mirror of
https://github.com/openobserve/openobserve.git
synced 2026-11-04 16:09:05 +00:00
a14d8e6bf5ef5bba400a7d5e692a2ddc7b978f45
177
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Sai Nikhil
|
81f872310e | ci(ui): shard the UI unit tests into 4 jobs and merge coverage (#16241) | ||
  dependabot[bot]andAshish Kolhe
|
748b799862 |
chore(deps): bump re2js from 2.8.6 to 2.8.7 in /web (#15988)
Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Ashish Kolhe <35160958+oasisk@users.noreply.github.com> |
||
 dependabot[bot]andHengfei Yang
|
2ea48d87e8 |
chore(deps-dev): bump happy-dom from 20.14.6 to 21.0.4 in /web (#15733)
Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Hengfei Yang <hengfei.yang@gmail.com> |
||
|
dependabot[bot]andHengfei Yang
|
0a6054ca2d |
chore(deps-dev): bump vite from 7.3.6 to 7.3.7 in /web (#15588)
Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Hengfei Yang <hengfei.yang@gmail.com> |
||
   
|
69ab7d90f6 |
chore(deps): update web npm dependencies (2026-10-13) (#15286)
Co-authored-by: Bhargav <BJP232004@GMAIL.COM> Co-authored-by: Shrinath-O2 <214651540+Shrinath-O2@users.noreply.github.com> Co-authored-by: ktx-vaidehi <134508096+ktx-vaidehi@users.noreply.github.com> |
||
 Ashish Kolheandgithub-actions[bot]
|
46678ea8da |
fix: tighten input validation, auth and outbound request checks (#15054)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
3805ea855c |
chore(deps): bump @vue/server-renderer and vue in /web (#15118)
Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]andHengfei Yang
|
acec993dbc |
chore(deps): bump dompurify from 3.4.13 to 3.4.16 in /web (#15050)
Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Hengfei Yang <hengfei.yang@gmail.com> |
||
 Prabhat Sharma
|
a70ea8d087 | feat(web): product analytics through the OpenObserve RUM SDK (#15046) | ||
|
dependabot[bot]andHengfei Yang
|
aa2ad5b9de |
chore(deps): bump moment from 2.30.1 to 2.31.0 in /web (#14993)
Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Hengfei Yang <hengfei.yang@gmail.com> |
||
 ktx-vaidehiandKirtan Thakkar
|
6f04af073d |
feat: fe caching (#13642)
Co-authored-by: Kirtan Thakkar <kirtan@kiara.tech> |
||
|
dependabot[bot]andHengfei Yang
|
9d68241204 |
chore(deps-dev): bump vitest from 4.1.10 to 4.1.11 in /web (#14298)
Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Hengfei Yang <hengfei.yang@gmail.com> |
||
 Omkar Kesarkhane
|
98a504fc16 | chore: bump browser SDK to 0.4.2 (#14101) | ||
 Abhay PadamaniandHengfei Yang
|
e58c0aadfe |
fix: memory leak v2 (#14145)
Co-authored-by: Hengfei Yang <hengfei.yang@gmail.com> |
||
|
Abhay PadamaniandKirtan Thakkar
|
168d8b4a48 |
fix: dashboard memory leak (#14072)
Co-authored-by: Kirtan Thakkar <kirtan@kiara.tech> |
||
|
Omkar Kesarkhane
|
2c17c07a11 |
fix(rum): restore RUM-traces correlation for zero-stripped trace ids (#13959)
## Problem RUM-to-traces correlation stopped working after the browser SDK 0.4.x line. The SDK's identifiers became plain `BigInt`, so the unchanged `toString(16)` serialization silently started dropping leading zeros. Trace ids are UUIDv7-shaped (48-bit ms timestamp in the top bits), so the leading hex nibble is always zero today — effectively every RUM event stored a 31-char `_oo_trace_id`/`_o2_trace_id` while the traces stream stores the padded 32-char `trace_id` (the `traceparent` header was padded correctly, so backend traces have the full id). Exact-match correlation could never hit, in either direction. Verified against live data: for sampled traced requests, `'0' + stored_id` found the backend trace every time; the stored id never did. ## Fix (frontend compatibility layer) Works for the already-ingested short ids **and** for correct ids from the fixed SDK: - `utils/rum/fields.ts`: `normalizeTraceId` (pads to canonical 32-char hex), `traceIdLookupVariants` (padded + legacy zero-stripped forms), `rumFieldEqualsAnySql` (matches both namespace spellings x both id forms), and a shared `RUM_CORRELATION_TRACES_STREAM` constant replacing four scattered "default" literals. - `useRumSpanBuilder`: trace→RUM lookup queries both id forms; canonical id stamped on generated RUM spans. - `useTraceCorrelation`: backend-span query now targets the real `default` traces stream (was a nonexistent `_traces` stream) as `page_type: "traces"` (was `"logs"`), with the padded id. - `EventDetailDrawerContent`: trace navigation pads the id before building the route. - `PlayerTracesTab`: the session Traces tab canonicalizes ids before the traces-stream metadata join (rows were silently dropped). - `ErrorViewer`: error correlation card receives the padded id; implausible (non-hex) ids hide the card instead of showing a misleading empty state. - `package.json`: browser SDK bumped to 0.4.2-beta.3, which serializes trace/span ids as fixed-width canonical hex at the source (resolved `browser-rum-core` verified at 0.4.2-beta.3). ## Testing - New unit coverage: `fields.spec.ts` (16 tests) plus regression tests in each touched spec (legacy 31-char id fixtures asserting padded 32-char behavior); full RUM/traces suites green (53 files, 1971 passed). - Live-verified against real data: a trace from the broken window renders the full RUM hierarchy (Session→View→Action→Resource + backend spans) where the old code showed backend spans only; pre-regression sessions still correlate (no behavior change for correct ids). - `npm run lint` and `npm run type-check` clean. |
||
|
5f034c6666 |
feat: folder icons (#13895)
Design at: https://github.com/openobserve/designs/blob/main/ux/folder-icons/design.md --------- Co-authored-by: Kirtan Thakkar <kirtan@kiara.tech> Co-authored-by: ktx-abhay <abhay.padamani@kiara.tech> Co-authored-by: Abhay Padamani <141122205+ktx-abhay@users.noreply.github.com> |
||
 
|
1c849a9c71 |
refactor(web): migrate templates + shadows to tokens, delete the debt baseline (#13769)
## What
Deletes `web/scripts/design-debt-baseline.json` — **not by relaxing the
rules, by fixing the debt**. Every design-token category is now
zero-tolerance, SCSS is gone from the app, and 144 hand-written shadow
values collapse into one scale.
## The guard was under-reporting (three separate holes)
1. **Comment contamination.** `check-design-consistency.mjs` fed comment
text into its exemption checks, so a `keep()` comment that merely
*named* `:deep(` / `::after` / `@keyframes` silenced the rule after it —
and a `;` or `{` inside a comment corrupted the offsets, so stripping
comments afterwards couldn't help. Comments are now blanked
(offset-preserving) before the scan. **Uncovered 9 occurrences in 6
files.** Real debt was 110, not 101.
2. **`arbShadow` only scanned the template.** `box-shadow:` in a
`<style>` block and `boxShadow:` in a JS/`:style` object were invisible
— 40 literals sat there while the guard reported zero. It now scans all
three syntaxes across `.vue` and `.ts`.
3. **`rawVarInTemplate` missed the fallback form.**
`border-(--color-x,rgba(…))` and `bg-[var(--color-x,#fff)]` slipped
through. The token is always defined, so the fallback can never fire —
it only hid the read.
## stylelint had never run on 14 files
`postcss-scss` isn't installed, so `postcss-html` **silently skipped**
every `<style lang="scss">` block. The CI step named *"Lint styles
(stylelint — bans legacy --o2-* tokens)"* was a no-op for those files —
including `color-no-hex` and the `.body--dark` selector ban. All 14 are
plain CSS now and `vue/block-lang` errors on `scss`/`sass`/`less`, so it
cannot silently recur.
## What moved
| | before | after |
|---|---|---|
| `rawVarInComponent` (in `<style>`) | 110 | **0** |
| template `x-[var(--color-*)]`, utility exists | 225 | **0** |
| template reads, no utility | 27 | **0** |
| `style` / `:style` colour literals | 29 | **0** |
| `color-mix(token N%, transparent)` | 160 | **0** |
| hand-written shadows | 233 (144 distinct) | **0** |
| SFCs using SCSS | 14 | **0** |
Guard categories: 22 → 24. `rawVarInTemplate` and `arbShadow` are new;
`arbPx` was deleted because main's `local/no-hardcoded-px` ESLint rule
(#13541) now owns px across every file type.
## Shadows are a system now
Stripped of colour, the 144 values were the same handful of geometries
rewritten in px vs rem, with and without an explicit `0` spread.
```
--shadow-xs / sm / md / lg elevation
--shadow-sticky-left / -right directional (sticky columns)
--shadow-rail inset status rail
--shadow-glow-sm / -md / -lg coloured, 3 intensities
--shadow-scroll-top / -bottom / -both scroll affordance
--shadow-ring-hairline 1px ring where a utility can't reach
--shadow-ai-focus AI composer focus glow (flips in dark)
```
Colour is a **separate axis**. Tailwind rewrites a `--shadow-*` token as
`<geometry> var(--tw-shadow-color, <default>)` — verified by compiling a
probe, and it holds for multi-layer tokens — so a template writes
`shadow-md shadow-ai-accent/35`. A plain stylesheet can't add a utility,
so the role and glow tokens read `--glow-color`; that keeps the pipeline
canvas colour-coding nodes by type from CSS and lets the status rail be
painted per row from JS.
Also reclassified: `0 0 0 2px <colour>` is a **ring**, not a shadow, and
`0 1px 0 0 <colour>` is a **border**.
## color-mix, analysed by intent
All 331 occurrences were classified rather than treated as one problem:
- **160** mixed a token with `transparent` — only an alpha change, so
it's Tailwind's `/N` modifier written the long way (verified: `/N`
compiles to `color-mix(in oklab, <token> N%, transparent)`, and mixing
with `transparent` is premultiplied, so the interpolation space doesn't
matter)
- **81** blended two colours — a derived colour, so it's a token now
(~50 minted)
- **75** were shadow/ring geometry, handled by the scale
- **8 gradients + 1 `calc()`-driven percentage** genuinely have no
utility form and remain; the guard exempts gradient/mask/filter
contexts, matching what the style-block counter already exempts
## Merge with main
Main was running the same migration in parallel (**#13541 "px to rem"**
removed all SCSS, added `no-hardcoded-px`, and built its own shadow
scale), so the merge collided in 68 files / 155 hunks. Resolved by
taking main's source files and re-applying this branch on top, with the
guards driving convergence (429 → 0) rather than hand-resolving hunks.
On shadows, **main's structure wins** — geometry in `semantic.css`
`@theme`, colours as `--shadow-*-c*` sub-tokens, wrapped in its px
disable; its `--shadow-sm/md/lg`, `--shadow-scroll-*` and
`--shadow-glow` keep their definitions. This branch adds what main
didn't have: `xs`, the directional/inset roles, and the
elevation-matched coloured glows.
## New tokens
No new *colours* — each names a value a component already hardcoded,
because a registered palette utility (`text-orange-500`) is banned by
`rawPalette`, so "just register the ramp" was never available.
`--color-splitter-hover`, `--color-status-flaky` (+`-text`),
`--color-chat-bubble-user-border`, `--color-thread-avatar-bg`,
`--color-thread-accent-strong`, `--color-menu-badge-ring`,
`--color-progress-track-fill`, `--color-ingest-accent-*` (5), ~50
derived blend tokens, plus `--color-border-strong` /
`--color-border-subtle` / `--color-warning-300` registered for utility
use.
