chore: v0.11.1

- Update Next.js to v15.5.7 for latest security patches
- Add file existence validation in assets API to prevent directory access
- Fix text overflow issues in task titles and descriptions with break-all

Author: dohsimpson

apps/web/app/api/v1/assets/[...path]/route.ts

@@ -1,5 +1,5 @@
 import { NextResponse } from "next/server"
-import { readFile } from "fs/promises"
+import { readFile, stat } from "fs/promises"
 import { getSecureAssetPath } from "@/lib/utils/path-validation"
 import { ApiErrorCode } from "@tasktrove/types/api-errors"
 import type { ErrorResponse } from "@tasktrove/types/api-responses"
@@ -65,6 +65,16 @@ async function serveAsset(request: EnhancedRequest, path: string[]) {
   }
 
   try {
+    const fileStats = await stat(securePath)
+    if (!fileStats.isFile()) {
+      const errorResponse: ErrorResponse = {
+        code: ApiErrorCode.ASSET_NOT_FOUND,
+        error: "Asset not found",
+        message: "Requested asset path is not a file",
+      }
+      return NextResponse.json<ErrorResponse>(errorResponse, { status: 404 })
+    }
+
     // Read the file
     const fileBuffer = await readFile(securePath)
 

apps/web/app/api/v1/assets/route.test.ts

@@ -0,0 +1,54 @@
+import { describe, it, expect, vi, beforeEach } from "vitest"
+import { NextRequest } from "next/server"
+import { mkdtemp, readFile } from "fs/promises"
+import { tmpdir } from "os"
+import { join } from "path"
+
+import { GET } from "./[...path]/route"
+import { getSecureAssetPath } from "@/lib/utils/path-validation"
+import { createMockEnhancedRequest } from "@/lib/utils/test-helpers"
+
+vi.mock("fs/promises", async () => {
+  const actual = await vi.importActual<typeof import("fs/promises")>("fs/promises")
+  return {
+    ...actual,
+    readFile: vi.fn(),
+  }
+})
+
+vi.mock("@/lib/utils/path-validation", () => ({
+  getSecureAssetPath: vi.fn(),
+}))
+
+const mockGetSecureAssetPath = vi.mocked(getSecureAssetPath)
+
+describe("GET /api/v1/assets when path points to a directory", () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it("returns 404 and does not attempt to read the directory", async () => {
+    const tempDir = await mkdtemp(join(tmpdir(), "asset-dir-"))
+
+    mockGetSecureAssetPath.mockReturnValue(tempDir)
+
+    const readFileSpy = vi.mocked(readFile)
+
+    const request = new NextRequest("http://localhost:3000/api/v1/assets/avatar/test")
+    const enhancedRequest = createMockEnhancedRequest(request)
+    const response = await GET(enhancedRequest, {
+      params: Promise.resolve({ path: ["avatar", "test"] }),
+    })
+
+    expect(response.status).toBe(404)
+
+    const body = await response.json()
+    expect(body).toEqual({
+      code: "ASSET_NOT_FOUND",
+      error: "Asset not found",
+      message: "Requested asset path is not a file",
+    })
+
+    expect(readFileSpy).not.toHaveBeenCalled()
+  })
+})

apps/web/components/task/task-item.tsx

@@ -530,7 +530,7 @@ export function TaskItem({
       >
         <div className="p-2">
           {/* Single row layout - simplified for non-mobile only */}
-          <div className="flex items-center gap-2">
+          <div className="flex items-center gap-2 min-w-0">
             {/* Task Completion Checkbox */}
             <TaskCheckbox
               checked={task.completed}
@@ -539,7 +539,7 @@ export function TaskItem({
             />
 
             {/* Title */}
-            <div className="flex-1 min-w-0 max-w-full truncate">
+            <div className="flex-1 min-w-0 max-w-full">
               <LinkifiedEditableDiv
                 as="span"
                 value={task.title}
@@ -548,8 +548,10 @@ export function TaskItem({
                     updateTask({ updateRequest: { id: task.id, title: newTitle.trim() } })
                   }
                 }}
+                onEditingChange={setIsTitleEditing}
                 className={cn(
-                  "text-sm block w-fit max-w-full",
+                  "text-sm block w-full min-w-0 break-all",
+                  !isTitleEditing && "line-clamp-2",
                   task.completed ? "line-through text-muted-foreground" : "text-foreground",
                 )}
                 data-action="edit"
@@ -1364,7 +1366,7 @@ export function TaskItem({
                 className={cn(
                   "text-xs sm:text-sm hover:bg-accent",
                   "w-full sm:w-[28rem] md:w-[32rem] lg:w-[36rem] xl:w-[40rem]",
-                  "max-w-full break-words min-w-0",
+                  "max-w-full break-all min-w-0",
                   task.description
                     ? "text-muted-foreground"
                     : !isDefaultDescriptionEditing
@@ -1536,7 +1538,7 @@ export function TaskItem({
                     {taskLabels.map((label) => (
                       <span
                         key={label.id}
-                        className="px-1.5 py-0.5 rounded text-xs flex items-center gap-1 hover:opacity-100 truncate max-w-20 sm:max-w-none"
+                        className="px-1.5 py-0.5 rounded text-xs flex items-center gap-1 hover:opacity-100 truncate max-w-20 sm:max-w-none break-all"
                         style={{
                           backgroundColor: label.color,
                           color: getContrastColor(label.color),

apps/web/package.json

@@ -1,6 +1,6 @@
 {
   "name": "web",
-  "version": "0.11.0",
+  "version": "0.11.1",
   "private": true,
   "type": "module",
   "scripts": {

packages/atoms/src/ui/views.ts

@@ -721,15 +721,19 @@ peopleAssigneesCollapsedAtom.debugLabel = "peopleAssigneesCollapsedAtom";
  * Enables global persistence for hide/dismiss toggles across the app
  */
 export const dismissedUiMapAtom = atom(
-  (get) => get(globalViewOptionsAtom).dismissedUi,
+  // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
+  (get) => get(globalViewOptionsAtom).dismissedUi ?? {},
   (
     get,
     set,
     update:
       | Record<string, boolean>
       | ((current: Record<string, boolean>) => Record<string, boolean>),
   ) => {
-    const current = get(globalViewOptionsAtom).dismissedUi;
+    // Older persisted state might not have the dismissedUi key yet, so
+    // normalize to an empty object before reading/updating.
+    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
+    const current = get(globalViewOptionsAtom).dismissedUi ?? {};
     const next = typeof update === "function" ? update(current) : update;
     set(updateGlobalViewOptionsAtom, { dismissedUi: next });
   },

pnpm-lock.yaml

@@ -108,7 +108,7 @@ catalog:
   lint-staged: ^16.2.0
   lucide-react: ^0.544.0
   motion: ^12.23.24
-  next: ^15.5.6
+  next: ^15.5.7
   next-logger: ^5.0.1
   next-themes: ^0.4.6
   node-cron: ^4.2.1