Repository navigation
🔖(release) major 6.0.0 - #2781
Merged
Merged
Conversation
Member
Author
|
@AntoLC the helm chart has not been upgraded yet, I published yet an alpha version I want to reuse before publishing version 6.0.0 |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configuration
⛔ Files ignored due to path filters (3)
📒 Files selected for processing (1)
Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review. WalkthroughThe changelog and upgrade guide document the 6.0.0 release. Package manifests update their versions and selected dependencies. Backend translation catalogs refresh dates and source references; message catalogs remain otherwise unchanged except for one French punctuation change. Frontend translations remove older sign-in entries, add sign-in-related translations in French, Russian, and Ukrainian, and revise two French translations. The Docker base image changes to Python 3.14.8 Alpine. Priority: ⬆️ High Estimated code review effort: 2 (Simple) | ~10 minutes
|
| Check name | Status | Explanation |
|---|---|---|
| Title check | ✅ Passed | The title identifies this as the major 6.0.0 release, which matches the main purpose of the changeset. |
| Description check | ✅ Passed | The description summarizes the 6.0.0 release changes, including additions, fixes, removals, and a security update. |
| Docstring Coverage | ✅ Passed | No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
| Linked Issues check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
✨ Finishing Touches
🧪 Generate unit tests (beta)
- Commit to this branch
- Create a new PR
- Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Contributor
|
Size Change: +1.79 kB (+0.04%) Total Size: 4.06 MB 📦 View Changed
|
Update translated files with new translations
lunika
force-pushed
the
release/v6.0.0
branch
10 times, most recently
from
October 6, 2026 07:53
3d0d5fe to
4916867
Compare
AntoLC
approved these changes
Oct 6, 2026
lunika
force-pushed
the
release/v6.0.0
branch
3 times, most recently
from
October 9, 2026 08:54
de7bc7f to
96c5e94
Compare
1 task done
pip is not used in production, we can remove it in the production to avoid having to maintain library linked to it and that can possibly contains CVEs
The yhub image was using a normal debian images with to many dependencies installed that can contain CVE. Using a slim image is enough
Trivy is reporting some CVE from debian packages and they have not published patches. These CVE are not critical, we ignore them for now.
Some translation have changed, the tests related to this string must be updated accordingly.
We need to upgrade to the last version of nginx to fix recent security issues.
A version is identified by the moment it ends, which is also all the changeset and the rollback are given. Two entries of the timeline can end at the same moment without merging: an imported `system` save next to an edit, or concurrent edits sorted by start. They produced two versions with the same id, which both looked selected and shared a React key. Entries ending together are the same document, so they are now folded into one version, keeping every author and the earliest start. Signed-off-by: Anthony LC <anthony.le-courric@mail.numerique.gouv.fr>
If two requests at the exact same time update a document and link-configuration, a race condition can happen and one action can overwrite the other one. If a document link_reach is changed from public to restricted, this change can be overwritten and the owner does not have this information. To fix this issue we set the updated_fields for every save.
One feature we have is to still be able to read a soft deleted document in the application. Calling the yhub service to delete the document inside yhub make it unreachable, so it does not load anymore in the editor. Yhub map the permission on what Docs returns in its abilities. A soft deleted document will be in read only.
When a document is deleted, we must reset the connection in the collaboration server otherwise all users remain connected and can still edit it if they are at least editor.
the task `sync_service_deletions_in_cascade` is no more called when a document is soft deleted. We rename it in sync_service_restorations_in_cascade and still call it when a document is restored. No ydoc should be tombstone in yhub anymore but we want to keep it as a safe guard, it is still possible to tombstone a ydoc programmatically but not used in the application for now.
Added - 👷(ci) lint, typecheck, build and test the collaboration server (yhub) #2757 - 👷(ci) check the load-test tooling: swarm, canary, k6 and dashboards #2757 - 👷(ci) cancel the superseded runs of a pull request #2757 - ✨(backend) add mention endpoint with cooldown-limited email notification #2447 - 🚩(setting) add feature flag on Duplicate with Children #2721 - 💄(frontend) redesign 404 error standalone page #2696 - 💄(frontend) redesign 403 access denied page #2720 - ✨(frontend) duplicate with subdocuments #2584 - ✨(frontend) add markdown download option #2608 - ✨(frontend) turn pasted doc links into interlinks #2713 - ✨(helm) allow disallowing search engine indexing per instance #2694 - ✨(backend) expose the attachment max size in the config endpoint #2577 - ✨(frontend) warn before uploading an attachment over the size limit #2577 - ✨(loadtest) add a websocket load generator for the collaboration server #2556 - ✨(loadtest) add k6 scenarios for the page-open sequence and the heavy endpoints #2556 - ✨(loadtest) add browser canaries measuring what a user feels under load #2556 - ✨(loadtest) add the grafana dashboards of the load-test campaign, valkey included #2556 - 📝(documentation) add the load-testing guide #2556 - 🔧(helm) run grafana with those dashboards in the dev cluster, in place of the prometheus console #2556 - ✨(backend) measure the calls to yhub and to the converters, the database pool and the celery queue #2556 - ✨(backend) add a `LoadTest` configuration and its `loadtest` application, minting sessions for load tests #2556 - ✨(collaboration) add opt-in prometheus metrics to yhub, server and worker, protected by a bearer token #2556 - ✨(collaboration) report yhub errors to sentry, configured through `SENTRY_*` #2556 - ✨(backend) add opt-in prometheus metrics on `/metrics`, protected by a bearer token #2556 - ✨(helm) add a dedicated ingress for the prometheus metrics of the backend and of yhub #2556 - ✨(helm) add a ServiceMonitor and a PodMonitor per component whose metrics are enabled, and `backend.metrics.enabled` #2556 - 🔧(helm) scrape the metrics of the dev cluster with a trimmed kube-prometheus-stack and the ServiceMonitors of the chart #2556 - 🔧(helm) serve the example console of django-prometheus on the dev Prometheus #2556 - ✨(backend) add a service generating cached RS256 JWT tokens #2556 - ✨(backend) publish the JWT public key on a JWKS endpoint #2556 - 🔧(dev) generate the JWT signing key when bootstrapping the dev stack #2556 - ✨(collaboration) add an admin reset-connections endpoint on yhub #2556 - ✨(collaboration) add a create-ydoc endpoint on yhub #2556 - ✨(collaboration) soft-migrate legacy S3 documents into yhub #2556 - ✨(collaboration) replay legacy s3 version history into yhub #2556 - ✨(backend) add a service to call the yhub REST API #2556 - ✨(backend) call YHubService to seed initial document content #2556 - ✨(collaboration) add a get-ydoc endpoint on yhub #2556 - ✨(backend) duplicate a document through the collaboration server #2556 - ✨(backend) serve `documents/{id}/formatted-content/` from yhub #2556 - ✨(collaboration) notify the backend when the worker persists new content #2556 - ✨(collaboration) let a user read the document's editing history #2556 - ✨(frontend) fall back to http polling when the websocket cannot be opened. #2556 - 🔧(collaboration) make the version-history granularity configurable through `COLLABORATION_VERSION_GRANULARITY_MS` #2556 - ✨(frontend) keep a local copy of documents, so they open and stay editable offline #2556 Changed - 🛂(backend) let users allowed to comment list each other's accesses #2447 - ♻️(collaboration) migrate the collaboration server from hocuspocus to yhub #2556 - 💥(y-provider) y-provider becomes converter-only #2556 - 💥(backend) move the resource server JWKS from `/api/{version}/jwks` to `/external_api/{version}/jwks` #2556 - 🔧(collaboration) adapt docker stack for development purpose #2556 - 🔧(helm) run a valkey for the backend and one for yhub in dev and feature #2556 - 💄(frontend) redesign 401 error standalone page #2716 Fixed - 🐛(documentation) fix minio port and keycloak realm in the k8s guide #2751 - 🐛(collaboration) bound the calls yhub makes to the backend with a timeout, `YHUB_BACKEND_REQUEST_TIMEOUT_MS`, 5s by default #2753 - 🐛(backend) compensate document duplication failures #2755 - 🐛(frontend) open search results in a new tab with ctrl/cmd+click #2719 - 🐛(docker) pull minio images from pgsty #2739 - 🐛(backend) retry the duplicate of a document on a tree path collision #2726 - 🐛(frontend) keep caption and alignment when replacing an image #2730 - 🐛(backend) reset the collaboration connections on every access change #2725 - ⚡️(backend) coalesce and pace the resets of collaboration connections #2725 - 🐛(frontend) clear callout background on Backspace #2052 - 🐛(export) keep image aspect ratio in PDF columns #2670 - 🐛(frontend) fix redirect after deleting a document #2706 - 🐛(frontend) keep documents draggable with a mouse when zoomed #2727 - 📝(docs) fix markdown typo in installation README #2766 - 🐛(i18n) export locale correctly #2750 - 🐛(frontend) keep login and logout out of the service worker cache #2771 - 🐛(frontend) reduce PostHog volume from web vitals and opt_in spam #2701 - 🐛(frontend) stop reconnecting to the websocket based on the status code #2556 - 🐛(frontend) stop the service worker from caching the collaboration server's rest api #2556 Removed - 🔥(backend) remove the unused `CollaborationService` #2556 - 💥(backend) remove the `documents/{id}/can-edit/` endpoint #2556 - 💥(backend) remove the `documents/{id}/content/` endpoint #2556 - 🔥(backend) remove the document version endpoints. #2556 - 🔥(backend) remove `Document.content` #2556 Security - 🔒️(collaboration) stop read-only users from sharing their cursor #2556
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Added
LoadTestconfiguration and itsloadtestapplication, minting sessions for load tests Switch to yhub as a collab backend #2556SENTRY_*Switch to yhub as a collab backend #2556/metrics, protected by a bearer token Switch to yhub as a collab backend #2556backend.metrics.enabledSwitch to yhub as a collab backend #2556documents/{id}/formatted-content/from yhub Switch to yhub as a collab backend #2556COLLABORATION_VERSION_GRANULARITY_MSSwitch to yhub as a collab backend #2556Changed
/api/{version}/jwksto/external_api/{version}/jwksSwitch to yhub as a collab backend #2556Fixed
YHUB_BACKEND_REQUEST_TIMEOUT_MS, 5s by default 🐛(yhub) bound the calls the server makes to the backend #2753Removed
CollaborationServiceSwitch to yhub as a collab backend #2556documents/{id}/can-edit/endpoint Switch to yhub as a collab backend #2556documents/{id}/content/endpoint Switch to yhub as a collab backend #2556Document.contentSwitch to yhub as a collab backend #2556Security