merge: upstream 165 commits#313
Open
github-actions[bot] wants to merge 166 commits into
Open
Conversation
GitOrigin-RevId: 94e25c0ea7431f3ce71d7fd63e8d42141ae5506e
GitOrigin-RevId: 41fbc3889b46cf8091bfa1fd2f2420128eb69b36
* feat: Highlight advanced props * refactor / feedback GitOrigin-RevId: 9edeb0b183b9fd6b373fd34a2e5cc27046d47426
GitOrigin-RevId: 68a5104052a763fd2c26fe4594fcd2e25a3cf54a
GitOrigin-RevId: 2f0f105d5b68cde85f24d6cacd93403dc92ad08f
GitOrigin-RevId: a845a88dda6b07356a3f321bf96d1c957653695f
GitOrigin-RevId: 3a101dcff4b6b5f6ce7db7752de7ac2c9901ab70
GitOrigin-RevId: a28317aef02a2eb91feb92387f2d0399cdbae87e
GitOrigin-RevId: fb745d5933efe7bfbbdb86d5e21383c51efcc73f
GitOrigin-RevId: 17782c920adf9f475363e16224f6f997b0d52154
Upgraded minor and patch versions across all platform workspaces. Skipped version upgrades will be documented in a separate PR. GitOrigin-RevId: a209f961d539ef5e67a72607eff1a7f74e038009
GitOrigin-RevId: 3fa1e141dd7097621f0de65f1fc610062248d23b
…(#2713) @octokit/app bumped 16.1.1 -> 16.1.2 and @octokit/auth-unauthenticated bumped 7.0.2 -> 7.0.3; rename patch files to silence version mismatch warnings on yarn install. Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> GitOrigin-RevId: 8eb7d2aa0b8aa95e78238e83466edf147bbd6970
@ai-sdk/react bumped from 3.0.80 to 3.0.170 as a transitive dependency of @ai-sdk/google-vertex v4. In that range, addToolOutput changed its return type from Promise<void> to void | PromiseLike<void>. Widening spawn's parameter type accommodates this without forcing every call site to cast. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> GitOrigin-RevId: cebf1df3da538c25819eb5d24c3100927f7de897
GitOrigin-RevId: 0e2dbc3d49d6dd874fa88fedc881de96fc42e8e9
…events (#2712)
BaseAnalytics.track() was not passing this.baseEventProperties to
mergeProperties, so properties like `production` and `host` set via
appendBaseEventProperties were never included in events sent to PostHog
(server-side).
mergeSane (lodash mergeWith) mutates the first argument in place. All
call sites pass class members as the first argument, so each call would
permanently accumulate properties from subsequent calls. Merge into a
fresh {} instead.
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitOrigin-RevId: 96f0f681abbce3f2f5e9b7079342f9785b84ea5d
Upgrade devDependency ranges across all `packages/` workspaces. ## devDependency ranges narrowed to latest **packages/cli** - `@babel/core` ^7.12.3 → ^7.29.0 - `@babel/generator` ^7.12.1 → ^7.29.1 - `@babel/parser` ^7.12.3 → ^7.29.2 - `@babel/preset-typescript` ^7.12.1 → ^7.28.5 - `@babel/traverse` ^7.12.1 → ^7.29.0 - `@babel/types` ^7.23.0 → ^7.29.0 - `@types/babel__core` ^7.20.3 → ^7.20.5 - `@types/babel__generator` ^7.6.6 → ^7.27.0 - `@types/babel__traverse` ^7.20.3 → ^7.28.0 - `@types/cli-progress` ^3.11.0 → ^3.11.6 - `@types/lodash` ^4.14.157 → ^4.17.24 - `@types/semver` ^7.3.1 → ^7.7.1 - `@types/tmp` ^0.2.0 → ^0.2.6 - `esbuild` 0.17.18 → 0.27.7 - `lodash` ^4.17.19 → ^4.18.1 - `prettier` ^3.6.2 → ^3.8.3 - `semver` ^7.3.2 → ^7.7.4 - `socket.io-client` ^4.1.2 → ^4.8.3 - `tmp` ^0.2.1 → ^0.2.5 - `ts-jest` ^29.1.1 → ^29.4.9 - `tsx` ^4.20.6 → ^4.21.0 - `utility-types` ^3.10.0 → ^3.11.0 - `winston` ^3.3.3 → ^3.19.0 **packages/create-plasmic-app** - `@types/lodash` ^4.14.168 → ^4.17.24 - `@types/semver` ^7.3.5 → ^7.7.1 - `tsx` ^4.20.6 → ^4.21.0 **packages/host** - `@rollup/plugin-json` ^6.0.0 → ^6.1.0 - `@types/classnames` ^2.3.0 → ^2.3.4 - `rollup-plugin-banner2` ^1.2.2 → ^1.3.1 **packages/loader-react** - `@types/pascalcase` ^1.0.0 → ^1.0.3 **packages/nextjs-app-router** - `@types/yargs` ^17.0.32 → ^17.0.35 **packages/react-web** - `@babel/core` ^7.14.6 → ^7.29.0 - `@babel/preset-env` ^7.22.15 → ^7.29.2 - `@babel/preset-react` ^7.22.15 → ^7.28.5 - `@babel/preset-typescript` ^7.22.15 → ^7.28.5 - `@rollup/plugin-json` ^6.0.0 → ^6.1.0 - `@types/classnames` ^2.3.1 → ^2.3.4 - `@types/clone` ^2.1.1 → ^2.1.4 - `@types/dlv` ^1.1.2 → ^1.1.5 **packages/react-web-runtime** - `rollup` ^4.1.4 → ^4.60.2 ## Lockfile deduplication - Ran `yarn-deduplicate --strategy fewer` after install — reduced from 729 to 470 duplicate entries vs master - Manually preserved two lockfile entries that dedup would incorrectly merge: - `@types/react@*` kept at 18.x (merging up to 19.x breaks `plasmicpkgs/react-slick` build — TS2786) - `@testing-library/user-event@^14.4.0` kept at 14.6.x (merging down to 14.5.2 breaks react-aria storybook focus tests) ## Skipped - `react-aria` / `@react-aria/*` / `@react-stately/*` / `@react-types/*` — blocked by PLA-12485 (focus regression on overlay dismiss) GitOrigin-RevId: 34942a8d48b026e372fe772a77752283cef420cf
- @plasmicapp/cli@0.1.361 - create-plasmic-app@0.0.142 - @plasmicapp/data-sources@1.0.3 - @plasmicapp/host@2.0.2 - @plasmicapp/loader-gatsby@2.0.3 - @plasmicapp/loader-nextjs@2.0.3 - @plasmicapp/loader-react@2.0.3 - @plasmicapp/nextjs-app-router@1.0.23 - @plasmicapp/react-web@1.0.3 - @plasmicapp/react-web-runtime@1.0.3 - plasmicpkgs-dev@0.0.62 - @plasmicpkgs/airtable@0.0.259 - @plasmicpkgs/antd@2.0.167 - @plasmicpkgs/antd5@0.0.340 - @plasmicpkgs/plasmic-chakra-ui@0.0.75 - @plasmicpkgs/cms@0.0.22 - @plasmicpkgs/commerce@0.0.243 - @plasmicpkgs/commerce-commercetools@0.0.193 - @plasmicpkgs/commerce-local@0.0.243 - @plasmicpkgs/commerce-saleor@0.0.207 - @plasmicpkgs/commerce-shopify@0.0.251 - @plasmicpkgs/commerce-swell@0.0.253 - @plasmicpkgs/contentful@0.0.17 - @plasmicpkgs/dnd-kit@0.0.22 - @plasmicpkgs/fetch@0.0.35 - @plasmicpkgs/framer-motion@0.0.243 - @plasmicpkgs/plasmic-google-maps@0.0.24 - @plasmicpkgs/graphql@0.0.29 - @plasmicpkgs/plasmic-keen-slider@0.0.88 - @plasmicpkgs/lottie-react@0.0.237 - @plasmicpkgs/plasmic-mailchimp@0.0.22 - @plasmicpkgs/plasmic-basic-components@0.0.274 - @plasmicpkgs/plasmic-calendly@0.0.91 - @plasmicpkgs/plasmic-cms@0.0.313 - @plasmicpkgs/plasmic-content-stack@0.0.199 - @plasmicpkgs/plasmic-contentful@0.0.193 - @plasmicpkgs/plasmic-embed-css@0.1.229 - @plasmicpkgs/plasmic-eventbrite@0.0.77 - @plasmicpkgs/plasmic-giphy@0.0.77 - @plasmicpkgs/plasmic-graphcms@0.0.216 - @plasmicpkgs/plasmic-hubspot@0.0.89 - @plasmicpkgs/plasmic-intercom@0.0.22 - @plasmicpkgs/plasmic-link-preview@1.0.147 - @plasmicpkgs/plasmic-nav@0.0.215 - @plasmicpkgs/plasmic-pigeon-maps@0.0.77 - @plasmicpkgs/plasmic-query@0.0.264 - @plasmicpkgs/plasmic-rich-components@1.0.246 - @plasmicpkgs/plasmic-sanity-io@1.0.224 - @plasmicpkgs/plasmic-soundcloud@0.0.89 - @plasmicpkgs/plasmic-strapi@0.1.201 - @plasmicpkgs/plasmic-tabs@0.0.86 - @plasmicpkgs/plasmic-typeform@0.0.89 - @plasmicpkgs/plasmic-wordpress@0.0.171 - @plasmicpkgs/plasmic-wordpress-graphql@0.0.161 - @plasmicpkgs/plasmic-yotpo@0.0.88 - @plasmicpkgs/radix-ui@0.0.103 - @plasmicpkgs/react-aria@0.0.177 - @plasmicpkgs/react-audio-player@0.0.72 - @plasmicpkgs/react-awesome-reveal@3.8.247 - @plasmicpkgs/react-chartjs-2@1.0.155 - @plasmicpkgs/react-parallax-tilt@0.0.245 - @plasmicpkgs/react-quill@1.0.108 - @plasmicpkgs/react-scroll-parallax@0.0.254 - @plasmicpkgs/react-slick@0.0.266 - @plasmicpkgs/react-twitter-widgets@0.0.243 - @plasmicpkgs/react-youtube@7.13.249 - @plasmicpkgs/rive@0.0.31 - @plasmicpkgs/plasmic-spotify@0.0.22 - @plasmicpkgs/strapi@0.0.20 - @plasmicpkgs/tiptap@0.0.28 - @plasmicpkgs/vanilla-cookieconsent@0.0.21 - @plasmicpkgs/wordpress@0.0.21 GitOrigin-RevId: f110feb3414bdfdcbd84167e91a951f8dcd4dd60
GitOrigin-RevId: be922d505cb61d4f6df699d002b4a3ba7540e0a3
Resolves critical/moderate audit vulnerabilities: - handlebars: JS injection via AST type confusion (CVE, patch >=4.7.9) - protobufjs: arbitrary code execution (patch >=7.5.5) - via posthog-js opentelemetry chain Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> GitOrigin-RevId: 29c254c6d581dd53094239218f0356e1a1c1ba2e
* fix: Choice prop codegen when options use object form * test: wabToTsType GitOrigin-RevId: 4b7d5bff4f86adc6f3917ecf1cd7a03e0af01a81
GitOrigin-RevId: 7e53e05781d6af6873315d1ad4eb4776e2e00697
GitOrigin-RevId: 13aad22bce0f9357d55549ead01d8b6df8d8733d
GitOrigin-RevId: 643a9d8dfb2d09c8a2c1bd5178ad47683220e0a4
Adds a `loader_bundle_cache_total` Prometheus counter that tracks S3
bundle cache hits and misses, labeled by source ("prefill" vs "live"),
so we can measure how often a live CDN request triggers an esbuild
run vs being served from a prefilled S3 cache.