## Visual deltas to review
Everything else is value-preserving. These are not:
- **4 hover accents** move from a fixed `primary-600` to `accent` — 600
→ 400 **in dark only** (2 chevrons, an empty-state icon fill, one link)
- **sticky table header** in `TraceDetailsSidebar` was a fixed light
grey that never flipped; now `border-default`, so it themes
- **shadow canonicalization** snaps near-identical geometries together
and moves ~40 hardcoded `rgba(0,0,0,x)` onto the scale's token colour
Highest-surface single file: `AlertSettingsHelpDrawer.vue` — a whole
style block deleted with ~44 class names moved into template utilities.
## Verification
`lint:design` · `lint:tokens` · `lint:token-purity` · `lint:styles` ·
`format:check` · `lint:ci` · `vue-tsc` — all clean.
**94 spec files covering every file this branch touches: 4395 passing, 0
failing.**
Not run: the full 1236-file unit suite, Playwright/E2E, and any browser
visual check.
---------
Co-authored-by: ktx-vaidehi <vaidehi.akhani@kiara.tech>
Co-authored-by: Abhay Padamani <141122205+ktx-abhay@users.noreply.github.com>
Co-authored-by: ktx-abhay <abhay.padamani@kiara.tech>
Co-authored-by: ktx-vaidehi <134508096+ktx-vaidehi@users.noreply.github.com>
Co-authored-by: Bhargav <BJP232004@GMAIL.COM>
|
||
|
Prabhat Sharmaandgithub-actions[bot]
|
0dba67d638 |
feat: composite alerts (#13797)
Design at : alerts/composite_alerts/composite_alerts.md ## Summary - add composite alert graph persistence, evaluation, scheduling, lifecycle APIs, and deletion safeguards - add composite alert UI forms, preview, references, list/detail integration, and localization - add Rust, API, Vue, and Playwright contracts ## Verification - cargo fmt --all -- --check - cargo check -p openobserve-core - cargo check -p openobserve-api-management - npm run type-check:composite-alerts - npm run type-check:app - npm run lint:ci -- --quiet - design/token/style checks - targeted Rust/Vitest suites - browser QA against local alerts UI ## Follow-ups (intentionally deferred, documented in the spec) - `RunOutcome::Error`/`NotifyFailed` outcome records on composite delivery failure (§11.5) - Incident detail live-definition resolver for composites + "definition unavailable" retention (§9.6) - `alert_composite_*` observability metrics (§16) - SLO/stream delete-conflict 409 bodies with readable-vs-hidden parent split (§10.3) - Super-cluster startup preflight (§18) <img width="1650" height="979" alt="image" src="https://github.com/user-attachments/assets/3def5246-7bf7-48fe-9a42-c0ac08271ea9" /> --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
Prabhat Sharma
|
fb50aaea7f |
fix(deps): resolve 39 Dependabot alerts (#13774)
## Summary - update vulnerable web transitive dependencies (`axios`, `brace-expansion`, `fast-uri`, `http-proxy-middleware`, `js-yaml`, `uuid`, and `websocket-driver`) - remove the unused `node-polyfill-webpack-plugin`, eliminating the unpatched `elliptic` dependency chain - update Playwright to 1.55.1 and `node-forge` to 1.4.0 in the UI test lockfile - adapt `BaseImport` to Axios 1.18's stricter response-header type This is expected to resolve 39 of the 41 currently open Dependabot alerts. ## Remaining alerts - `rmcp` remains on the project's custom `rmcp-openapi` fork. Updating it safely requires a coordinated change to the enterprise `Cargo.toml.openobserve`, which currently replaces the OSS manifest during enterprise builds and pins the old API. The compatible intermediate upstream releases also lack the fork's required `allOf`/`anyOf` support. - `thrift` 0.17.0 remains through `parquet` 58.4.0. The patched Thrift line (0.23+) is outside Parquet 58's version constraint. Parquet 59 removes the Thrift dependency, but adopting it requires a coordinated Arrow/DataFusion 59 upgrade. ## Validation - `npm ci` and `npm audit --package-lock-only` in `web/` (0 vulnerabilities) - `npm ci` and `npm audit --package-lock-only` in `tests/ui-testing/` (0 vulnerabilities) - `npm run type-check:app` - `npm run lint:ci -- --quiet` - `npm run lint:design:strict` - `NODE_OPTIONS=--max-old-space-size=8192 npm run build` - `npm run test:unit -- --run` (41,917 passed, 404 skipped) - `npx vitest run src/components/common/BaseImport.spec.ts --environment jsdom` (41 passed) - Playwright test discovery under 1.55.1 (2,076 tests in 265 files) - `cargo fmt --all -- --check` - `cargo test -p openobserve-mcp` (94 passed, 1 ignored) - `cargo audit` (0 vulnerabilities; 2 allowed unmaintained warnings) |
||
|
Bhargav
|
9cf4933f15 | fix: Browser sdk test 0.4.2 (#13584) | ||
|
ktx-vaidehi
|
6c43e01823 | fix: px to rem (#13541) | ||
|
74805cf8ae |
chore(deps): update web npm dependencies (2026-08-06) (#13673)
## 📦 Weekly NPM Dependencies Update This automated PR updates `web/` npm packages to their latest versions and regenerates `package-lock.json`. ### Updated Packages - **@rudderstack/analytics-js**: 3.6.0 → 3.31.6 - **@tanstack/vue-form**: ^1.29.1 → ^1.33.3 - **@tanstack/vue-table**: ^8.21.3 → ^9.0.0 - **@tanstack/vue-virtual**: ^3.13.16 → ^3.13.35 - **@vue-flow/core**: ^1.48.1 → ^1.48.2 - **acorn**: ^8.15.0 → ^8.18.0 - **acorn-walk**: ^8.3.4 → ^8.3.5 - **cron-parser**: ^5.4.0 → ^5.7.0 - **date-fns**: ^4.1.0 → ^4.4.0 - **dompurify**: ^3.4.12 → ^3.4.13 - **gridstack**: ^12.4.2 → ^13.0.2 - **js-beautify**: ^1.15.4 → ^2.0.3 - **js-cookie**: ^3.0.7 → ^3.0.8 - **js-yaml**: ^4.3.0 → ^5.2.3 - **lucide-vue-next**: ^0.562.0 → ^1.0.0 - **marked**: ^17.0.1 → ^18.0.9 - **moment-timezone**: ^0.6.0 → ^0.6.3 - **monaco-editor**: ^0.52.2 → ^0.56.0 - **node-polyfill-webpack-plugin**: ^4.0.0 → ^4.1.0 - **reka-ui**: ^2.9.6 → ^2.10.1 - **reodotdev**: ^1.0.0 → ^1.1.0 - **sql-formatter**: ^15.6.12 → ^15.8.2 - **uuid**: ^14.0.0 → ^14.0.1 - **vue**: ^3.5.26 → ^3.5.41 - **vue-i18n**: ^11.2.8 → ^11.4.8 - **vue-router**: ^4.6.4 → ^5.2.0 - **@cypress/vue**: ^6.0.2 → ^6.0.3 - **@cypress/webpack-dev-server**: ^5.4.1 → ^5.6.2 - **@iconify-json/majesticons**: ^1.2.4 → ^1.2.5 - **@iconify-json/material-symbols**: ^1.2.72 → ^1.2.88 - **@iconify-json/octicon**: ^1.2.25 → ^1.2.31 - **@intlify/core-base**: ^11.2.8 → ^11.4.8 - **@rushstack/eslint-patch**: ^1.15.0 → ^1.16.1 - **@tailwindcss/postcss**: ^4.1.18 → ^4.3.3 - **@tailwindcss/typography**: ^0.5.19 → ^0.5.20 - **@tailwindcss/vite**: ^4.1.18 → ^4.3.3 - **@types/jsdom**: ^27.0.0 → ^28.0.3 - **@types/leaflet**: ^1.9.21 → ^1.9.22 - **@types/luxon**: ^3.7.1 → ^3.7.3 - **@types/node**: ^25.0.3 → ^26.1.2 - **@vitejs/plugin-vue**: ^6.0.3 → ^6.0.8 - **@vitejs/plugin-vue-jsx**: ^5.1.3 → ^5.1.6 - **@vitest/coverage-v8**: ^4.0.16 → ^4.1.10 - **@vitest/ui**: ^4.0.16 → ^4.1.10 - **@vue/eslint-config-typescript**: ^14.6.0 → ^14.9.0 - **@vue/test-utils**: ^2.4.6 → ^2.4.11 - **@vue/tsconfig**: ^0.8.1 → ^0.9.1 - **autoprefixer**: ^10.4.23 → ^10.5.4 - **c8**: ^10.1.3 → ^12.0.0 - **cypress**: ^15.19.0 → ^15.20.0 - **cypress-localstorage-commands**: ^2.2.8 → ^2.3.0 - **dotenv**: ^17.2.3 → ^17.4.2 - **eslint**: ^9.39.2 → ^10.8.0 - **eslint-plugin-cypress**: ^5.2.0 → ^7.0.0 - **eslint-plugin-vue**: ^10.6.2 → ^10.10.0 - **fs-extra**: ^11.3.3 → ^11.4.0 - **happy-dom**: ^20.8.9 → ^20.11.1 - **jsdom**: ^27.4.0 → ^30.0.1 - **msw**: ^2.12.7 → ^2.15.0 - **postcss**: ^8.5.10 → ^8.5.26 - **postcss-html**: ^1.8.1 → ^2.0.0 - **prettier**: ^3.7.4 → ^3.9.6 - **rollup-plugin-visualizer**: ^6.0.5 → ^7.0.1 - **sass**: ^1.97.1 → ^1.102.0 - **sass-loader**: ^16.0.6 → ^17.0.0 - **start-server-and-test**: ^2.1.3 → ^3.0.12 - **stylelint**: ^17.14.0 → ^17.14.1 - **vite**: ^7.3.2 → ^8.2.0 - **vite-plugin-istanbul**: ^7.2.1 → ^9.0.1 - **vitest-canvas-mock**: ^1.1.3 → ^1.1.4 - **vue-tsc**: ^3.2.1 → ^3.3.9 - **typescript**: ~5.9.3 → ~7.0.2 - **vitest**: ^4.0.16 → ^4.1.10 ### Validation This workflow does **not** run any checks — type check, unit tests and build all run as normal PR checks below. Review the results there before merging; a red check usually means one of the upgrades above needs to be pinned back or accompanied by a code change. --- 🤖 This PR was automatically created by the Weekly NPM Update workflow --------- Co-authored-by: Bhargav <551527+bjp232004@users.noreply.github.com> Co-authored-by: Bhargav <BJP232004@GMAIL.COM> Co-authored-by: ktx-abhay <abhay.padamani@kiara.tech> Co-authored-by: Abhay Padamani <141122205+ktx-abhay@users.noreply.github.com> |
||
|
dependabot[bot]andHengfei Yang
|
88051c7ec1 |
chore(deps): bump js-yaml from 4.3.0 to 4.3.1 in /web (#13678)
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.3.0 to 4.3.1. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md">js-yaml's changelog</a>.</em></p> <blockquote> <h2>4.3.1 - 2026-07-31</h2> <h3>Security</h3> <ul> <li>[backport] Remove quadratic complexity from <code>!!omap</code> duplicate key detection.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nodeca/js-yaml/commit/86e91b815b8794c3c73a179c1770871e37ec2df8"><code>86e91b8</code></a> 4.3.1 released</li> <li><a href="https://github.com/nodeca/js-yaml/commit/c3cc4b0bb9ddb9af2dd9b61e0d56f5ce7983cd4a"><code>c3cc4b0</code></a> Backport quadratic complexity fix for !!omap</li> <li>See full diff in <a href="https://github.com/nodeca/js-yaml/compare/4.3.0...4.3.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/openobserve/openobserve/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Hengfei Yang <hengfei.yang@gmail.com> |
||
|
dependabot[bot]andHengfei Yang
|
0b853837ca |
chore(deps-dev): bump postcss from 8.5.19 to 8.5.25 in /web (#13610)
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.19 to 8.5.25. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/postcss/postcss/releases">postcss's releases</a>.</em></p> <blockquote> <h2>8.5.25</h2> <ul> <li>Fixed 8.5.17 visitor regression.</li> <li>Fixed <code>list.split()</code> for non-string values (by <a href="https://github.com/amir-rezaei"><code>@amir-rezaei</code></a>).</li> </ul> <h2>8.5.24</h2> <ul> <li>Preserve the BOM after the processing (by <a href="https://github.com/hdimer"><code>@hdimer</code></a>).</li> </ul> <h2>8.5.23</h2> <ul> <li>Do not load source map without <code>opts.from</code> for security reasons.</li> </ul> <h2>8.5.22</h2> <ul> <li>Fixed custom property losing semicolon before a comment (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> </ul> <h2>8.5.21</h2> <ul> <li>Fixed childless at-rule losing semicolon before comment (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> <li>Fixed docs (by <a href="https://github.com/isker"><code>@isker</code></a>).</li> </ul> <h2>8.5.20</h2> <ul> <li>Fixed missing space if <code>AtRule#params</code> is set after (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> <li>Fixed mixing AST error on warnings (by <a href="https://github.com/MahinAnowar"><code>@MahinAnowar</code></a>).</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/postcss/postcss/blob/main/CHANGELOG.md">postcss's changelog</a>.</em></p> <blockquote> <h2>8.5.25</h2> <ul> <li>Fixed 8.5.17 visitor regression.</li> <li>Fixed <code>list.split()</code> for non-string values (by <a href="https://github.com/amir-rezaei"><code>@amir-rezaei</code></a>).</li> </ul> <h2>8.5.24</h2> <ul> <li>Preserve the BOM after the processing (by <a href="https://github.com/hdimer"><code>@hdimer</code></a>).</li> </ul> <h2>8.5.23</h2> <ul> <li>Do not load source map without <code>opts.from</code> for security reasons.</li> </ul> <h2>8.5.22</h2> <ul> <li>Fixed custom property losing semicolon before a comment (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> </ul> <h2>8.5.21</h2> <ul> <li>Fixed childless at-rule losing semicolon before comment (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> <li>Fixed docs (by <a href="https://github.com/isker"><code>@isker</code></a>).</li> </ul> <h2>8.5.20</h2> <ul> <li>Fixed missing space if <code>AtRule#params</code> is set after (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> <li>Fixed mixing AST error on warnings (by <a href="https://github.com/MahinAnowar"><code>@MahinAnowar</code></a>).</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/postcss/postcss/commit/08c989c43cc87edb1ed71408c2f5164c54fc21df"><code>08c989c</code></a> Release 8.5.25 version</li> <li><a href="https://github.com/postcss/postcss/commit/24f681471645cd960ee760ab7f9e348fbabfd42c"><code>24f6814</code></a> Fix 8.5.17 visitor regression</li> <li><a href="https://github.com/postcss/postcss/commit/f2fa53f11daab3a16c7eb8bcaf5a945142341df3"><code>f2fa53f</code></a> Add supply chain security requirement to PostCSS plugin guide</li> <li><a href="https://github.com/postcss/postcss/commit/10edf0b0606f97b1510e040c27bfd078c48d6ea7"><code>10edf0b</code></a> fix: return empty array for empty string in list.split (<a href="https://redirect.github.com/postcss/postcss/issues/2121">#2121</a>)</li> <li><a href="https://github.com/postcss/postcss/commit/0ebe8ad591621ab4e48311da47a76974617571f9"><code>0ebe8ad</code></a> Release 8.5.24 version</li> <li><a href="https://github.com/postcss/postcss/commit/73218c64245be53e25d58150e0cc7e984f1d162d"><code>73218c6</code></a> Update dependencies</li> <li><a href="https://github.com/postcss/postcss/commit/9a114f62b0deb37be859102f93b414b49385805a"><code>9a114f6</code></a> Preserve the BOM when stringifying (<a href="https://redirect.github.com/postcss/postcss/issues/2119">#2119</a>)</li> <li><a href="https://github.com/postcss/postcss/commit/90692619125cb9424f5eafd8c64bc76b2da23db1"><code>9069261</code></a> Fix types check</li> <li><a href="https://github.com/postcss/postcss/commit/eb9e1fe793740bb3280bdf5bf98147f857f011bd"><code>eb9e1fe</code></a> Release 8.5.23 version</li> <li><a href="https://github.com/postcss/postcss/commit/9d19c78ac91108b3f7d7130e55c6fa806c0efb84"><code>9d19c78</code></a> Update dependencies</li> <li>Additional commits viewable in <a href="https://github.com/postcss/postcss/compare/8.5.19...8.5.25">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Hengfei Yang <hengfei.yang@gmail.com> |
||
|
ktx-vaidehiandKirtan Thakkar
|
3285a31e6f |
fix: i18n lint enforcement (#13439)
Co-authored-by: Kirtan Thakkar <kirtan@kiara.tech> |
||
|
hengfei yang
|
e525ad4b17 | ci: fix windows build | ||
|
Hengfei Yang
|
a05eba7ae0 | ci: fix build on window (#13631) | ||
|
Prabhat Sharma
|
624425a08a |
feat(editor): rebuild query autocomplete, and fix the value path behind it (#13586)
Design at autocomplete/autocomplete.md
Rewrites the query editor's autocomplete across every surface that has
one, and
follows the field-value path far enough to fix the bugs it was hiding.
53
commits, in six phases; each phase was written test-first, reviewed
adversarially, and checked in a browser before the next one started.
## What was wrong
The completion providers were wired inconsistently. Six surfaces bound a
resolver that was never defined, so their value completion could not
resolve at
all — SLO, dashboards and anomaly detection among them. Traces never
bound
`:suggestions`. Alerts never called `updateStreamKeywords`. PromQL ran a
second
editor runtime purely for its grammar, and asked
`/prometheus/api/v1/series`
— the heaviest endpoint available — for data the stream schema already
has.
## Phases
**1 — icons, staleness, quoting.** Correct `CompletionItemKind` glyphs,
stream
keywords refreshed when the stream changes, `spath` quoting.
**2 — the function catalog.** Custom functions get one tab stop per
argument,
org VRL functions stop appearing twice, column types read from
`dataType` as
well as `type`.
**3 — signature help, hover, async completion.** Providers return real
`CompletionList`s with `incomplete: true`, so a list that arrives late
is
re-queried rather than pinned.
**4 — numeric ranking.** Numeric columns sort first inside a numeric
aggregate.
**5 — values for streams nobody has searched.** The value cache only
ever held
what a search had already returned, so a stream you had not queried
offered
nothing. Values are now fetched on demand, bounded (10s timeout, 60s
cooldown,
one in-flight request per key), and shared between the editor and the
builder.
PromQL joins the same path: labels from the stream schema, values from
the
shared cache. `/series` now has zero production callers.
**6 — one way to fetch a value.** Item 22 only, in this PR.
## The dashboard filter 400
Clicking the ✕ beside "Select Field" in a filter's dropdown sets the
column to
`{}`, and the watcher on `condition.column` then asks for that column's
values.
`loadFilterItem` built `fields: [row.field]` out of `undefined`,
JSON.stringify
turned that into `null`, and the server answered
```
400 {"code":400,"message":"SerdeJsonError# invalid type: null, expected a string"}
```
`_values_stream` answers 400, not an empty result, for each way a piece
of the
payload can go missing — and every one is reachable: an unresolved
stream alias
(`.find(…)?.stream`), a stream not yet chosen (`""`), a range not yet
set. The
range fails differently: `meta.dateTime` starts as `{start_time: ""}`
and
`""?.toISOString()` does not short-circuit, so it throws and both
callers
surface "Something went wrong!" for a lookup the user never asked to
fail.
Guarded at the two callers, where the payload is built and where the
throw
happens. Not at `fetchFieldValues` — a guard there is too late to stop
the
throw and would duplicate validation the callers need anyway. The
trigger is
left alone: re-picking a field must still load its values.
## Notable removals
CodeMirror is gone — it was still bundled for the PromQL grammar alone.
Bundle 26.3 MB → 25.43 MB; the PromQL chunks 442.7 KB → 20.6 KB. The
PromQL
term catalog went from 7 entries to 113, generated from Prometheus's own
tables
and vendored with its MIT notice.
## Verification
- 76 files, +10.5k/−1.4k, ~9,100 tests passing across the touched areas.
- `vue-tsc` clean, `npm run build` exit 0.
- Every phase checked in a running browser against a live instance,
including
the 400 above: the ✕ now produces no request and no toast, adding a
filter and
re-picking a field each still fetch once, and the value list still
populates.
## Known, deliberately out of scope
- A filter still fetches twice (once on add, once on open) — that is
item 23,
the cache read, not this PR.
- `useMetricsExplorer.loadFilterItem` has the same unguarded
`toISOString()`
pattern on a different surface.
- `services/metrics.ts` and `services/search.ts` still carry dead
`get_promql_series` wrappers now that nothing calls `/series`.
