Security Meassure , as discussed in uppy call
- Yarn package age gate increased to seven days
- Weekly npm Dependabot updates enabled with a seven-day cooldown
Note: Dependabot security-update PRs intentionally bypass the seven-day
cooldown, ensuring security fixes remain available immediately.
examples/angular still depends on @angular/core ^19.2.18, which declares a
peer on zone.js ~0.15.0, so the 0.16 bump left it running against an
unsupported peer. packages/@uppy/angular is on Angular 21 and keeps ~0.16.2.
Adds the missing changeset: @uppy/companion and @uppy/angular both take
runtime dependency bumps in this PR and would otherwise never be released.
Majors confined to dev tooling, verified to need no source changes:
- jasmine-core ~5.1 -> ~6.3, @types/jasmine ~5.1 -> ~6.0 (angular)
- zone.js ~0.15 -> ~0.16 (angular)
- jsdom ^26 -> ^29
- execa 9.6.1 -> 10.0.0 (companion)
- @npmcli/arborist ^9 -> ^10, pacote ^21 -> ^22 (release tooling)
- dotenv ^16 -> ^17 (aws-nodejs example)
Deliberately excluded after testing:
- @types/node 20 -> 26 breaks companion typecheck (Uploader.ts FormData ->
FormDataLike cast, TS2352). Blocked on the same formdata-node work as got 14.
- body-parser 2.2.2 -> 2.3.0 in companion makes the @uppy/url browser test
fail under the full parallel `yarn test` run (the URL plugin stops
receiving file metadata). It passes when that package is run alone, so the
trigger is load-dependent; reverting to 2.2.2 makes the full run green
again, reproduced three times each way.
- body-parser ^1 -> ^2 in the express examples, held back with the above.
undici 8.8.0 lands 4.2 days inside the cooldown as a transitive of the
release tooling; no in-range alternative exists.
Verified: yarn build (54/54), yarn typecheck (75/75), yarn check:ci,
yarn test (19/19), example-angular build.
Re-resolves 41 already-in-range dependencies to their newest release that
is at least seven days old, matching the dependabot cooldown. No package.json
changes: ranges are untouched, only yarn.lock resolutions move.
Notable: preact 10.29.2 -> 10.29.7 (26 workspaces), vitest/@vitest/browser
4.1.6 -> 4.1.10, sass 1.89.2 -> 1.101.0, msw 2.10.4 -> 2.15.0, turbo,
tailwindcss 4.3.3, vue 3.5.40, svelte-check, tsx, multer (supersedes #6347).
Two transitive resolutions land inside the cooldown window because no
in-range alternative exists: postcss 8.5.22 (2.5d) and enhanced-resolve
5.24.3 (4.6d). Both are patch-level build tooling.
This PR fixes#6280, Adds **IndexedDB** as MetaDataStore falling back to
`localStorage` when IndexedDB isn't available.
AI Disclaimer : AI Used
### Changes
- **`IndexedDBMetaDataStore.ts`** : IndexedDB-backed `MetaDataStore`;
sync `get`/`set` via in-memory cache, async `load`/`save`.
- **`IndexedDBStore.ts`** : add a `state` store to the existing
`uppy-blobs` DB (v3→4, additive); expire it in `cleanup()`; close on
`versionchange`.
- **`index.ts`** : choose IndexedDB vs localStorage; restore is async
and failure-safe.
- **`MetaDataStore.ts`** : `setItem` wrapped in try/catch so the
fallback can't throw either.
- **Added Tests**
### Notes for reviewers
- **Snapshot is `JSON.stringify`'d before `put()`** (not stored raw):
structured clone *throws* on non-cloneable values; JSON drops them like
localStorage did. Storing raw froze the snapshot and ghosted files.
- **No migration** : an in-flight recovery at upgrade time starts fresh
(rare, no data loss).
- **Best-effort persistence** : write failures are swallowed; they must
never break uploading.
#### Manual Testing : Manually Tested with large Assemblies
Resolve conflicts from the @uppy/core consolidation refactor (#6370),
which folded @uppy/companion-client and @uppy/provider-views into
@uppy/core.
- Move the controller-based googlePicker.ts to
@uppy/core/src/companion-client and drop main's old ref-based copy
- Adapt GooglePickerView, GoogleDrivePicker and GooglePhotosPicker to
the @uppy/core/companion-client and @uppy/core/provider-views subpaths
- Point @uppy/components and the useGooglePicker hooks at
@uppy/core/companion-client
- Keep SearchProvider's own Opts (RequestClient no longer carries
name/provider/pluginId) and drop the removed CompanionClientSearchProvider
- Remove the deleted packages' tsconfig project references from
@uppy/components and regenerate yarn.lock
- Import useSyncExternalStore from 'use-sync-external-store/shim' so its
types resolve under NodeNext
- Retarget the changeset from the removed packages to @uppy/core
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EdZdYGrk6vKmty5EPeevV7
Closes#6042.
Merges `@uppy/utils`, `@uppy/store-default`, `@uppy/companion-client`,
and `@uppy/provider-views` into `@uppy/core`, exposed via subpath
exports. These packages are removed. This collapses four
separately-versioned packages into the one package every plugin already
depends on removing duplicate-version bugs, making updates actually
reach users, and letting co-dependent types reference each other
directly instead of through hand-maintained duplicates.
Since this was a massive change so it's was done across 5 PRs
- #6351 — merge `@uppy/store-default` → `@uppy/core/store-default`
- #6352 — merge `@uppy/utils` → `@uppy/core/utils`
- #6353 — merge `@uppy/companion-client` → `@uppy/core/companion-client`
- #6358 — merge `@uppy/provider-views` → `@uppy/core/provider-views`
- #6359 — remove the duplicate `CompanionClientProvider` / `view: any`
bridge types and type `UnknownProviderPlugin['provider']` structurally
(Pick of the real `Provider`/`SearchProvider`)
### Breaking (6.0)
Import paths change, e.g. `@uppy/utils` → `@uppy/core/utils`,
`@uppy/provider-views/css/*` → `@uppy/core/provider-views/css/*`.
`RequestOptions` moves to `@uppy/core/companion-client`;
`CompanionClientProvider`/ `CompanionClientSearchProvider` are removed
(use the native `Provider`/ `SearchProvider`). See
`MIGRATION-6.0-merge-into-core.md`.
