chore(deps): Bump the minor-and-patch group across 1 directory with 8 updates - #9
Closed
dependabot[bot] wants to merge 17 commits into
Closed
Conversation
Apache-2.0 licensing (REUSE-compliant), OSPO community files, Conventional Commits enforcement via commitlint/husky, CI workflow covering frontend/backend/e2e jobs, and the local dev docker-compose stack (oCIS + Traefik + ai-llm-proxy + this backend), all based on owncloud/web-app-skeleton's conventions. Signed-off-by: Lukas Hirt <info@hirt.cz>
Extension entry point registers AI Workflows as a full app (nav item + own routes), scaffolded from web-app-skeleton's defineWebApplication pattern. Adds a workflow list view backed by the Graph-shaped backend CRUD API, and a Vue Flow canvas for building trigger/LLM/action node graphs. No execution yet — that lands with the backend graph interpreter. Signed-off-by: Lukas Hirt <info@hirt.cz>
Standalone HTTP service (chi router, stdlib log/slog, no ocis-pkg or reva dependency) that validates bearer tokens itself against oCIS's IdP userinfo endpoint, exactly like a well-behaved external sidecar. Workflow definitions are persisted as JSON via WebDAV in the caller's own oCIS space (no NATS, no system-user credential, no internal gRPC), with a /me/workflows CRUD surface shaped after oCIS's Graph API conventions (value-wrapped collections, PATCH updates, Graph-style error envelopes). Signed-off-by: Lukas Hirt <info@hirt.cz>
Two issues found while getting the builder canvas working against a real oCIS Web instance: (1) vue-router isn't among extension-sdk's externalized deps, so importing useRouter/useRoute from 'vue-router' directly bundles a second, disconnected router instance whose injection silently resolves to undefined — switched to @ownclouders/web-pkg's useRouter/useRoute, which share the host app's actual router; (2) client-side navigation into this app's :id sub-route throws inside Web's persistent-layout sidebar code (a resource-injection assumption unrelated to this app), so list<->builder navigation uses a hard navigation instead, which is proven reliable. Also excludes tests/e2e from vitest's default include pattern, since extension-sdk's own exclude list only accounts for a top-level e2e/ directory. Signed-off-by: Lukas Hirt <info@hirt.cz>
LLM calls are now made directly by the backend against a configured LLM_ENDPOINT/LLM_API_KEY — no external ai-llm-proxy service, no web-extensions sibling checkout needed for local dev. Extends the dev docker-compose stack with the workflows backend as a Traefik-routed sidecar (path-prefixed + stripped, same pattern ai-llm-proxy used to occupy) and enables PROXY_ENABLE_APP_AUTH/auth-app on the oCIS container, since background/automated workflow runs will authenticate via oCIS app-passwords now that LLM calls no longer require a real IdP-issued token to reach an external validator. Signed-off-by: Lukas Hirt <info@hirt.cz>
Backend suite (build-tagged e2e) makes real HTTP calls through Traefik against the live compose stack and asserts on Graph-shaped responses — no mocks. Frontend suite drives a real browser through login, building a trigger->LLM->action graph on the Vue Flow canvas, and saving it. Both share get-token.ts, a small headless-Playwright script that logs in through oCIS's real sign-in page: the IdP hashes credentials client-side, so there is no plain HTTP request to replay to obtain a token, and a real browser session is the only practical way to get one. All actual assertions in the backend suite are still plain Go net/http against the real API. Signed-off-by: Lukas Hirt <info@hirt.cz>
Per explicit direction: n8n's UX, not its branding/colors. Replaces the fixed "Add LLM step"/"Add action" toolbar with a searchable, categorized node-type picker triggered by "+" (on an empty canvas or on a node's output handle, auto-connecting when opened from a node). Node cards on the canvas are now compact and display-only; clicking one opens a Node Details View modal for configuration instead of inline form fields. Top bar gains an inline-editable workflow name and an Active/Inactive toggle. Adds a minimap and re-fits the viewport after each node is added, since newly added nodes otherwise render further right each time without ever re-centering. Also fixes two bugs the rework's e2e coverage caught: a v-model directive ordering lint warning, and a template attribute with literal double quotes inside a double-quoted HTML attribute that vue-tsc rejected as a syntax error. Signed-off-by: Lukas Hirt <info@hirt.cz>
The single interpreter every workflow run (manual/scheduled/event)
goes through: walks a workflow's trigger->llm->action graph, calling
this backend's own directly-configured LLM_ENDPOINT for llm nodes
(pkg/llm, no external proxy) and oCIS's WebDAV/Graph APIs for action
nodes with the run's own token. {{file.name}}/{{file.content}}/
{{llm.output}} template variables are substituted into prompts and
action params; node/edge "condition" fields are stored but not yet
evaluated (every reachable node runs unconditionally for now).