|
||
|
ktx-vaidehi
|
c9fc8d3b55 | fix: dashboard builder redesign (#13419) | ||
|
Bhargav
|
e9596a10a3 |
feat: Mobile rum sdk v2 (#13503)
Design at: design/mobile-rum-sdk-evaluation/design-docs Backend changes exist to make the OpenObserve RUM intake accept the mobile SDK wire format alongside the existing browser format. src/api/src/handler/http/request/rum/ingest.rs 200 → 202 Accepted on /rum, /logs, /replay | ---> OpenObserve-family SDKs (which the mobile forks derive from) treat any non-202 as an unexpected error and drop the batch. #[serde(default)] on Event ---> Mobile replay omits creation_reason / index_in_view that the browser format sends. Multi-segment replay handling ---> Browser sends 1 segment + 1 event object; mobile sends N segment parts + one event JSON array. Handler now collects all segments, parses event as array-or-object, pairs them, emits NDJSON → one _sessionreplay row per segment. MAX_SEGMENTS=200, 16 MB decompressed cap via .take() ---> Decompression-bomb guard, newly needed now that N segments are accepted. |
||
|
Bhargav
|
1d99426df9 | fix: browser sdk package version upgraded to 0.4.1 (#13455) | ||
 Abhay PadamaniandClaude Opus 4.8
|
5ec9b89ff8 |
build: FE code format check for improved maintainability (#13351)
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
dependabot[bot]
|
455b021106 |
chore(deps): bump qs, cypress and express in /web (#13433)
Bumps [qs](https://github.com/ljharb/qs) to 6.15.3 and updates ancestor dependencies [qs](https://github.com/ljharb/qs), [cypress](https://github.com/cypress-io/cypress) and [express](https://github.com/expressjs/express). These dependencies need to be updated together. Updates `qs` from 6.14.2 to 6.15.3 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/ljharb/qs/blob/main/CHANGELOG.md">qs's changelog</a>.</em></p> <blockquote> <h2><strong>6.15.3</strong></h2> <ul> <li>[Fix] <code>parse</code>: enforce <code>throwOnLimitExceeded</code> for cumulative array growth via <code>combine</code>/<code>merge</code></li> <li>[Fix] <code>utils</code>: respect encoding of surrogate pairs across chunks (<a href="https://redirect.github.com/ljharb/qs/issues/559">#559</a>)</li> <li>[Robustness] <code>parse</code>: throw the <code>arrayLimit</code> error before splitting oversized comma values</li> <li>[Robustness] <code>utils.merge</code> / <code>utils.assign</code>: avoid invoking <code>__proto__</code> setter when copying own properties</li> <li>[Robustness] <code>utils</code>: enforce <code>arrayLimit</code> consistently across <code>merge</code>'s array paths</li> <li>[Perf] <code>utils</code>: make <code>compact</code> O(n) via a side-channel visited-set instead of <code>Array.indexOf</code></li> <li>[Deps] update <code>side-channel</code></li> <li>[Dev Deps] update <code>eslint</code>, <code>mock-property</code>, <code>tape</code></li> <li>[Tests] <code>parse</code>: characterize current lenient handling of unbalanced bracket keys (<a href="https://redirect.github.com/ljharb/qs/issues/558">#558</a>)</li> </ul> <h2><strong>6.15.2</strong></h2> <ul> <li>[Fix] <code>stringify</code>: skip null/undefined entries in <code>arrayFormat: 'comma'</code> + <code>encodeValuesOnly</code> instead of crashing in <code>encoder</code></li> <li>[Fix] <code>stringify</code>: use configured <code>delimiter</code> after <code>charsetSentinel</code> (<a href="https://redirect.github.com/ljharb/qs/issues/555">#555</a>)</li> <li>[Fix] <code>stringify</code>: apply <code>formatter</code> to encoded key under <code>strictNullHandling</code> (<a href="https://redirect.github.com/ljharb/qs/issues/554">#554</a>)</li> <li>[Fix] <code>stringify</code>: skip null/undefined filter-array entries instead of crashing in <code>encoder</code> (<a href="https://redirect.github.com/ljharb/qs/issues/551">#551</a>)</li> <li>[Fix] <code>parse</code>: handle nested bracket groups and add regression tests (<a href="https://redirect.github.com/ljharb/qs/issues/530">#530</a>)</li> <li>[readme] fix grammar (<a href="https://redirect.github.com/ljharb/qs/issues/550">#550</a>)</li> <li>[Dev Deps] update <code>@ljharb/eslint-config</code></li> <li>[Tests] add regression tests for keys containing percent-encoded bracket text</li> </ul> <h2><strong>6.15.1</strong></h2> <ul> <li>[Fix] <code>parse</code>: <code>parameterLimit: Infinity</code> with <code>throwOnLimitExceeded: true</code> silently drops all parameters</li> <li>[Deps] update <code>@ljharb/eslint-config</code></li> <li>[Dev Deps] update <code>@ljharb/eslint-config</code>, <code>iconv-lite</code></li> <li>[Tests] increase coverage</li> </ul> <h2><strong>6.15.0</strong></h2> <ul> <li>[New] <code>parse</code>: add <code>strictMerge</code> option to wrap object/primitive conflicts in an array (<a href="https://redirect.github.com/ljharb/qs/issues/425">#425</a>, <a href="https://redirect.github.com/ljharb/qs/issues/122">#122</a>)</li> <li>[Fix] <code>duplicates</code> option should not apply to bracket notation keys (<a href="https://redirect.github.com/ljharb/qs/issues/514">#514</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ljharb/qs/commit/18d085e919dae70c8f1b200ab99323058edab2c2"><code>18d085e</code></a> v6.15.3</li> <li><a href="https://github.com/ljharb/qs/commit/c38af42039d8cbf83f3e0d486c924eaa5a5d1712"><code>c38af42</code></a> [Deps] update <code>side-channel</code></li> <li><a href="https://github.com/ljharb/qs/commit/adce539489fcd34cc10830cf8c4a43e90b9300b0"><code>adce539</code></a> [Dev Deps] update <code>eslint</code>, <code>mock-property</code>, <code>tape</code></li> <li><a href="https://github.com/ljharb/qs/commit/74a0f6a83af59245b4fa78785fbe709438580c97"><code>74a0f6a</code></a> [Robustness] <code>utils</code>: enforce <code>arrayLimit</code> consistently across <code>merge</code>'s arra...</li> <li><a href="https://github.com/ljharb/qs/commit/f4938f594a0a2773d3c99c0c6f5c96f30d909a2c"><code>f4938f5</code></a> [Tests] <code>parse</code>: characterize current lenient handling of unbalanced bracket ...</li> <li><a href="https://github.com/ljharb/qs/commit/5d5f723afe55a861c52cff6327f62269df35fdd1"><code>5d5f723</code></a> [Perf] <code>utils</code>: make <code>compact</code> O(n) via a side-channel visited-set instead of...</li> <li><a href="https://github.com/ljharb/qs/commit/52afe00abdb36416ee01c8d5243919b47a59af67"><code>52afe00</code></a> [Robustness] <code>parse</code>: throw the <code>arrayLimit</code> error before splitting oversized...</li> <li><a href="https://github.com/ljharb/qs/commit/963e538c740961a35ecaa0b38ee1f5c16697e208"><code>963e538</code></a> [Fix] <code>parse</code>: enforce <code>throwOnLimitExceeded</code> for cumulative array growth via...</li> <li><a href="https://github.com/ljharb/qs/commit/59da434d5de8c3d2564e4d75aeedde2e8af72369"><code>59da434</code></a> [Fix] <code>utils</code>: respect encoding of surrogate pairs across chunks</li> <li><a href="https://github.com/ljharb/qs/commit/9532969635a4bc96506370b28dd28dcab446e7ee"><code>9532969</code></a> [Robustness] <code>utils.merge</code> / <code>utils.assign</code>: avoid invoking <code>__proto__</code> sette...</li> <li>Additional commits viewable in <a href="https://github.com/ljharb/qs/compare/v6.14.2...v6.15.3">compare view</a></li> </ul> </details> <br /> Updates `cypress` from 15.8.2 to 15.19.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/cypress-io/cypress/releases">cypress's releases</a>.</em></p> <blockquote> <h2>v15.19.0</h2> <p>Changelog: <a href="https://docs.cypress.io/app/references/changelog#15-19-0">https://docs.cypress.io/app/references/changelog#15-19-0</a></p> <h2>v15.18.1</h2> <p>Changelog: <a href="https://docs.cypress.io/app/references/changelog#15-18-1">https://docs.cypress.io/app/references/changelog#15-18-1</a></p> <h2>v15.18.0</h2> <p>Changelog: <a href="https://docs.cypress.io/app/references/changelog#15-18-0">https://docs.cypress.io/app/references/changelog#15-18-0</a></p> <h2>v15.17.0</h2> <p>Changelog: <a href="https://docs.cypress.io/app/references/changelog#15-17-0">https://docs.cypress.io/app/references/changelog#15-17-0</a></p> <h2>v15.16.0</h2> <p>Changelog: <a href="https://docs.cypress.io/app/references/changelog#15-16-0">https://docs.cypress.io/app/references/changelog#15-16-0</a></p> <h2>v15.15.0</h2> <p>Changelog: <a href="https://docs.cypress.io/app/references/changelog#15-15-0">https://docs.cypress.io/app/references/changelog#15-15-0</a></p> <h2>v15.14.2</h2> <p>Changelog: <a href="https://docs.cypress.io/app/references/changelog#15-14-2">https://docs.cypress.io/app/references/changelog#15-14-2</a></p> <h2>v15.14.1</h2> <p>Changelog: <a href="https://docs.cypress.io/app/references/changelog#15-14-1">https://docs.cypress.io/app/references/changelog#15-14-1</a></p> <h2>v15.14.0</h2> <p>Changelog: <a href="https://docs.cypress.io/app/references/changelog#15-14-0">https://docs.cypress.io/app/references/changelog#15-14-0</a></p> <h2>v15.13.1</h2> <p>Changelog: <a href="https://docs.cypress.io/app/references/changelog#15-13-1">https://docs.cypress.io/app/references/changelog#15-13-1</a></p> <h2>v15.13.0</h2> <p>Changelog: <a href="https://docs.cypress.io/app/references/changelog#15-13-0">https://docs.cypress.io/app/references/changelog#15-13-0</a></p> <h2>v15.12.0</h2> <p>Changelog: <a href="https://docs.cypress.io/app/references/changelog#15-12-0">https://docs.cypress.io/app/references/changelog#15-12-0</a></p> <h2>v15.11.0</h2> <p>Changelog: <a href="https://docs.cypress.io/app/references/changelog#15-11-0">https://docs.cypress.io/app/references/changelog#15-11-0</a></p> <h2>v15.10.0</h2> <p>Changelog: <a href="https://docs.cypress.io/app/references/changelog#15-10-0">https://docs.cypress.io/app/references/changelog#15-10-0</a></p> <h2>v15.9.0</h2> <p>Changelog: <a href="https://docs.cypress.io/app/references/changelog#15-9-0">https://docs.cypress.io/app/references/changelog#15-9-0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/cypress-io/cypress/commit/d19a47c2421485e2352b89e3167a0a3237c2d21c"><code>d19a47c</code></a> test: migrate dev-server e2e specs to the reporter iframe (<a href="https://redirect.github.com/cypress-io/cypress/issues/34301">#34301</a>)</li> <li><a href="https://github.com/cypress-io/cypress/commit/dd72f31efdf30291f0aa7387ad290afecbdbebde"><code>dd72f31</code></a> chore: Update Chrome (stable) to 150.0.7871.128 (<a href="https://redirect.github.com/cypress-io/cypress/issues/34293">#34293</a>)</li> <li><a href="https://github.com/cypress-io/cypress/commit/388f6e09f568571f11ee221c6a52254dec600752"><code>388f6e0</code></a> chore: retrieve SSL.com CodeSignTool for Windows signing from github CDN (<a href="https://redirect.github.com/cypress-io/cypress/issues/34">#34</a>...</li> <li><a href="https://github.com/cypress-io/cypress/commit/3ff59601d1f07fffba90881b9514ed48d8f12e75"><code>3ff5960</code></a> perf: render command log in an isolated iframe to prevent renderer crash (<a href="https://redirect.github.com/cypress-io/cypress/issues/34">#34</a>...</li> <li><a href="https://github.com/cypress-io/cypress/commit/37a899cab005044b6b98576de87de2b6c810e31f"><code>37a899c</code></a> fix: allow chaining assertions after should('exist') on raw DOM elements (<a href="https://redirect.github.com/cypress-io/cypress/issues/34">#34</a>...</li> <li><a href="https://github.com/cypress-io/cypress/commit/bfe83a15d38a06b715b40cbb1b53b2443ff02f3a"><code>bfe83a1</code></a> chore: clean up the server cookie automation converters and various automatio...</li> <li><a href="https://github.com/cypress-io/cypress/commit/72cef528bff59f94843afcd4482ce1d5d260c302"><code>72cef52</code></a> chore: Update Chrome (stable) to 150.0.7871.124 and Chrome (beta) to 151.0.79...</li> <li><a href="https://github.com/cypress-io/cypress/commit/6792160d0eda19fe04dd9c9a93da42c8fcf6af1e"><code>6792160</code></a> chore: bump websocket-driver to 0.7.5 to resolve critical Snyk vulnerability ...</li> <li><a href="https://github.com/cypress-io/cypress/commit/de06a0731b305b4bbd82d20cceb994fdc51e3acc"><code>de06a07</code></a> test: fix cy-in-cy studio AI test to exercise authenticated flow (<a href="https://redirect.github.com/cypress-io/cypress/issues/34278">#34278</a>)</li> <li><a href="https://github.com/cypress-io/cypress/commit/9e7e850e1693e1c2a4d2d66dbb92149eaef62244"><code>9e7e850</code></a> feat: upgrade chai to 4.5.0 and expose new assertion aliases (<a href="https://redirect.github.com/cypress-io/cypress/issues/34178">#34178</a>)</li> <li>Additional commits viewable in <a href="https://github.com/cypress-io/cypress/compare/v15.8.2...v15.19.0">compare view</a></li> </ul> </details> <br /> Updates `express` from 4.22.1 to 4.22.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/expressjs/express/releases">express's releases</a>.</em></p> <blockquote> <h2>v4.22.2</h2> <h2>What's Changed</h2> <ul> <li>fix: restore >20 array parsing for <code>req.query</code> repeated keys (<a href="https://github.com/expressjs/express/commit/8d09bfe6d88983da5c3e12cfdd54782c4dc675db"><code>8d09bfe6</code></a>) <ul> <li>This also unifies array-cap behavior across notations. Indexed notation (<code>a[0]=...</code>) was historically capped at qs's default <code>arrayLimit</code> of 20 even in older qs versions; after this change it also allows up to 1000 items.</li> </ul> </li> <li>deps: qs@~6.15.1</li> <li>deps: body-parser@~1.20.5</li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/suuuuuuminnnnnn"><code>@suuuuuuminnnnnn</code></a> made their first contribution in <a href="https://redirect.github.com/expressjs/express/pull/7021">expressjs/express#7021</a></li> <li><a href="https://github.com/SAY-5"><code>@SAY-5</code></a> made their first contribution in <a href="https://redirect.github.com/expressjs/express/pull/7181">expressjs/express#7181</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/expressjs/express/compare/v4.22.1...v4.22.2">https://github.com/expressjs/express/compare/v4.22.1...v4.22.2</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/expressjs/express/blob/v4.22.2/History.md">express's changelog</a>.</em></p> <blockquote> <h1>4.22.2 / 2026-05-011</h1> <ul> <li>fix: restore >20 array parsing for <code>req.query</code> repeated keys (<a href="https://github.com/expressjs/express/commit/8d09bfe6d88983da5c3e12cfdd54782c4dc675db"><code>8d09bfe6</code></a>) <ul> <li>This also unifies array-cap behavior across notations. Indexed notation (<code>a[0]=...</code>) was historically capped at qs's default <code>arrayLimit</code> of 20 even in older qs versions; after this change it also allows up to 1000 items.</li> </ul> </li> <li>deps: qs@~6.15.1</li> <li>deps: body-parser@~1.20.5</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/expressjs/express/commit/df0abc9333a3398b97b71f6ea7cd77d5ea3e9f97"><code>df0abc9</code></a> 4.22.2</li> <li><a href="https://github.com/expressjs/express/commit/836d36668ea750f78b4373b4de79bbd22634e6ec"><code>836d366</code></a> <code>4.x</code> update qs to 6.15.1, body-parser 1.20.5 (<a href="https://redirect.github.com/expressjs/express/issues/7224">#7224</a>)</li> <li><a href="https://github.com/expressjs/express/commit/8d09bfe6d88983da5c3e12cfdd54782c4dc675db"><code>8d09bfe</code></a> fix: restore array parsing for req.query repeated keys (<a href="https://redirect.github.com/expressjs/express/issues/7181">#7181</a>)</li> <li><a href="https://github.com/expressjs/express/commit/d39e8ad1778a0b8a606a5a7b17096d0cc5ec722d"><code>d39e8ad</code></a> deps: body-parser@~1.20.4 (<a href="https://redirect.github.com/expressjs/express/issues/7021">#7021</a>)</li> <li><a href="https://github.com/expressjs/express/commit/efe85d9fdc9e3a62f7a1121b4f5f484862298b48"><code>efe85d9</code></a> deps: qs@^6.14.1 (<a href="https://redirect.github.com/expressjs/express/issues/6972">#6972</a>)</li> <li><a href="https://github.com/expressjs/express/commit/f62378e1bc776259c0a471476c2dc043a02ac762"><code>f62378e</code></a> 📝 add note to history</li> <li>See full diff in <a href="https://github.com/expressjs/express/compare/v4.22.1...v4.22.2">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/openobserve/openobserve/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Bhargav
|
1c60b7904b |
build(web): add CI-parity verify script and pin Node version (#13393)
Local checks could diverge from CI in three ways: no Node version was pinned (CI runs 24, older runtimes fail stylelint and Tailwind outright), and the six quality gates had to be remembered and run individually. - .nvmrc + engines pin the runtime so nvm switches automatically - verify runs exactly the gates CI enforces (type-check:app + 5 lints) - verify:all adds the coverage gate from ui_unit_tests type-check:app is the one CI gates on; plain type-check uses a different tsconfig and misses errors, which is the common way a frontend PR goes red. |
||
|
dependabot[bot]
|
f22b9c8a2d |
chore(deps): bump dompurify from 3.4.11 to 3.4.12 in /web (#13357)
Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.4.11 to 3.4.12. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/cure53/DOMPurify/releases">dompurify's releases</a>.</em></p> <blockquote> <h2>DOMPurify 3.4.12</h2> <ul> <li>Fixed an issue where a hook would not get called for custom elements, thanks <a href="https://github.com/Rikuxx0"><code>@Rikuxx0</code></a></li> <li>Hardened the handling of hooks removing elements, <a href="https://github.com/mkrause-bee360"><code>@mkrause-bee360</code></a></li> <li>Added support for a few new SVG attributes, thanks <a href="https://github.com/cbn-falias"><code>@cbn-falias</code></a> & <a href="https://github.com/Develop-KIM"><code>@Develop-KIM</code></a></li> <li>Hardened the handling of declarative partial updates</li> <li>Updated the documentation is several spots, README, wiki, etc.</li> <li>Bumped several dependencies where possible</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/cure53/DOMPurify/commit/a9ca1e537422319a557a9a2aa61f003b23b4a197"><code>a9ca1e5</code></a> release: 3.4.12 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1537">#1537</a>)</li> <li>See full diff in <a href="https://github.com/cure53/DOMPurify/compare/3.4.11...3.4.12">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/openobserve/openobserve/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Abhay Padamani
|
4d58a1efe4 |
build: add UI code quality checks and enhance linting processe (#13174)
chore: update package.json scripts for improved type-checking fix: adjust frontmatter regex to handle BOM characters refactor: streamline error handling in dashboard data conversion style: clean up comments and formatting in various files |
||
|
dependabot[bot]andHengfei Yang
|
209e263851 |
chore(deps): bump js-yaml from 4.2.0 to 4.3.0 in /web (#13312)
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.2.0 to 4.3.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md">js-yaml's changelog</a>.</em></p> <blockquote> <h2>4.3.0, 3.15.0 - 2026-06-27</h2> <h3>Security</h3> <ul> <li>Backported <code>maxTotalMergeKeys</code> option.</li> </ul> <h2>[5.2.0] - 2026-06-26</h2> <h3>Added</h3> <ul> <li>Added <code>maxTotalMergeKeys</code> (10000) loader option to limit the total number of keys processed by YAML merge (<code><<</code>) across one <code>load()</code> / <code>loadAll()</code> call.</li> <li>Added <code>maxAliases</code> (-1) loader option to limit the number of YAML aliases per document.</li> </ul> <h3>Removed</h3> <ul> <li><code>maxMergeSeqLength</code> replaced with <code>maxTotalMergeKeys</code> for limiting YAML merge processing.</li> </ul> <h3>Fixed</h3> <ul> <li>Round-trip of integers with exponential form (>= <code>1e21</code>)</li> </ul> <h2>[5.1.0] - 2026-06-23</h2> <h3>Added</h3> <ul> <li>Collection tags can finalize an incrementally populated carrier into a different result value.</li> </ul> <h3>Changed</h3> <ul> <li>[breaking] <code>quoteStyle</code> now selects the preferred quote style; use the restored <code>forceQuotes</code> option to force quoting non-key strings.</li> </ul> <h2>[5.0.0] - 2026-06-20</h2> <h3>Added</h3> <ul> <li>Added named exports for schemas, tags, parser events and AST utilities.</li> <li>Reworked <code>JSON_SCHEMA</code> and <code>CORE_SCHEMA</code> with spec-compliant scalar resolution rules, and added <code>YAML11_SCHEMA</code>.</li> <li>Added <code>realMapTag</code> for lossless mappings with non-string and complex keys. Object-based mappings now reject complex keys instead of stringifying them.</li> <li>Added <code>dump()</code> <code>transform</code> option for changing the generated AST before rendering.</li> <li>Added <code>dump()</code> options <code>seqInlineFirst</code>, <code>flowBracketPadding</code>, <code>flowSkipCommaSpace</code>, <code>flowSkipColonSpace</code>, <code>quoteFlowKeys</code>, <code>quoteStyle</code> and <code>tagBeforeAnchor</code>.</li> <li>Added formal data layers (events and AST) for modular data pipelines. <ul> <li>Added low-level parser (to events), presenter and visitor APIs.</li> </ul> </li> <li>Added the <a href="https://github.com/yaml/yaml-test-suite">YAML Test Suite</a> to the test set.</li> </ul> <h3>Changed</h3> <ul> <li>See the <a href="https://github.com/nodeca/js-yaml/blob/master/docs/migrate_v4_to_v5.md">migration guide</a> for upgrade notes.</li> <li>Rewritten in TypeScript and reorganized the public API around flat named exports.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nodeca/js-yaml/commit/33d05b5d29a8c21360f620f7e1c1706e24522eda"><code>33d05b5</code></a> 4.3.0 released</li> <li><a href="https://github.com/nodeca/js-yaml/commit/663bfab6db2b4a146a9366fd685f069345be4ddb"><code>663bfab</code></a> Drop demo publish, to not override new v5 one.</li> <li><a href="https://github.com/nodeca/js-yaml/commit/1cb8c7b94bf75e15116869c1c0482dcb22785986"><code>1cb8c7b</code></a> Add v4-legacy tag for publish</li> <li><a href="https://github.com/nodeca/js-yaml/commit/02f27afad532763263cd2b6be35c24ee8e1f6157"><code>02f27af</code></a> Restore umd builds back to es5</li> <li><a href="https://github.com/nodeca/js-yaml/commit/8be84edaf15e7c394fa3b813179d1bcc280e87fb"><code>8be84ed</code></a> Fix es5 compatibility</li> <li><a href="https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4"><code>59423c6</code></a> Replace <code>maxMergeSeqLength</code> option with <code>maxTotalMergeKeys</code> (more robust). Ba...</li> <li><a href="https://github.com/nodeca/js-yaml/commit/6842ef6a02df01ca7282ea01dc3c70787710c05d"><code>6842ef6</code></a> doc polish</li> <li>See full diff in <a href="https://github.com/nodeca/js-yaml/compare/4.2.0...4.3.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/openobserve/openobserve/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Hengfei Yang <hengfei.yang@gmail.com> |
||
|
f15e27e5fd |
refactor: design token migration + CI guards (#13173)
# Design System Unification — one visual language, enforced end-to-end
Establishes **one source of truth for every visual decision**, wires the
whole app to it, and **locks it in with CI** so it can't drift back.
### Foundations
- **Design-token system ("one knob per decision").** Every colour, text
size, spacing, corner radius, and shadow is a named token defined in
exactly one place — change the token, every screen updates. Collapsed
hundreds of near-duplicate definitions and removed "fake" duplicates
that pretended to be different but weren't.
- **Shared component library (O2).** Buttons, tables, dialogs, drawers,
form fields, badges, etc. already know the correct colours, spacing, and
dark-mode behaviour; new screens compose them instead of hand-styling.
Added new primitives on this branch (`OContent`, `KpiCard`) and
standardized existing ones.
- **One page structure everywhere** (`PageLayout` / `AppPageHeader` /
`AppPage` / `OContent`) — titles, breadcrumbs, spacing, and content
edges line up identically across every screen.
- **One table implementation** — all tabular data uses the same table
(sorting, density, sticky headers, empty states).
- **Styling consolidated onto Tailwind; old systems removed** —
hand-written CSS driven to the practical minimum, the legacy **Quasar**
framework fully removed, surviving stylesheets required to justify
themselves.
- **Two-tier corner radius** — a tight **4px** for controls and a soft
**12px** for surfaces (dialogs, cards, the app shell), plus a
full-circle option — replacing five radius names that all secretly meant
the same thing.
### Detailed improvements across screens
**Page structure & alignment** — unified page shell rolled across ~40+
screens (IAM, Settings, Alerts, Dashboards, Functions, Pipelines, RUM,
Metrics, Synthetics, Billing, editors, lists); one header height; one
page-edge grid driving headers, tables, rails, and tabs; unified
side-rail widths; inset rail selection/hover pills; every tab strip on
the grid line; tightened title/subtitle spacing.
**Tables (cross-screen)** — action columns consistently centered (incl.
Organizations); unified row-number column with no "#" truncation;
non-standard tables restyled to match; loading skeletons made
geometrically identical to the loaded table; symmetric edge inset; IAM
first-column grid alignment fixed.
**Traces** — flame graph + span-detail correlation panel fixes;
correlated logs/metrics placeholder fit; sticky headers; removed a
double scrollbar + a 1px sliver; aligned table fonts/badges; polished
the service detail drawer; stream-selector + correlation alignment;
aligned loading spinners; floating overlay arrows for the
disabled-services strip.
**Logs** — field-list controls aligned (focus ring no longer clipped);
detail-drawer spacing + metrics-tab overflow fixed; Run Query toolbar
tidied; listing sizing + stray border fixed.
**Metrics** — search added to the "Type" facet rail and aligned with the
other rails; proper empty states for the explorer and facet rail.
**Dashboards** — removed inconsistent card shadows; tightened
borders/resizers/field-list spacing; aligned View Dashboard chrome to
the grid; chart colours via the token helper.
**Home** — redesigned the Usage tab; added reusable KPI stat cards so
summary strips stop drifting.
**Dark mode** — new theme-switch animation; fixed a 1px content shift on
toggle and a white flash on load; fixed AI-chat text and assorted
light/dark mismatches; completed the token-driven dark migration.
**Empty states, controls & small polish** — restored 3 broken
empty-state animations; adopted the standard empty state; added the
sliding indicator to the toggle control; fixed the Quality-page inset +
drawer badge; refreshed Search History / Schedulers; fixed the
alert-history drawer scrollbar + timeline hover; removed a stray
menu-bar border.
### Dead code & cruft removal
- **Deleted the entire legacy `utilities.css`** global stylesheet (well
over a thousand lines) — evacuated in waves, roughly half of it dead
once traced.
- **Removed Quasar entirely**, including dead `.q-*` styles and ~25
phantom `--q-*` variables that were silently breaking bits of the UI.
- Stripped hundreds of **dead CSS classes and tokens that compiled to
nothing** — e.g. 46 uses of a colour class with no backing token, a
no-op shadow class on 51 elements, dead layout/utility classes, a
leftover `card-container` block, a dead table-actions token, and a
mis-registered gradient that rendered nothing.
- Cut **unused keyframe animations (19 → 3)** and removed **unused
components** + a stray build artifact.
- Net effect: a much smaller, leaner styling surface — less to maintain,
fewer dead ends to copy.
## Safety & verification
Large but low-risk: this is overwhelmingly a **styling and structure**
change, not product behaviour or data. Guarded by the
design-token/consistency/type checks above plus the existing test suite,
and reviewed screen-by-screen.
---------
Co-authored-by: Kirtan Thakkar <kirtan@kiara.tech>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: ktx-mihir <mihir.patel@kiara.tech>
|
||
|
|
d1ae0a633a |
chore(deps): bump echarts, @joakimono/echarts-extension-leaflet and echarts-gl in /web (#12957)
Bumps [echarts](https://github.com/apache/echarts), [@joakimono/echarts-extension-leaflet](https://github.com/joakimono/echarts-extension-leaflet) and [echarts-gl](https://github.com/ecomfe/echarts-gl). These dependencies needed to be updated together. Updates `echarts` from 5.6.0 to 6.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/apache/echarts/releases">echarts's releases</a>.</em></p> <blockquote> <h2>6.1.0</h2> <ul> <li>[Feature] [axis] Support <code>dataMin</code> and <code>dataMax</code> option for calculating a nice axis extent. <a href="https://redirect.github.com/apache/echarts/pull/20838">#20838</a> (<a href="https://github.com/Justin-ZS">Justin-ZS</a>, <a href="https://github.com/Ovilia">Ovilia</a>)</li> <li>[Feature] [axis] Comprehensively enable all types of axis (i.e., <code>"value"</code>/<code>"time"</code>/<code>"category"</code>/<code>"log"</code>) to render series (typically <code>"bar"</code>/<code>"pictorialBar"</code>/<code>"candlestick"</code>/<code>"boxplot"</code>) without overflow (including the case <code>"category"</code> axis with <code>boundaryGap: false</code>); provide <code>containShape</code> option; provide some corresponding <code>clip</code> option. <a href="https://github.com/apache/echarts/commit/dbfaf6a73">dbfaf6a73</a> <a href="https://github.com/apache/echarts/commit/fe932a2aa">fe932a2aa</a> <a href="https://github.com/apache/echarts/commit/3973b21ee">3973b21ee</a> (<a href="https://github.com/100pah">100pah</a>) <a href="https://redirect.github.com/apache/echarts/pull/21511">#21511</a> (<a href="https://github.com/akashsonune">Akash Sonune</a>)</li> <li>[Feature] [axis] Automatically exclude non-positive series data values on <code>"log"</code> axis. <a href="https://github.com/apache/echarts/commit/dedc5dc18">dedc5dc18</a> (<a href="https://github.com/100pah">100pah</a>)</li> <li>[Feature] [axis] Enable <code>axisLabel.formatter</code> to receive its index for working with <code>customValues</code>. <a href="https://redirect.github.com/apache/echarts/pull/21220">#21220</a> <a href="https://redirect.github.com/apache/echarts/pull/21432">#21432</a> (<a href="https://github.com/szymonpachucki">Szymon Pachucki</a>, <a href="https://github.com/Ovilia">Ovilia</a>, <a href="https://github.com/plainheart">plainheart</a>)</li> <li>[Feature] [line] Add <code>triggerEvent</code> option for more control over mouse event. <a href="https://redirect.github.com/apache/echarts/pull/21001">#21001</a> (<a href="https://github.com/sjcobb">Steven Cobb</a>, <a href="https://github.com/plainheart">plainheart</a>)</li> <li>[Feature] [pie] Add <code>tangential-noflip</code> rotation mode to keep labels tangential without flipping. <a href="https://redirect.github.com/apache/echarts/pull/21258">#21258</a> (<a href="https://github.com/MC-YCY">春秋半夏</a>, <a href="https://github.com/Ovilia">Ovilia</a>)</li> <li>[Feature] [gauge] <code>progress.color</code> supports <code>'auto'</code>. <a href="https://redirect.github.com/apache/echarts/pull/21224">#21224</a> (<a href="https://github.com/StNimmerlein">StNimmerlein</a>, <a href="https://github.com/Ovilia">Ovilia</a>)</li> <li>[Feature] [radar] Add <code>clockwise</code> option. <a href="https://redirect.github.com/apache/echarts/pull/21143">#21143</a> (<a href="https://github.com/daidr">Dai Xuezhou</a>, <a href="https://github.com/Ovilia">Ovilia</a>)</li> <li>[Feature] [candlestick] [dataZoom] Add <code>cursor</code> option for <code>candlestick</code> series and add <code>cursorGrab</code> option & <code>cursorGrabbing</code> for <code>'inside'</code> dataZoom. <a href="https://redirect.github.com/apache/echarts/pull/21558">#21558</a> (<a href="https://github.com/diysimon">zuming</a>, <a href="https://github.com/Ovilia">Ovilia</a>, <a href="https://github.com/100pah">100pah</a>)</li> <li>[Feature] [scatter] [effectScatter] [geo] Enable <code>clip</code> option on <code>"scatter"</code>/<code>"effectScatter"</code> on <code>geo</code>. <a href="https://github.com/apache/echarts/commit/417592289">417592289</a> (<a href="https://github.com/100pah">100pah</a>)</li> <li>[Feature] [visualMap] Add <code>seriesTargets</code> option for multiple series-dimension mappings. <a href="https://redirect.github.com/apache/echarts/pull/20703">#20703</a> (<a href="https://github.com/Justin-ZS">Justin-ZS</a>, <a href="https://github.com/plainheart">plainheart</a>)</li> <li>[Feature] [matrix] Support <code>matrix.x/y.length</code> for conveniently creating a headless matrix without composing an array. <a href="https://redirect.github.com/apache/echarts/pull/21191">#21191</a> (<a href="https://github.com/100pah">100pah</a>, <a href="https://github.com/plainheart">plainheart</a>)</li> <li>[Feature] [matrix] Add <code>triggerEvent</code> option to support triggering event on matrix cells. <a href="https://redirect.github.com/apache/echarts/pull/21390">#21390</a> (<a href="https://github.com/natsuokawai">Natsuo Kawai</a>, <a href="https://github.com/100pah">100pah</a>)</li> <li>[Feature] [i18n] add Latvian(LV) translation. <a href="https://redirect.github.com/apache/echarts/pull/21546">#21546</a> (<a href="https://github.com/EPoikans">EPoikans</a>)</li> <li>[Fix] [axis] Change and clarify the rounding error and auto-precision utils and solutions. <a href="https://github.com/apache/echarts/commit/479dcd454">479dcd454</a> (<a href="https://github.com/100pah">100pah</a>)</li> <li>[Fix] [axis] Fix chart does not work when using <code>customValues</code> with <code>formatter</code> in time axis (<code>axis.type: 'time'</code>) label. <a href="https://redirect.github.com/apache/echarts/pull/21352">#21352</a> (<a href="https://github.com/Srajan-Sanjay-Saxena">Srajan Sanjay Saxena</a>, <a href="https://github.com/plainheart">plainheart</a>)</li> <li>[Fix] [axis] Fix and clarify <code>alignTick</code> strategy, and fix <code>LogScale</code> precision. <a href="https://github.com/apache/echarts/commit/a6ab2458f">a6ab2458f</a> <a href="https://github.com/apache/echarts/commit/ffcc636fb">ffcc636fb</a> (<a href="https://github.com/100pah">100pah</a>)</li> <li>[Fix] [axis] Fix duplicate ticks when using time axis (<code>axis.type: 'time'</code>) or <code>customValues</code>, which causes jitter of <code>splitArea</code>; fix the <code>showMin/MaxLabel</code> handling of a category axis (<code>axis.type: 'category'</code>); enable a uniform <code>bandWidth</code> calculation in numeric axis (<code>axis.type: 'value' | 'time' | 'log'</code>). <a href="https://github.com/apache/echarts/commit/8de2b64fa">8de2b64fa</a> <a href="https://github.com/apache/echarts/commit/15af0db02">15af0db02</a> <a href="https://github.com/apache/echarts/commit/8ddaa5c69">8ddaa5c69</a> (<a href="https://github.com/100pah">100pah</a>)</li> <li>[Fix] [axis] Fix time axis (<code>axis.type: 'time'</code>) bug when value scale is in millisecond. <a href="https://github.com/apache/echarts/commit/40b77b464">40b77b464</a> (<a href="https://github.com/100pah">100pah</a>)</li> <li>[Fix] [bar] Fix wrong label position when bar series has a 0 width/height. <a href="https://redirect.github.com/apache/echarts/pull/21218">#21218</a> (<a href="https://github.com/Justin-ZS">Justin-ZS</a>, <a href="https://github.com/Ovilia">Ovilia</a>)</li> <li>[Fix] [scatter] Fix jitter layout does not support progressive rendering and cause chart to be frozen and potential NPE. <a href="https://redirect.github.com/apache/echarts/pull/21436">#21436</a> (<a href="https://github.com/plainheart">plainheart</a>)</li> <li>[Fix] [lines] Fix effect symbol flip on unidirectional loop end when <code>roundTrip</code> is not enabled. <a href="https://redirect.github.com/apache/echarts/pull/21320">#21320</a> (<a href="https://github.com/mynk2611">Mayank Mehta</a>, <a href="https://github.com/plainheart">plainheart</a>)</li> <li>[Fix] [candlestick] Fix candlestick render error with <code>series.encode</code> on horizontal layout. <a href="https://redirect.github.com/apache/echarts/pull/21325">#21325</a> (<a href="https://github.com/PPRAMANIK62">Purbayan Pramanik</a>, <a href="https://github.com/100pah">100pah</a>)</li> <li>[Fix] [parallel] Fix incorrect axis extent when any subsequent series has a larger value than the first. <a