Adds cache miss log message with the cache key.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitOrigin-RevId: 29dd37be14bd3bab0922875ff51bf3f49b95a3b9
GitOrigin-RevId: 26a99ab7a4b47a43145712b8b0e4b68f8d7db9e8
GitOrigin-RevId: 8765cdc08085347514c193d541654af29c24d15a
GitOrigin-RevId: d781fb8e8a177f3cf7c58d0b632642c94c9bdebc
GitOrigin-RevId: e67b4877ade6f0c9ecd9514b47553a501b02cebc
GitOrigin-RevId: 32c2b217cedc96b7e876664d0d89a4d315b41275
Rename normalizeHtmlEventHandlerAttrName to toReactEventAttr GitOrigin-RevId: 0d17ec02aac6751c2bc523ac2f626e580db337bf
GitOrigin-RevId: d29453f584b8fb35102abfe4383a5249f27471f8
Double click/edit content for inline blocks edits the inner content instead of selecting the parent/root content GitOrigin-RevId: 175719697a9ff0984a7a551b6a4734e65438802c
GitOrigin-RevId: b0c7f7a7751d0676008fa0045b6cd99269861e7e
GitOrigin-RevId: 406be0172b7bd08682aa94687a29bbc0995854a2
GitOrigin-RevId: 46ce7c77c384c3c5b64e35878503e7f68726e4bc
GitOrigin-RevId: 1a697edf6cc7e8fe4854834fa3ab19bebc5c0344
GitOrigin-RevId: dfe3ca8c981bd168a7c5c11eb110d963114cf33a
Add unit tests for tryParseAsObjectPath, ensuring ?. is not parsed as a path Update dynamicStringSchema description, allowing for static strings with single quotes/back ticks. Refactor/reuse TemplatedStringPropEditorValue instead of DynamicStringValue GitOrigin-RevId: b054d277096a9b45081770c4443d63806e41edf2
GitOrigin-RevId: 07e92ce122e5980f0d18dc29378d02674db8fc37
GitOrigin-RevId: af67b3be2a0bd963b4a30fcae47cf1850d1cd887
GitOrigin-RevId: 99adac72cf7e0e2a622f4a66708c4a21e5cb820a
GitOrigin-RevId: 5a89cac483ff7425d5145c24c46d4b113f19158b
GitOrigin-RevId: 34c48fb1e1cfbaf69a05bc9ee26e6236cddac094
GitOrigin-RevId: 64ff0f014d8880ed4d910ffdaa7e2c1e7ca6b429
GitOrigin-RevId: a3aabeecb8499bb144874843efeebc86b8e220d2
GitOrigin-RevId: 26c82c9cc38e456ffd6cefecd0cfa6e54226cafb
- create-plasmic-app@0.0.151 - @plasmicapp/data-sources@1.0.9 - @plasmicapp/host@2.0.4 - @plasmicapp/loader-gatsby@2.0.7 - @plasmicapp/loader-nextjs@2.0.6 - @plasmicapp/loader-react@2.0.6 - @plasmicapp/react-web@1.0.10 - @plasmicapp/react-web-runtime@1.0.10 - plasmicpkgs-dev@0.0.67 - @plasmicpkgs/airtable@0.0.261 - @plasmicpkgs/antd@2.0.169 - @plasmicpkgs/antd5@0.0.347 - @plasmicpkgs/plasmic-chakra-ui@0.0.77 - @plasmicpkgs/cms@0.0.25 - @plasmicpkgs/commerce@0.0.245 - @plasmicpkgs/commerce-commercetools@0.0.195 - @plasmicpkgs/commerce-local@0.0.245 - @plasmicpkgs/commerce-saleor@0.0.209 - @plasmicpkgs/commerce-shopify@0.0.253 - @plasmicpkgs/commerce-swell@0.0.255 - @plasmicpkgs/contentful@0.0.19 - @plasmicpkgs/dnd-kit@0.0.24 - @plasmicpkgs/fetch@0.0.39 - @plasmicpkgs/framer-motion@0.0.245 - @plasmicpkgs/plasmic-google-maps@0.0.26 - @plasmicpkgs/graphql@0.0.33 - @plasmicpkgs/plasmic-keen-slider@0.0.90 - @plasmicpkgs/lottie-react@0.0.239 - @plasmicpkgs/plasmic-mailchimp@0.0.24 - @plasmicpkgs/plasmic-basic-components@0.0.276 - @plasmicpkgs/plasmic-calendly@0.0.93 - @plasmicpkgs/plasmic-cms@0.0.316 - @plasmicpkgs/plasmic-content-stack@0.0.201 - @plasmicpkgs/plasmic-contentful@0.0.195 - @plasmicpkgs/plasmic-embed-css@0.1.231 - @plasmicpkgs/plasmic-eventbrite@0.0.79 - @plasmicpkgs/plasmic-giphy@0.0.79 - @plasmicpkgs/plasmic-graphcms@0.0.218 - @plasmicpkgs/plasmic-hubspot@0.0.91 - @plasmicpkgs/plasmic-intercom@0.0.24 - @plasmicpkgs/plasmic-link-preview@1.0.153 - @plasmicpkgs/plasmic-nav@0.0.217 - @plasmicpkgs/plasmic-pigeon-maps@0.0.79 - @plasmicpkgs/plasmic-query@0.0.266 - @plasmicpkgs/plasmic-rich-components@1.0.253 - @plasmicpkgs/plasmic-sanity-io@1.0.226 - @plasmicpkgs/plasmic-soundcloud@0.0.91 - @plasmicpkgs/plasmic-strapi@0.1.204 - @plasmicpkgs/plasmic-tabs@0.0.88 - @plasmicpkgs/plasmic-typeform@0.0.91 - @plasmicpkgs/plasmic-wordpress@0.0.174 - @plasmicpkgs/plasmic-wordpress-graphql@0.0.163 - @plasmicpkgs/plasmic-yotpo@0.0.90 - @plasmicpkgs/radix-ui@0.0.105 - @plasmicpkgs/react-aria@0.0.180 - @plasmicpkgs/react-audio-player@0.0.74 - @plasmicpkgs/react-awesome-reveal@3.8.249 - @plasmicpkgs/react-chartjs-2@1.0.157 - @plasmicpkgs/react-parallax-tilt@0.0.247 - @plasmicpkgs/react-quill@1.0.110 - @plasmicpkgs/react-scroll-parallax@0.0.256 - @plasmicpkgs/react-slick@0.0.268 - @plasmicpkgs/react-twitter-widgets@0.0.245 - @plasmicpkgs/react-youtube@7.13.251 - @plasmicpkgs/rive@0.0.33 - @plasmicpkgs/plasmic-spotify@0.0.24 - @plasmicpkgs/strapi@0.0.23 - @plasmicpkgs/tiptap@0.0.34 - @plasmicpkgs/vanilla-cookieconsent@0.0.23 - @plasmicpkgs/wordpress@0.0.24 GitOrigin-RevId: f9760e92bc673fce71817beaf70d910d4137fbd0
GitOrigin-RevId: 246698e94ad573ef925a5f6893310ceaf8688bdd
GitOrigin-RevId: c8d96bebff5d2755ce970d03b35bfb34112341f4
GitOrigin-RevId: f4166ff66f0d8f96ce5a263a3be34232dcca7a10
This PR adds a new option in the prop editor submenu, to shortcut using data tokens as dynamic value. GitOrigin-RevId: f235da45f7027085ef60c745803136dc76853334
…#2757) This PR fixes several issues with arbitrary code in data queries: - The stored arbitrary code wasn't wrapped in parentheses, which the codebase uses to mark a value as evaluable code rather than a literal. This PR wraps it on store and strips the parentheses before parsing. - 1 was partly why the Studio crashed when using a Use Data Query action with arbitrary code; 1 fixes this. - $steps was not available in the data context of the Use Data Query action. - await was not allowed in arbitrary code inside a Use Data Query action. - Adds a test for arbitrary code in Use Data Query action GitOrigin-RevId: 5e7f8db0df11aa40216794d4008788538df4de24
GitOrigin-RevId: ca2cbf553007520ee80b2416e960cf81352811f5
6db4dab to
b183c14
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Upstream Merge
165 new commits from plasmicapp/plasmic master.
Conflicts to resolve
git fetch origin merge/upstream git checkout merge/upstream # Resolve conflicts, then: git push origin merge/upstreamConflicted files:
Before merging
See Upstream Merge Runbook.