From d7b031d34bf376a5f1431e1846aecd2a3f0cd149 Mon Sep 17 00:00:00 2001 From: olerast <53008835+olerast67@users.noreply.github.com> Date: Fri, 30 Oct 2026 06:22:46 +0700 Subject: [PATCH 1/2] Release 1.1.7: zod 4.6.7 in dela-mcp, fast-uri 3.1.9, serialize-javascript 7.1.4 Replaces Dependabot #34-#36. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 4 ++++ apps/desktop/src-tauri/Cargo.lock | 2 +- apps/desktop/src-tauri/Cargo.toml | 2 +- apps/desktop/src-tauri/tauri.conf.json | 2 +- apps/mobile/android/app/build.gradle | 4 ++-- apps/mobile/package.json | 2 +- apps/server/src/app.ts | 2 +- apps/wear/app/build.gradle | 4 ++-- fastlane/metadata/android/en-US/changelogs/25.txt | 1 + fastlane/metadata/android/ru-RU/changelogs/25.txt | 1 + package-lock.json | 12 ++++++------ packages/mcp/package.json | 4 ++-- 12 files changed, 23 insertions(+), 17 deletions(-) create mode 100644 fastlane/metadata/android/en-US/changelogs/25.txt create mode 100644 fastlane/metadata/android/ru-RU/changelogs/25.txt diff --git a/CHANGELOG.md b/CHANGELOG.md index 7d4db65..e90c224 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,9 @@ # Changelog +## 1.1.7 + +- Security: dela-mcp now pins zod 4.6.7 (memory exhaustion on oversized constrained collections, GHSA for zod < 4.6.6) and the MCP SDK 1.32.2; fast-uri 3.1.9 and serialize-javascript 7.1.4 in the lockfile (Dependabot #34–#36). + ## 1.1.6 - Android: quick add opened from the widget or the quick settings tile now shows the keyboard right away; before, the field had the cursor but you had to tap it. diff --git a/apps/desktop/src-tauri/Cargo.lock b/apps/desktop/src-tauri/Cargo.lock index 8449e02..5232a3b 100644 --- a/apps/desktop/src-tauri/Cargo.lock +++ b/apps/desktop/src-tauri/Cargo.lock @@ -940,7 +940,7 @@ dependencies = [ [[package]] name = "dela-desktop" -version = "1.1.6" +version = "1.1.7" dependencies = [ "cpal", "libloading 0.9.0", diff --git a/apps/desktop/src-tauri/Cargo.toml b/apps/desktop/src-tauri/Cargo.toml index f5ce8f1..58f4e7f 100644 --- a/apps/desktop/src-tauri/Cargo.toml +++ b/apps/desktop/src-tauri/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "dela-desktop" -version = "1.1.6" +version = "1.1.7" description = "Dela, a task manager with end-to-end encryption" edition = "2021" license = "AGPL-3.0-only" diff --git a/apps/desktop/src-tauri/tauri.conf.json b/apps/desktop/src-tauri/tauri.conf.json index b99722e..5520774 100644 --- a/apps/desktop/src-tauri/tauri.conf.json +++ b/apps/desktop/src-tauri/tauri.conf.json @@ -1,7 +1,7 @@ { "$schema": "https://schema.tauri.app/config/2", "productName": "Dela", - "version": "1.1.6", + "version": "1.1.7", "identifier": "io.github.olerast67.dela", "build": { "frontendDist": "../../web/dist", diff --git a/apps/mobile/android/app/build.gradle b/apps/mobile/android/app/build.gradle index 13daf26..dd7c1bd 100644 --- a/apps/mobile/android/app/build.gradle +++ b/apps/mobile/android/app/build.gradle @@ -13,8 +13,8 @@ android { applicationId "io.github.olerast67.dela" minSdkVersion rootProject.ext.minSdkVersion targetSdkVersion rootProject.ext.targetSdkVersion - versionCode 24 - versionName "1.1.6" + versionCode 25 + versionName "1.1.7" testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner" // Встроенное обновление из выпусков GitHub. Сборка для F-Droid (-PdelaFdroid) его выключает: там обновляет F-Droid. buildConfigField "boolean", "SELF_UPDATE", project.hasProperty('delaFdroid') ? 'false' : 'true' diff --git a/apps/mobile/package.json b/apps/mobile/package.json index 1a002b6..3a9ceea 100644 --- a/apps/mobile/package.json +++ b/apps/mobile/package.json @@ -1,6 +1,6 @@ { "name": "dela-mobile", - "version": "1.1.6", + "version": "1.1.7", "private": true, "license": "AGPL-3.0-only", "dependencies": { diff --git a/apps/server/src/app.ts b/apps/server/src/app.ts index 2f2e478..4a5afb2 100644 --- a/apps/server/src/app.ts +++ b/apps/server/src/app.ts @@ -27,7 +27,7 @@ import { generateVapid, isAllowedEndpoint, loadVapid, sendPush } from './webpush import { newTotpSecret, otpauthUri, verifyTotp } from './totp.ts'; import { EMAIL_RE, UUID_RE, b64, bad, int, obj, optStr, str } from './validate.ts'; -export const VERSION = '1.1.6'; +export const VERSION = '1.1.7'; interface Auth { readonly userId: string; diff --git a/apps/wear/app/build.gradle b/apps/wear/app/build.gradle index 026229c..65e8738 100644 --- a/apps/wear/app/build.gradle +++ b/apps/wear/app/build.gradle @@ -39,8 +39,8 @@ android { // Wear OS 3 и новее. minSdk 30 targetSdk 36 - versionCode 12 - versionName '1.1.6' + versionCode 13 + versionName '1.1.7' // Часы — ARM; x86_64 только для эмулятора в отладочной сборке. ndk { abiFilters 'arm64-v8a', 'armeabi-v7a' } buildConfigField 'String', 'GIT_BUILD', "\"${buildId}\"" diff --git