fix: flush pending changesets immediately after reconnect

[deepshekhardas]

Summary

Fixes issue where edits made while disconnected sat as pending local changesets and were only transmitted when the user made another edit.

Changes

• When transitions from to (after reconnect and server revisions are applied), call to flush any queued local changes.

Why this fix

After reconnecting, called and but never called . The fix in ensures pending changes are flushed once all server revisions have been applied.

Fixes ether#5108

---

Summary by cubic

Flushes any offline edits immediately after reconnect by sending pending changes as soon as server revisions finish applying. This fixes pending changesets that only synced after making a new edit.

• New Features

  • Added cookie name prefixing via settings.cookie.prefix to avoid collisions with other apps (backward compatible; defaults to empty).
  • Session store now periodically cleans up expired/stale sessions (configurable via settings.cookie.sessionCleanup).

• Bug Fixes

  • Timeslider no longer breaks on identity changesets; playback and slider position advance reliably.
  • PageDown moves the caret by a full page; improved clamping for selection.
  • Pad deletion waits for server confirmation before navigating; server awaits pad.remove(); shows proper error if not allowed.
  • appendText API attributes inserted text to the supplied author so colors and author lists are correct.
  • Lists: fixed numbering after bullets or indents, improved continuity, and ensured indented text exports without bullet markers; batching avoids O(n²) renumbering.
  • API: POST requests with JSON bodies no longer hang; guarded against parameter pollution; safer method handling.
  • Stability: ignore errors from browser extensions during init and global error handling; correct numConnectedUsers for the joining user.
  • i18n: URL lang reliably overrides defaults, custom strings load without stale cache, language list sorted by native name, and window._() always available for plugins.
  • Accessibility and input: Escape exits the editor to the toolbar (without trapping), improved screen reader roles/aria, removed per-line aria-live to stop character echo, popups fit small screens, and compose/dead-key input no longer eats spaces on Firefox/Linux.

^{Written for commit f430da5. Summary will update on new commits.}

[cubic-dev-ai]

5 issues found across 174 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/node/hooks/express/specialpages.ts">

<violation number="1" location="src/node/hooks/express/specialpages.ts:24">
P1: `x-proxy-path` sanitization still allows protocol-relative URLs (for example `//host`), enabling external script loading via `entrypoint`.</violation>
</file>

<file name="admin/src/localization/i18n.ts">

<violation number="1" location="admin/src/localization/i18n.ts:29">
P1: Return after invoking the error callback to avoid calling the backend callback twice on JSON parse failures.</violation>
</file>

<file name="README.md">

<violation number="1" location="README.md:103">
P2: The README now omits the minimum supported Node.js version, which conflicts with the project requirement (`node >=20.0.0`) and can cause users to run unsupported environments.</violation>
</file>

<file name="admin/src/components/IconButton.tsx">

<violation number="1" location="admin/src/components/IconButton.tsx:13">
P3: Avoid concatenating an optional `className` directly; when omitted it renders `"undefined"` as a CSS class.</violation>
</file>

<file name="admin/package.json">

<violation number="1" location="admin/package.json:23">
P1: `@vitejs/plugin-react` 6.x requires Vite 8, but this package is still pinned to Vite 7.2.10, creating an incompatible dependency set.</violation>
</file>

_{Note: This PR contains a large number of files. cubic only reviews up to 75 files per PR, so some files may not have been reviewed. cubic prioritizes the most important files to review.
On a pro plan you can use ultrareview for larger PRs.}

[cubic-dev-ai]

P1: x-proxy-path sanitization still allows protocol-relative URLs (for example //host), enabling external script loading via entrypoint.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/node/hooks/express/specialpages.ts, line 24:

<comment>`x-proxy-path` sanitization still allows protocol-relative URLs (for example `//host`), enabling external script loading via `entrypoint`.</comment>

<file context>
@@ -17,6 +17,13 @@ import prometheus from "../../prometheus";
+// Only allow path-like characters (letters, digits, hyphens, underscores, slashes, dots).
+const sanitizeProxyPath = (req: any): string => {
+  const raw = req.header('x-proxy-path') || '';
+  return raw.replace(/[^a-zA-Z0-9\-_\/\.]/g, '');
+};
+
</file context>

Suggested change

	return raw.replace(/[^a-zA-Z0-9\-_\/\.]/g, '');
	return raw.replace(/[^a-zA-Z0-9\-_\/\.]/g, '').replace(/\/{2,}/g, '/').replace(/\.\./g, '').replace(/^\/?/, '/').replace(/\/$/, '');

[cubic-dev-ai]

P1: Return after invoking the error callback to avoid calling the backend callback twice on JSON parse failures.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At admin/src/localization/i18n.ts, line 29:

<comment>Return after invoking the error callback to avoid calling the backend callback twice on JSON parse failures.</comment>

<file context>
@@ -6,52 +6,50 @@ import LanguageDetector from 'i18next-browser-languagedetector'
+    try {
+      json = JSON.parse(await localeJSON.text())
+    } catch(e) {
+      callback(new Error("Error loading"), null);
+    }
+
</file context>

Suggested change

	callback(new Error("Error loading"), null);
	return callback(new Error("Error loading"), null);

[cubic-dev-ai]

P1: @vitejs/plugin-react 6.x requires Vite 8, but this package is still pinned to Vite 7.2.10, creating an incompatible dependency set.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At admin/package.json, line 23:

<comment>`@vitejs/plugin-react` 6.x requires Vite 8, but this package is still pinned to Vite 7.2.10, creating an incompatible dependency set.</comment>

<file context>
@@ -18,27 +18,27 @@
-    "@vitejs/plugin-react": "^5.1.4",
+    "@typescript-eslint/eslint-plugin": "^8.58.0",
+    "@typescript-eslint/parser": "^8.58.0",
+    "@vitejs/plugin-react": "^6.0.1",
     "babel-plugin-react-compiler": "19.1.0-rc.3",
-    "eslint": "^10.0.0",
</file context>

Suggested change

	"@vitejs/plugin-react": "^6.0.1",
	"@vitejs/plugin-react": "^5.1.4",

[cubic-dev-ai]

P2: The README now omits the minimum supported Node.js version, which conflicts with the project requirement (node >=20.0.0) and can cause users to run unsupported environments.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At README.md, line 103:

<comment>The README now omits the minimum supported Node.js version, which conflicts with the project requirement (`node >=20.0.0`) and can cause users to run unsupported environments.</comment>

<file context>
@@ -100,7 +100,7 @@ volumes:
 ### Requirements
 
-[Node.js](https://nodejs.org/) >= **18.18.2**.
+[Node.js](https://nodejs.org/).
 
 ### Windows, macOS, Linux
</file context>

Suggested change

	[Node.js](https://nodejs.org/).
	[Node.js](https://nodejs.org/) >= **20.0.0**.

[cubic-dev-ai]

P3: Avoid concatenating an optional className directly; when omitted it renders "undefined" as a CSS class.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At admin/src/components/IconButton.tsx, line 13:

<comment>Avoid concatenating an optional `className` directly; when omitted it renders `"undefined"` as a CSS class.</comment>

<file context>
@@ -1,17 +1,17 @@
-        {icon}
-        <span>{title}</span>
-        </button>
+  return <button style={style}  onClick={onClick} className={"icon-button "+ className} disabled={disabled}>
+    {icon}
+    <span>{title}</span>
</file context>