[pull] main from tldraw:main#509
Merged
Merged
Conversation
In order to detect memory leaks in production (#8586, #8440), this PR extends the existing RUM telemetry in dotcom with periodic heap snapshots and richer slicing dimensions on all rum events. **Memory sampling** (Chrome-only via `performance.memory`, no-ops elsewhere): - 60s interval + samples on `visibilitychange` (hidden) and page switches - Tracks heap size, shape/page counts, page change count - Gated behind existing `rum_enabled` flag **New properties on all rum events** (interaction, camera, memory): - `release` — deploy tag from `sentryReleaseName` (`local` in dev, `{env}-{sha}` in prod) for correlating regressions to specific deploys OS/platform slicing uses PostHog's built-in `$os` property instead of a custom field — it already provides Mac OS X / Windows / Linux / Chrome OS / iOS / Android breakdown. Relates to #8586, #8440 ### Change type - [x] `improvement` ### Test plan 1. Run `yarn dev-app`, open Chrome 2. Enable `rum_enabled` flag (or temporarily set default to true in FeatureFlagPoller) 3. Verify PostHog captures `rum` events with `type: 'memory'` and `release: 'local'` 4. Verify interaction and camera events also include `release` 5. Switch pages → verify immediate `page_change` sample 6. Background tab → verify `visibility_hidden` sample 7. Open Firefox → verify no errors (graceful no-op) - [ ] Unit tests - [ ] End to end tests
…8605) Closes #8496 When preview deploys are pruned, the Fly.io apps, CF Workers, and Supabase branches get cleaned up — but litestream backup data in R2 (`pr-<number>/`) is left behind indefinitely. This PR adds R2 cleanup to the prune script so backup data is deleted alongside other preview resources. ### Change type - [x] `improvement` ### Test plan - Cannot be manually tested (requires R2 credentials and closed PRs) - Verified typecheck and lint pass ### Code changes | Section | LOC change | | -------------- | ---------- | | Config/tooling | +68 / -0 |
In order to make production the safe default when someone runs the Deploy MCP app workflow without changing inputs, this PR sets the workflow_dispatch `target` default from `main` to `production`. ### Code changes | Section | LOC change | | -------------- | ---------- | | Config/tooling | +1 / -1 | ### Change type - [x] `improvement` ### Test plan 1. In GitHub Actions, open **Deploy MCP app**, choose **Run workflow**, and confirm the **target** field defaults to `production`. - [ ] Unit tests - [ ] End to end tests Made with [Cursor](https://cursor.com)
…dates (#8610) Bumps the npm_and_yarn group with 2 updates in the / directory: [fastify](https://github.com/fastify/fastify) and [dompurify](https://github.com/cure53/DOMPurify). Updates `fastify` from 5.8.4 to 5.8.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/fastify/fastify/releases">fastify's releases</a>.</em></p> <blockquote> <h2>v5.8.5</h2> <h2>⚠️ Security Release</h2> <p>This fixes CVE CVE-2026-33806 <a href="https://github.com/fastify/fastify/security/advisories/GHSA-247c-9743-5963">https://github.com/fastify/fastify/security/advisories/GHSA-247c-9743-5963</a>.</p> <h2>What's Changed</h2> <ul> <li>chore: Fix port parsing by <a href="https://github.com/jsumners"><code>@jsumners</code></a> in <a href="https://redirect.github.com/fastify/fastify/pull/6603">fastify/fastify#6603</a></li> <li>chore: upgrade to typescript v6.0.2 by <a href="https://github.com/Tony133"><code>@Tony133</code></a> in <a href="https://redirect.github.com/fastify/fastify/pull/6605">fastify/fastify#6605</a></li> <li>fix: restore trustProxy function for number and string types, add null check for socketAddr by <a href="https://github.com/mcollina"><code>@mcollina</code></a> in <a href="https://redirect.github.com/fastify/fastify/pull/6613">fastify/fastify#6613</a></li> <li>ci: reduce cron scheduled workflows from daily/weekly to monthly by <a href="https://github.com/Fdawgs"><code>@Fdawgs</code></a> in <a href="https://redirect.github.com/fastify/fastify/pull/6623">fastify/fastify#6623</a></li> <li>chore: Bump pnpm/action-setup from 4.2.0 to 5.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/fastify/fastify/pull/6629">fastify/fastify#6629</a></li> <li>chore: Bump markdownlint-cli2 from 0.21.0 to 0.22.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/fastify/fastify/pull/6632">fastify/fastify#6632</a></li> <li>chore: Bump borp from 0.21.0 to 1.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/fastify/fastify/pull/6633">fastify/fastify#6633</a></li> <li>chore: Bump actions/dependency-review-action from 4.8.3 to 4.9.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/fastify/fastify/pull/6630">fastify/fastify#6630</a></li> <li>docs(ecosystem): add <code>@pompelmi/fastify-plugin</code> by <a href="https://github.com/SonoTommy"><code>@SonoTommy</code></a> in <a href="https://redirect.github.com/fastify/fastify/pull/6610">fastify/fastify#6610</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/SonoTommy"><code>@SonoTommy</code></a> made their first contribution in <a href="https://redirect.github.com/fastify/fastify/pull/6610">fastify/fastify#6610</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/fastify/fastify/compare/v5.8.4...v5.8.5">https://github.com/fastify/fastify/compare/v5.8.4...v5.8.5</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/fastify/fastify/commit/3983cce8124714242099e8756a7a9a80a0ba0aea"><code>3983cce</code></a> Bumped v5.8.5</li> <li><a href="https://github.com/fastify/fastify/commit/3ce3ae6752dbed672759856081af9cb1e2733105"><code>3ce3ae6</code></a> Merge commit from fork</li> <li><a href="https://github.com/fastify/fastify/commit/b06a196b694c0c7aed53976cd77456f1ad7d4c9f"><code>b06a196</code></a> docs(ecosystem): add <code>@pompelmi/fastify-plugin</code> (<a href="https://redirect.github.com/fastify/fastify/issues/6610">#6610</a>)</li> <li><a href="https://github.com/fastify/fastify/commit/909c5d5329536b0acc004da7649b3da8af9273b2"><code>909c5d5</code></a> chore: Bump actions/dependency-review-action from 4.8.3 to 4.9.0 (<a href="https://redirect.github.com/fastify/fastify/issues/6630">#6630</a>)</li> <li><a href="https://github.com/fastify/fastify/commit/4db21a36ddb588acaebf5a4472ccb3b0d5fc9db0"><code>4db21a3</code></a> chore: Bump borp from 0.21.0 to 1.0.0 (<a href="https://redirect.github.com/fastify/fastify/issues/6633">#6633</a>)</li> <li><a href="https://github.com/fastify/fastify/commit/0f4e544c8acd7c42df347936e613a73cecc4f3fe"><code>0f4e544</code></a> chore: Bump markdownlint-cli2 from 0.21.0 to 0.22.0 (<a href="https://redirect.github.com/fastify/fastify/issues/6632">#6632</a>)</li> <li><a href="https://github.com/fastify/fastify/commit/33a2fcd39de584713495bf4b3bd864137746f224"><code>33a2fcd</code></a> chore: Bump pnpm/action-setup from 4.2.0 to 5.0.0 (<a href="https://redirect.github.com/fastify/fastify/issues/6629">#6629</a>)</li> <li><a href="https://github.com/fastify/fastify/commit/fd35d829a8cd496a3c1170c0c1c021130e3ca0e8"><code>fd35d82</code></a> ci: reduce cron schedules from daily/weekly to monthly (<a href="https://redirect.github.com/fastify/fastify/issues/6623">#6623</a>)</li> <li><a href="https://github.com/fastify/fastify/commit/8dee9be05ebf683cd212aeff1d294f6ea1ec405c"><code>8dee9be</code></a> fix: restore trustProxy function for number and string types, add null check ...</li> <li><a href="https://github.com/fastify/fastify/commit/d457aeda8611777389c7e4713a288eb7ddb9a389"><code>d457aed</code></a> chore: upgrade to typescript v6.0.2 (<a href="https://redirect.github.com/fastify/fastify/issues/6605">#6605</a>)</li> <li>Additional commits viewable in <a href="https://github.com/fastify/fastify/compare/v5.8.4...v5.8.5">compare view</a></li> </ul> </details> <br /> Updates `dompurify` from 3.3.3 to 3.4.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/cure53/DOMPurify/releases">dompurify's releases</a>.</em></p> <blockquote> <h2>DOMPurify 3.4.0</h2> <p><strong>Most relevant changes:</strong></p> <ul> <li>Fixed a problem with <code>FORBID_TAGS</code> not winning over <code>ADD_TAGS</code>, thanks <a href="https://github.com/kodareef5"><code>@kodareef5</code></a></li> <li>Fixed several minor problems and typos regarding MathML attributes, thanks <a href="https://github.com/DavidOliver"><code>@DavidOliver</code></a></li> <li>Fixed <code>ADD_ATTR</code>/<code>ADD_TAGS</code> function leaking into subsequent array-based calls, thanks <a href="https://github.com/1Jesper1"><code>@1Jesper1</code></a></li> <li>Fixed a missing <code>SAFE_FOR_TEMPLATES</code> scrub in <code>RETURN_DOM</code> path, thanks <a href="https://github.com/bencalif"><code>@bencalif</code></a></li> <li>Fixed a prototype pollution via <code>CUSTOM_ELEMENT_HANDLING</code>, thanks <a href="https://github.com/trace37labs"><code>@trace37labs</code></a></li> <li>Fixed an issue with <code>ADD_TAGS</code> function form bypassing <code>FORBID_TAGS</code>, thanks <a href="https://github.com/eddieran"><code>@eddieran</code></a></li> <li>Fixed an issue with <code>ADD_ATTR</code> predicates skipping URI validation, thanks <a href="https://github.com/christos-eth"><code>@christos-eth</code></a></li> <li>Fixed an issue with <code>USE_PROFILES</code> prototype pollution, thanks <a href="https://github.com/christos-eth"><code>@christos-eth</code></a></li> <li>Fixed an issue leading to possible mXSS via Re-Contextualization, thanks <a href="https://github.com/researchatfluidattacks"><code>@researchatfluidattacks</code></a> and others</li> <li>Fixed an issue with closing tags leading to possible mXSS, thanks <a href="https://github.com/frevadiscor"><code>@frevadiscor</code></a></li> <li>Fixed a problem with the type dentition patcher after Node version bump</li> <li>Fixed freezing BS runs by reducing the tested browsers array</li> <li>Bumped several dependencies where possible</li> <li>Added needed files for OpenSSF scorecard checks</li> </ul> <p><strong>Published Advisories are here:</strong> <a href="https://github.com/cure53/DOMPurify/security/advisories?state=published">https://github.com/cure53/DOMPurify/security/advisories?state=published</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/cure53/DOMPurify/commit/5b16e0b892e82b1779d62b9928b43c4c4ff290b9"><code>5b16e0b</code></a> Getting 3.x branch ready for 3.4.0 release (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1250">#1250</a>)</li> <li>See full diff in <a href="https://github.com/cure53/DOMPurify/compare/3.3.3...3.4.0">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/tldraw/tldraw/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Mime Čuvalo <mimecuvalo@gmail.com>
issue was: sticky notes would grab the attribution from the prev author when cloning via a "nib" ### Change type - [x] `bugfix` - [ ] `improvement` - [ ] `feature` - [ ] `api` - [ ] `other` ### Test plan - [x] Unit tests - [ ] End to end tests ### Release notes - fix sticky notes preserving attribution via nib cloning
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )