[M0] Cherry-pick fixes from dev-v8

[miccy]

Goal

Aplikovat kritické fixy z původní dev větve, aby dev-bun byl stabilní.

Commits to Cherry-pick

• 0fd4a283 (remove obsolete snapshots)
• 09363432 (security fix)
• e4fafe65, 6c64e85a (issue templates)

Note

Tyto commity jsou v origin/dev-v8.

[coderabbitai]

📝 CodeRabbit Plan Mode

Generate an implementation plan and prompts that you can use with your favorite coding agent.

✅ Successfully generated implementation plan.

💡 Use @coderabbitai <feedback> to replan

Examples

• Example 1
• Example 2

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord or schedule a call!

[coderabbitai]

Coding Plan

Approach

Cherry-pick four critical commits from origin/dev-v8 to dev-bun to ensure stability: snapshot cleanup, a security fix, and issue template updates.

Observations

This is a pnpm monorepo (Evolu project) with multiple packages under packages/ and applications under apps/. The testing infrastructure uses Vitest with snapshot testing capabilities. Issue templates are managed in .github/ISSUE_TEMPLATE/ using GitHub's YAML-based form templates. The dev-bun branch has diverged significantly from dev-v8 (9 commits vs 2352 commits ahead of their common merge-base), indicating substantial architectural differences between branches.

Assumptions

Assumption 1: Security Fix File Existence

Options Considered:

• Skip the security fix cherry-pick entirely since the file doesn't exist
• Investigate if equivalent vulnerable code exists elsewhere in dev-bun's architecture and apply the fix manually
• Document the situation and defer the decision to later investigation

Chosen Option: Skip the security fix cherry-pick and document the situation

Rationale: Since the file has no history in the repository and doesn't exist on any branch, the vulnerability likely doesn't exist in dev-bun's current architecture. This avoids introducing unnecessary complexity and aligns with the principle of only building what's actually needed.

Assumption 2: Issue Template Cherry-Pick Strategy

Options Considered:

• Cherry-pick both commits (will create conflicts since file already exists)
• Cherry-pick only e4fafe6 (formatting fix only, since content already exists)
• Skip both if dev-bun's version is equivalent

Chosen Option: Cherry-pick only e4fafe6 (the formatting fix)

Rationale: Since dev-bun already has the bug report template with the correct content structure, only the formatting improvement is needed. This minimizes conflicts and focuses on the actual beneficial change—converting list formatting from - to - for proper Markdown syntax.

💡 User Tips

Regenerate the plan with different choices with @coderabbitai <feedback>.

Implementation Steps

Phase 1: Pre-Cherry-Pick Verification

Validate the current state of dev-bun and confirm which cherry-picks are applicable to avoid unnecessary work or conflicts.

Task 1: Check Out and Verify dev-bun Branch State

Ensure you're working on the correct branch and understand its current state.

• Check out the dev-bun branch from origin if not already local
• Verify the current HEAD commit matches the expected state (a0b1420 from exploration findings)
• Confirm the branch is up-to-date with origin/dev-bun

Task 2: Verify Target File Existence

Confirm which files from the cherry-pick commits actually exist on dev-bun to avoid cherry-picking commits that modify non-existent files.

• Verify packages/common/test/local-first/__snapshots__/Db.test.ts.snap exists (confirmed in exploration: it exists)
• Verify packages/common/test/local-first/__snapshots__/Evolu.test.ts.snap exists (confirmed in exploration: it exists)
• Verify .github/ISSUE_TEMPLATE/bug_report.md exists and examine its formatting (confirmed: exists with old - format)
• Document that apps/web/src/mdx/searchIndex.js does not exist and the security fix commit (0936343) will be skipped

🤖 Prompt for AI agents

Verify the dev-bun branch state and confirm which cherry-pick commits are
applicable.

Check out dev-bun branch and verify HEAD is at a0b1420c
Ensure branch is synced with origin/dev-bun
Confirm existence of snapshot files:
packages/common/test/local-first/__snapshots__/Db.test.ts.snap and
Evolu.test.ts.snap
Confirm .github/ISSUE_TEMPLATE/bug_report.md exists
Document that apps/web/src/mdx/searchIndex.js does not exist (security fix
commit 09363432 will be skipped)

Phase 2: Apply Snapshot Cleanup

Remove obsolete snapshot files that are no longer needed in the test suite.

Task 1: Cherry-Pick Snapshot Removal Commit

Apply the commit that removes outdated test snapshots.

• Cherry-pick commit 0fd4a28 from origin/dev-v8
• This commit deletes packages/common/test/local-first/__snapshots__/Db.test.ts.snap (216 lines)
• This commit deletes packages/common/test/local-first/__snapshots__/Evolu.test.ts.snap (144 lines)
• No test file modifications are included—this is a pure snapshot cleanup

Task 2: Verify Test Suite After Snapshot Removal

Ensure removing these snapshots doesn't break the test suite.

• Run the test suite for packages/common using pnpm test or equivalent
• Verify that tests previously using these snapshots still pass (they should use inline snapshots or have been updated in earlier commits)
• Commit the cherry-pick if tests pass

🤖 Prompt for AI agents

Cherry-pick snapshot cleanup commit and verify test stability.

