This PR removes the duplicate companion/provider bridge types
(CompanionClientProvider CompanionClientSearchProvider, and the`view:
any` escape hatch) and wires the real Provider/ProviderView types
directly, now possible since everything lives in `@uppy/core` Net gain
in type safety; no behavior change.
for more context on the approach see description of #6351
This PR merges @uppy/companion-client into core and re-exports it via
export maps from `@uppy/core`
should be merged after #6352
see #6351 for more context
update: this PR should be reviewed after merging #6352
partly addresses #6042
This PR merges `@uppy/store-default` into core and re-exports it via
export maps from `@uppy/core`
This is 1st of the 5 stacked PRs which I'll create to merge
`provider-views` , `companion-client` , `utils` and `store-default` into
`@uppy/core` the reason for this stacked PRs approach is to make
reviewing easier as 4 out of these 5 PRs are purely mechanical i.e.
`removing package` -> `copying files` -> `updating imports and exports`.
and it invovles changes across lots of files. so it's easier to review
if all the changes are related to a single plugin.
AI disclaimer : AI used
## Changes
- **jsdom 26 → 29** across all packages' devDependencies —
**except`@uppy/aws-s3`** (left at 26; that plugin is being rewritten and
its deps are handled on the rewrite branch).
- **`@uppy/xhr-upload` unit tests migrated from nock to MSW**, and
`nock` dropped from its devDependencies.
## Why the test migration was needed
jsdom **28** overhauled resource loading so `XMLHttpRequest` now goes
through jsdom's internal (undici-based) fetch instead of Node's `http`
module ([jsdom 28 release
notes](https://github.com/jsdom/jsdom/releases/tag/28.0.0)).
nock intercepts at the Node `http` / `http.ClientRequest` layer ([nock
README](https://github.com/nock/nock)), so it can no longer see uppy's
upload requests — the mocked responses never arrive and the tests time
out. (This is the long-standing nock + jsdom XHR incompatibility:
[nock#518](https://github.com/nock/nock/issues/518).)
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Part of the dev-dependency major-version upgrades. These required code
changes so they're split out from the no-code-change batch (#6315).
**AI Disclaimer** : AI Used
- **glob 8 → 13** — `@uppy/locales` scripts: the callback API was
removed, so `getPaths()` uses the promise form and `test.mjs` uses the
named `globSync`.
- **npm-packlist 5 → 11** — `upload-to-cdn.js`: v7+ takes an
`@npmcli/arborist` tree instead of `{ path }`; loads the tree and passes
it to `packlist()`. Adds `@npmcli/arborist` as a devDependency.
- **nock 13 → 14** (`@uppy/companion`) — the v14 @mswjs/interceptors
rewrite crashed the SSRF tests in `http-agent.test.ts`; nock
interception is now kept off by default and only activated for the one
test that mocks a host.
- **@types/use-sync-external-store 0 → 1** — `@uppy/react`: v1's exports
map only exposes extensionless subpaths, so imports use
`use-sync-external-store/shim` and `/with-selector` (runtime supports
both).
will do a separte PR for changes which would require code changes so
it's easier to review , didn't upgrade any deps for `@uppy/aws-s3` since
we'll merge the rewrite so I think we should do that upgrade in the
rewrite branch before merging.
update : Dependency upgrades which required code changes were raised
separately
- #6309
- #6310
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
this fixes#6287 , another similar attempted fix which didn't got merged
: #5683
in #5683 we discussed a more longer term solution but IMO that would be
a breaking change as it would change the event contract
AI Disclaimer : AI Used
This fix is Manually Tested across **Chrome and Firefox**
all the dev deps upgraded excepts for these :
- `@types/cors: 2.8.6`
- `@types/jsonwebtoken: 8.3.7`
- `@types/morgan: 1.7.37`
- `@types/node: ^20.19.0`
- `nock: ^13.1.3`
upgrading these to their latest major either breaks the test suite or
requires us to do code changes on our end.
#6297
---------
Co-authored-by: Mikael Finstad <finstaden@gmail.com>
exact copy of #6175
- I will point the uppy deps upgrade pr to this PR's branch
- no other changes needed in this branch as #6175 was reviewed and all
the comments were resolved
this should be the order of merge :
1. #6300
2. uppy deps upgrade ( yet to be raised )
3. merge this to main
4. merge biome changes #6244
@mifi let me know if you think otherwise.
---------
Co-authored-by: Mikael Finstad <finstaden@gmail.com>
## Why
Recent npm supply-chain compromises showed that dependency installs and
shared CI caches can execute or preserve newly published malicious
packages before advisories catch up. This PR reduces that exposure for
this repo.
## What changed
- Made eligible Yarn installs immutable and removed shared dependency
caching from the manual CDN upload path; existing minimal age gate
remains unchanged.
## Validation
- Ran `git diff --check` across the prepared worktree.
- Audited this PR set for `pull_request_target` and release/deploy/CDN
cache reuse; patched actionable hits.
- Did not run the full test suite; this is a workflow/config-only
change.
## Summary
- replace QEMU-based multi-platform build in
`.github/workflows/companion-deploy.yml` with native runner matrix
builds
- build amd64 on `ubuntu-24.04` and arm64 on `ubuntu-24.04-arm`
- push architecture-specific tags (`edge-amd64`, `edge-arm64`) and
publish `transloadit/companion:edge` as a manifest that references both
- add explicit workflow permissions (`contents: read`) and keep workflow
expression formatting consistent
- remove conflicting `DOCKER_BUILDKIT`/`COMPOSE_DOCKER_CLI_BUILD` env
overrides from the docker job
## Validation
- `corepack yarn check:ci` ✅
- baseline full run before edits: `corepack yarn check:ci && corepack
yarn build && corepack yarn test` (test step had pre-existing failures
in `@uppy/utils` due `Promise.withResolvers` in this environment)
- parallel validation (Code Review + CodeQL) ✅
## TODO
- [ ] do the same for release?
https://github.com/transloadit/uppy/blob/main/.github/workflows/release.yml
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: mifi <402547+mifi@users.noreply.github.com>
Co-authored-by: Mikael Finstad <finstaden@gmail.com>
Supersedes #6178.
This branch keeps the exact same final content as #6178, but splits
history for reviewability:
1. `chore(companion): rename source and test files from .js to .ts`
(pure `git mv`, no content changes)
2. `feat(companion): port Companion to TypeScript` (actual
content/type/schema/build updates)
Validation note:
- Final tree is byte-for-byte identical to `ts-companion`
(`7b5b16a298690b0492de4cc4fab744f998b45570`).
---------
Co-authored-by: Mikael Finstad <finstaden@gmail.com>
fixes#6181
`uploadRemoteFile()` now treats one remote upload attempt as a single
queue-owned unit. Instead of queueing “request token” and “open
websocket / wait for upload” as two separate jobs, it now:
- acquires one queue slot
- reuses serverToken if resuming, otherwise requests a new
token
- immediately proceeds to the websocket/upload phase within
that same admitted attempt
That removes the stale-token race where Companion starts its 60s
socket-wait timer before the client’s websocket phase has actually been
admitted by the queue. Retries still reacquire the queue per attempt,
and existing abort/cancel behavior is
preserved.
refer
https://github.com/transloadit/uppy/issues/6181#issuecomment-4295036192
for more context about the bug
Fixes#6256
## Problem
When `fileManagerSelectionType` is set to `'folders'`, clicking the **My
Device** tab/button
still opens the file picker instead of the folder picker.
The inline "browse" link in the tagline correctly respects the setting,
but
`renderMyDeviceAcquirer` in `AddFiles.tsx` always called
`triggerFileInputClick`
regardless of the `fileManagerSelectionType` prop.
## Solution
`renderMyDeviceAcquirer` now reads `fileManagerSelectionType` and calls
`triggerFolderInputClick` when set to `'folders'`, or
`triggerFileInputClick`
for `'files'` and `'both'`.
For `'both'` mode, the button defaults to file selection because a
single
HTML `<input>` cannot handle both files and folders simultaneously
(`webkitdirectory` is all-or-nothing). The folder picker remains
accessible
via the tagline's "browse folders" link.
---------
Co-authored-by: Prakash <qxprakash@gmail.com>
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.
# Releases
## @uppy/utils@7.2.0
### Minor Changes
- 6b1abaa: Introduce modern, minimal TaskQueue to replace
RateLimitedQueue
## @uppy/xhr-upload@5.2.0
### Minor Changes
- 6b1abaa: Introduce modern, minimal TaskQueue to replace
RateLimitedQueue
### Patch Changes
- Updated dependencies [6b1abaa]
- @uppy/utils@7.2.0
## @uppy/companion@6.2.2
### Patch Changes
- 49db42d: Fix bug with 429 not returning JSON response with message
- 4652dc6: upgrade @aws-sdk/ deps in @uppy/companion
## @uppy/transloadit@5.5.1
### Patch Changes
- 4787960: Add type re-export for `AssemblyInstructionsInput`
- 2f6849d: Fix allowMultipleUploadBatches to prevent adding/removing
files while an upload is in progress (#6156)
- 29d2772: remove monkey patch from uppy bundle package
- Updated dependencies [6b1abaa]
- @uppy/utils@7.2.0
## uppy@5.2.4
### Patch Changes
- 29d2772: remove monkey patch from uppy bundle package
- a86c624: upgrade esbuild in uppy to "^0.27.0"
- Updated dependencies [6b1abaa]
- Updated dependencies [4787960]
- Updated dependencies [2f6849d]
- Updated dependencies [29d2772]
- @uppy/xhr-upload@5.2.0
- @uppy/transloadit@5.5.1
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