Action handlers (pkg/webdavfile, pkg/ocisclient/tags.go):
- tag: real Graph tags API. Resolving a WebDAV path to the Graph
resourceId turned out to need a PROPFIND for the oc:fileid WebDAV
property, not a Graph path-lookup endpoint — Graph has none.
- move/copy/rename: real WebDAV MOVE/COPY.
- comment: oCIS has no native file-comments API, unlike tags — this
writes a JSON sidecar list under the user's own .workflows/
folder instead. Real and retrievable, documented as not visible in
oCIS Web's own UI, not a stub.
- notify: github.com/unraid/apprise-go (BSD-2-Clause, see NOTICE.md),
100+ integrations behind one target-URL scheme, with an SSRF guard
on the generic webhook schemes.
Execution history is stored the same way workflow definitions are —
JSON via WebDAV in the caller's own space — and the run endpoint
responds the way a real Graph async action would (202 + Location),
even though execution is currently synchronous.
Adds a fake-llm fixture (cmd/fakellm, a ~30-line OpenAI-compatible
stub) to the dev stack so it — and its e2e suite — never depend on a
real LLM provider being reachable.
Signed-off-by: Lukas Hirt <info@hirt.cz>
New "Executions" panel: a resourcePath input + Run now button, and the run history below it (status pill, per-node results). runWorkflow parses the execution id out of the 202 response's Location header rather than assuming a body, matching the backend's Graph-style async action shape. Signed-off-by: Lukas Hirt <info@hirt.cz>
Backend: uploads a real file, runs a trigger->llm->tag graph through the real API, and asserts the tag actually landed by reading it back over WebDAV — no mocks. Frontend: builds and saves a workflow through the UI, runs it via the Executions panel, and asserts success and the LLM output render. Also fixes both existing specs to clean up the workflows/files they create (build-workflow.spec.ts now does it via the UI's own delete button, exercising that flow too) — a prior run left test data behind that only surfaced when checking the store by hand. Signed-off-by: Lukas Hirt <info@hirt.cz>
…oken webdavstore, webdavfile, and ocisclient all hard-coded "Bearer "+token when setting the Authorization header. Scheduled/event-triggered runs (next up) authenticate to oCIS with an app-password over HTTP Basic, not a bearer token, so these packages now take the full header value as-is and every call site formats it. Manual runs are unaffected — callers just now write "Bearer "+token explicitly instead of it being implicit three packages down. Signed-off-by: Lukas Hirt <info@hirt.cz>
Enabling automation (POST /me/automation) mints an oCIS app-password via auth-app using the caller's own live token in the same request — no separate consent redirect needed, since the user is already authenticated to our API at that moment. The credential is encrypted (AES-256-GCM, pkg/secretbox) and stored in a new local SQLite database (pkg/localdb, pure-Go driver) — this is the sidecar's own operational state, not user content, so it never goes through any oCIS API. A background scheduler (pkg/scheduler) polls a denormalized trigger index for due schedule-triggered workflows and runs them through the same executor as manual runs, authenticating via the owner's stored app-password over HTTP Basic — no live session involved. The trigger index is kept in sync automatically whenever a workflow with a schedule/event trigger is created, updated, or deleted. Verified end-to-end against the real stack: connect mints a real app-password, a workflow scheduled for "every second" actually fires on its own using that stored credential, and disconnect revokes it. Cron expressions accept an optional leading seconds field (still backwards compatible with classic 5-field syntax) — mainly so tests (and anyone who wants sub-minute schedules) aren't stuck waiting on minute boundaries. Signed-off-by: Lukas Hirt <info@hirt.cz>
Automation is per-user, not per-workflow, so it's a status pill and toggle button in the workflow list header rather than anything per-row: shows whether background execution is enabled and lets the user connect (mint an app-password) or disconnect (revoke it) it. test(e2e): cover automation and scheduled execution end-to-end Backend: connects automation (mints a real auth-app token), verifies status, disconnects (revokes it) — then separately, creates a schedule-triggered workflow and polls until it actually fires on its own via the background scheduler, authenticated with the stored app-password, no live session involved. Frontend: exercises the connect/disconnect UI, including that the connected state survives a page reload. Signed-off-by: Lukas Hirt <info@hirt.cz>
Add a per-user SSE consumer manager that reconciles against the trigger index and runs event-triggered workflows through the same executor manual/scheduled runs use, resolving SSE spaceId/itemId payloads to WebDAV paths via Graph's drive-item-by-id endpoint. No NATS client is involved anywhere in the process. Guard event matching against this backend's own .workflows bookkeeping writes (workflow definitions, execution records) - without it, an event trigger with no path filter is indistinguishable from a real upload and re-triggers itself on every execution it records. Also fixes a schema migration gap: trigger_index rows created before this milestone lacked the new path_prefix/extension columns, and CREATE TABLE IF NOT EXISTS is a no-op against an existing table. Signed-off-by: Lukas Hirt <info@hirt.cz>
Backend: connect automation, create an upload-triggered workflow scoped to a path/extension filter, upload a matching file over WebDAV, and assert the workflow fires on its own via the SSE consumer - no manual/scheduled trigger involved. Frontend: build a workflow with a File Event Trigger node, configure its event type and path filter through the Node Details panel, and confirm both persist across a reload. Widen the scheduled-trigger test's polling window: with the SSE manager now running continuously alongside the scheduler, first-fire latency under load comfortably exceeds the original 25s budget. Signed-off-by: Lukas Hirt <info@hirt.cz>
Add a reuse job running fsfe/reuse-action so REUSE/SPDX compliance is enforced on every push and PR, not just checked manually. Fixes the one pre-existing gap it surfaces: LICENSES/BSD-2-Clause.txt (bundled for apprise-go's redistribution requirement, since it's statically linked into the backend binary) wasn't referenced by any SPDX tag, since apprise-go itself isn't vendored into this repo - tag NOTICE.md, the file that documents it, with the combined license identifier. Add a dependency license check to the frontend CI job (scripts/check-licenses.mjs, via `pnpm licenses list --json`) that fails on any GPL/AGPL/LGPL/MPL-family dependency other than @ownclouders/* - ownCloud Web's own AGPL-3.0 SDK, unavoidable for any Web extension and already an accepted, load-bearing dependency here. Drop the stable-* branch trigger: there's no such branch in this repo. Signed-off-by: Lukas Hirt <info@hirt.cz>
… updates Bumps the minor-and-patch group with 8 updates in the /frontend directory: | Package | From | To | | --- | --- | --- | | [vue](https://github.com/vuejs/core) | `3.5.39` | `3.5.40` | | [vue-router](https://github.com/vuejs/router) | `5.1.0` | `5.2.0` | | [@ownclouders/eslint-config](https://github.com/owncloud/web/tree/HEAD/packages/eslint-config) | `12.3.2` | `12.5.0` | | [@ownclouders/extension-sdk](https://github.com/owncloud/web/tree/HEAD/packages/extension-sdk) | `12.3.2` | `12.5.0` | | [happy-dom](https://github.com/capricorn86/happy-dom) | `20.10.6` | `20.11.0` | | [prettier](https://github.com/prettier/prettier) | `3.8.3` | `3.9.5` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.7` | `4.1.10` | | [vue-tsc](https://github.com/vuejs/language-tools/tree/HEAD/packages/tsc) | `3.3.2` | `3.3.7` | Updates `vue` from 3.5.39 to 3.5.40 - [Release notes](https://github.com/vuejs/core/releases) - [Changelog](https://github.com/vuejs/core/blob/main/CHANGELOG.md) - [Commits](vuejs/core@v3.5.39...v3.5.40) Updates `vue-router` from 5.1.0 to 5.2.0 - [Release notes](https://github.com/vuejs/router/releases) - [Commits](vuejs/router@v5.1.0...v5.2.0) Updates `@ownclouders/eslint-config` from 12.3.2 to 12.5.0 - [Release notes](https://github.com/owncloud/web/releases) - [Changelog](https://github.com/owncloud/web/blob/master/CHANGELOG.md) - [Commits](https://github.com/owncloud/web/commits/v12.5.0/packages/eslint-config) Updates `@ownclouders/extension-sdk` from 12.3.2 to 12.5.0 - [Release notes](https://github.com/owncloud/web/releases) - [Changelog](https://github.com/owncloud/web/blob/master/CHANGELOG.md) - [Commits](https://github.com/owncloud/web/commits/v12.5.0/packages/extension-sdk) Updates `happy-dom` from 20.10.6 to 20.11.0 - [Release notes](https://github.com/capricorn86/happy-dom/releases) - [Commits](capricorn86/happy-dom@v20.10.6...v20.11.0) Updates `prettier` from 3.8.3 to 3.9.5 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.8.3...3.9.5) Updates `vitest` from 4.1.7 to 4.1.10 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest) Updates `vue-tsc` from 3.3.2 to 3.3.7 - [Release notes](https://github.com/vuejs/language-tools/releases) - [Changelog](https://github.com/vuejs/language-tools/blob/master/CHANGELOG.md) - [Commits](https://github.com/vuejs/language-tools/commits/v3.3.7/packages/tsc) --- updated-dependencies: - dependency-name: vue dependency-version: 3.5.40 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: vue-router dependency-version: 5.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@ownclouders/eslint-config" dependency-version: 12.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@ownclouders/extension-sdk" dependency-version: 12.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: happy-dom dependency-version: 20.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: prettier dependency-version: 3.9.5 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: vitest dependency-version: 4.1.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: vue-tsc dependency-version: 3.3.7 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Contributor
Author
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
dependabot
Bot
deleted the
dependabot/npm_and_yarn/frontend/minor-and-patch-47d6183fb7
branch
July 20, 2026 11:52
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the minor-and-patch group with 8 updates in the /frontend directory:
3.5.393.5.405.1.05.2.012.3.212.5.012.3.212.5.020.10.620.11.03.8.33.9.54.1.74.1.103.3.23.3.7Updates
vuefrom 3.5.39 to 3.5.40Release notes
Sourced from vue's releases.
Changelog
Sourced from vue's changelog.
Commits
fa2885drelease: v3.5.4020c9d26fix(compiler-core): avoid leaking slot branch keys (#15051)7da6334Revert "fix(runtime-core): pause tracking when invoking function refs" (#15094)90aecb1chore(deps): update all non-major dependencies (#15026)97f3525fix(runtime-core): skip lazy hydration for detached roots (#15092)fe1c0f8chore(deps): update test (#15025)e41c45achore(deps): update dependency conventional-changelog to v8 (#15078)3eb66a9chore(deps): update actions/cache action to v6 (#15076)40178ddchore(deps): update lint (#15075)7f122b9chore(deps): update dependency conventional-changelog-angular to v9 (#15079)Updates
vue-routerfrom 5.1.0 to 5.2.0Release notes
Sourced from vue-router's releases.
Commits
6e5f8d2release: vue-router@5.2.01653533fix: allow pinia 4f634b2fdocs: improve compatd4319bechore: up ts where possibleb5b5f94ci: pin image680e905ci: update playwright image385ca6bchore: up lint, babel and others92ff264chore: up deps minor and patchesfeed382ci: bump the actions group with 3 updates (#2745)4d96741fix(unplugin): reject invalid hex digits in [x+hh] character codes (#2744)Updates
@ownclouders/eslint-configfrom 12.3.2 to 12.5.0Release notes
Sourced from @ownclouders/eslint-config's releases.
... (truncated)
Changelog
Sourced from @ownclouders/eslint-config's changelog.
... (truncated)
Commits
b16a34f[full-ci] chore: prepare final release from web repo (#13930)be0f6acChore/sync master branch with stable 12.4 (#13814)0215824chore: sync 12.3 branch changelog and version (#13729)ba19f2dfix(deps): update linters6e4fcf5Revert "Merge pull request #13521 from owncloud/chore/revert-changes-to-master"69b4edcRevert "Merge pull request #13519 from owncloud/stable-12.3"Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@ownclouders/eslint-configsince your current version.Updates
@ownclouders/extension-sdkfrom 12.3.2 to 12.5.0Release notes
Sourced from @ownclouders/extension-sdk's releases.
... (truncated)
Changelog
Sourced from @ownclouders/extension-sdk's changelog.
... (truncated)
Commits
b16a34f[full-ci] chore: prepare final release from web repo (#13930)be0f6acChore/sync master branch with stable 12.4 (#13814)0215824chore: sync 12.3 branch changelog and version (#13729)02ec681fix(deps): update dependency@vitejs/plugin-vueto ^6.0.6 (#13700)06dab4ffix(deps): update dependency@vitejs/plugin-vueto ^6.0.56e4fcf5Revert "Merge pull request #13521 from owncloud/chore/revert-changes-to-master"69b4edcRevert "Merge pull request #13519 from owncloud/stable-12.3"Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@ownclouders/extension-sdksince your current version.Updates
happy-domfrom 20.10.6 to 20.11.0Release notes
Sourced from happy-dom's releases.
Commits
bffe73achore: #2243 Fixes problem with canvas in release build (#2245)9b46f5echore: #2243 Fixes problem with canvas in release build (#2244)f9c57a5feat: #1864 Adds support for CookieStore API (#2040)a4c4faffeat: #1506 Adds support for Element checkVisibility (#2223)Updates
prettierfrom 3.8.3 to 3.9.5Release notes
Sourced from prettier's releases.
Changelog
Sourced from prettier's changelog.
... (truncated)
Commits
b6c7d18Release 3.9.5cd54cccAvoid corrupting empty Markdown link with title (#19487)2bb67cePreserving comments'placementproperty (#19567)91bcac8Add more tests for comment-only object type (#19587)cbee737Remove space in empty object type (#19583)6394c73Align empty module declaration with TS (#19568)a4e6f7aPrevent the addition of space intype()with+(#19516)3d063b5Ignore dangling comments when checking type parameter comments (#19572)908503eHandle dangling comments inSwitchStatement(#19581)943a475Angular: Support expression for exhaustive typechecking (#19571)Updates
vitestfrom 4.1.7 to 4.1.10Release notes
Sourced from vitest's releases.
Commits
db616d2chore: release v4.1.10 (#10718)bae52b5fix(vm): fix external module resolve error with deps optimizer query for enco...a7a61e7chore: release v4.1.9 (#10598)934b0f5fix(pool): prevent test run hang on worker crash (#10543) [backport to v4] (#...7fb2965fix(browser): wait for orchestrator readiness before resolving browser sessio...a518019fix: fiximportOriginalwith optimizer and query import [backport to v4] (#...e61f2ddchore: release v4.1.8e4067b3fix(browser): disable clientcdpAPI whenallowWrite/allowExec: false[ba...Updates
vue-tscfrom 3.3.2 to 3.3.7Release notes
Sourced from vue-tsc's releases.
... (truncated)
Changelog
Sourced from vue-tsc's changelog.
... (truncated)
Commits
f6cc297v3.3.7 (#6120)26ceb0cchore: update deps4893ec6v3.3.6 (#6112)3abce61refactor: normalize regexp variable names toxxxREformatbff182afix(language-core): make generic component internal context inference type-sa...2fe255cv3.3.5 (#6102)043a77bv3.3.4 (#6095)5c41b5fv3.3.3 (#6079)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions