Release v2025.4 #1506
Merged
Release v2025.4 #1506
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
* `gixy-ng` seems to be a maintained, popular fork of `gixy` * `gixy-ng`: https://github.com/dvershinin/gixy/ * original `gixy` repo: https://github.com/yandex/gixy/ * currently only considering HIGH-level reports * there are some HIGH reports that can be fixed without much effort or controversy * there are some MEDIUM reports which are more complicated; this commit ignores those
It was an oversight to omit reporting for blank.html and other "disallow-all" pages. With a `report-uri` directive, violations will not be known. Co-authored-by: alxndrsn <alxndrsn>
Compared to mocha, the gixy step is slow and noisy, and it's helpful locally to be able to set up the docker compose env and then run the mocha tests separately from gixy.
This commit: * makes the frontend policy consistent with other policies which allow for Google Translate images * provides a template for addition of other browser-plugin-related policy * removes enforcement of policy order, although the served policies maintain their current ordering Closes #1518
Co-authored-by: Hélène Martin <ln@getodk.org>
Split from https://github.com/getodk/central/pull/1526/files#r2587794987 The only identifiable Worker in frontend is from OpenLayers for displaying maps, and requires blob:, not data:. Incorrect map-specific CSP introduced in #1468. Co-authored-by: Hélène Martin <ln@getodk.org> Co-authored-by: alxndrsn <alxndrsn>
Users can include images in various bits of markdown around odk-central-frontend. This change blocks non-HTTPS images from being loaded in those markdown snippets. --------- Co-authored-by: alxndrsn <alxndrsn>
* Chores: updated node to 22.21.1 * updated stmp image to 1.1.5 * updated redis to 7.4.7 * Updated npm packages * Updated postgres to 14.20
Member
Author
|
I've marked this PR as ready for review, since the only thing it needs now is an update to submodules. |
sadiqkhoja
approved these changes
Dec 15, 2025
Contributor
sadiqkhoja
left a comment
sadiqkhoja
left a comment
There was a problem hiding this comment.
Verified that it includes already approved changes only.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR prepares the release of v2025.4. It should only contain changes from other PRs that have already been approved and merged (and possibly merge commits from the
masterbranch).