Repository navigation
fix(deps): port October security fixes to macOS Author - #141
Merged
Amir Bredy (ABMFST) merged 2 commits intoOct 15, 2026
Merged
Conversation
Cherry-pick shared dependency remediation from f1b345f while preserving 0.3.101-author.1 and author-only capabilities. Resolve workflow pin conflicts and add native macOS build/bridge verification. (cherry picked from commit f1b345f) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b57352bc-2fa6-4f21-bf28-d72b093d3c10
The author bundles and native icons built successfully; the isolated verification VM needs the CommonJS module object emitted by esbuild. Keep all capability assertions unchanged. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b57352bc-2fa6-4f21-bf28-d72b093d3c10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Cherry-pick the reviewed security changes from
f1b345f188374262ed8f3f61792d6cf69a25ebe7(#140) ontomac-author-build.author-specific build scripts, and every author capability gate.
coverage, CSS compatibility tests, and setup-node/upload-artifact updates.
cross-merge
mainor replace author renderer/preload source.hoisted xmldom 0.8.15 layout rather than regressing them to main's layout.
preload excludes health, deploy, deployRecovery, revert, auditResults,
and system while retaining authoring APIs.
All Node.js/npm execution is on GitHub Actions, never the local machine.
Normal lint, full tests, Linux build, Node 24, Windows Electron smoke, and
the native macOS author job must pass before merge. No release or tag is
created, and no advisory is dismissed.
The additional upstream build-only braces and sprintf-js advisories remain
documented without suppression, as in #140.