chore: forward-merge main into next after 1.0.1 by raviships · Pull Request #317 · edgestorejs/edgestore

raviships · 2026-10-24T04:10:56Z

Summary

Forward-merges main into next, as RELEASING.md describes. This brings the 1.0.1 release work to next:

the security fixes fix: harden the context cookie against cross-site requests #308 (context cookie) and fix: require beforeDelete to replace or overwrite files from the browser #309 (beforeDelete for replace/overwrite)
the release pipeline hardening ci: harden the release pipeline and dependency installs #307 and ci: migrate release workflow to changesets/action v2 #316 (changesets/action v2 + Changesets CLI v3)
the Dependabot action updates (chore(deps): bump pnpm/action-setup from 6.0.10 to 6.1.0 in the github-actions group #311, chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 #312, chore(deps): bump actions/setup-node from 6.5.0 to 7.1.0 #313, chore(deps): bump actions/cache from 5.1.0 to 6.1.0 #315)
the 1.0.1 version bump (Version Packages #310)

One conflict, in .github/workflows/release.yml: the three publishing setup-node steps. next had switched them to node-version-file: .nvmrc in #305, its Node 24.22.1 pin, while main had removed cache: pnpm from them in #307. The resolution keeps both:

-          node-version: 24        # main
-          cache: pnpm             # next
+          node-version-file: .nvmrc

Evidence

On the merge commit, with pnpm 11.15.1 and Node 24.22.1:

pnpm install --frozen-lockfile: passes
pnpm build: passes
pnpm typecheck: passes
pnpm test: 9/9 tasks pass

Risk and rollback

Door: Two-way. Revert the merge commit to undo. Merge with a merge commit, not a squash, so later forward merges stay clean.
Blast radius: Only the next branch and its Vercel previews. next is dormant (no .changeset/pre.json), so the release workflow skips publishing on push.

By: Claude Opus 5.5 Extra High on Claude Code

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The EdgeStore handler now rejects request bodies that are not sent as application/json, so cross-origin requests always need a CORS preflight. The edgestore-ctx cookie defaults to SameSite=Lax and HttpOnly, plus Secure over HTTPS or in production, and the encrypted context expires with the configured cookie maxAge instead of a fixed 30 days. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…talls Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Drop the per-request https flag from the adapters, the dispatcher request, init and getCookieConfig. Secure now defaults to on when NODE_ENV is production, the same for every adapter, and cookieConfig still overrides it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

trustPolicyIgnoreAfter (30 days) applies the trust check to fresh releases, where hijacked versions appear, so the semver/vite exclusions are no longer needed. next@16.4.1 is now well past the one-day release age gate, so its minimumReleaseAgeExclude entries are removed. Also trims the comments. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The defaults work without configuration, and the JSDoc on each cookie option already states its default. The changeset keeps the one override a cross-site frontend needs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Testing a production build over plain HTTP drops the Secure context cookie (Safari does so even on localhost), and uploads then fail with a bare "Missing edgestore-ctx cookie". The error and changeset now say how to opt out with secure: false. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ci: harden the release pipeline and dependency installs

fix: harden the context cookie against cross-site requests

Bumps the github-actions group with 1 update: [pnpm/action-setup](https://github.com/pnpm/action-setup). Updates `pnpm/action-setup` from 6.0.10 to 6.1.0 - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](pnpm/action-setup@0977fd9...ea17c68) --- updated-dependencies: - dependency-name: pnpm/action-setup dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.5.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@924ae3a...b7ad1da) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6.5.0 to 7.1.0. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@2499707...949feb2) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [actions/cache](https://github.com/actions/cache) from 5.1.0 to 6.1.0. - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@caa2961...55cc834) --- updated-dependencies: - dependency-name: actions/cache dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

…placement

The SDK now runs beforeDelete on replacement targets, so the next-complete example no longer needs its own ownership check in beforeUpload. The docs keep one sentence per place a user meets the change, and the changeset is shorter. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…key layout A custom `path` callback can place files with different router paths at the same key, so the shared layer can't assume an existing file has the upload's path. S3 and Azure now include the path only with the default layout; otherwise `canDelete` fails closed for buckets with path fields. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…thub-actions-dfc3086b10 chore(deps): bump pnpm/action-setup from 6.0.10 to 6.1.0 in the github-actions group

…tions/setup-go-7.0.0 chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0

…tions/cache-6.1.0 chore(deps): bump actions/cache from 5.1.0 to 6.1.0

…tions/setup-node-7.1.0 chore(deps): bump actions/setup-node from 6.5.0 to 7.1.0

A "/" inside a path value or the browser-chosen file name lets different paths produce the same default key, so the key no longer proves the existing object's path. S3 and Azure now share one helper that reports the path only for the default layout with slash-free segments; otherwise the overwrite check fails closed like deletion does. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

changesets/action v2 refuses to run against @changesets/cli 2.x. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ci: migrate release workflow to changesets/action v2

Re-uploading an existing manualFileName now says which file already exists, both when the bucket has no beforeDelete and when beforeDelete refuses, instead of a generic replacement error. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…placement

fix: require beforeDelete to replace or overwrite files from the browser

Version Packages

Brings the security fixes (#308, #309), release pipeline hardening (#307, #316), action updates and the 1.0.1 version bump into next. In release.yml, keeps next's node-version-file pin from #305 and main's removal of the pnpm cache from publishing jobs (#307). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

vercel · 2026-10-24T04:11:00Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
edgestore-docs	Ready	Preview	Oct 24, 2026 4:12am UTC
example-access-control	Ready	Preview	Oct 24, 2026 4:12am UTC
example-components	Ready	Preview	Oct 24, 2026 4:12am UTC

chatgpt-codex-connector · 2026-10-24T04:11:12Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-24T04:12:15.240768Z	`8d97023`	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

raviships and others added 30 commits October 23, 2026 16:48

ci: pin GitHub Actions to commit SHAs

b6f766c

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ci: add Dependabot updates for pinned actions

8f264bb

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ci: drop persisted git credentials from jobs that never push

7985dd2

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ci: stop restoring the pnpm cache in publishing jobs

668a63a

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs: document the context cookie defaults and overrides

83cba2a

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

chore: reject trust downgrades and exotic subdependencies in pnpm ins…

6e3c24d

…talls Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

fix(cli): update smol-toml to 1.9.1

394fded

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ci: give major action updates their own Dependabot PRs

314f04c

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

fix: require beforeDelete to replace or overwrite files from the browser

3a79dc3

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

fix: authorize S3 and Azure Blob overwrites before signing URLs

a999d36

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

fix: cancel hosted uploads that would supersede an unauthorized file

db4f359

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs: explain that replacing a file requires beforeDelete

3436d15

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

chore: add changeset for replacement authorization

85791bb

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

style: format dispatcher content type test

0e211a5

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs: align the context cookie options table

931c982

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

chore: drop blockExoticSubdeps, which pnpm 11 already defaults to true

4212484

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Merge pull request #307 from edgestorejs/ci/harden-release-pipeline

d67b890

ci: harden the release pipeline and dependency installs

Merge pull request #308 from edgestorejs/fix/harden-context-cookie

c5f5b29

fix: harden the context cookie against cross-site requests

Merge remote-tracking branch 'origin/main' into fix/authorize-file-re…

d8016bb

…placement

raviships and others added 14 commits October 24, 2026 11:46

Merge pull request #311 from edgestorejs/dependabot/github_actions/gi…

c4cacf0

…thub-actions-dfc3086b10 chore(deps): bump pnpm/action-setup from 6.0.10 to 6.1.0 in the github-actions group

Merge pull request #312 from edgestorejs/dependabot/github_actions/ac…

7c6583f

…tions/setup-go-7.0.0 chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0

Merge pull request #315 from edgestorejs/dependabot/github_actions/ac…

c83bc3b

…tions/cache-6.1.0 chore(deps): bump actions/cache from 5.1.0 to 6.1.0

Merge pull request #313 from edgestorejs/dependabot/github_actions/ac…

ebc0f20

…tions/setup-node-7.1.0 chore(deps): bump actions/setup-node from 6.5.0 to 7.1.0

chore: upgrade Changesets CLI to v3

289b401

changesets/action v2 refuses to run against @changesets/cli 2.x. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ci: migrate release workflow to changesets/action v2

cd45e38

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Merge pull request #316 from edgestorejs/ci/migrate-changesets-action-v2

1645b62

ci: migrate release workflow to changesets/action v2

Merge remote-tracking branch 'origin/main' into fix/authorize-file-re…

2b7e569

…placement

Merge pull request #309 from edgestorejs/fix/authorize-file-replacement

e987bab

fix: require beforeDelete to replace or overwrite files from the browser

Version Packages

9944886

Merge pull request #310 from edgestorejs/changeset-release/main

238e6e9

Version Packages

vercel Bot deployed to Preview – example-components October 24, 2026 04:11

View deployment

vercel Bot deployed to Preview – example-access-control October 24, 2026 04:12

View deployment

vercel Bot deployed to Preview – edgestore-docs October 24, 2026 04:12

View deployment

raviships merged commit 49e5e7f into next Oct 24, 2026
10 checks passed

raviships deleted the chore/forward-merge-main-into-next-1.0.1 branch October 24, 2026 04:14

raviships mentioned this pull request Oct 24, 2026

chore: merge next into main for the Node 24.22.1 pin #318

Merged

Navigation Menu

Repository navigation

chore: forward-merge main into next after 1.0.1 - #317

chore: forward-merge main into next after 1.0.1#317
raviships merged 44 commits into
nextfrom
chore/forward-merge-main-into-next-1.0.1

raviships commented Oct 24, 2026

Uh oh!

vercel Bot commented Oct 24, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 24, 2026 •

edited

Loading

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

raviships commented Oct 24, 2026

Summary

Evidence

Risk and rollback

Uh oh!

vercel Bot commented Oct 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Oct 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Oct 24, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 24, 2026 •

edited

Loading