href="https://redirect.github.com/apache/echarts/pull/21387">#21387</a> (<a href="https://github.com/jackhickson">jackhickson</a>, <a href="https://github.com/100pah">100pah</a>)</li> <li>[Fix] [pie] Support axes extent union pie center automatically when pie is laid out on Cartesian (<code>grid</code> component). <a href="https://github.com/apache/echarts/commit/18a23a875">18a23a875</a> (<a href="https://github.com/100pah">100pah</a>)</li> <li>[Fix] [treemap] Fix treemap can not be zoomed out after a zoom-in when <code>scaleLimit</code> is specified <a href="https://redirect.github.com/apache/echarts/pull/21427">#21427</a> (<a href="https://github.com/liuyizhou">TateLiu</a>, <a href="https://github.com/100pah">100pah</a>)</li> <li>[Fix] [lines] Fix potential <code>tooltip</code> XSS vulnerability in lines series (<code>series.type: 'lines'</code>). <a href="https://redirect.github.com/apache/echarts/pull/21608">#21608</a> (<a href="https://github.com/plainheart">plainheart</a>)</li> <li>[Fix] [map] [geo] Fix the failed synchronization and visual artifacts on geo roaming and animation. <a href="https://github.com/apache/echarts/commit/417592289">417592289</a> (<a href="https://github.com/100pah">100pah</a>)</li> <li>[Fix] [tooltip] Fix <code>tooltip</code> content does not refresh when changing tooltip trigger from <code>'axis'</code> to <code>'item'</code>. <a href="https://redirect.github.com/apache/echarts/pull/20710">#20710</a> (<a href="https://github.com/Justin-ZS">Justin-ZS</a>, <a href="https://github.com/plainheart">plainheart</a>)</li> <li>[Fix] [tooltip] <code>valueFormatter</code> callback param <code>dataIndex</code> should be <code>rawDataIndex</code> rather than <code>dataZoom</code> filtered <code>dataIndex</code>. <a href="https://redirect.github.com/apache/echarts/pull/21479">#21479</a> (<a href="https://github.com/100pah">100pah</a>, <a href="https://github.com/plainheart">plainheart</a>)</li> <li>[Fix] [axisPointer] Fix <code>axisPointer</code> shadow and enable clipping - it is previously only applicable to <code>"category"</code> axis, but is buggy in numeric axis with <code>"bar"</code> series. <a href="https://github.com/apache/echarts/commit/8de2b64fa">8de2b64fa</a> (<a href="https://github.com/100pah">100pah</a>)</li> <li>[Fix] [axisPointer] Fix visual artifacts caused by failed <code>axisPointer</code> restoration. <a href="https://github.com/apache/echarts/commit/56a32c0bb">56a32c0bb</a> (<a href="https://github.com/100pah">100pah</a>)</li> <li>[Fix] [hoverLayer] Fix visual artifacts arisen on hover layer. <a href="https://redirect.github.com/ecomfe/zrender/pull/1151">zrender#1151</a> <a href="https://github.com/apache/echarts/commit/933585126">933585126</a> (<a href="https://github.com/100pah">100pah</a>)</li> <li>[Fix] [marker] Fix <code>marker</code> fails to render with <code>dataset</code> and <code>encode</code>. <a href="https://redirect.github.com/apache/echarts/pull/21439">#21439</a> (<a href="https://github.com/plainheart">plainheart</a>, <a href="https://github.com/100pah">100pah</a>).</li> <li>[Fix] [dataZoom] Fix wrong position of the <code>dataZoom</code> when the <code>series</code> has only one data point. <a href="https://redirect.github.com/apache/echarts/pull/21196">#21196</a> (<a href="https://github.com/alesmit">alesmit</a>, <a href="https://github.com/Ovilia">Ovilia</a>)</li> <li>[Fix] [dataZoom] Fix <code>dataZoom</code> bug that data info disappears when dragging released; fix <code>dataZoom</code> dragging cursor style. <a href="https://github.com/apache/echarts/commit/64305a4b8">64305a4b8</a> (<a href="https://github.com/100pah">100pah</a>)</li> <li>[Fix] [dataZoom] Apply a better auto-precision method; fix unexpected behaviors when <code>dataZoom</code> controls axes with <code>alignTicks: true</code>. <a href="https://github.com/apache/echarts/commit/d168bf237">d168bf237</a> (<a href="https://github.com/100pah">100pah</a>)</li> <li>[Fix] [dataZoom] Fix <code>AxisProxy</code> can not be cleared when <code>dataZoom</code> option changed; fix related <code>onZero</code> behaviors. <a href="https://github.com/apache/echarts/commit/52ceb924a">52ceb924a</a> <a href="https://github.com/apache/echarts/commit/2e82d33c3">2e82d33c3</a> (<a href="https://github.com/100pah">100pah</a>)</li> <li>[Fix] [areaStyle] Fix <code>areaStyle</code> render error when dimension name is empty string. <a href="https://redirect.github.com/apache/echarts/pull/21219">#21219</a> (<a href="https://github.com/Justin-ZS">Justin-ZS</a>, <a href="https://github.com/Ovilia">Ovilia</a>)</li> <li>[Fix] [sunburst] Fix root node label may not be centered. <a href="https://redirect.github.com/apache/echarts/pull/21306">#21306</a> (<a href="https://github.com/akashsonune">Akash Sonune</a>, <a href="https://github.com/Ovilia">Ovilia</a>)</li> <li>[Fix] [matrix] Fix matrix label formatter does not work. <a href="https://redirect.github.com/apache/echarts/pull/21410">#21410</a> (<a href="https://github.com/Justin-ZS">Justin-ZS</a>, <a href="https://github.com/Ovilia">Ovilia</a>)</li> <li>[Fix] [toolbox] Fix <code>emphasis</code> color is the same as the default color. <a href="https://redirect.github.com/apache/echarts/pull/21384">#21384</a> (<a href="https://github.com/Ovilia">Ovilia</a>) <a href="https://github.com/apache/echarts/commit/b094f987d">b094f987d</a> (<a href="https://github.com/100pah">100pah</a>)</li> <li>[Fix] [toolbox] Fix the <code>dataView</code> component does not fit the dark mode. <a href="https://redirect.github.com/apache/echarts/pull/21176">#21176</a> (<a href="https://github.com/notthistrain">notthistrain</a>, <a href="https://github.com/Ovilia">Ovilia</a>)</li> <li>[Fix] [progressive] Fix progressive rendering issues. <a href="https://github.com/apache/echarts/commit/91a60fc76">91a60fc76</a> (<a href="https://github.com/100pah">100pah</a>)</li> <li>[Fix] [labelLine] Fix <code>labelLine.smooth</code> can not be reset. <a href="https://redirect.github.com/apache/echarts/pull/21425">#21425</a> (<a href="https://github.com/fanwww">fanwww</a>, <a href="https://github.com/plainheart">plainheart</a>)</li> <li>[Fix] [graphic] Fix stroke corner gap due to not closing path in <code>roundRect</code> helper. <a href="https://redirect.github.com/ecomfe/zrender/pull/1155">zrender#1155</a> (<a href="https://github.com/plainheart">plainheart</a>)</li> <li>[Fix] [svg] Enhance SVG <code>encodeBase64</code> compatibility to make it available in more environments like Web Worker/NodeJS/Bun. <a href="https://redirect.github.com/ecomfe/zrender/pull/1145">zrender#1145</a> (<a href="https://github.com/plainheart">plainheart</a>)</li> <li>[Fix] [core] Mark <code>echarts</code> instance object as <code>raw</code> in <code>Vue</code>. <a href="https://redirect.github.com/apache/echarts/pull/21293">#21293</a> (<a href="https://github.com/plainheart">plainheart</a>)</li> <li>[Fix] [chord] Add the missing export entry for chord chart. <a href="https://redirect.github.com/apache/echarts/pull/21197">#21197</a> (<a href="https://github.com/plainheart">plainheart</a>, <a href="https://github.com/Ovilia">Ovilia</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/apache/echarts/commit/c5a48f5f97d23e5379720870b8444cd05b50ffb4"><code>c5a48f5</code></a> Merge pull request <a href="https://redirect.github.com/apache/echarts/issues/21612">#21612</a> from apache/release-dev</li> <li><a href="https://github.com/apache/echarts/commit/77e5222d15690b539505eb7690b8ff53b52aab9c"><code>77e5222</code></a> release 6.1.0-rc.2</li> <li><a href="https://github.com/apache/echarts/commit/21f17bec20d42623edcd66f91cf2344d2bced6b1"><code>21f17be</code></a> fixRegression(map,geo): Resolve circular dependencies introduced by this vers...</li> <li><a href="https://github.com/apache/echarts/commit/830e8b6ec780ff24d59577c69e3bbf69f1df315e"><code>830e8b6</code></a> chore: Supplement package.json (for module cjs declaration) to source release.</li> <li><a href="https://github.com/apache/echarts/commit/ed0e2103071744cb97887757679336cec1d8dac4"><code>ed0e210</code></a> chore: Fix <code>addHeader</code> tool and add missing license headers.</li> <li><a href="https://github.com/apache/echarts/commit/cc78ada709b6028371b24f5449ad7a4dda93f992"><code>cc78ada</code></a> Merge pull request <a href="https://redirect.github.com/apache/echarts/issues/21611">#21611</a> from apache/release-dev</li> <li><a href="https://github.com/apache/echarts/commit/3f6e0125fdd8a485c59652cdf628144fcea1702f"><code>3f6e012</code></a> release: Build release.</li> <li><a href="https://github.com/apache/echarts/commit/d69405f83fe2be367beb0ff1e08b49380d6485c6"><code>d69405f</code></a> chore: Add missing headers.</li> <li><a href="https://github.com/apache/echarts/commit/6998ed02fcfe39aafcefc47f4fb4822b36b0642d"><code>6998ed0</code></a> release: Upgrade npm version.</li> <li><a href="https://github.com/apache/echarts/commit/8cb374b15ca842e057812715caf73acf17649a5b"><code>8cb374b</code></a> fix(build): Fix build commands.</li> <li>Additional commits viewable in <a href="https://github.com/apache/echarts/compare/5.6.0...6.1.0">compare view</a></li> </ul> </details> <br /> Updates `@joakimono/echarts-extension-leaflet` from 1.0.3 to 1.1.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/joakimono/echarts-extension-leaflet/commit/1244a9f545c2668b7c643828094f2d8259a59d6e"><code>1244a9f</code></a> Merge pull request <a href="https://redirect.github.com/joakimono/echarts-extension-leaflet/issues/4">#4</a> from joakimono/feature/echarts-6</li> <li><a href="https://github.com/joakimono/echarts-extension-leaflet/commit/4f757e4422867c7568bc22c8030e8a840b546d4b"><code>4f757e4</code></a> Apply suggestions from code review</li> <li><a href="https://github.com/joakimono/echarts-extension-leaflet/commit/012c9f630b748897241879b07bf5b521e8fbdfa6"><code>012c9f6</code></a> feat: add ECharts 6 support and fix security vulnerabilities</li> <li>See full diff in <a href="https://github.com/joakimono/echarts-extension-leaflet/compare/v1.0.3...v1.1.0">compare view</a></li> </ul> </details> <br /> Updates `echarts-gl` from 2.0.9 to 2.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/ecomfe/echarts-gl/releases">echarts-gl's releases</a>.</em></p> <blockquote> <h2>2.1.0</h2> <ul> <li>Fix compatible issues with Apache ECharts 6</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/ecomfe/echarts-gl/commits/2.1.0">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/openobserve/openobserve/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Hengfei Yang <hengfei.yang@gmail.com> Co-authored-by: ktx-abhay <abhay.padamani@kiara.tech> |
||
|
Bhargav
|
8222a0b6dc | fix: upgraded browser sdk package (#13221) | ||
|
dependabot[bot]
|
c86176d9c4 |
chore(deps): bump json-2-csv from 5.5.10 to 5.5.11 in /web (#12983)
Bumps [json-2-csv](https://github.com/mrodrig/json-2-csv) from 5.5.10 to 5.5.11. <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/mrodrig/json-2-csv/commits">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/openobserve/openobserve/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
  Yashodhan JoshiandYashodhan Joshi
|
86fc9973c1 |
ci: revert the env specification in package.json (#12974)
~Powershell is ... weird~ ~bash good.~ No no, no no no, this time maybe windows was right and I was wrong. --------- Signed-off-by: Yashodhan Joshi <yjdoc2@gmail.com> Co-authored-by: Yashodhan Joshi <yjdoc2@gmail.com> |
