅ 145/145 | |||
| npm | ✅ | ✅ 551/551 | |||
| app:check-code | ⏭️ | ||||
| info.xml | ✅ | ||||
| REUSE | ❌ | ||||
| PHPUnit | ✅ | ||||
| Newman | ✅ | ||||
| Playwright | ✅ | ||||
| Hydra gates | ❌ |
Quality workflow — 2026-08-27 17:28 UTC
Download the full PDF report from the workflow artifacts.
…1610) The App Store keys everything on the app id, so renaming <id> to integriq made it a brand new store entry starting from nothing. The release workflow derives its version baseline from the git tags and info.xml of THIS repo, neither of which knows anything about what shipped as openconnector -- so the version line restarts below it. filinq was about to publish 0.0.40 while docudesk sits at 0.1.0-beta.3 on the store. The store has no version ordering rule (_check_permission validates existence and ownership only), so that uploads with a 200 and is then never offered to anyone already on the higher version. previous-app-id folds the old entry's published versions into the baseline, so the renamed app picks the line up instead of restarting it.
Contributor
Author
Quality Report — ConductionNL/integriq @
|
| Check | PHP | Vue | Security | License | Tests |
|---|---|---|---|---|---|
| lint | ⏭️ | ||||
| phpcs | ⏭️ | ||||
| phpmd | ⏭️ | ||||
| psalm | ⏭️ | ||||
| phpstan | ⏭️ | ||||
| phpmetrics | ⏭️ | ||||
| eslint | ⏭️ | ||||
| stylelint | ⏭️ | ||||
| build | ⏭️ | ||||
| composer | ⏭️ | ⏭️ | |||
| npm | ⏭️ | ⏭️ | |||
| app:check-code | ⏭️ | ||||
| info.xml | ⏭️ | ||||
| REUSE | ⏭️ | ||||
| PHPUnit | ❌ | ||||
| Newman | ❌ | ||||
| Playwright | ❌ | ||||
| Hydra gates | ❌ |
Quality workflow — 2026-08-27 18:19 UTC
Download the full PDF report from the workflow artifacts.
integriq was on ^2.8.0 with the lock at 2.8.x - twelve minor versions behind the fleet, and the largest single jump left. Done on its own so that if something surfaces, the dependency move is bisectable from the flow-surface migration that follows it. 2.20.0 carries the named index sources (`entitySource`) and the `flow` page type. That is what lets integriq drop its two `type: "custom"` flow pages in a follow-up: below 2.20.0 the runtime does not register `flow` at all, and a manifest naming a page type the runtime does not know renders nothing rather than failing. No source changes here. Verified the jump rather than assuming it: npm resolved without a peer conflict, and the control build compiles - 39 artifacts, warnings only. A regenerated lock is not a working tree, and this fleet has already produced one broken `npm install` today from a dependency edit that looked fine on paper. Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
Contributor
Author
Quality Report — ConductionNL/integriq @
|
| Check | PHP | Vue | Security | License | Tests |
|---|---|---|---|---|---|
| lint | ⏭️ | ||||
| phpcs | ⏭️ | ||||
| phpmd | ⏭️ | ||||
| psalm | ⏭️ | ||||
| phpstan | ⏭️ | ||||
| phpmetrics | ⏭️ | ||||
| eslint | ⏭️ | ||||
| stylelint | ⏭️ | ||||
| build | ⏭️ | ||||
| composer | ⏭️ | ⏭️ | |||
| npm | ⏭️ | ⏭️ | |||
| app:check-code | ⏭️ | ||||
| info.xml | ⏭️ | ||||
| REUSE | ⏭️ | ||||
| PHPUnit | ❌ | ||||
| Newman | ❌ | ||||
| Playwright | ❌ | ||||
| Hydra gates | ❌ |
Quality workflow — 2026-08-27 18:48 UTC
Download the full PDF report from the workflow artifacts.
