chore(release): prepare v1.1.0-alpha.3#135
Merged
Merged
Conversation
Bump version to 1.1.0-alpha.3 across appinfo/info.xml, package.json, and package-lock.json (consistency guard green); regenerate js/ license sidecars with the new version (bundles unchanged). Add the alpha.3 CHANGELOG section summarising the security hardening (#105, #102, #110), the Playwright e2e suite (#54), the Psalm burndown + findUnusedCode (#82, #122, #133, #134), and the supporting refactors/tooling.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release prep for v1.1.0-alpha.3 (third public-review release).
Changes
1.1.0-alpha.3inappinfo/info.xml(source of truth),package.json, and bothpackage-lock.jsonfields — version-consistency guard green.js/*.licensesidecars regenerated with the new version (the.mjsbundles are byte-identical; no source JS changed) so the stale-assets CI check (CI: fail the build when committed js/ assets are stale #101) stays green.CHANGELOG.md: new1.1.0-alpha.3 — 2026-06-09section.What's in alpha.3 (since alpha.2)
Security: sensitive-config API key storage (#105), explicit CSP allowlist for external-pad framing (#102), client-side DOMPurify snapshot sanitisation (#110).
Changed: Etherpad HTTP via
IClientService(#103), shared pad-sync frontend module (#106), no per-request MIME registration (#108), legacyRetryPendingDeleteJobretired (#111), dead-code removal (#104).Tooling/tests/CI: Playwright e2e suite (#54), Psalm enabled + baseline burned down to zero type issues +
findUnusedCode(#82, #122, #133, #134), stale-js CI guard (#101), version-consistency guard (#107, #119).No user-facing feature changes since alpha.2.
Verification
Code is identical to the just-merged green
main(#134): PHPUnit 409 ✅, Psalm 0 unbaselined ✅, Playwright 23/23 ✅,npm run buildclean ✅. Tagv1.1.0-alpha.3to be applied after merge.