Release/11.14.0 - #66
Merged
Merged
Conversation
#noJiraCheck Upgrade Node.js version in deploy workflows
#noJiraCheck merge release/26.0.0 to dev/11
Add a dedicated `spfx` build configuration that resolves `@sinequa/atomic` to the AadHttpClient-aware `@sinequa/atomic-spfx` build and bootstraps the app with Azure AD auth wired from the SharePoint host context. - angular.json: `spfx` build + serve configurations (tsconfig.spfx.json, file replacements) - main.spfx.ts: reads window.__MINT_SPFX_CONTEXT__, initializes AadHttpClient, applies backendUrl/app, provides the AAD token provider; falls back to a dev mock under ng serve - config/: AAD HttpClient interceptor, swappable interceptor lists, SPFx context contract + dev mock - app.config.ts: extract the HTTP interceptor list into a swappable module - package.json: alias @sinequa/atomic -> @sinequa/atomic-spfx (local file build), add @microsoft/sp-http - spfx-host/: reference SPFx web part glue + README (injects the AAD context, loads the bundle) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…debar - New atomic/features/spfx.md: setup guide, full web part example, internals, AadHttpClientLike/AadHttpResponseLike API ref - New atomic/changelogs/CHANGELOG_feat_spfx-support.md - atomic/intro.md: add SPFx bullet in Key Features - sidebars.js: wire atomic/types and atomic/changelogs categories (pre-existing folders not yet registered in the sidebar) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- add `spfx-production` Angular build configuration (optimized, fixed asset names via `outputHashing: none` for the host loader) + `environment.spfx.production.ts` - import `initializeAadHttpClient` from the `@sinequa/atomic/spfx` subpath - swap spfx-host docs: English `README.md` + French `README.fr.md`; add a DEV (mock) vs PROD run-modes section - translate spfx-host and spfx config code comments to English - dev: point `@sinequa/atomic` at local `../atomic` build; spfx proxy/env settings Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- SPFx prod runtime is Node-agnostic (browser JS) - mint bundle builds on Node 24; sp-* are dev-only type providers - only the separate .sppkg packaging requires Node 22
- build:spfx → deployable spfx-production bundle - start:spfx → local dev serve with mocked AAD context
- spfx/, transloco/, providers/, interceptors/ subfolders - update @config imports, main.spfx.ts relative imports, angular.json fileReplacements - fix i18n-overrides doc path
- revert environment.ts to standard dev values (app: mint_rnd); app:"spfx" was a local test-only tweak - document in spfx-host READMEs (EN/FR): no SPFx-only test env; mock supplies only AAD auth, app comes from environment.ts in DEV - gitignore local proxy.conf.spfx.json
- proxy.conf.json target → su-sba.demo.sinequa.com, drop /__mock route
- serve spfx config → proxy.conf.spfx.json (git-ignored, holds /__mock mock route) - proxy.conf.json now points at the demo backend for standard dev - update spfx-host READMEs proxy row accordingly
…arch - Show the sidebar Search item on non-search routes so it stops disappearing - Skip the query in fetchServerPage when empty search is disabled and text is empty - Toast the "empty search not allowed" message, mirroring the search component - Guard against undefined records when the query returns an empty result
…ant route attach The /assistant route is the only one with reuse: true (CustomReuseStrategy freezes/ thaws it, never destroys/recreates it). The page title was relying solely on the route-guarded effect (path === "/assistant"), whose flush on (re)attach is racy: injectCurrentUrl() is seeded (startWith) with the previous URL under Angular's deferred urlUpdateStrategy, and on thaw the effect can flush before selectionStore is cleared -- so the single setTitle write is missed and the tab title is not applied when navigating to /assistant. Restore an imperative title set in initialize() -- the deterministic attach hook called on construction and on every thaw via onRouteAttached. Uses the synchronous translate() with a raw-key guard (same pattern already used app-side) so it stays translated with no key flash. The reactive effect is kept for in-place language changes while the assistant is the visible route. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…arch ES-32653 #done fix(sidebar): restore search button and guard empty search
…were-not-translated-in-french
…were-not-translated-in-french
…ant, agent) ES-32619 #done fix(i18n): translate page titles (home, search, assistant, agent)
# Conflicts: # src/components/sidebar-groups/sidebar-group-navigation.ts
… inputFilters
Sync the latest agent-demo behaviour into Mint's agent sidebar/page:
- Search-chats dialog: wire (chatSelected) so selecting a chat loads it (the library
now exposes the output); the dialog closes itself after.
