Merge pull request #63578 from nextcloud/dependabot/npm_and_yarn/build/frontend-legacy/dompurify-3.4.14

build(deps): bump dompurify from 3.4.13 to 3.4.14 in /build/frontend-legacy

Author: github-actions[bot]

build/frontend-legacy/package-lock.json

@@ -62,7 +62,7 @@
     "core-js": "^3.50.0",
     "crypto-browserify": "^3.12.1",
     "debounce": "^3.0.0",
-    "dompurify": "^3.4.13",
+    "dompurify": "^3.4.14",
     "escape-html": "^1.0.3",
     "focus-trap": "^8.2.2",
     "is-svg": "^6.1.0",

build/frontend-legacy/package.json

@@ -9,3 +9,15 @@
 	border: 0;
 }
 
+/* ---- LIBRARY FIXES ---- */
+
+/**
+ * TODO: Hotfix for https://github.com/nextcloud-libraries/nextcloud-vue/issues/8783
+ *
+ * NcSelect appends its dropdown to the body, but `--vs-dropdown-z-index` is only
+ * set on the select itself, so the dropdown falls back to the vue-select default
+ * of 1000 and ends up behind modals (z-index 9998 and above).
+ */
+.nc-select__dropdown.vs__dropdown-menu {
+	--vs-dropdown-z-index: 9999;
+}

core/css/fixes.scss

@@ -14,7 +14,7 @@ test.describe('Files: Delete', () => {
 		const row = filesListPage.getRowForFile('file.txt')
 		await expect(row).toBeVisible()
 		// Preview must finish loading before delete — a loading preview can lock the file
-		await expect(row.locator('.files-list__row-icon-preview--loaded')).toBeVisible()
+		await filesListPage.waitForPreviewLoaded('file.txt')
 
 		const deleteResponse = page.waitForResponse(
 			(r) => r.url().includes('/remote.php/dav/files/') && r.request().method() === 'DELETE',

tests/playwright/e2e/files/files-delete.spec.ts

@@ -14,12 +14,15 @@ const SHARE_NAME = 'shared'
  * by a guest.
  */
 test.describe('files_sharing: Public share - copy, move and rename files', () => {
-	test.beforeEach(async ({ user, ownerRequest, publicShare }) => {
+	test.beforeEach(async ({ user, ownerRequest, publicShare, filesListPage }) => {
 		await seedSharedFolder(ownerRequest, user, SHARE_NAME)
 		const share = await createLinkShare(ownerRequest, `/${SHARE_NAME}`, {
 			permissions: BUNDLED_PERMISSIONS.UPLOAD_AND_UPDATE,
 		})
 		await publicShare.open(share.url)
+		// Every test moves, copies or renames foo.txt, so its preview has to be
+		// loaded first — a preview being generated locks the file on the server.
+		await filesListPage.waitForPreviewLoaded('foo.txt')
 	})
 
 	test('can copy a file to another folder', async ({ page, filesListPage, copyMoveDialog }) => {

tests/playwright/e2e/files_sharing/public-share/copy-move-rename-files.spec.ts

@@ -311,6 +311,17 @@ export class FilesListPage {
 		await moved
 	}
 
+	/**
+	 * Wait for a row's preview thumbnail to be loaded.
+	 *
+	 * Generating a preview locks the file on the server, so a MOVE, COPY or
+	 * DELETE issued while the thumbnail is still being fetched fails with a
+	 * `LockedException`. Await this before any action that writes to the file.
+	 */
+	async waitForPreviewLoaded(filename: string): Promise<void> {
+		await expect(this.getRowForFile(filename).locator('.files-list__row-icon-preview--loaded')).toBeVisible()
+	}
+
 	getFavoriteIconForFile(filename: string): Locator {
 		return this.getRowForFile(filename).getByRole('img', { name: 'Favorite' })
 	}