a/fastlane/metadata/android/en-US/changelogs/25.txt b/fastlane/metadata/android/en-US/changelogs/25.txt new file mode 100644 index 0000000..d05545e --- /dev/null +++ b/fastlane/metadata/android/en-US/changelogs/25.txt @@ -0,0 +1 @@ +Dependency security updates. diff --git a/fastlane/metadata/android/ru-RU/changelogs/25.txt b/fastlane/metadata/android/ru-RU/changelogs/25.txt new file mode 100644 index 0000000..f666cda --- /dev/null +++ b/fastlane/metadata/android/ru-RU/changelogs/25.txt @@ -0,0 +1 @@ +Обновления безопасности зависимостей. diff --git a/package-lock.json b/package-lock.json index 94f5317..5f2112e 100644 --- a/package-lock.json +++ b/package-lock.json @@ -5297,9 +5297,9 @@ "license": "MIT" }, "node_modules/fast-uri": { - "version": "3.1.8", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz", - "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==", + "version": "3.1.9", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.9.tgz", + "integrity": "sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==", "dev": true, "funding": [ { @@ -7912,9 +7912,9 @@ } }, "node_modules/serialize-javascript": { - "version": "7.1.2", - "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-7.1.2.tgz", - "integrity": "sha512-GL2BWwVa6JydKO6l/ljVgjAZF4QJ3S7dWDWi53s5GZT8PJzD2fNxi67HANQGKAqPrwEpL5ba7gUBGi0Ls/sEoQ==", + "version": "7.1.4", + "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-7.1.4.tgz", + "integrity": "sha512-FqlEuoTq/zRmA4Lg6aOqyH3lCHbUtCB0bmHCeFniX2GBdDqMJM3FwdvEhlE5Pim1dlt2FfBdVPmUNNiGhhKqpw==", "dev": true, "license": "BSD-3-Clause", "engines": { diff --git a/packages/mcp/package.json b/packages/mcp/package.json index a8dcdd6..f44a978 100644 --- a/packages/mcp/package.json +++ b/packages/mcp/package.json @@ -34,8 +34,8 @@ "prepack": "npm run build" }, "dependencies": { - "@modelcontextprotocol/sdk": "1.32.1", + "@modelcontextprotocol/sdk": "1.32.2", "libsodium-wrappers-sumo": "0.8.4", - "zod": "4.6.5" + "zod": "4.6.7" } } From 1aba8f0d1a9bff5c0e44991601ffdcd73955ea24 Mon Sep 17 00:00:00 2001 From: olerast <53008835+olerast67@users.noreply.github.com> Date: Fri, 30 Oct 2026 06:38:40 +0700 Subject: [PATCH 2/2] e2e: calendar drag tests no longer drop on a past day at the end of the month Both tests dropped onto the 28th of the current month. From the 29th on that day is in the past, the task becomes overdue and the calendar shows it on today, so the checks failed. Co-Authored-By: Claude Opus 5.5 --- e2e/calendar-views.spec.ts | 3 ++- e2e/calendar.spec.ts | 7 ++++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/e2e/calendar-views.spec.ts b/e2e/calendar-views.spec.ts index d05db86..645fe1c 100644 --- a/e2e/calendar-views.spec.ts +++ b/e2e/calendar-views.spec.ts @@ -54,7 +54,8 @@ test('календарь: три дня и задачи без даты из б // Месяц: бросок на день даёт дату без времени. await page.getByRole('tab', { name: 'Месяц' }).click(); - const cell = page.locator('.cal-cell:not(.other)').nth(27); + // Последний день месяца не раньше сегодня: на прошедший день задача стала бы просроченной и осталась в панели. + const cell = page.locator('.cal-cell:not(.other)').last(); await side.locator('.cal-chip', { hasText: 'Починить кран' }).dragTo(cell); await expect(cell.locator('.cal-chip', { hasText: 'Починить кран' })).toBeVisible(); await expect(side.locator('.cal-chip', { hasText: 'Починить кран' })).toHaveCount(0); diff --git a/e2e/calendar.spec.ts b/e2e/calendar.spec.ts index 7bb0c29..760b1bc 100644 --- a/e2e/calendar.spec.ts +++ b/e2e/calendar.spec.ts @@ -66,8 +66,13 @@ test('календарь: планирование дня перетаскива await page.getByRole('tab', { name: 'Месяц' }).click(); const ролик = page.locator('.cal-month .cal-chip', { hasText: 'Записать ролик' }); await expect(ролик).toContainText('15:00'); + // День в прошлом сделал бы задачу просроченной, и календарь показал бы её на сегодня: цель — последний день + // месяца, а если «завтра» и есть последний день, то сегодня. const cells = page.locator('.cal-cell:not(.other)'); - const target = cells.nth(27); + const moscow = (d: Date) => new Intl.DateTimeFormat('en-CA', { timeZone: 'Europe/Moscow' }).format(d); + const tomorrow = moscow(new Date(Date.now() + 24 * 3600_000)); + const lastIsTomorrow = (await cells.last().getByRole('button', { name: /^Открыть день / }).getAttribute('aria-label'))?.endsWith(tomorrow); + const target = lastIsTomorrow ? page.locator('.cal-cell', { has: page.getByRole('button', { name: `Открыть день ${moscow(new Date())}` }) }) : cells.last(); await ролик.dragTo(target); await expect(target.locator('.cal-chip', { hasText: 'Записать ролик' })).toContainText('15:00'); if (process.env.SHOTS) await page.screenshot({ path: `${process.env.SHOTS_DIR ?? 'test-results/shots'}/cal-month.png` });