restore #6314 to d30c93df37
- merged `main` to it
- resolved confilicts
- squashed all commits into a single commit and sign it ( I had to do
this as signing the past unsigned commits was difficult it was messing
up the history everytime I tried )
The Norwegian Bokmål (`nb_NO`) locale had fallen behind `en_US` by ~55
strings. This brings it up to date.
**Added** translations for the missing keys, including: AI image
generation (`generateImage`, `generating1`–`5`), audio recording
(`allowAudioAccess*`, `noAudio*`, `startAudioRecording`,
`stopAudioRecording`), required meta fields
(`missingRequiredMetaField*`), session recovery (`recoveredAllFiles`,
`recoveredXFiles`, `sessionRestored`), plugin names (`pluginName*`),
image compression (`compressedX`, `compressingImages`), and various UI
strings (`error`, `search`, `pleaseWait`, `unnamed`, `uploadStalled`,
etc.).
**Removed** keys no longer present in `en_US` (`backToSearch`,
`fileSource`, `selectFileNamed`, `timedOut`, `unselectFileNamed`).
**Fixed** `exceedsSize` to include the `%{file}` placeholder, and
aligned key order with `en_US`.
I'm a native Norwegian speaker and reviewed every string. Translation
was done with AI assistance (Claude) and checked by me.
---------
Co-authored-by: Mikael Finstad <finstaden@gmail.com>
AI disclaimer : AI used
## Changes
- **jsdom 26 → 29** across all packages' devDependencies —
**except`@uppy/aws-s3`** (left at 26; that plugin is being rewritten and
its deps are handled on the rewrite branch).
- **`@uppy/xhr-upload` unit tests migrated from nock to MSW**, and
`nock` dropped from its devDependencies.
## Why the test migration was needed
jsdom **28** overhauled resource loading so `XMLHttpRequest` now goes
through jsdom's internal (undici-based) fetch instead of Node's `http`
module ([jsdom 28 release
notes](https://github.com/jsdom/jsdom/releases/tag/28.0.0)).
nock intercepts at the Node `http` / `http.ClientRequest` layer ([nock
README](https://github.com/nock/nock)), so it can no longer see uppy's
upload requests — the mocked responses never arrive and the tests time
out. (This is the long-standing nock + jsdom XHR incompatibility:
[nock#518](https://github.com/nock/nock/issues/518).)
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Part of the dev-dependency major-version upgrades. These required code
changes so they're split out from the no-code-change batch (#6315).
**AI Disclaimer** : AI Used
- **glob 8 → 13** — `@uppy/locales` scripts: the callback API was
removed, so `getPaths()` uses the promise form and `test.mjs` uses the
named `globSync`.
- **npm-packlist 5 → 11** — `upload-to-cdn.js`: v7+ takes an
`@npmcli/arborist` tree instead of `{ path }`; loads the tree and passes
it to `packlist()`. Adds `@npmcli/arborist` as a devDependency.
- **nock 13 → 14** (`@uppy/companion`) — the v14 @mswjs/interceptors
rewrite crashed the SSRF tests in `http-agent.test.ts`; nock
interception is now kept off by default and only activated for the one
test that mocks a host.
- **@types/use-sync-external-store 0 → 1** — `@uppy/react`: v1's exports
map only exposes extensionless subpaths, so imports use
`use-sync-external-store/shim` and `/with-selector` (runtime supports
both).
will do a separte PR for changes which would require code changes so
it's easier to review , didn't upgrade any deps for `@uppy/aws-s3` since
we'll merge the rewrite so I think we should do that upgrade in the
rewrite branch before merging.
update : Dependency upgrades which required code changes were raised
separately
- #6309
- #6310
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
this fixes#6287 , another similar attempted fix which didn't got merged
: #5683
in #5683 we discussed a more longer term solution but IMO that would be
a breaking change as it would change the event contract
AI Disclaimer : AI Used
This fix is Manually Tested across **Chrome and Firefox**
all the dev deps upgraded excepts for these :
- `@types/cors: 2.8.6`
- `@types/jsonwebtoken: 8.3.7`
- `@types/morgan: 1.7.37`
- `@types/node: ^20.19.0`
- `nock: ^13.1.3`
upgrading these to their latest major either breaks the test suite or
requires us to do code changes on our end.
#6297
---------
Co-authored-by: Mikael Finstad <finstaden@gmail.com>
exact copy of #6175
- I will point the uppy deps upgrade pr to this PR's branch
- no other changes needed in this branch as #6175 was reviewed and all
the comments were resolved
this should be the order of merge :
1. #6300
2. uppy deps upgrade ( yet to be raised )
3. merge this to main
4. merge biome changes #6244
@mifi let me know if you think otherwise.
---------
Co-authored-by: Mikael Finstad <finstaden@gmail.com>
## Why
Recent npm supply-chain compromises showed that dependency installs and
shared CI caches can execute or preserve newly published malicious
packages before advisories catch up. This PR reduces that exposure for
this repo.
## What changed
- Made eligible Yarn installs immutable and removed shared dependency
caching from the manual CDN upload path; existing minimal age gate
remains unchanged.
## Validation
- Ran `git diff --check` across the prepared worktree.
- Audited this PR set for `pull_request_target` and release/deploy/CDN
cache reuse; patched actionable hits.
- Did not run the full test suite; this is a workflow/config-only
change.
## Summary
- replace QEMU-based multi-platform build in
`.github/workflows/companion-deploy.yml` with native runner matrix
builds
- build amd64 on `ubuntu-24.04` and arm64 on `ubuntu-24.04-arm`
- push architecture-specific tags (`edge-amd64`, `edge-arm64`) and
publish `transloadit/companion:edge` as a manifest that references both
- add explicit workflow permissions (`contents: read`) and keep workflow
expression formatting consistent
- remove conflicting `DOCKER_BUILDKIT`/`COMPOSE_DOCKER_CLI_BUILD` env
overrides from the docker job
## Validation
- `corepack yarn check:ci` ✅
- baseline full run before edits: `corepack yarn check:ci && corepack
yarn build && corepack yarn test` (test step had pre-existing failures
in `@uppy/utils` due `Promise.withResolvers` in this environment)
- parallel validation (Code Review + CodeQL) ✅
## TODO
- [ ] do the same for release?
https://github.com/transloadit/uppy/blob/main/.github/workflows/release.yml
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: mifi <402547+mifi@users.noreply.github.com>
Co-authored-by: Mikael Finstad <finstaden@gmail.com>
Supersedes #6178.
This branch keeps the exact same final content as #6178, but splits
history for reviewability:
1. `chore(companion): rename source and test files from .js to .ts`
(pure `git mv`, no content changes)
2. `feat(companion): port Companion to TypeScript` (actual
content/type/schema/build updates)
Validation note:
- Final tree is byte-for-byte identical to `ts-companion`
(`7b5b16a298690b0492de4cc4fab744f998b45570`).
---------
Co-authored-by: Mikael Finstad <finstaden@gmail.com>
fixes#6181
`uploadRemoteFile()` now treats one remote upload attempt as a single
queue-owned unit. Instead of queueing “request token” and “open
websocket / wait for upload” as two separate jobs, it now:
- acquires one queue slot
- reuses serverToken if resuming, otherwise requests a new
token
- immediately proceeds to the websocket/upload phase within
that same admitted attempt
That removes the stale-token race where Companion starts its 60s
socket-wait timer before the client’s websocket phase has actually been
admitted by the queue. Retries still reacquire the queue per attempt,
and existing abort/cancel behavior is
preserved.
refer
https://github.com/transloadit/uppy/issues/6181#issuecomment-4295036192
for more context about the bug