…DR-111) (#1616) Three objects per (register, schema) pair, each generated from the schema itself and validated against it. Not installed automatically: a mock register is imported on demand, from the setup walkthrough or `occ openregister:descriptors:list --app=<id> --import=<slug>`. Attributed to the app id in appinfo/info.xml — `x-openregister.app` is what the descriptor inventory resolves a register to an app by, so the checkout directory name would name an app that does not exist. Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
Contributor
Author
Quality Report — ConductionNL/integriq @
|
| Check | PHP | Vue | Security | License | Tests |
|---|---|---|---|---|---|
| lint | ✅ | ||||
| phpcs | ✅ | ||||
| phpmd | ✅ | ||||
| psalm | ✅ | ||||
| phpstan | ✅ | ||||
| phpmetrics | ✅ | ||||
| eslint | ✅ | ||||
| stylelint | ✅ | ||||
| build | ✅ | ||||
| build | ✅ | ||||
| check-specs | ✅ | ||||
| test-l10n | ✅ | ||||
| format | ✅ | ||||
| check-schema-l10n | ✅ | ||||
| check-l10n-js | ✅ | ||||
| composer | ✅ | ✅ 145/145 | |||
| npm | ✅ | ✅ 551/551 | |||
| app:check-code | ⏭️ | ||||
| info.xml | ✅ | ||||
| REUSE | ❌ | ||||
| PHPUnit | ❌ | ||||
| Newman | ❌ | ||||
| Playwright | ❌ | ||||
| Hydra gates | ❌ |
Quality workflow — 2026-08-27 20:44 UTC
Download the full PDF report from the workflow artifacts.
Contributor
Author
Quality Report — ConductionNL/integriq @
|
| Check | PHP | Vue | Security | License | Tests |
|---|---|---|---|---|---|
| lint | ✅ | ||||
| phpcs | ✅ | ||||
| phpmd | ✅ | ||||
| psalm | ✅ | ||||
| phpstan | ✅ | ||||
| phpmetrics | ✅ | ||||
| eslint | ✅ | ||||
| stylelint | ✅ | ||||
| build | ✅ | ||||
| build | ✅ | ||||
| check-specs | ✅ | ||||
| test-l10n | ✅ | ||||
| format | ✅ | ||||
| check-schema-l10n | ✅ | ||||
| check-l10n-js | ✅ | ||||
| composer | ✅ | ✅ 145/145 | |||
| npm | ✅ | ✅ 551/551 | |||
| app:check-code | ⏭️ | ||||
| info.xml | ✅ | ||||
| REUSE | ❌ | ||||
| PHPUnit | ✅ | ||||
| Newman | ✅ | ||||
| Playwright | ✅ | ||||
| Hydra gates | ❌ |
Quality workflow — 2026-08-27 22:27 UTC
Download the full PDF report from the workflow artifacts.
connector-catalog.spec.ts skips two whole describe blocks -- 6 tests -- with `test.describe.skip(...)`. That form records NO reason in the Playwright report. The report is the only place a skip reason is machine-readable. The CI log prints counts without reasons, and the skip-discipline gate (check_e2e_skips.py, now running fleet-wide) reads report.json. So the extensive source comment above these blocks -- which is genuinely good and explains the paginated-grid / sidebar-search mismatch in detail -- is invisible to every tool. Both blocks classify as V3 "skip with no reason". This changes nothing about WHAT runs. Same skip, same tracker (#1187), same tests. It just moves the reason somewhere a machine can read it, via the documented Playwright form for skipping a group with a reason: test.describe('...', () => { test.skip(true, '<reason>') Verified: npm ci rc=0, npm run lint rc=0, prettier clean, and `playwright test --list` compiles all 18 tests in the file. Part of ConductionNL/.github#609 (178 specs skip fleet-wide; a skip is counted as a pass). Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
Contributor
Author
Quality Report — ConductionNL/integriq @
|
| Check | PHP | Vue | Security | License | Tests |
|---|---|---|---|---|---|
| lint | ✅ | ||||
| phpcs | ✅ | ||||
| phpmd | ✅ | ||||
| psalm | ✅ | ||||
| phpstan | ✅ | ||||
| phpmetrics | ✅ | ||||
| eslint | ✅ | ||||
| stylelint | ✅ | ||||
| build | ✅ | ||||
| build | ✅ | ||||
| check-specs | ✅ | ||||
| test-l10n | ✅ | ||||
| format | ✅ | ||||
| check-schema-l10n | ✅ | ||||
| check-l10n-js | ✅ | ||||
| composer | ✅ | ✅ 145/145 | |||
| npm | ✅ | ✅ 551/551 | |||
| app:check-code | ⏭️ | ||||
| info.xml | ✅ | ||||
| REUSE | ❌ | ||||
| PHPUnit | ✅ | ||||
| Newman | ✅ | ||||
| Playwright | ✅ | ||||
| Hydra gates | ✅ |
Quality workflow — 2026-08-28 06:15 UTC
Download the full PDF report from the workflow artifacts.
