Commit graph

3306 commits

Author SHA1 Message Date
Prakash
cef447baac
Merge branch 'main' into angular-v21-support-attempt-2 2026-07-01 16:43:11 +05:30
prakash
ad84895e08
remove unused dep nock 2026-06-30 21:15:28 +05:30
Travis Hamp
1e2d2ee9a4
add verified support for angular 21 2026-06-29 12:40:45 -04:00
Prakash
f28afb9eea
Merge branch 'main' into restore/pr-6314 2026-06-28 08:53:15 +05:30
Mikael Finstad
cd34c9cf4f
upgrade @types/cors and @types/morgan (#6360)
see #6297

---------

Co-authored-by: Prakash <qxprakash@gmail.com>
2026-06-28 01:39:06 +02:00
prakash
4c30023e35
yarn check 2026-06-25 20:35:45 +05:30
prakash
a05035f70f
remove stale config and fix failing test 2026-06-25 20:34:11 +05:30
prakash
500e848eb8
#6287 fix squash all commits 2026-06-25 19:59:31 +05:30
Arvind
32b9f06a22
@uppy/locales: update Norwegian Bokmål (nb_NO) (#6346)
The Norwegian Bokmål (`nb_NO`) locale had fallen behind `en_US` by ~55
strings. This brings it up to date.

**Added** translations for the missing keys, including: AI image
generation (`generateImage`, `generating1`–`5`), audio recording
(`allowAudioAccess*`, `noAudio*`, `startAudioRecording`,
`stopAudioRecording`), required meta fields
(`missingRequiredMetaField*`), session recovery (`recoveredAllFiles`,
`recoveredXFiles`, `sessionRestored`), plugin names (`pluginName*`),
image compression (`compressedX`, `compressingImages`), and various UI
strings (`error`, `search`, `pleaseWait`, `unnamed`, `uploadStalled`,
etc.).

**Removed** keys no longer present in `en_US` (`backToSearch`,
`fileSource`, `selectFileNamed`, `timedOut`, `unselectFileNamed`).

**Fixed** `exceedsSize` to include the `%{file}` placeholder, and
aligned key order with `en_US`.

I'm a native Norwegian speaker and reviewed every string. Translation
was done with AI assistance (Claude) and checked by me.

---------

Co-authored-by: Mikael Finstad <finstaden@gmail.com>
2026-06-23 22:37:53 +02:00
Prakash
675b48fa14
@uppy/upgrade devdeps v2 (#6318)
AI disclaimer : AI used

## Changes
- **jsdom 26 → 29** across all packages' devDependencies —
**except`@uppy/aws-s3`** (left at 26; that plugin is being rewritten and
its deps are handled on the rewrite branch).
- **`@uppy/xhr-upload` unit tests migrated from nock to MSW**, and
`nock` dropped from its devDependencies.
  ## Why the test migration was needed
jsdom **28** overhauled resource loading so `XMLHttpRequest` now goes
through jsdom's internal (undici-based) fetch instead of Node's `http`
module ([jsdom 28 release
notes](https://github.com/jsdom/jsdom/releases/tag/28.0.0)).
nock intercepts at the Node `http` / `http.ClientRequest` layer ([nock
README](https://github.com/nock/nock)), so it can no longer see uppy's
upload requests — the mocked responses never arrive and the tests time
out. (This is the long-standing nock + jsdom XHR incompatibility:
[nock#518](https://github.com/nock/nock/issues/518).)

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
2026-06-03 15:30:55 +05:30
Prakash
1427add64a
@uppy/upgrade-devdeps-v1 (#6317)
Part of the dev-dependency major-version upgrades. These required code
changes so they're split out from the no-code-change batch (#6315).

**AI Disclaimer** : AI Used

- **glob 8 → 13** — `@uppy/locales` scripts: the callback API was
removed, so `getPaths()` uses the promise form and `test.mjs` uses the
named `globSync`.
- **npm-packlist 5 → 11** — `upload-to-cdn.js`: v7+ takes an
`@npmcli/arborist` tree instead of `{ path }`; loads the tree and passes
it to `packlist()`. Adds `@npmcli/arborist` as a devDependency.
- **nock 13 → 14** (`@uppy/companion`) — the v14 @mswjs/interceptors
rewrite crashed the SSRF tests in `http-agent.test.ts`; nock
interception is now kept off by default and only activated for the one
test that mocks a host.
- **@types/use-sync-external-store 0 → 1** — `@uppy/react`: v1's exports
map only exposes extensionless subpaths, so imports use
`use-sync-external-store/shim` and `/with-selector` (runtime supports
both).
2026-06-03 14:38:14 +05:30
Prakash
d7aaab7ad1
@uppy: upgrade dev deps (#6315)
addresses #6297

I'll raise another PR which would include deps which require code
changes
2026-06-02 10:48:58 +08:00
Prakash
7ea7530997
upgrade playwright (#6316)
fixes the timeout which we're facing in "CI / Test" in the past few days
which gets stuck at "Install Playwright Browsers"


https://github.com/transloadit/uppy/actions/runs/26646754991/job/78534314307?pr=6315

tested on my local fork
2026-06-01 18:08:22 +05:30
Prakash
c3c7cef4ed
@uppy: upgrade deps (#6307)
will do a separte PR for changes which would require code changes so
it's easier to review , didn't upgrade any deps for `@uppy/aws-s3` since
we'll merge the rewrite so I think we should do that upgrade in the
rewrite branch before merging.

update : Dependency upgrades which required code changes were raised
separately

- #6309 
- #6310

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
2026-05-29 18:58:42 +05:30
Prakash
ef370da2b3
Revert "@uppy/tus: don't abort errored request" (#6313)
Reverts transloadit/uppy#6312
2026-05-29 18:48:40 +05:30
Prakash
51acfe9e6c
@uppy/tus: don't abort errored request (#6312)
this fixes #6287 , another similar attempted fix which didn't got merged
: #5683

in #5683 we discussed a more longer term solution but IMO that would be
a breaking change as it would change the event contract

AI Disclaimer : AI Used 

This fix is Manually Tested across **Chrome and Firefox**
2026-05-29 18:42:58 +05:30
Prakash
5519b84409
@uppy: upgrade biome and more improvements (#6244)
- This PR upgrades `biome` from `2.0.5` -> `2.1.2` and adds two new
rules
-
[noUnusedImports](https://biomejs.dev/linter/rules/no-unused-private-class-members)
( we already had suppressions for this rule in code, but the rule itself
was never enabled in the config )
-
[noUnusedPrivateClassMembers](https://biomejs.dev/linter/rules/no-unused-private-class-members/)
- remove stale suppressions. 
- remove stale code.

---------

Co-authored-by: Mikael Finstad <finstaden@gmail.com>
2026-05-21 12:28:03 +08:00
Prakash
9143d41bc2
@uppy/companion: upgrade dev deps (#6300)
all the dev deps upgraded excepts for these : 

  - `@types/cors: 2.8.6`
  - `@types/jsonwebtoken: 8.3.7`
  - `@types/morgan: 1.7.37`
  - `@types/node: ^20.19.0`
  - `nock: ^13.1.3`
  
upgrading these to their latest major either breaks the test suite or
requires us to do code changes on our end.
  
  #6297

---------

Co-authored-by: Mikael Finstad <finstaden@gmail.com>
2026-05-21 12:26:42 +08:00
Mikael Finstad
3c537e2780
Companion upgrade deps (#6305)
recreates #6296

---------

Co-authored-by: Prakash <qxprakash@gmail.com>
2026-05-21 12:07:05 +08:00
Prakash
d9d44ce5e5
upgrade to express v5 (#6304)
exact copy of #6175 

- I will point the uppy deps upgrade pr to this PR's branch
- no other changes needed in this branch as #6175 was reviewed and all
the comments were resolved

this should be the order of merge : 

1. #6300
2. uppy deps upgrade ( yet to be raised ) 
3. merge this to main
4. merge biome changes #6244 

@mifi let me know if you think otherwise.

---------

Co-authored-by: Mikael Finstad <finstaden@gmail.com>
2026-05-21 11:14:23 +08:00
Prakash
d9742ba4e4
Revert "Upgrade to express 5" (#6303)
Reverts transloadit/uppy#6175
2026-05-21 02:36:00 +05:30
Mikael Finstad
489d76717c
Upgrade to express 5 (#6175)
closes #6157

https://expressjs.com/en/guide/migrating-5.html

---------

Co-authored-by: Prakash <qxprakash@gmail.com>
2026-05-20 21:06:46 +05:30
Prakash
ca916f6580
@uppy/transloadit: fix stale assemblyStatus in 'transloadit:assembly-cancelled' event (#6294)
@mifi this is small change which we missed , based on our discussion in
uppy call.

---------

Co-authored-by: Mikael Finstad <finstaden@gmail.com>
2026-05-20 13:03:47 +08:00
Prakash
622daa498c
@uppy/examples: update examples after recent breaking changes (#6299) 2026-05-18 21:03:42 +05:30
Mikael Finstad
5efc32a2e7
remove angular eslint (#6164)
closes #6161

---------

Co-authored-by: Prakash <qxprakash@gmail.com>
2026-05-18 20:35:10 +08:00
Prakash
12de077e6d
remove @uppy/instagram (#6257)
closes #5455 , this PR removes all Instagram support from both the
client and Companion server.

Removed:
- Instagram from @uppy/remote-sources (src, package.json, keywords)
- Instagram export from uppy bundle (bundle.ts, index.ts, package.json)
- Companion Instagram OAuth provider (provider/index.js, grant.js)
- Companion standalone helper Instagram env vars (helper.js,
env_example)
- All Companion Instagram tests (providers.test.js,
provider-manager.test.js, fixtures/index.js, mockserver.js)
2026-05-13 14:42:10 +05:30
Prakash
57f8daf55d
@uppy/transloadit: add AssemblyStatus to plugin state (#6267)
- fixes content repo testing area bug
https://github.com/transloadit/content/issues/4943 (tested locally in
content repo)
- Simplifies the testing area code — no need to manually construct the
assembly object and listen for multiple events; just subscribe to state
using `useUppyState` and that's it (tested locally in content repo)
- Addresses
https://transloadit.slack.com/archives/C0AFZGN6W2F/p1775580430051829?thread_ts=1775555821.837409&cid=C0AFZGN6W2F
(one of our customers wanted to create a custom UI around assembly
execution); this would become much easier now (need to verify)
- Addresses
9474e8d8e7/_console/js/features/templates/components/TestingArea/uppy.tsx (L131-L147)
- Partially addresses #6264
2026-05-13 02:52:53 +05:30
Mikael Finstad
ad4050b51e
Send token using websocket (#6248)
instead of window.opener - it is more robust

inspired by #4110
closes #6246
closes #4107

Biggest caveat: In cases where window.opener is null (Dropbox), the auth
window will not be auto closed (I don't know how to fix that). It will
show the user a message "Authentication successful. You may now close
this page."
https://github.com/transloadit/uppy/pull/6248/changes#diff-ef5b69c4ab5b83168eaba6f57047bb07c53e3a426f375b42fcb32d79c746872cR22

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Prakash <qxprakash@gmail.com>
2026-05-09 15:03:04 +08:00
Kevin van Zonneveld
e99a17f1fe
companion: port to TypeScript (#6179)
Supersedes #6178.

This branch keeps the exact same final content as #6178, but splits
history for reviewability:

1. `chore(companion): rename source and test files from .js to .ts`
(pure `git mv`, no content changes)
2. `feat(companion): port Companion to TypeScript` (actual
content/type/schema/build updates)

Validation note:
- Final tree is byte-for-byte identical to `ts-companion`
(`7b5b16a298690b0492de4cc4fab744f998b45570`).

---------

Co-authored-by: Mikael Finstad <finstaden@gmail.com>
2026-05-04 20:50:43 +08:00
Prakash
7ac262374f
@uppy/companion-client: fix stale websocket connection (#6269)
fixes #6181

`uploadRemoteFile()` now treats one remote upload attempt as a single
queue-owned unit. Instead of queueing “request token” and “open
websocket / wait for upload” as two separate jobs, it now:

  - acquires one queue slot
  - reuses serverToken if resuming, otherwise requests a new
    token
  - immediately proceeds to the websocket/upload phase within
    that same admitted attempt

That removes the stale-token race where Companion starts its 60s
socket-wait timer before the client’s websocket phase has actually been
admitted by the queue. Retries still reacquire the queue per attempt,
and existing abort/cancel behavior is
preserved.

refer
https://github.com/transloadit/uppy/issues/6181#issuecomment-4295036192
for more context about the bug
2026-04-30 01:54:15 +05:30
Prakash
588e1c0f88
@uppy/core: fix stale comments (#6272)
reported in https://github.com/transloadit/uppy/issues/6270
2026-04-24 17:00:50 +05:30
Enver
b9253f797a
@uppy/dashboard: My Device button respects fileManagerSelectionType (#6258)
Fixes #6256

## Problem

When `fileManagerSelectionType` is set to `'folders'`, clicking the **My
Device** tab/button
still opens the file picker instead of the folder picker.

The inline "browse" link in the tagline correctly respects the setting,
but
`renderMyDeviceAcquirer` in `AddFiles.tsx` always called
`triggerFileInputClick`
regardless of the `fileManagerSelectionType` prop.

## Solution

`renderMyDeviceAcquirer` now reads `fileManagerSelectionType` and calls
`triggerFolderInputClick` when set to `'folders'`, or
`triggerFileInputClick`
for `'files'` and `'both'`.

For `'both'` mode, the button defaults to file selection because a
single
HTML `<input>` cannot handle both files and folders simultaneously
(`webkitdirectory` is all-or-nothing). The folder picker remains
accessible
via the tagline's "browse folders" link.

---------

Co-authored-by: Prakash <qxprakash@gmail.com>
2026-04-24 16:00:02 +05:30
github-actions[bot]
dabd878b87
[ci] release (#6170)
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.


# Releases
## @uppy/utils@7.2.0

### Minor Changes

- 6b1abaa: Introduce modern, minimal TaskQueue to replace
RateLimitedQueue

## @uppy/xhr-upload@5.2.0

### Minor Changes

- 6b1abaa: Introduce modern, minimal TaskQueue to replace
RateLimitedQueue

### Patch Changes

-   Updated dependencies [6b1abaa]
    -   @uppy/utils@7.2.0

## @uppy/companion@6.2.2

### Patch Changes

-   49db42d: Fix bug with 429 not returning JSON response with message
-   4652dc6: upgrade @aws-sdk/ deps in @uppy/companion

## @uppy/transloadit@5.5.1

### Patch Changes

-   4787960: Add type re-export for `AssemblyInstructionsInput`
- 2f6849d: Fix allowMultipleUploadBatches to prevent adding/removing
files while an upload is in progress (#6156)
-   29d2772: remove monkey patch from uppy bundle package
-   Updated dependencies [6b1abaa]
    -   @uppy/utils@7.2.0

## uppy@5.2.4

### Patch Changes

-   29d2772: remove monkey patch from uppy bundle package
-   a86c624: upgrade esbuild in uppy to "^0.27.0"
-   Updated dependencies [6b1abaa]
-   Updated dependencies [4787960]
-   Updated dependencies [2f6849d]
-   Updated dependencies [29d2772]
    -   @uppy/xhr-upload@5.2.0
    -   @uppy/transloadit@5.5.1

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-03-25 20:59:50 +05:30
Prakash
a86c6240f4
@uppy: upgrade esbuild from "^0.25.0" -> "^0.27.0" (#6235)
this should fix CI error in bundlers workflow , more context :
https://transloadit.slack.com/archives/C0FMW9PSB/p1773989607853769?thread_ts=1773336079.954969&cid=C0FMW9PSB
2026-03-20 18:09:06 +05:30
Prakash
29d27726c8
remove monkey patch in bundle.ts (#6207)
full context here :
https://transloadit.slack.com/archives/C0FMW9PSB/p1771342759948189

I tested the local bundle it works as expected with the same API and 15%
reduced bundle size.
2026-03-09 00:07:53 +05:30
Copilot
47879609c7
Export AssemblyInstructionsInput type from @uppy/transloadit (#6184)
The `AssemblyInstructionsInput` type from `@transloadit/types` is now
publicly exported from `@uppy/transloadit`, allowing consumers to type
their assembly parameters without importing from the external package.

## Changes

- Re-exported `AssemblyInstructionsInput` type in
`packages/@uppy/transloadit/src/index.ts`

## Usage

```typescript
import type { AssemblyInstructionsInput } from '@uppy/transloadit'

const params: AssemblyInstructionsInput = {
  steps: {
    encode: {
      robot: '/video/encode',
      use: ':original',
      preset: 'mp4',
    },
  },
}
```

The type was already imported internally and aliased as
`AssemblyParameters`. This change makes it available to plugin
consumers.

<!-- START COPILOT ORIGINAL PROMPT -->



<details>

<summary>Original prompt</summary>

> Make the AssemblyInstructionsInput type available from the
@uppy/transloadit package by re-exporting it from
packages/@uppy/transloadit/src/index.ts.
> 
> Background
> - The Transloadit plugin imports the type AssemblyInstructionsInput
from the external package @transloadit/types and aliases it as
AssemblyParameters in packages/@uppy/transloadit/src/index.ts.
> - Consumers of the @uppy/transloadit package need direct access to the
AssemblyInstructionsInput type but it is not currently exported from the
plugin package.
> 
> Change requested
> - Add a type re-export so that consumers can import
AssemblyInstructionsInput from the transloadit plugin package, e.g.
>   import type { AssemblyInstructionsInput } from '@uppy/transloadit'
> 
> Files to change
> - packages/@uppy/transloadit/src/index.ts
> - Add the following export alongside the other package exports (near
the end of the module where other exports live):
> 
> ```typescript name=packages/@uppy/transloadit/src/index.ts
url=https://github.com/transloadit/uppy/blob/main/packages/@uppy/transloadit/src/index.ts
> -export { COMPANION_URL, COMPANION_ALLOWED_HOSTS }
> +export { COMPANION_URL, COMPANION_ALLOWED_HOSTS }
> +
> +// Re-export type from @transloadit/types so callers can import it
from the plugin package.
> +export type { AssemblyInstructionsInput } from '@transloadit/types'
> ```
> 
> Notes
> - This is a purely type-only export and should be erased at compile
time; it does not add runtime code.
> - No other behavior or API surface should change.
> 
> Please create a branch, apply the change, and open a pull request with
a descriptive title and a short description of the change. Run
TypeScript build checks if available.
> 


</details>



<!-- START COPILOT CODING AGENT SUFFIX -->

*This pull request was created from Copilot chat.*
>

<!-- START COPILOT CODING AGENT TIPS -->
---

💬 We'd love your input! Share your thoughts on Copilot coding agent in
our [2 minute survey](https://gh.io/copilot-coding-agent-survey).

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: mifi <402547+mifi@users.noreply.github.com>
Co-authored-by: Mikael Finstad <finstaden@gmail.com>
2026-03-02 10:38:57 +08:00
Merlijn Vos
23cbd4a05a
@uppy/xhr-upload: add browser tests (#6169)
Good to have actual browser tests for this uploader.
2026-02-19 15:10:17 +01:00
dependabot[bot]
63c56c9d1d
build(deps-dev): bump tar from 7.5.7 to 7.5.8 (#6185)
Bumps [tar](https://github.com/isaacs/node-tar) from 7.5.7 to 7.5.8.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="6b8eba0ef3"><code>6b8eba0</code></a>
7.5.8</li>
<li><a
href="2cb1120bce"><code>2cb1120</code></a>
fix(unpack): improve UnpackSync symlink error &quot;into&quot; path
accuracy</li>
<li><a
href="d18e4e1f84"><code>d18e4e1</code></a>
fix: do not write linkpaths through symlinks</li>
<li>See full diff in <a
href="https://github.com/isaacs/node-tar/compare/v7.5.7...v7.5.8">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~isaacs">isaacs</a>, a new releaser for tar
since your current version.</p>
</details>
<details>
<summary>Install script changes</summary>
<p>This version adds <code>prepare</code> script that runs during
installation. Review the package contents before updating.</p>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tar&package-manager=npm_and_yarn&previous-version=7.5.7&new-version=7.5.8)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/transloadit/uppy/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-19 10:02:39 +01:00
Prakash
4652dc6a4a
upgrade aws-sdk in @uppy/companion (#6180)
this fixes  #6167 

AI summary :

**The Bug: S3 Multipart Upload Fails with InvalidPart**

**What happened**
When uploading large files (200MB+) from Google Drive → Companion → S3
using multipart upload, the upload would reach ~96-100% and then fail
with S3's `InvalidPart` error on `CompleteMultipartUpload`.

*Root cause*
_A version mismatch between two AWS SDK packages caused by yarn dedupe._

Commit `3c3034b40` ("Dedupe dependencies #6085") ran `yarn dedupe`.
Companion had `@aws-sdk/client-s3` and `@aws-sdk/lib-storage` both at
`"^3.338.0"`, which previously both resolved to `3.600.0`. But the
`@uppy/transloadit` package elsewhere in the monorepo had
`"@aws-sdk/client-s3": "^3.891.0"`. Dedupe merged the resolutions —
`client-s3` jumped to `3.896.0` while `lib-storage` stayed at `3.600.0`.

*Why the mismatch matters*
AWS SDK `client-s3@3.896.0` introduced a _breaking behavioral change_ in
its checksum middleware:
• *Old (3.600.0):* Default checksum = MD5, no auto-injection.
`UploadPart` requests sent _no checksum header_.
• *New (3.896.0):* Default checksum = CRC32,
`requestChecksumCalculation` defaults to `"WHEN_SUPPORTED"`. The
middleware _auto-injects `x-amz-checksum-crc32`_ on every `UploadPart`
request.

The old `lib-storage@3.600.0` didn't know about this new behavior. It
called `CreateMultipartUpload` _without_ setting `ChecksumAlgorithm`.
Then `client-s3@3.896.0` added CRC32 checksums to each `UploadPart`. S3
saw parts with checksums that weren't declared at creation time →
rejected with `InvalidPart` at `CompleteMultipartUpload`.

*How the fixes work*

_Option A — `requestChecksumCalculation: 'WHEN_REQUIRED'`_ (workaround):
Tells the new `client-s3` to only add checksums when S3 requires them
(which it doesn't for `UploadPart`). This restores the old behavior — no
checksum headers, no mismatch.

_Option B — Upgrade all AWS SDK packages to `^3.986.0`_ (proper fix):
The new `lib-storage@3.986.0` is _aware_ of the CRC32 checksum behavior.
When it detects `requestChecksumCalculation = "WHEN_SUPPORTED"`, it
explicitly sets `ChecksumAlgorithm: "CRC32"` on the
`CreateMultipartUpload` call. Now S3 expects CRC32 checksums on the
parts, the parts have CRC32 checksums → everything is consistent →
upload succeeds.

*TL;DR*
`yarn dedupe` upgraded `client-s3` but not `lib-storage`. The new
`client-s3` started adding CRC32 checksums to parts, but the old
`lib-storage` didn't declare CRC32 at multipart creation time. S3
rejected the mismatch. Fix: upgrade both packages together so they agree
on checksum behavior.
2026-02-13 18:03:55 +05:30
Copilot
f6efd2ebcc
Fix allowMultipleUploadBatches by preventing file operations during upload (#6156)
## Implementation Plan for Transloadit allowMultipleUploadBatches Fix

- [x] Explore the codebase to understand existing structure
  - [x] Review transloadit/src/index.ts
  - [x] Review existing event handlers (#onError, #onCancelAll)
  - [x] Review install() and uninstall() methods
  - [x] Understand test structure
- [x] Implement the proper fix in
packages/@uppy/transloadit/src/index.ts
- [x] Set allowNewUpload: false at start of #prepareUpload
(preprocessor)
- [x] Reset allowNewUpload: true at end of #afterUpload (postprocessor)
  - [x] Reset allowNewUpload: true in #prepareUpload error handler
  - [x] Keep existing resets in #onError and #onCancelAll handlers
  - [x] Removed event listener approach (was causing race conditions)
- [x] Update tests to match implementation
- [x] Test allowNewUpload lifecycle through actual upload flow
(preprocessor/postprocessor)
  - [x] Test allowNewUpload reset on preprocessor error
  - [x] Test allowNewUpload reset on error event
  - [x] Test allowNewUpload reset on cancel-all
  - [x] Remove obsolete event listener tests

<!-- START COPILOT CODING AGENT TIPS -->
---

💡 You can make Copilot smarter by setting up custom instructions,
customizing its development environment and configuring Model Context
Protocol (MCP) servers. Learn more [Copilot coding agent
tips](https://gh.io/copilot-coding-agent-tips) in the docs.

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: mifi <402547+mifi@users.noreply.github.com>
Co-authored-by: Mikael Finstad <finstaden@gmail.com>
2026-02-09 21:42:43 +08:00
Mikael Finstad
49db42d72a
@uppy/companion: fix 429 not returning JSON response with message (#6177)
discovered by llm
2026-02-09 20:41:26 +08:00
Merlijn Vos
6b1abaa541
@uppy/utils,@uppy/xhr-upload: create and use new queue (#6105)
Closes #4173, kind off

## Problem

Current situation with `RateLimitedQueue`

- Track concurrency: keep a running count, only dispatch up to limit,
accept Infinity.
- Priority enqueue: queued handlers sorted by priority; dequeued in that
order.
- Lifecycle bookkeeping: each job gets abort()/done() hooks; abort for
running vs queued differs; decrement active count and advance queue via
microtasks.
- Requeue placeholders: supports a shouldBeRequeued marker so callers
can hold/retry slots without running immediately.
- Function wrappers: wrap sync or async fns to enforce the queue and
return abortable handles.
- Cancellation plumbing: provides abortOn(signal) to bind queued/running
work to an AbortSignal; abortable promises carry abort().
- Pausing: pause(duration?) freezes dispatch (optional auto-resume);
resume() restarts up to the current limit.
- Rate limiting/backoff: rateLimit(duration) pauses, drops concurrency,
then ramps it back toward the previous upper bound over time.

Case in point: it's some sort of made up, monstrosity data structure
trying to be too many things. It also has rate limiting and exponential
backoff but that's already in
[`fetcher`](https://github.com/transloadit/uppy/blob/main/packages/%40uppy/utils/src/fetcher.ts)
too.

Would be better if we had separation of concerns and proven data
structures.

## Solution

A "dumb" promise-based priority queue that doesn't care at all about
what a promise does or if it needs to be retried. The promise inside
determines if it has retrying and exponential backoff, such as a
`fetcher` promise.

To not make this a breaking change and a huge diff, we still implement
this per uploader, starting with xhr-upload, and keep backwards
compatibility in the interface so we can still pass it to
`companion-client`, which needs to share the same queue.

## Ideal future

When you think about it, it's odd that we implement a queue per uploader
if a queue is so central to uppy working correctly. It's even more odd
that we also have to inject that queue into `companion-client` per
uploader for queue sharing.

Ideally, `core` is responsible for having the queue. All uploaders would
do is push a promise to `core` and `core` doesn't care if that promise
is a tus, xhr, or S3 upload.

---------

Co-authored-by: Prakash <qxprakash@gmail.com>
2026-02-05 15:46:45 +01:00
Murderlon
9ed49719f7
fix import in upload-to-cdn.js 2026-02-03 11:30:23 +01:00
github-actions[bot]
9d87b9eab1
[ci] release (#6166)
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.


# Releases
## @uppy/components@1.2.0

### Minor Changes

- 37f69d0: Introduce `useImageEditor` to build your own UI for using our
image editor in React, Vue, and Svelte.

### Patch Changes

- 37f69d0: - Fix Vue components to work with kebab-case props
(`:edit-file` instead of `:editFile`)
-   Updated dependencies [37f69d0]
    -   @uppy/image-editor@4.2.0

## @uppy/image-editor@4.2.0

### Minor Changes

- 37f69d0: Introduce `useImageEditor` to build your own UI for using our
image editor in React, Vue, and Svelte.

## @uppy/react@5.2.0

### Minor Changes

- 37f69d0: Introduce `useImageEditor` to build your own UI for using our
image editor in React, Vue, and Svelte.

### Patch Changes

-   Updated dependencies [37f69d0]
-   Updated dependencies [37f69d0]
    -   @uppy/components@1.2.0

## @uppy/svelte@5.2.0

### Minor Changes

- 37f69d0: Introduce `useImageEditor` to build your own UI for using our
image editor in React, Vue, and Svelte.

### Patch Changes

-   Updated dependencies [37f69d0]
-   Updated dependencies [37f69d0]
    -   @uppy/components@1.2.0

## @uppy/transloadit@5.5.0

### Minor Changes

- 37f69d0: Migrate from 'transloadit' to '@transloadit/types' to get the
types. No need to drag in the entire SDK.

### Patch Changes

-   Updated dependencies [37f69d0]
    -   @uppy/tus@5.1.1

## @uppy/vue@3.2.0

### Minor Changes

- 37f69d0: Introduce `useImageEditor` to build your own UI for using our
image editor in React, Vue, and Svelte.

### Patch Changes

- 37f69d0: - Fix Vue components to work with kebab-case props
(`:edit-file` instead of `:editFile`)
-   Updated dependencies [37f69d0]
-   Updated dependencies [37f69d0]
    -   @uppy/components@1.2.0

## @uppy/locales@5.1.1

### Patch Changes

-   37f69d0: Update cs_CZ dropPaste keys to use the correct variables.

## @uppy/tus@5.1.1

### Patch Changes

- 37f69d0: Fix Node.js support by conditionally setting a property which
does not exist in Node.js instead of crashing.

## uppy@5.2.3

### Patch Changes

-   Updated dependencies [37f69d0]
-   Updated dependencies [37f69d0]
-   Updated dependencies [37f69d0]
-   Updated dependencies [37f69d0]
    -   @uppy/locales@5.1.1
    -   @uppy/tus@5.1.1
    -   @uppy/transloadit@5.5.0
    -   @uppy/image-editor@4.2.0

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-02-03 11:08:41 +01:00
Murderlon
c979a9d82b
@uppy/components: do not use symlink
Breaks changeset releases
2026-02-03 10:51:40 +01:00
Murderlon
37f69d088d
Revert "[ci] release (#6162)"
This reverts commit 671e6b26f4.
2026-02-03 10:51:07 +01:00
github-actions[bot]
671e6b26f4
[ci] release (#6162)
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.


# Releases
## @uppy/components@1.2.0

### Minor Changes

- c0a8776: Introduce `useImageEditor` to build your own UI for using our
image editor in React, Vue, and Svelte.

### Patch Changes

- c0a8776: - Fix Vue components to work with kebab-case props
(`:edit-file` instead of `:editFile`)
-   Updated dependencies [c0a8776]
    -   @uppy/image-editor@4.2.0

## @uppy/image-editor@4.2.0

### Minor Changes

- c0a8776: Introduce `useImageEditor` to build your own UI for using our
image editor in React, Vue, and Svelte.

## @uppy/react@5.2.0

### Minor Changes

- c0a8776: Introduce `useImageEditor` to build your own UI for using our
image editor in React, Vue, and Svelte.

### Patch Changes

-   Updated dependencies [c0a8776]
-   Updated dependencies [c0a8776]
    -   @uppy/components@1.2.0

## @uppy/svelte@5.2.0

### Minor Changes

- c0a8776: Introduce `useImageEditor` to build your own UI for using our
image editor in React, Vue, and Svelte.

### Patch Changes

-   Updated dependencies [c0a8776]
-   Updated dependencies [c0a8776]
    -   @uppy/components@1.2.0

## @uppy/transloadit@5.5.0

### Minor Changes

- c0a8776: Migrate from 'transloadit' to '@transloadit/types' to get the
types. No need to drag in the entire SDK.

### Patch Changes

-   Updated dependencies [c0a8776]
    -   @uppy/tus@5.1.1

## @uppy/vue@3.2.0

### Minor Changes

- c0a8776: Introduce `useImageEditor` to build your own UI for using our
image editor in React, Vue, and Svelte.

### Patch Changes

- c0a8776: - Fix Vue components to work with kebab-case props
(`:edit-file` instead of `:editFile`)
-   Updated dependencies [c0a8776]
-   Updated dependencies [c0a8776]
    -   @uppy/components@1.2.0

## @uppy/locales@5.1.1

### Patch Changes

-   c0a8776: Update cs_CZ dropPaste keys to use the correct variables.

## @uppy/tus@5.1.1

### Patch Changes

- c0a8776: Fix Node.js support by conditionally setting a property which
does not exist in Node.js instead of crashing.

## uppy@5.2.3

### Patch Changes

-   Updated dependencies [c0a8776]
-   Updated dependencies [c0a8776]
-   Updated dependencies [c0a8776]
-   Updated dependencies [c0a8776]
    -   @uppy/locales@5.1.1
    -   @uppy/tus@5.1.1
    -   @uppy/transloadit@5.5.0
    -   @uppy/image-editor@4.2.0

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-02-03 10:15:43 +01:00
dependabot[bot]
24632aea47
build(deps-dev): bump tar from 7.5.5 to 7.5.7 (#6158)
Bumps [tar](https://github.com/isaacs/node-tar) from 7.5.5 to 7.5.7.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="4a37eb9a1c"><code>4a37eb9</code></a>
7.5.7</li>
<li><a
href="f4a7aa9bc3"><code>f4a7aa9</code></a>
fix: properly sanitize hard links containing ..</li>
<li><a
href="394ece6ad8"><code>394ece6</code></a>
7.5.6</li>
<li><a
href="7d4cc17c76"><code>7d4cc17</code></a>
fix race puting a Link ahead of its target File</li>
<li>See full diff in <a
href="https://github.com/isaacs/node-tar/compare/v7.5.5...v7.5.7">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~isaacs">isaacs</a>, a new releaser for tar
since your current version.</p>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tar&package-manager=npm_and_yarn&previous-version=7.5.5&new-version=7.5.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/transloadit/uppy/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-02 22:12:55 +08:00
Murderlon
c0a8776484
Revert "[ci] release (#6153)"
This reverts commit 0ee8fef148.
2026-01-29 17:32:56 +01:00
github-actions[bot]
0ee8fef148
[ci] release (#6153)
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.


# Releases
## @uppy/components@1.2.0

### Minor Changes

- 850c1cb: Introduce `useImageEditor` to build your own UI for using our
image editor in React, Vue, and Svelte.

### Patch Changes

- 680052b: - Fix Vue components to work with kebab-case props
(`:edit-file` instead of `:editFile`)
-   Updated dependencies [850c1cb]
    -   @uppy/image-editor@4.2.0

## @uppy/image-editor@4.2.0

### Minor Changes

- 850c1cb: Introduce `useImageEditor` to build your own UI for using our
image editor in React, Vue, and Svelte.

## @uppy/react@5.2.0

### Minor Changes

- 850c1cb: Introduce `useImageEditor` to build your own UI for using our
image editor in React, Vue, and Svelte.

### Patch Changes

-   Updated dependencies [680052b]
-   Updated dependencies [850c1cb]
    -   @uppy/components@1.2.0

## @uppy/svelte@5.2.0

### Minor Changes

- 850c1cb: Introduce `useImageEditor` to build your own UI for using our
image editor in React, Vue, and Svelte.

### Patch Changes

-   Updated dependencies [680052b]
-   Updated dependencies [850c1cb]
    -   @uppy/components@1.2.0

## @uppy/transloadit@5.5.0

### Minor Changes

- 680052b: Migrate from 'transloadit' to '@transloadit/types' to get the
types. No need to drag in the entire SDK.

### Patch Changes

-   Updated dependencies [680052b]
    -   @uppy/tus@5.1.1

## @uppy/vue@3.2.0

### Minor Changes

- 850c1cb: Introduce `useImageEditor` to build your own UI for using our
image editor in React, Vue, and Svelte.

### Patch Changes

- 680052b: - Fix Vue components to work with kebab-case props
(`:edit-file` instead of `:editFile`)
-   Updated dependencies [680052b]
-   Updated dependencies [850c1cb]
    -   @uppy/components@1.2.0

## @uppy/locales@5.1.1

### Patch Changes

-   680052b: Update cs_CZ dropPaste keys to use the correct variables.

## @uppy/tus@5.1.1

### Patch Changes

- 680052b: Fix Node.js support by conditionally setting a property which
does not exist in Node.js instead of crashing.

## uppy@5.2.3

### Patch Changes

-   Updated dependencies [680052b]
-   Updated dependencies [680052b]
-   Updated dependencies [680052b]
-   Updated dependencies [850c1cb]
    -   @uppy/locales@5.1.1
    -   @uppy/tus@5.1.1
    -   @uppy/transloadit@5.5.0
    -   @uppy/image-editor@4.2.0

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-01-29 17:28:33 +01:00