Release 6.7.0 - #463
Merged
Merged
Conversation
…tuning to follow..
* initial commit * restore hidden fields for service
…ng multiple file ok too..
* initial ocmmit * fix test
hide empty filters
6.6.0 into Develop
* initial commit * remove second package lock
Replace svg-captcha with captcha-canvas
* store * fix issues * fix test * fix action
…ut looking good now..
* chore: wip - convert express module to typescript * fix: unused import and unnecessary export * refactor: more expressive function name for paging links * refactor: convert express module to typescript * fix: delete unnecessary routes for admin pages * fix: make /api/users route inert by returning an empty result and remove all underlying functions that enabled fetching all users * chore: remove unnecessary express typedef * fix: rebase errors in express modules * chore: deprecate get all users operation in openapi doc * fix(service): remove obsolete failing user read tests * fix(service): remove unnecessary mocks causing paging test failure * fix(service): remove unnecessary mocks causing export test failure
…#447) * Cap admin page width and centralize breadcrumb rendering in the shell Move <admin-breadcrumb> out of each admin page into the shell, driven by a new AdminBreadcrumbService, so a single global CSS rule can cap every admin page at 1200px without per-page styles. * Add missing service file
* chore: add entries to dockerignore * feat: use ironbank base image for development image * ci: remove unused "test" ref name from dev image build and add annotation for source commit hash to dev image
…try in addition to undefined (#452)
…r data directory (#455) * fix: omit web-core-lib development package from dev docker image * fix: dev image permission errors - create base data directory as nonroot user
…tion and feed item views
…spacing with observation and people list items
Headlined by the Angular 20 / Material 3 upgrade, audit logging, Mongoose 8 / MongoDB 8 support, the ldapts migration, and removal of the epic, geoserver, and rage plugins. Also drops PR number citations from the 6.5.5/6.5.8 entries added in the prior commit for consistency.
Moves the production js-yaml dependency (via xmlbuilder2) from the vulnerable 3.14.1 to 4.3.0. Only fragment() is used in kmlWriter.ts, whose behavior is unchanged between the two major versions.
cfenv pulled in a vulnerable js-yaml (and unused ports/underscore) for a feature — reading VCAP_APPLICATION/VCAP_SERVICES — that hasn't been documented as supported deployment path in years. Environment config is now read directly from MAGE_* env vars with no cfenv indirection.
…39244 (#457) * fix(service): bump adm-zip to 0.6.0 for CVE-2026-39244 A crafted zip declaring a huge uncompressed size could force an unbounded Buffer.alloc and OOM the process (GHSA-xcpc-8h2w-3j85), high severity. Both call sites (form/icon zip import, KMZ layer import) extract user-uploaded archives, so this is a real DoS surface. 0.6.0 ships its own TypeScript types, so @types/adm-zip is dropped too. * fix(service): fix primary/variant icon extraction on form import PR #431 replaced the walk package with fs.readdir({recursive: true}) but left the regex used to derive primary/variant from each icon's parent path unchanged. That regex was written to match walk's double-separator paths (e.g. ".../formId//primaryA") and never matches fs.readdir's normalized single-separator parentPath, so primary/variant always parsed as null. Every icon in a form's zip collapsed into a single Mongo document, breaking per-primary/variant map symbology even though the extracted files were correct on disk. Use path.relative instead of a hand-built regex.
Resolves GHSA-664h-wqgq-64gw (prototype pollution via __proto__-prefixed dotted path in update casting). Patch-level bump within 8.x, no breaking changes
…458) * fix(web-app): fix "go to" snackbar links after admin entity creation Snackbar navigation used router-relative paths (e.g. '../events') with no relativeTo context, so Router.navigate resolved them from the root and fell through to the home route instead of the new entity. Switch to absolute /admin/... paths for events, layers, teams, users, and devices, and standardize the action text to "Go to X". * fix tests
…459) The create-layer dialog gave no feedback while a .gpkg file uploaded, leaving the user staring at an unresponsive dialog. createLayer now reports HttpEvent progress, and the dialog shows a progress bar, disables Cancel/Create while uploading, and closes on the final response.
The feed's location query populated users with a field projection
that excluded `avatar`, so `avatarUrl` was never computed for feed
users even though it worked for the profile page's full user fetch.
The feed's list-item component also received the raw
{id, location, user} location-feature wrapper and passed it directly
to <user-avatar> instead of the nested actual user, so avatarUrl/id
were looked up on the wrong object. Renamed the wrapper input to
`userWithLocation` and unwrap it once into `user`/`location` fields,
matching the pattern already used correctly in user-popup.component.
* fix: set docker image user/group to 999 to match existing images and file system ownership * chore(ci): update all actions workflows to latest checkout and setup-node actions * chore(nga-msi): upgrade typescript * feat: add msi plugin to dev image * chore: remove unused ldif file * ci: set a custom input tag to publish the dev container image * fix: typo in dockerfile * fix: bad package name in dockerfile * fix(ci): consistent image url across steps * fix(ci): missing closing brackets * fix(ci): missing quotes * fix(ci): wrong image url * fix(ci): missing step id * fix(ci): remove extra quotes around image url to fix trivy step * fix(sftp/web): bad import in showcase app * fix(sftp): bump beta version for publish * chore(nga-msi): bump patch version * chore(ci): add oidc token permissions to release workflow per npm docs * chore(image.service): remove beta qualifier from package version * refactor(ci): rename release to release.core * chore(ci): upgrade download-artifact actions to v8 * chore(ci): upgrade release action to v3 * chore(ci): remove mistakenly added oidc permissions block * refactor(ci): rename plugin release workflows hierarchically * fix(web-app): show default map icon for forms without select fields (#461) The Default symbology card was only rendered when a form had select fields and a primary field was chosen, making the default icon unreachable otherwise. It now always renders and displays the actual uploaded icon via getIconUrl instead of a static placeholder. * fix: remove duplicate docker section from readme * refactor(ci): add container image workflow for prod and rename dev image workflow to match hierarchically * fix: typos in readme * chore(container): use multistage build with distroless/rootless image for prod container image; add image plugin to container image * feat(ci): use oidc trusted publishing for plugin release workflows * fix(ci): remove reference to absent plugins in core release workflow * feat(ci): use publish dry run for draft release in core release workflow --------- Co-authored-by: Billy Newman <3382274+newmanw@users.noreply.github.com>
… deprecation warning feat(ci): add dist_tag input to core release; add package_info action; add dry run fail-fast; enhance prerelease check fix(ci): add checkout to use package info action fix(ci): use eval for npm publish command with tag switch because npm does not interpret the tag switch properly from an environment variable feat(ci): add dist tag support to plugin release workflows
…reviously published
newmanw
approved these changes
Jul 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
9 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR merges the changes from the 6.7.0 release process to master, including enhancements to the GitHub Actions workflows. This effectively merges develop to master.