Cherry-pick commit 0fd4a283 from origin/dev-v8
This removes two snapshot files: Db.test.ts.snap (216 lines) and
Evolu.test.ts.snap (144 lines)
Run pnpm test in packages/common to verify tests still pass
Commit the cherry-pick if successful

Phase 3: Apply Issue Template Formatting Fix

Update the bug report template to use proper Markdown list formatting.

Task 1: Cherry-Pick Issue Template Formatting Commit

Apply only the formatting improvement commit since dev-bun already has the template content.

• Cherry-pick commit e4fafe6 from origin/dev-v8 (skip 6c64e85 since file already exists)
• This commit changes list item formatting in .github/ISSUE_TEMPLATE/bug_report.md from - OS: to - OS: (removes leading space)
• Affects 7 list items in the Desktop and Smartphone sections
• If cherry-pick succeeds cleanly, commit; if there are conflicts, they should be trivial formatting differences

Task 2: Resolve Any Formatting Conflicts (If Needed)

Handle potential conflicts if dev-bun's template has diverged slightly from the expected state.

• If conflicts occur, accept the incoming changes (proper - formatting without leading space)
• Verify the template renders correctly in GitHub's issue form preview
• Ensure all required fields and structure remain intact

🤖 Prompt for AI agents

Cherry-pick issue template formatting fix and resolve any conflicts.

Cherry-pick commit e4fafe65 from origin/dev-v8 (skip 6c64e85a since file already
exists)
This fixes list formatting in .github/ISSUE_TEMPLATE/bug_report.md by removing
leading spaces
If conflicts occur, accept incoming changes for proper Markdown formatting (` -
` to `-`)
Verify template renders correctly

Phase 4: Documentation and Validation

Document decisions made during cherry-picking and verify the branch is stable.

Task 1: Document Skipped Security Fix

Create clear documentation about why the security fix commit was not applied.

• Add a commit message or PR description explaining that commit 0936343 was skipped
• Document that apps/web/src/mdx/searchIndex.js does not exist on dev-bun or any branch in the repository
• Note that the regex vulnerability (incomplete multi-character sanitization) is not applicable to dev-bun's current architecture
• If the web app search functionality exists in dev-bun, reference its current implementation location for context

Task 2: Run Full Test Suite and Validation

Ensure all changes are integrated correctly and the branch remains stable.

• Run the full monorepo test suite using pnpm test or pnpm -r test for all workspaces
• Verify no new test failures were introduced by the snapshot removal
• Check that the issue template changes don't break GitHub's template validation (can be tested by attempting to create a new issue)
• Update any relevant documentation about the cherry-pick process

Task 3: Final Commit and Push

Finalize the cherry-picked changes and push to origin.

• Ensure all cherry-picks are properly committed with clear commit messages
• Push the updated dev-bun branch to origin/dev-bun
• Verify the branch builds successfully in CI (if applicable)

🤖 Prompt for AI agents

Document skipped commits, validate all changes, and finalize the branch.

Create documentation explaining commit 09363432 was skipped
(apps/web/src/mdx/searchIndex.js doesn't exist)
Note the regex vulnerability is not applicable to dev-bun architecture
Run full test suite with pnpm test or pnpm -r test
Verify issue template is valid
Ensure all cherry-picks have clear commit messages
Push updated dev-bun branch to origin

---

🚀 Next Steps

🤖 All AI agent prompts combined

Task: 1

Verify the dev-bun branch state and confirm which cherry-pick commits are
applicable.

Check out dev-bun branch and verify HEAD is at a0b1420c
Ensure branch is synced with origin/dev-bun
Confirm existence of snapshot files:
packages/common/test/local-first/__snapshots__/Db.test.ts.snap and
Evolu.test.ts.snap
Confirm .github/ISSUE_TEMPLATE/bug_report.md exists
Document that apps/web/src/mdx/searchIndex.js does not exist (security fix
commit 09363432 will be skipped)
===============================================================================

Task: 2

Cherry-pick snapshot cleanup commit and verify test stability.

Cherry-pick commit 0fd4a283 from origin/dev-v8
This removes two snapshot files: Db.test.ts.snap (216 lines) and
Evolu.test.ts.snap (144 lines)
Run pnpm test in packages/common to verify tests still pass
Commit the cherry-pick if successful
===============================================================================

Task: 3

Cherry-pick issue template formatting fix and resolve any conflicts.

Cherry-pick commit e4fafe65 from origin/dev-v8 (skip 6c64e85a since file already
exists)
This fixes list formatting in .github/ISSUE_TEMPLATE/bug_report.md by removing
leading spaces
If conflicts occur, accept incoming changes for proper Markdown formatting (` -
` to `-`)
Verify template renders correctly
===============================================================================

Task: 4

Document skipped commits, validate all changes, and finalize the branch.

Create documentation explaining commit 09363432 was skipped
(apps/web/src/mdx/searchIndex.js doesn't exist)
Note the regex vulnerability is not applicable to dev-bun architecture
Run full test suite with pnpm test or pnpm -r test
Verify issue template is valid
Ensure all cherry-picks have clear commit messages
Push updated dev-bun branch to origin

💡 Iterate on the plan with: @coderabbitai <feedback>

Example Feedback
- @coderabbitai You can skip phase 3. Add a simple unit test case for phase 2.
- @coderabbitai For assumption 1 go ahead with option 3 and replan.

---

💬 Have feedback or questions? Drop into our discord or schedule a call!