#1626) Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
.github#597 set cancel-in-progress on the shared quality.yml, but a caller-level concurrency cancels the whole run before the called workflows setting can apply -- so that fix reached only the apps that declare no concurrency of their own. Measured 2026-08-28 over push runs on development since #597 merged: caller silent 0 of 11 cancelled caller says true 7 of 13 cancelled (54%) This repo is in the second group. pull_request keeps cancelling, where superseding really is correct.
Contributor
Author
Quality Report — ConductionNL/integriq @
|
| Check | PHP | Vue | Security | License | Tests |
|---|---|---|---|---|---|
| lint | ✅ | ||||
| phpcs | ✅ | ||||
| phpmd | ✅ | ||||
| psalm | ✅ | ||||
| phpstan | ✅ | ||||
| phpmetrics | ✅ | ||||
| eslint | ✅ | ||||
| stylelint | ✅ | ||||
| build | ✅ | ||||
| build | ✅ | ||||
| check-specs | ✅ | ||||
| test-l10n | ✅ | ||||
| format | ✅ | ||||
| check-schema-l10n | ✅ | ||||
| check-l10n-js | ✅ | ||||
| composer | ❌ | ✅ 145/145 | |||
| npm | ✅ | ✅ 551/551 | |||
| app:check-code | ⏭️ | ||||
| info.xml | ✅ | ||||
| REUSE | ❌ | ||||
| PHPUnit | ✅ | ||||
| Newman | ✅ | ||||
| Playwright | ✅ | ||||
| Hydra gates | ❌ |
Quality workflow — 2026-08-28 09:05 UTC
Download the full PDF report from the workflow artifacts.
Contributor
Author
Quality Report — ConductionNL/integriq @
|
| Check | PHP | Vue | Security | License | Tests |
|---|---|---|---|---|---|
| lint | ✅ | ||||
| phpcs | ✅ | ||||
| phpmd | ✅ | ||||
| psalm | ✅ | ||||
| phpstan | ✅ | ||||
| phpmetrics | ✅ | ||||
| eslint | ✅ | ||||
| stylelint | ✅ | ||||
| build | ✅ | ||||
| build | ✅ | ||||
| check-specs | ✅ | ||||
| test-l10n | ✅ | ||||
| format | ✅ | ||||
| check-schema-l10n | ✅ | ||||
| check-l10n-js | ✅ | ||||
| composer | ✅ | ✅ 145/145 | |||
| npm | ✅ | ✅ 551/551 | |||
| app:check-code | ⏭️ | ||||
| info.xml | ✅ | ||||
| REUSE | ❌ | ||||
| PHPUnit | ✅ | ||||
| Newman | ✅ | ||||
| Playwright | ✅ | ||||
| Hydra gates | ✅ |
Quality workflow — 2026-08-29 17:53 UTC
Download the full PDF report from the workflow artifacts.
Bumps [webpack](https://github.com/webpack/webpack) from 5.109.2 to 5.110.1. - [Release notes](https://github.com/webpack/webpack/releases) - [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md) - [Commits](webpack/webpack@v5.109.2...v5.110.1) --- updated-dependencies: - dependency-name: webpack dependency-version: 5.110.1 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [@nextcloud/router](https://github.com/nextcloud-libraries/nextcloud-router) from 2.2.1 to 3.1.0. - [Release notes](https://github.com/nextcloud-libraries/nextcloud-router/releases) - [Changelog](https://github.com/nextcloud-libraries/nextcloud-router/blob/main/CHANGELOG.md) - [Commits](nextcloud-libraries/nextcloud-router@v2.2.1...v3.1.0) --- updated-dependencies: - dependency-name: "@nextcloud/router" dependency-version: 3.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [marked](https://github.com/markedjs/marked) from 12.0.2 to 18.0.11. - [Release notes](https://github.com/markedjs/marked/releases) - [Commits](markedjs/marked@v12.0.2...v18.0.11) --- updated-dependencies: - dependency-name: marked dependency-version: 18.0.11 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [sass-loader](https://github.com/webpack/sass-loader) from 16.0.8 to 17.0.0. - [Release notes](https://github.com/webpack/sass-loader/releases) - [Changelog](https://github.com/webpack/sass-loader/blob/main/CHANGELOG.md) - [Commits](webpack/sass-loader@v16.0.8...v17.0.0) --- updated-dependencies: - dependency-name: sass-loader dependency-version: 17.0.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…1672) Bumps [@cyclonedx/cyclonedx-npm](https://github.com/CycloneDX/cyclonedx-node-npm) from 6.0.0 to 6.0.1. - [Release notes](https://github.com/CycloneDX/cyclonedx-node-npm/releases) - [Changelog](https://github.com/CycloneDX/cyclonedx-node-npm/blob/main/HISTORY.md) - [Commits](CycloneDX/cyclonedx-node-npm@v6.0.0...v6.0.1) --- updated-dependencies: - dependency-name: "@cyclonedx/cyclonedx-npm" dependency-version: 6.0.1 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [phpmetrics/phpmetrics](https://github.com/phpmetrics/PhpMetrics) from 2.9.1 to 2.11.0. - [Release notes](https://github.com/phpmetrics/PhpMetrics/releases) - [Changelog](https://github.com/phpmetrics/PhpMetrics/blob/master/CHANGELOG.md) - [Commits](phpmetrics/PhpMetrics@v2.9.1...v2.11.0) --- updated-dependencies: - dependency-name: phpmetrics/phpmetrics dependency-version: 2.11.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…1670) Bumps [phpcsstandards/phpcsextra](https://github.com/PHPCSStandards/PHPCSExtra) from 1.5.0 to 1.5.1. - [Release notes](https://github.com/PHPCSStandards/PHPCSExtra/releases) - [Changelog](https://github.com/PHPCSStandards/PHPCSExtra/blob/develop/CHANGELOG.md) - [Commits](PHPCSStandards/PHPCSExtra@1.5.0...1.5.1) --- updated-dependencies: - dependency-name: phpcsstandards/phpcsextra dependency-version: 1.5.1 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) from 7.29.7 to 8.0.1. - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v8.0.1/packages/babel-core) --- updated-dependencies: - dependency-name: "@babel/core" dependency-version: 8.0.1 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [phpstan/phpstan](https://github.com/phpstan/phpstan-phar-composer-source) from 2.2.8 to 2.2.9. - [Commits](https://github.com/phpstan/phpstan-phar-composer-source/commits) --- updated-dependencies: - dependency-name: phpstan/phpstan dependency-version: 2.2.9 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [vue-router](https://github.com/vuejs/router) from 4.6.4 to 5.3.0. - [Release notes](https://github.com/vuejs/router/releases) - [Commits](vuejs/router@v4.6.4...v5.3.0) --- updated-dependencies: - dependency-name: vue-router dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [twig/twig](https://github.com/twigphp/Twig) from 3.27.1 to 3.28.0. - [Release notes](https://github.com/twigphp/Twig/releases) - [Changelog](https://github.com/twigphp/Twig/blob/3.x/CHANGELOG) - [Commits](twigphp/Twig@v3.27.1...v3.28.0) --- updated-dependencies: - dependency-name: twig/twig dependency-version: 3.28.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [adbario/php-dot-notation](https://github.com/adbario/php-dot-notation) from 3.3.0 to 3.5.0. - [Release notes](https://github.com/adbario/php-dot-notation/releases) - [Commits](adbario/php-dot-notation@3.3.0...3.5.0) --- updated-dependencies: - dependency-name: adbario/php-dot-notation dependency-version: 3.5.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…1663) Bumps [elasticsearch/elasticsearch](https://github.com/elastic/elasticsearch-php) from 8.19.0 to 9.5.0. - [Release notes](https://github.com/elastic/elasticsearch-php/releases) - [Changelog](https://github.com/elastic/elasticsearch-php/blob/main/CHANGELOG.md) - [Commits](elastic/elasticsearch-php@v8.19.0...v9.5.0) --- updated-dependencies: - dependency-name: elasticsearch/elasticsearch dependency-version: 9.5.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [nextcloud/ocp](https://github.com/nextcloud-deps/ocp) from 34.0.2 to 34.0.3. - [Commits](nextcloud-deps/ocp@v34.0.2...v34.0.3) --- updated-dependencies: - dependency-name: nextcloud/ocp dependency-version: 34.0.3 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* fix(e2e): FlowRunWorker moved to OpenRegister's BackgroundJob namespace
`flowRunWorkerJobId()` asked occ for
`--class=OCA\OpenRegister\Cron\FlowRunWorker`. OpenRegister moved every job out
of that namespace, so the lookup matched nothing and the helper's own guard
failed on a count of 0:
exactly one FlowRunWorker job must be scheduled; occ reported 0.
That guard did exactly what it was written to do. Without it the suite would
have carried on and asserted the state of a run that was never picked up, and
the failure would have surfaced somewhere further down as a puzzle about flow
execution rather than a plain statement about a missing job.
## Why this repo's own CI could not have caught it earlier
The class lives in openregister, and `code-quality.yml` installs that app at
`ref: development`:
additional-apps: '[{"repo":"ConductionNL/openregister","app":"openregister","ref":"development"}]'
So the reference tracks another repo's default branch, and nothing in this
repo's build has any view of it. It broke the moment the rename landed there.
The docblock now says so, so the next reader knows the string is a cross-repo
dependency rather than a local constant.
Verified against openregister's current `appinfo/info.xml`, which registers
`OCA\OpenRegister\BackgroundJob\FlowRunWorker` — one `<job>` entry, matching
the helper's `toBe(1)`.
Swept the rest of the fleet for the retired namespace. The only other live
references are documentation: two docblocks in filinq and one openregister spec
line that still requires the old class name. Neither is executable and both are
being handled separately rather than smuggled into this fix.
Not touched: `eslint tests/e2e/...` reports 8 pre-existing errors in this file
(import ordering, an unused arg, a missing `playwright/no-skipped-test` rule
definition). All 8 are present on `development` before this change, and the
repo's `lint` script is `eslint src`, so they are not gating. They want their
own change, not a drive-by edit inside a one-line fix.
* fix(copy): six analytics widget titles used em-dashes (gate-96)
Outgoing calls — daily -> Outgoing calls per day
Outgoing calls — by hour -> Outgoing calls per hour
Job executions — daily -> Job executions per day
Job executions — by hour -> Job executions per hour
Synchronization runs — daily -> Synchronization runs per day
Synchronization runs — by hour-> Synchronization runs per hour
voice.md §8 bans em-dashes; hydra gate-96 (manifest-copy-style, added
2026-08-26) enforces it mechanically. "per day" / "per hour" drops the
punctuation instead of swapping it for a colon, and says the same thing more
plainly — these are bucket sizes, not asides.
Included here rather than in its own PR because gate-96 is FULL-TREE, not
diff-scoped: it fails every PR raised against this app until the tree is clean,
so these six strings were blocking an unrelated e2e fix.
## A note on how this was edited
`src/manifest.json` contains 42 em-dashes; the gate flags 6. The other 36 sit
in fields it does not treat as user-visible (`_note` and similar), and a
blanket replace would have rewritten all 42. The two anchored patterns used
here match exactly 3 + 3, which is the number the gate reported — the counts
agreeing is the check, not the command succeeding.
Verified after: the file still parses as JSON, gate-96 reports 0 failures over
229 manifest strings, and `check:manifest` structural lint passes. None of the
six is a translation key (`l10n/en.js` has no entry for any of them), so no
catalogue is orphaned.
* Revert "fix(copy): six analytics widget titles used em-dashes (gate-96)"
This reverts commit c1b0d85.
* docs(endpoint-runtime): reopen the spec for the id-fetch guard
REQ-EP-010 lets a single-object GET re-check the fetched object against
the Endpoint declared fixed filters and 404 on a mismatch, closing the
gap where the getObjects() id-branch bypassed every filter. Generic;
first consumer is ORI 1.4 public serving.
Contributor
Author
Quality Report — ConductionNL/integriq @
|
| Check | PHP | Vue | Security | License | Tests |
|---|---|---|---|---|---|
| lint | ⏭️ | ||||
| phpcs | ⏭️ | ||||
| phpmd | ⏭️ | ||||
| psalm | ⏭️ | ||||
| phpstan | ⏭️ | ||||
| phpmetrics | ⏭️ | ||||
| eslint | ⏭️ | ||||
| stylelint | ⏭️ | ||||
| build | ⏭️ | ||||
| composer | ⏭️ | ⏭️ | |||
| npm | ⏭️ | ⏭️ | |||
| app:check-code | ⏭️ | ||||
| info.xml | ⏭️ | ||||
| REUSE | ⏭️ | ||||
| PHPUnit | ❌ | ||||
| Newman | ❌ | ||||
| Playwright | ❌ | ||||
| Hydra gates | ❌ |
Quality workflow — 2026-08-30 08:17 UTC
Download the full PDF report from the workflow artifacts.
beta held 26 commit(s) development did not. Version files were resolved to development's side so the version never moves backwards -- the same rule release.yml applies to its own post-release sync. Recording the ancestry is the payload: without it the merge base never moves and the next development -> beta promotion conflicts on the version file exactly as before.
…0260830084049 chore(sync): carry beta back into development
…02608300839 chore(sync): record beta's ancestry on development
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Contributor
Author
Quality Report — ConductionNL/integriq @
|
| Check | PHP | Vue | Security | License | Tests |
|---|---|---|---|---|---|
| lint | ✅ | ||||
| phpcs | ✅ | ||||
| phpmd | ✅ | ||||
| psalm | ✅ | ||||
| phpstan | ✅ | ||||
| phpmetrics | ✅ | ||||
| eslint | ❌ | ||||
| stylelint | ❌ | ||||
| build | ❌ | ||||
| build | ❌ | ||||
| check-specs | ❌ | ||||
| test-l10n | ❌ | ||||
| format | ❌ | ||||
| check-schema-l10n | ❌ | ||||
| check-l10n-js | ❌ | ||||
| composer | ✅ | ✅ 146/146 | |||
| npm | ❌ | ❌ | |||
| app:check-code | ⏭️ | ||||
| info.xml | ✅ | ||||
| REUSE | ❌ | ||||
| PHPUnit | ❌ | ||||
| Newman | ❌ | ||||
| Playwright | ❌ | ||||
| Hydra gates | ❌ |
Quality workflow — 2026-08-30 08:58 UTC
Download the full PDF report from the workflow artifacts.
The dependabot sweep on 2026-08-30 merged several bumps whose lockfiles were each generated in isolation. Git merged the lock text cleanly, but the result no longer matched package.json: npm ci refused with "Missing: @types/jsesc@2.5.1 from lock file". No constraint is changed here. The lock is regenerated from the package.json already on development, which is what brings the two back into agreement. Verified with npm ci --dry-run: exit 0.
Contributor
Author
Quality Report — ConductionNL/integriq @
|
| Check | PHP | Vue | Security | License | Tests |
|---|---|---|---|---|---|
| lint | ⏭️ | ||||
| phpcs | ⏭️ | ||||
| phpmd | ⏭️ | ||||
| psalm | ⏭️ | ||||
| phpstan | ⏭️ | ||||
| phpmetrics | ⏭️ | ||||
| eslint | ⏭️ | ||||
| stylelint | ⏭️ | ||||
| build | ⏭️ | ||||
| composer | ⏭️ | ⏭️ | |||
| npm | ⏭️ | ⏭️ | |||
| app:check-code | ⏭️ | ||||
| info.xml | ⏭️ | ||||
| REUSE | ⏭️ | ||||
| PHPUnit | ❌ | ||||
| Newman | ❌ | ||||
| Playwright | ❌ | ||||
| Hydra gates | ❌ |
Quality workflow — 2026-08-30 09:22 UTC
Download the full PDF report from the workflow artifacts.
…against (#1689) A dependabot bump took vue-router to ^5.3.0 on development on 2026-08-30 without CI. npm resolves it, so nothing failed at install time, but webpack cannot resolve the package at all and the build dies with "Can't resolve 'vue-router'" from src/main.js and from every @nextcloud/vue chunk that imports it. vue-router 5 is a major with a reworked exports map. Adopting it is a real migration, not a version bump, so this reverts to ^4.6.4 and leaves that migration to be done deliberately. Verified: npm install then npm run build, both exit 0.
Dexie refuses to run twice in one page: it throws "Two different versions of Dexie loaded in the same app". Nextcloud loads openregister's global integration script and hermiq's agent leaf on every page, alongside whichever leaf app you are in, so all three have to agree on one dexie. After the dependabot sweep on 2026-08-30 they did not. openregister resolved 4.4.4 while hermiq resolved 4.4.5, and the throw happened before the leaf app mounted, so every app page rendered as bare Nextcloud chrome with no content. This pins the floor at ^4.4.5 and regenerates the lock, matching the apps that were already there. Verified in the browser: the Dexie error is gone from the console and app pages render their navigation and content again.
Contributor
Author
Quality Report — ConductionNL/integriq @
|
| Check | PHP | Vue | Security | License | Tests |
|---|---|---|---|---|---|
| lint | ⏭️ | ||||
| phpcs | ⏭️ | ||||
| phpmd | ⏭️ | ||||
| psalm | ⏭️ | ||||
| phpstan | ⏭️ | ||||
| phpmetrics | ⏭️ | ||||
| eslint | ⏭️ | ||||
| stylelint | ⏭️ | ||||
| build | ⏭️ | ||||
| composer | ⏭️ | ⏭️ | |||
| npm | ⏭️ | ⏭️ | |||
| app:check-code | ⏭️ | ||||
| info.xml | ⏭️ | ||||
| REUSE | ⏭️ | ||||
| PHPUnit | ❌ | ||||
| Newman | ❌ | ||||
| Playwright | ❌ | ||||
| Hydra gates | ❌ |
Quality workflow — 2026-08-30 09:46 UTC
Download the full PDF report from the workflow artifacts.
Contributor
Author
Quality Report — ConductionNL/integriq @
|
| Check | PHP | Vue | Security | License | Tests |
|---|---|---|---|---|---|
| lint | ✅ | ||||
| phpcs | ✅ | ||||
| phpmd | ✅ | ||||
| psalm | ✅ | ||||
| phpstan | ✅ | ||||
| phpmetrics | ✅ | ||||
| eslint | ✅ | ||||
| stylelint | ✅ | ||||
| build | ✅ | ||||
| build | ✅ | ||||
| check-specs | ✅ | ||||
| test-l10n | ✅ | ||||
| format | ✅ | ||||
| check-schema-l10n | ✅ | ||||
| check-l10n-js | ✅ | ||||
| composer | ✅ | ✅ 146/146 | |||
| npm | ✅ | ✅ 541/541 | |||
| app:check-code | ⏭️ | ||||
| info.xml | ✅ | ||||
| REUSE | ❌ | ||||
| PHPUnit | ✅ | ||||
| Newman | ✅ | ||||
| Playwright | ✅ | ||||
| Hydra gates | ✅ |
Quality workflow — 2026-08-30 10:38 UTC
Download the full PDF report from the workflow artifacts.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated PR to sync development changes to beta for beta release.
Merging this PR will trigger the beta release workflow.