[roomote-roomote]

​Opened on behalf of @mrubens. Follow up by mentioning @roomote-roomote, in the web UI, or in Slack.

What changed

Prepare the confirmed 1.19.6 → 1.19.7 patch release from audited develop 249d87b97c34eb3c7450855b56be1e6940c84fe0. Generated the root version and changelog with pnpm run version, then polished the in-app summary and highlights. Only root package.json and CHANGELOG.md change; historical notes and workspace package versions are preserved.

Release summary

Roomote 1.19.7 strengthens runtime security while keeping your existing sign-in and task workflows familiar.

Highlights

• Includes security updates for request parsing, input validation, Microsoft authentication, and URI handling.

Patch changes

• Update runtime dependencies to address security issues in request parsing, input validation, Microsoft authentication, and URI handling while preserving existing sign-in, account-linking, and task workflows.

Release audit and public docs coverage

• Audited the complete first-parent range since published v1.19.6: #3628 and #3600. The published tag resolves to main 3c11dbaa0ec59f63373e21f1f251b4b8be1b44ea; main/develop root versions and top changelog agreed at 1.19.6.
• No existing applicable preparation or Promote PR, unshipped version, or pending changeset was found. One temporary patch changeset grouped the runtime security maintenance and was consumed by tooling; .changeset/README.md remains.
• Contributor/reporter audit: both PR authors are GitHub App bots and neither PR closes an issue. Read the three individual CODEOWNERS; no external acknowledgements are required.
• Runtime dependency security maintenance → self-hosted operations and upgrades. Reviewed both included changes and current public guidance: no new public capability, configuration, permission, provider, prerequisite, or workflow needs documentation. No release-blocking docs or provider-icon update is required.

Why this change was made

Package the merged security maintenance into the next normal patch release, using the repository's single-product version tooling and keeping release copy aligned with the actual shipped scope.

Impact

Squash-merging this preparation PR into develop lets CI freeze the version-bump commit and automatically open Promote v1.19.7 to production against main. Preparation CI and reviews must pass before merge; promotion needs its own current-head CI and review evidence. This PR does not merge, promote, tag, publish, or deploy anything.

How it was tested

• pnpm run version generated 1.19.6 → 1.19.7 and consumed the one temporary patch changeset.
• Direct artifact assertions passed: exact root-only version delta, unchanged historical changelog, polished summary/highlight and patch heading, no pending changesets, retained README, unchanged workspace versions, exactly two release-artifact paths, and branch rooted at audited develop.
• git diff --check passed. Ordinary pre-commit formatting and Judgement passed (four judgments).
• The ordinary git push origin HEAD ran the pre-push hook exactly once: oxlint, both residual ESLint tasks, all 27 fast type-check tasks (zero cache hits), and Knip passed. Non-failing notices: circular workspace dependencies and an existing Mint ignore-binary hint.
• Per the release skill, full release-script/repository suites and formatting-inclusive checks are left to PR CI rather than rerun locally. No docs changed. Browser proof is not applicable to this version/changelog-only preparation; no screenshot evidence is claimed.
• Re-fetched main/develop/tags after the push: both audited branch tips and latest published v1.19.6 were unchanged; no duplicate prep/Promote PR appeared. If develop advances before merge, rebuild and re-audit from the new tip.

Checklist

• The PR title follows the repo convention: [Fix], [Feat], [Improve], [Refactor], [Docs], or [Chore] followed by a user-facing description
  • Release-specific exception: the checked-in release skill prescribes Release Roomote X.Y.Z.
• This PR is small and scoped to one change
• pnpm lint and pnpm check-types pass locally
  • The ordinary push hook's fast equivalents passed; full checks remain PR CI gates as prescribed by the release skill.
• I added tests or included a clear manual validation note above
• I removed secrets, tokens, private keys, and customer data from code, logs, and screenshots
• If this change should appear in the changelog, I ran pnpm changeset
  • Authored the temporary release input directly in the prescribed format and consumed it with pnpm run version.

[roomote-community]

No code issues found. See session

Reviewed the root-only 1.19.6 → 1.19.7 version bump and changelog against the release tooling and the two merged dependency-security changes since v1.19.6. The release notes match that scope, historical entries are unchanged, and no pending changesets remain.

Current-head lint, typecheck, tests, Knip, deployment-artifact, backup-restore, and Judgement checks passed. Docker app build, upgrade compatibility, and JavaScript/TypeScript CodeQL analysis were still running when checked. No approval submitted.

_{Reviewed ee3b3ee}