||
|
Shrinath RaoandClaude Opus 4.8
|
ee496de79e |
fix: bump Node heap to 8GB for web build to prevent OOM (#12792)
## What Adds `NODE_OPTIONS=--max-old-space-size=8192` to all three `build-only` scripts in `web/package.json` (default, `alpha1`, `cloud-prod`). ## Why The web production build crashes with: ``` FATAL ERROR: Ineffective mark-compacts near heap limit Allocation failed - JavaScript heap out of memory ``` The vite/rollup build hits Node's default ~4 GB old-space heap limit (the GC log shows it maxing out around 4.2 GB). When the build dies, `dist/` is never created, so the `postbuild` → `copy` step then fails with `sh: cd: dist: No such file or directory` — a confusing symptom of the real OOM. Bumping the heap to 8 GB lets the build complete. This matches the pattern already used by `test:unit:coverage`, which sets the same option. ## Scope Single change — only the three build script lines in `web/package.json`. No dependency or lockfile changes. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> |
||
 ktx-mihirandgithub-actions[bot]
|
8b3bd75783 |
fix: ux revamp form validation migration v1 (#12747)
- Form with zod validation migration for dashboards , getstarted , createdestination(pipeline) , addregexpattern --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
cce062a4ad |
chore(deps): bump dompurify from 3.4.0 to 3.4.11 in /web (#12766)
Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.4.0 to 3.4.11. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/cure53/DOMPurify/releases">dompurify's releases</a>.</em></p> <blockquote> <h2>DOMPurify 3.4.11</h2> <ul> <li>Fixed an issue with a leaky config for hooks via <code>setConfig</code>, thanks <a href="https://github.com/trace37labs"><code>@trace37labs</code></a></li> <li>Bumped vulnerable development dependencies to arrive at plain 0 with <code>npm audit</code></li> <li>Updated the <code>osv-scanner</code> suppression list as no vulnerable dependencies are left for now</li> <li>Updated up the linting tool-chain and removed now-redundant lint directives</li> <li>Updated the documentation is several spots, README, wiki, etc.</li> <li>Bumped several dependencies where possible</li> </ul> <h2>DOMPurify 3.4.10</h2> <ul> <li>Refactored codebase for clarity: extracted the public type declarations into <code>types.ts</code></li> <li>Decomposed the three largest sanitizer functions into focused helpers</li> <li>Removed duplicated defaults and dead branches, consolidated <code>SAFE_FOR_TEMPLATES</code> scrubbing into single shared path</li> <li>Improved per-node performance by hoisting the mXSS probe regexes and testing <code>textContent</code> before <code>innerHTML</code></li> <li>Added a deterministic micro-benchmark harness (<code>npm run bench</code>) with a <code>--compare</code> mode</li> <li>Reduced CI cost by running the full three-engine browser suite once per PR</li> <li>Refreshed the <code>demos/</code> folder so every demo runs again, and added a SVG-via-<code><img></code> demo</li> <li>Documented the bench and <code>test:happydom</code> scripts in the README</li> <li>Completed the Attack Classes & Bypass History wiki page</li> <li>Bumped several dependencies where possible</li> </ul> <h2>DOMPurify 3.4.9</h2> <ul> <li>Further improved the handling of Trusted Types config options, thanks <a href="https://github.com/offset"><code>@offset</code></a></li> <li>Further improved the handling of <code>IN_PLACE</code> sanitization, thanks <a href="https://github.com/mozfreddyb"><code>@mozfreddyb</code></a></li> <li>Added more test coverage for <code>IN_PLACE</code> and Trusted Types related usage</li> <li>Bumped several dependencies where possible</li> <li>Updated README and wiki with more accurate documentation & attack samples</li> </ul> <h2>DOMPurify 3.4.8</h2> <ul> <li>Cleaned up the repository root, renamed some and removed unneeded files</li> <li>Fixed an issue with handling of Trusted Types policies, thanks <a href="https://github.com/fulstadev"><code>@fulstadev</code></a></li> <li>Fixed the node iterator for better template scrubbing, thanks <a href="https://github.com/IamLeandrooooo"><code>@IamLeandrooooo</code></a></li> <li>Included formerly missing LICENSE-MPL in published npm package, thanks <a href="https://github.com/asamuzaK"><code>@asamuzaK</code></a></li> <li>Bumped several dependencies where possible</li> </ul> <h2>DOMPurify 3.4.7</h2> <ul> <li>Hardened the handling of Shadow Roots when using <code>IN_PLACE</code>, thanks <a href="https://github.com/GameZoneHacker"><code>@GameZoneHacker</code></a></li> <li>Removed a problem leading to permanent hook pollution, thanks <a href="https://github.com/offset"><code>@offset</code></a></li> <li>Refactored the test suite and expanded test coverage significantly</li> </ul> <h2>DOMPurify 3.4.6</h2> <ul> <li>Fixed several issues with DOM Clobbering in <code>IN_PLACE</code> mode, thanks <a href="https://github.com/offset"><code>@offset</code></a> & <a href="https://github.com/Bankde"><code>@Bankde</code></a></li> <li>Hardened the checks for cross-realm <code>IN_PLACE</code> and Shadow DOM sanitization, thanks <a href="https://github.com/offset"><code>@offset</code></a> & <a href="https://github.com/Bankde"><code>@Bankde</code></a></li> <li>Added more test coverage for <code>IN_PLACE</code> and general DOM Clobbering attacks</li> <li>Bumped several dependencies where possible</li> </ul> <h2>DOMPurify 3.4.5</h2> <ul> <li>Fixed a bypass caused by the new HTML element <code>selectedcontent</code> added in 3.4.4, thanks <a href="https://github.com/KabirAcharya"><code>@KabirAcharya</code></a></li> </ul> <p><strong>Note that this is a security release for an issue introduced in 3.4.4 and should be upgraded to immediately.</strong></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/cure53/DOMPurify/commit/0cae5187403132f96a6d357649e4b15633fc210a"><code>0cae518</code></a> release: 3.4.11 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1494">#1494</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/6ee5716f8336989753611beeca364957c0eb0c3e"><code>6ee5716</code></a> release: 3.4.10 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1478">#1478</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/52102472d46035857c52df19e44285f8a1e102fc"><code>5210247</code></a> release: 3.4.9 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1459">#1459</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/bcdd8285412dc9c4c149652aed2d712e790d6ccf"><code>bcdd828</code></a> release: 3.4.8 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1439">#1439</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff"><code>ca30f07</code></a> release: 3.4.7 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1414">#1414</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/bb7739e5bccec7e1ab3dae3f3e42d02db3acaaae"><code>bb7739e</code></a> release: 3.4.6 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1394">#1394</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/011b0c78f2a0f57ee54f5fcccb697a46ca6e63ea"><code>011b0c7</code></a> release: 3.4.5 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1382">#1382</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/5817ad969c15e67dfcd6cb37248d6e9c1553e7c3"><code>5817ad9</code></a> release: 3.4.4 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1374">#1374</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/520edb0371a9638f9b51f1798051299a250c686b"><code>520edb0</code></a> release: 3.4.3 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1352">#1352</a>)</li> <li><a href="https://github.com/cure53/DOMPurify/commit/6f67fd396a7b8c64294343999fe607ca1f5299c0"><code>6f67fd3</code></a> Sync/3.4.2 (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1322">#1322</a>)</li> <li>Additional commits viewable in <a href="https://github.com/cure53/DOMPurify/compare/3.4.0...3.4.11">compare view</a></li> </ul> </details> <details> <summary>Install script changes</summary> <p>This version adds <code>prepare</code> script that runs during installation. Review the package contents before updating.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/openobserve/openobserve/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Bhargavandsai nikhil kethe
|
c097cea561 |
fix: Data sources tab for AI integration (#12478)
Co-authored-by: sai nikhil kethe <nikhil@openobserve.ai> |
||
|
|
d20cd2e47a |
chore: theme & font ux changes (#12645)
Co-authored-by: ktx-vaidehi <vaidehi.akhani@kiara.tech> Co-authored-by: Bhargav <BJP232004@GMAIL.COM> |
||
|
Omkar Kesarkhaneandgithub-actions[bot]
|
20ccfb5fa0 |
fix: RUM - Traces e2e tracing (#12420)
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
010714c139 |
chore(deps): bump js-cookie from 3.0.5 to 3.0.7 in /web (#12098)
Bumps [js-cookie](https://github.com/js-cookie/js-cookie) from 3.0.5 to 3.0.7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/js-cookie/js-cookie/releases">js-cookie's releases</a>.</em></p> <blockquote> <h2>v3.0.7</h2> <ul> <li>Prevent cookie attribute injection: CVE-2026-46625 (eb3c40e)</li> <li>Add <code>Partitioned</code> attribute to readme (b994768)</li> <li>Publish to npm registry via trusted publisher exclusively (4dc71be)</li> <li>Ensure consistent behaviour for <code>get('name')</code> + <code>get()</code> (1953d30)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/js-cookie/js-cookie/commit/17bacba0171dd022728d8fdeba3203c60791bf58"><code>17bacba</code></a> Craft v3.0.7 release</li> <li><a href="https://github.com/js-cookie/js-cookie/commit/adb823cb7e95ead47f3af4d4951e589acbde2077"><code>adb823c</code></a> Fix release workflow halting at <code>git tag</code></li> <li><a href="https://github.com/js-cookie/js-cookie/commit/5f9e759b07d2752e8407a3a43fb5f879bf384c5e"><code>5f9e759</code></a> May remove Git user config from release workflow</li> <li><a href="https://github.com/js-cookie/js-cookie/commit/6ac921184c7b3b7d9431c88707f56521acd72ab4"><code>6ac9211</code></a> Fix release workflow not able to push commit + tag</li> <li><a href="https://github.com/js-cookie/js-cookie/commit/2278bc55e1804c4c2d9bd2110a9b449949a52751"><code>2278bc5</code></a> Fix missing package version bump</li> <li><a href="https://github.com/js-cookie/js-cookie/commit/eb3c40e89731e99b8970faaf35ddad249c6c0020"><code>eb3c40e</code></a> Prevent cookie attribute injection</li> <li><a href="https://github.com/js-cookie/js-cookie/commit/f6f157f430d707d2ffd0c9c9138227a6cea564e5"><code>f6f157f</code></a> Bump globals from 17.5.0 to 17.6.0</li> <li><a href="https://github.com/js-cookie/js-cookie/commit/f409d022da50a0c6fa8724f087fbc50fab9a9533"><code>f409d02</code></a> Bump eslint from 10.2.0 to 10.3.0</li> <li><a href="https://github.com/js-cookie/js-cookie/commit/a686883c03a754c04546cfc1653911a70a640b40"><code>a686883</code></a> Bump protobufjs in the npm_and_yarn group across 1 directory</li> <li><a href="https://github.com/js-cookie/js-cookie/commit/c6112d2d4f2881a12aaf89d9e2996ef6870eb6d0"><code>c6112d2</code></a> Bump <code>@protobufjs/utf8</code> in the npm_and_yarn group across 1 directory</li> <li>Additional commits viewable in <a href="https://github.com/js-cookie/js-cookie/compare/v3.0.5...v3.0.7">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for js-cookie since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/openobserve/openobserve/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |