Release: merge beta into main - #518
Merged
Merged
Conversation
The 1.1.8-beta.20260830190821 release bumped the version on beta. Without this, development stays behind beta and the next development -> beta promotion conflicts on the version file. Version files resolve to development's side, which is the higher line, so this never moves a version backwards.
…91345 chore(sync): carry main back into beta
…260830191352 chore(sync): carry beta back into development
vue-router 5 peers `vite: ^7.3.0 || ^8.0.0` and expects a Vite toolchain. These apps build with webpack, which cannot resolve it at all: the build dies on `Can't resolve 'vue-router'` from src and from @nextcloud/vue's own chunks. Adopting it is a Vite migration, not a version bump. Dependabot proposed it across 8 repositories in a single run, and merging any one of them takes that app's build from green to red with no code change that can fix it. versioniq already builds with Vite and is the natural pilot if the fleet does move. Lift this when an app's toolchain can actually take it. Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
#514) The comment claimed these apps "cannot resolve it at all". That is not what the evidence shows, and a comment that overstates its case is worse than none: the next person reads it, tries vue-router 5 somewhere it works, and stops trusting the file. Measured across four apps: integriq and zaakafhandelapp fail their build on `Can't resolve 'vue-router'`, while openregister and learniq build clean on 5.3.0. The holdback still stands, for the honest reason rather than the overstated one: a major that breaks some apps and not others cannot be merged unattended, and the difference between them is not yet understood. No behaviour change. The ignore rule is unchanged; only the reasoning is. Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
Release: merge development into beta
The 1.1.10-beta.20260831003553 release bumped the version on beta. Without this, development stays behind beta and the next development -> beta promotion conflicts on the version file. Version files resolve to development's side, which is the higher line, so this never moves a version backwards.
Contributor
Quality Report — ConductionNL/thematiq @
|
| Check | PHP | Vue | Security | License | Tests |
|---|---|---|---|---|---|
| lint | ⏭️ | ||||
| phpcs | ✅ | ||||
| phpmd | ⏭️ | ||||
| psalm | ⏭️ | ||||
| phpstan | ⏭️ | ||||
| phpmetrics | ⏭️ | ||||
| eslint | ⏭️ | ||||
| stylelint | ⏭️ | ||||
| build | ⏭️ | ||||
| test-l10n | ✅ | ||||
| composer | ⏭️ | ⏭️ | |||
| npm | ⏭️ | ✅ 2/2 | |||
| app:check-code | ⏭️ | ||||
| info.xml | ✅ | ||||
| REUSE | ⏭️ | ||||
| PHPUnit | ❌ | ||||
| Newman | ❌ | ||||
| Playwright | ❌ | ||||
| Hydra gates | ❌ |
Quality workflow — 2026-08-31 00:36 UTC
Download the full PDF report from the workflow artifacts.
Contributor
Quality Report — ConductionNL/thematiq @
|
| Check | PHP | Vue | Security | License | Tests |
|---|---|---|---|---|---|
| lint | ✅ | ||||
| phpcs | ✅ | ||||
| phpmd | ✅ | ||||
| psalm | ✅ | ||||
| phpstan | ✅ | ||||
| phpmetrics | ✅ | ||||
| eslint | ✅ | ||||
| stylelint | ✅ | ||||
| build | ✅ | ||||
| check-manifest | ✅ | ||||
| test-l10n | ✅ | ||||
| format | ✅ | ||||
| composer | ✅ | ✅ 104/104 | |||
| npm | ✅ | ✅ 2/2 | |||
| app:check-code | ⏭️ | ||||
| info.xml | ✅ | ||||
| REUSE | ❌ | ||||
| PHPUnit | ✅ | ||||
| Newman | ✅ | ||||
| Playwright | ✅ | ||||
| Hydra gates | ✅ |
Quality workflow — 2026-08-31 01:14 UTC
Download the full PDF report from the workflow artifacts.
…260831012108 chore(sync): carry beta back into development
Picks up the fix for the Buildiq edit button, which had disappeared from
every host app in the fleet.
The shared library gated the button on `useAppStatus('openbuild')`, an
`OC.appswebroots` lookup keyed by the Nextcloud app id. That id moved when
Buildiq shipped `<id>buildiq</id>`, so the lookup missed, availability
stayed false, and the button rendered nothing: no error, no failed
request, no console warning. 2.25.1 checks the current id and falls back
to the legacy one.
The caret range already permitted the newer library, so the lockfile pin
was the thing actually holding this app back.
Lockfile edited surgically rather than regenerated: a full re-resolve
rewrote ~3000 lines and pulled in 161 unrelated transitive packages. Only
version, resolved, integrity and the widened pinia peer range change. The
integrity hash was checked against the published tarball bytes, and
`npm ci` was run against the result.
…1.10-beta.20260831003553 chore(release): sync beta back into development
…1.8-beta.20260830190821 chore(release): sync beta back into development
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
hydra-gates v1.10.0 -> v1.10.0 nc-vue 2.25.1 -> 2.26.0 Lock-only: both packages are already declared with caret ranges that permit these versions, so nothing about what this app ACCEPTS changes - only what it currently resolves to. Opened by the weekly fleet shared-dependency bump, because a lock nobody re-resolves is a pin nobody chose. Merging is gated by this repository's own suite, deliberately: taking hydra-gates v1.8.1 added patchObject() to a published interface, which is a load-time fatal for any concrete double that implements it without the method. CI is the only thing that can tell a safe bump from that. Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Release: merge development into beta
Contributor
Quality Report — ConductionNL/thematiq @
|
| Check | PHP | Vue | Security | License | Tests |
|---|---|---|---|---|---|
| lint | ✅ | ||||
| phpcs | ✅ | ||||
| phpmd | ✅ | ||||
| psalm | ✅ | ||||
| phpstan | ✅ | ||||
| phpmetrics | ✅ | ||||
| eslint | ✅ | ||||
| stylelint | ✅ | ||||
| build | ✅ | ||||
| check-manifest | ✅ | ||||
| test-l10n | ✅ | ||||
| format | ✅ | ||||
| composer | ✅ | ✅ 104/104 | |||
| npm | ✅ | ✅ 2/2 | |||
| app:check-code | ⏭️ | ||||
| info.xml | ✅ | ||||
| REUSE | ❌ | ||||
| PHPUnit | ✅ | ||||
| Newman | ✅ | ||||
| Playwright | ✅ | ||||
| Hydra gates | ✅ |
Quality workflow — 2026-08-31 11:00 UTC
Download the full PDF report from the workflow artifacts.
Contributor
Author
|
Merging with That job fails on Merging does not make that worse: What merging does buy is the thing that is actually blocked otherwise: Dependabot alerts and the Security (composer) gate are measured on the default branch, and every fix lands on development, so main stays vulnerable until a promotion carries them up. thematiq will not appear in the App Store until the certificate is issued. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Second hop of the promotion.
development → betaalready merged; this carriesbetatomain, which is the branch Dependabot alerts and theSecurity (composer)gate actually read. Until it lands, the fixes ondevelopmentdrain nothing measurable.Safe on the certificate front: this app's
<id>inappinfo/info.xmlis identical onbetaandmain, so signing is unaffected. Nextcloud issues one certificate per id, and an app whose id moves on promotion cannot sign a release until a new one is issued.--merge, never squash. Squashing a promotion rewrites the target's history and reverts commits already onmain.⏳ Do not merge before ~07:00 UTC. The Nextcloud App Store is rate-limiting this account: the current refusal is
429 ... available in 25043 seconds. The backoff escalates on every retry (3889s → 7010s → 25043s across today's attempts), so merging now would fail the App Store publish and risk pushing the window out further for every other app queued behind it. The GitHub release and tag are created regardless; only the store listing lags.🤖 Generated with Claude Code