* main: (63 commits)
Prevent Fizzy menu from closing on page refreshes
Rename bin/gitleaks to gitleaks-audit
Introduce gitleaks to the codebase
Simplify Current.with_account and .without_account
Disable focus ring
Larger emojis in picker, fit on narrow viewports
Fix a couple of typos
Revert unnecessary fixture change
Switch to a pool size of 5
Update SQLite schema
Tidy up modules and on_load points
Enforce SQLite column limits via CHECK constraints
Ensure avatar thumbnails are square
Enforce column limits via concern
Enforce MySQL string/text limits in SQLite
Use Uuid type directly
Update config/database.yml
Update config/database.yml
Don't use Current.account for search records
Drop sqlite compability, using a separate schema.rb
...
* main: (116 commits)
Ensure avatar thumbnails are square
Update useragent to recognize twitterbot/facebot
Add defensive styles for non-square avatar images
Update test for copy changes
Missed commit
AI: standardize on https://agents.md
Make it clear this is just notifications, not comprehensive activity
AI: configure MCP servers for Chrome, Grafana, and Sentry (#1727)
Allow requests from Google Image Proxy
Update to basecamp's useragent fork
Clean up a little bit the CSRF reporting code
Claude: production observability guidance (#1725)
Prevent autoscroll to the root columns container to prevent jump on page load
Include full name string so you can type your name to filter
Prioritize current user and assigned users in assignment dropdown
Check and report on Sec-Fetch-Site header for forgery protection
bundle update
Bump bootsnap from 1.18.6 to 1.19.0
Bump rails from `077c3ad` to `17f6e00`
Fix cards getting stuck in edit mode
...
Patch the sqlite adapter to add CHECK constraints for string and text
column limits. We'll do them inline, so that any column changes
automatically update the constraints.
* main: (30 commits)
Update useragent to recognize twitterbot/facebot
Add defensive styles for non-square avatar images
Update test for copy changes
Missed commit
AI: standardize on https://agents.md
Make it clear this is just notifications, not comprehensive activity
AI: configure MCP servers for Chrome, Grafana, and Sentry (#1727)
Allow requests from Google Image Proxy
Update to basecamp's useragent fork
Clean up a little bit the CSRF reporting code
Claude: production observability guidance (#1725)
Prevent autoscroll to the root columns container to prevent jump on page load
Include full name string so you can type your name to filter
Prioritize current user and assigned users in assignment dropdown
Check and report on Sec-Fetch-Site header for forgery protection
bundle update
Bump bootsnap from 1.18.6 to 1.19.0
Bump rails from `077c3ad` to `17f6e00`
Fix cards getting stuck in edit mode
Don't report ConcurrentMigrationError to Sentry
...
Previously we were fitting the image inside a 256x256 box while keeping
it's original aspect ratio. But this can lead to images that are
squished and/or pixelated when we try to show them inside a square
container in the app.
Instead we can resize them to be square.
This is a great, solid alternative to CSRF tokens for CSRF protection
when we aren't worried about older browsers or other kind of actors
doing modifying requests in our app, and could be a good test for future
upstreaming to Rails (although there we'd need to continue using CSRF
tokens or at least letting people opt out manually).
Let's start checking the header and reporting on it when CSRF fails or
when it doesn't match the other checks Rails does, and then promote this
to be the only way to defend from CSRF.
It doesn't actually work, and even if we could make it work reliably
we are better off if the records always know to go to the right shard.
It does make the interface a bit more complicated as we need to select
the right shard class with `for(account_id)`.
* main: (35 commits)
Replace the whole card on update
Include bottom inset on the modal and footer, too
Attempt to fix expanded search input
Lose the second close button
This seems to have caused the unwanted effect of not focusing the field in Mobile Safari
Always display the cancel button, `esc` isn't obvious
Nothing should cover the bar, trays or search results
Dark theme color isn't black
Add env constaints for mobile layout
Smaller on mobile
Reasonalbe max heights
Remove top orientation (it doesn't work well), make right and left classes exclusive
This is too fancy, remove it
Set reasonable maxes
Restore bubble to Maybe
Restore structured logging of `queenbee_id`
Add a kamal pre-build hook with some safety checks
Configure beta to use production blob store
Configure beta load balancer
Update beta deployment and secrets config
...
Usually, `<b>`, `<i>`, etc are enough but when you attempt a combo like
bold-italic, Lexxy applies two classes to a single element instead of
rendering tags like in the output
Instead of writer pinning, we'll track the last transaction ID of each
write in the session. Then on each read we'll wait for the replica to
report that this transaction is available.
If it doesn't become available within a reasonable timeout, we'll
proceed anyway, and accept the possibility of a stale read.
The hope here is that most of the time, the replica is caught up in the
time between a write request and the following read request. If it's
not, we now have a little tolerance to wait for it, which hopefully
proves enough to stale reads are not encountered in normal use.
We also disable the writer affinity opt-out mechanism that we had
before, since we will no longer be using writer affinity at the load
balancer.
Adrien Maston