Sync with upstream

.github/workflows/baseimage.yaml

@@ -31,7 +31,7 @@ jobs:
                 "containerd-snapshotter": true
               }
             }
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 1
           filter: tree:0

.github/workflows/main.yml

@@ -68,7 +68,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.inputs.ref || github.ref }}
           fetch-depth: 0
@@ -78,7 +78,7 @@ jobs:
         with:
           node-version-file: '.nvmrc'
       - name: Cache node modules
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         env:
           cache-name: cache-node-platform
         with:
@@ -127,7 +127,7 @@ jobs:
         run: node common/scripts/install-run-rush.js validate
 
       - name: Cache build results
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         env:
           cache-name: cache-build-results
         with:
@@ -139,7 +139,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           filter: tree:0
@@ -150,7 +150,7 @@ jobs:
           node-version-file: '.nvmrc'
 
       - name: Cache build results
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         env:
           cache-name: cache-build-results
         with:
@@ -165,15 +165,15 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           submodules: recursive
       - uses: actions/setup-node@v6
         with:
           node-version-file: '.nvmrc'
       - name: Cache build results
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         env:
           cache-name: cache-build-results
         with:
@@ -196,7 +196,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           filter: tree:0
@@ -205,7 +205,7 @@ jobs:
         with:
           node-version-file: '.nvmrc'
       - name: Cache build results
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         env:
           cache-name: cache-build-results
         with:
@@ -234,7 +234,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           filter: tree:0
@@ -243,7 +243,7 @@ jobs:
         with:
           node-version-file: '.nvmrc'
       - name: Cache node modules
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         env:
           cache-name: cache-node-platform
         with:
@@ -322,7 +322,7 @@ jobs:
           name: playwright-results
           path: ./tests/sanity/playwright-report/
       # - name: Get Allure history
-      #   uses: actions/checkout@v6
+      #   uses: actions/checkout@v7
       #   if: ${{ github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v') }}
       #   continue-on-error: true
       #   with:
@@ -366,7 +366,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           filter: tree:0
@@ -375,7 +375,7 @@ jobs:
         with:
           node-version-file: '.nvmrc'
       - name: Cache node modules
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         env:
           cache-name: cache-node-platform
         with:
@@ -463,7 +463,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           filter: tree:0
@@ -472,7 +472,7 @@ jobs:
         with:
           node-version-file: '.nvmrc'
       - name: Cache node modules
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         env:
           cache-name: cache-node-platform
         with:
@@ -544,7 +544,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           filter: tree:0
@@ -553,7 +553,7 @@ jobs:
         with:
           node-version-file: '.nvmrc'
       - name: Cache node modules
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         env:
           cache-name: cache-node-platform
         with:
@@ -641,7 +641,7 @@ jobs:
     timeout-minutes: 60
     steps:
       # https://github.com/actions/runner-images/issues/2840#issuecomment-790492173
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           filter: tree:0
@@ -674,7 +674,7 @@ jobs:
         with:
           version: 10
       - name: Cache node modules
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         env:
           cache-name: cache-node-platform
         with:
@@ -744,7 +744,7 @@ jobs:
     runs-on: macos-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           filter: tree:0
@@ -755,7 +755,7 @@ jobs:
           node-version-file: '.nvmrc'
 
       - name: Cache node modules
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         env:
           cache-name: node
         with:
@@ -847,7 +847,7 @@ jobs:
     runs-on: macos-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           filter: tree:0
@@ -858,7 +858,7 @@ jobs:
           node-version-file: '.nvmrc'
 
       - name: Cache node modules
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         env:
           cache-name: node
         with:
@@ -949,15 +949,15 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.inputs.ref || github.ref }}
           fetch-depth: 0
       - uses: actions/setup-node@v6
         with:
           node-version-file: '.nvmrc'
       - name: Cache node modules
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         env:
           cache-name: cache-node-platform
         with:

.github/workflows/publish-npm.yml

@@ -15,15 +15,15 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.inputs.ref }}
           fetch-depth: 0
       - uses: actions/setup-node@v6
         with:
           node-version-file: '.nvmrc'
       - name: Cache node modules
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         env:
           cache-name: cache-node-platform
         with:

SECURITY.md

@@ -0,0 +1,27 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+We take security seriously. If you discover a security vulnerability in the
+Huly Platform, please report it privately — **do not open a public issue.**
+
+Use GitHub's private vulnerability reporting:
+
+1. Go to the [Security tab](https://github.com/hcengineering/platform/security) of this repository.
+2. Click **"Report a vulnerability"**.
+3. Fill in the advisory with as much detail as possible (affected component,
+   reproduction steps, impact, suggested fix if any).
+
+We'll acknowledge your report, investigate, and coordinate a fix and
+disclosure timeline with you before any public disclosure.
+
+## Supported Versions
+
+Security fixes are applied to the latest release on the `main`/`develop`
+branch. Older versions are not guaranteed to receive patches.
+
+## Scope
+
+This policy covers the code in this repository. Vulnerabilities in
+third-party dependencies should be reported upstream, though we're happy to
+hear about them too if they affect the Platform directly.

desktop/src/ui/findInPageBar.ts

@@ -358,6 +358,7 @@ const shadowStyles = `
   font-variant-numeric: tabular-nums;
   text-align: right;
   color: rgba(0, 0, 0, 0.52);
+  -webkit-user-select: none;
   user-select: none;
   flex-shrink: 0;
 }

desktop/src/ui/index.ejs

@@ -96,6 +96,7 @@
             cursor: pointer;
             font-size: 13px;
             position: relative;
+            -webkit-user-select: none;
             user-select: none;
             align-items: normal; /* explicitly set this up to prevent values from above */
         }
@@ -151,6 +152,7 @@
             text-align: left;
             cursor: pointer;
             font-size: 13px;
+            -webkit-user-select: none;
             user-select: none;
         }
 
@@ -185,6 +187,7 @@
             font-size: 13px;
             line-height: 32px;
             color: var(--text-primary);
+            -webkit-user-select: none;
             user-select: none;
             -webkit-app-region: drag;
             white-space: nowrap;
@@ -208,6 +211,7 @@
             display: flex;
             align-items: center;
             justify-content: center;
+            -webkit-user-select: none;
             user-select: none;
         }