- Gating: replace the isIdle machine-state check with AgentsStore.canLoadChat
("canNavigate") across the Agent entry, the search dialog and the inline history —
the library's single source of truth (Idle/WaitingForApproval/Editing…, blocked while busy).
- New chat: guard onNewChat() with canNavigate (keyboard activation bypasses the
pointer-events gating).
- Saved-chat deletion: on SAVED_CHAT_DELETED of the open chat, navigate to /chat/new
without re-dispatching createAgentNewChatEvent (the library resets itself), guarded
by canNavigate + instanceId.
- Forward the new inputFilters pass-through input to <AgentInjector>.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…(LF, drop CRLF-only diff unrelated to ES-32885) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ome + .gitattributes) The repo had drifted to a mixed EOL state: oxfmt and prettier were pinned to CRLF while biome defaults to LF and Git did no normalization (core.autocrlf=false, no eol attribute in .gitattributes). This produced spurious CRLF-only diffs (e.g. LF files being rewritten to CRLF by the formatter), most recently polluting an unrelated PR. Standardize on LF (the Git/cross-platform norm, already biome's default): - .oxfmtrc.json / .prettierrc: endOfLine crlf -> lf. - biome.json: pin formatter.lineEnding to lf (was the implicit default). - .gitattributes: add `text=auto eol=lf` for text source extensions so Git normalizes newly committed/edited content to LF. `text=auto` (not forced) does not retroactively flag existing CRLF blobs, so files converge to LF progressively as they are edited (no bulk renormalization, per the "no bulk reformat" convention). Only text extensions are listed, so binaries and LFS assets are never matched. The two JSON config files above appear fully rewritten because their own CRLF blobs are normalized to LF as part of this change; the only semantic edits are the three endOfLine/lineEnding lines. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ect-theme-menu-was-not-full-displayed-in-moblie ES-30566 #done feat(sidebar-user-menu): inline theme/language selection on mobile
Update the `@sinequa/atomic-angular` dependency to version 1.10.0 in both `package.json` and `package-lock.json`, picking up the latest release from the npm registry.
…o the sidebar ES-32885 #done feat(agent): move new chat, search chats & history into the sidebar
Root workspace: 10 vulnerabilities (3 moderate, 7 high) -> 0. All 10 reduced to two root causes: - brace-expansion <= 5.0.7 (GHSA-mh99-v99m-4gvg / CVE-2026-14257, high), reached through glob/minimatch under the transloco packages. - @hono/node-server < 2.0.5 (GHSA-frvp-7c67-39w9, moderate), reached through @angular/cli -> @modelcontextprotocol/sdk. Bump the @jsverse packages to the v8 line. transloco 8 drops its glob and replace-in-file dependencies entirely, which clears three findings at once (including the one attributed to @sinequa/atomic-angular). Mint only uses TranslocoPipe, TranslocoService, provideTranslocoScope, provideTransloco and provideTranslocoMessageformat, none of which are touched by the v8 breaking changes (schematics, privatised utils, Node 18 minimum). Add three security overrides: - @hono/node-server >=2.0.5 <3 - @modelcontextprotocol/sdk caps the range at ^1.19.9, so npm audit fix can never reach the patched version. v2 keeps serve and getRequestListener, the only symbols the SDK imports; its breaking changes are dropping Node 18 (CI runs 22) and removing the unused Vercel adapter. - @jsverse/transloco ^8.4.0 - @sinequa/atomic-angular@1.10.0 declares @jsverse/transloco ^7.6.1 as a hard dependency. Without this override npm installs a second nested transloco 7, which breaks Angular DI (two distinct TranslocoService instances) and keeps the vulnerable glob chain alive. - @jsverse/transloco-scoped-libs > glob ^13.0.6 - scoped-libs 8.4.0 still depends on glob ^10.3.3, the last consumer of brace-expansion 2.x. Its only call site is glob(pattern), unchanged in v13. Add SECURITY-NOTES.md recording the docusaurus workspace as an accepted risk and the removal condition for each override. Not fixed: docusaurus (20 high, all CVE-2026-14257). No upstream fix exists - serve-handler@6.1.7 is the latest release and pins minimatch: 3.1.5 exactly, and @docusaurus/core still depends on it up to 3.10.2. Overriding minimatch breaks at runtime: serve-handler and docusaurus-lunr-search both call minimatch(a, b) as a function, but from v9 onwards the CommonJS build exports a namespace object. Overriding brace-expansion to 1.1.16 / 2.1.2 does not help either - their patched dist/commonjs/index.js is dead code (main: index.js, no exports field) and the legacy entry point still has max = Infinity with no maxLength cap. Not exploitable here: build-time only, patterns come from our own docusaurus config, the published artefact is a static site, and serve-handler only backs the local docusaurus serve preview. ES-32852 (exponential-time expansion) is fully covered on both manifests: the root audit is clean and docusaurus now resolves brace-expansion 1.1.16, which does contain that fix. Verified: - npm audit (root): found 0 vulnerabilities - one deduped @jsverse/transloco@8.4.0, including under @sinequa/atomic-angular - chain reduced to glob@13.0.6 -> minimatch@10.2.5 -> brace-expansion@5.0.8; replace-in-file gone - npm run t:extract reproduces src/assets/i18n identically (empty git diff) - npm run build succeeds Note: ng test is not runnable in this repo (no test target in angular.json), so the test suite could not be exercised. The i18n browser smoke test still needs a backend session. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
#noJiraCheck chore: standardize line endings on LF (oxfmt/prettier/biome + .gitattributes)
…ties ES-32988 #done ES-32985 #done fix(deps): resolve root npm audit to zero, document docusaurus dead-end
…-left-side-to-filters-below-search-bar ES-27661 #done mint switch from facets left side to filters below search bar
Sync the internal release/11.14.0 branch (b386bfc) into the public mirror. Conflict resolutions: - package-lock.json: take the internal version (also drops the stale "../sba-atomic-angular/atomic-ui/dist/atomic-ui" extraneous entry) - package.json: take the internal version but keep the public postinstall script (no internal npm registry, no @sinequa/assistant@latest_11.14.0) - src/environments/environment.ts: keep the public version as-is (app 'training-mint') Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
These 32 files were deleted upstream (internal release/11.14.0) but survived on the public mirror because earlier sync merges resolved conflicts by keeping the public side. None of them is referenced any more: their replacements already exist (src/config/highlight.config.ts, src/components/preview/preview-navbar, src/components/sidebar-groups/sidebar-group-widgets, src/app2/pages/**/ *.layout.ts), and the orphan templates (preview-tabs.html, app2 home.html) are unused since their components moved to inline templates. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@microsoft/sp-http pulled in 19 @microsoft/sp-* / graph packages whose `engines`
field caps Node at 22, so every `npm install` printed a wall of cosmetic
EBADENGINE warnings on Node 24:
npm warn EBADENGINE package: '@microsoft/sp-page-context@1.23.2'
npm warn EBADENGINE required: { node: '>=18.17.1 <19.0.0 || >=22.14.0 < 23.0.0' }
npm warn EBADENGINE current: { node: 'v24.16.0', npm: '11.3.0' }
Those packages are dev-only type providers: src/config/spfx/spfx-context.ts
imports them with `import type`, and it is only reachable from src/main.spfx.ts
(tsconfig.spfx.json). The default build (tsconfig.app.json, entry src/main.ts)
never compiles them, so the devDependency is dropped and reinstalled on demand
before `npm run build:spfx`. Removing it from the lockfile alone would have
broken `npm ci` (lockfile out of sync with package.json).
Also bumps @sinequa/agent to ^4.1.0, the version the postinstall installs anyway.
- package.json: remove the @microsoft/sp-http devDependency
- package-lock.json: regenerated (-908 lines, no @microsoft/sp-* left, no
remaining package caps Node below 24)
- spfx-host/README.md + README.fr.md: document the on-demand install
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…ed docs docusaurus/versioned_docs/version-11.13.0/atomic-angular/stores/app.mdx and .../atomic/api/suggest.mdx were committed mid-conflict by an earlier sync merge: both carried `<<<<<<<<` / `========` / `>>>>>>>>` markers plus the 11.14.0 side of the conflict pasted into the 11.13.0 versioned page. Both files are restored from the internal branch, which has never had the markers. Pure deletion (-125 lines, 0 added): nothing unique is lost, the removed 11.14.0 content already lives in versioned_docs/version-11.14.0/ and in docs/ (verified for `getAuthorizedFilters`/`getAuthorized` and for the Suggest module page). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
sync: release/11.14.0 (sba-internal → sba-mint)
hebus
added
release
🔄 sync
larde
approved these changes
Aug 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.