The paragraph correcting the coexistence claim opened by saying an earlier
reading had it wrong, which is the same history narration the commit before it
removed from four other places. The fact stands without it.
Verifying the last pass found that two of its own corrections introduced fresh
errors. Removing a reference to an earlier draft left the Telegram sentence
circular, comparing a defect to a milder form of itself with no antecedent. And
the OAuth scope sentence attached its relative clause to the wrong thing, so it
read as though blocking-or-partitioning were the recommended recipe; those are
different facts, since the recipe drops AUTH_SAME_SITE=none and the callback
cookie then carries no attribute at all.
One correction had not been applied. The line saying AUTH_SAME_SITE=none adds an
unpartitioned HttpOnly JWT and contributes nothing was true of the engine the
cookie jar was read on and stated of all of them; Safari drops that pair
outright and Firefox delivers it either way, so it is dead weight on all three
for three different reasons.
Smaller: a configuration survives a browser setting instead of reaching it, the
Path B task list is above its cost paragraph and not below, Firefox never holds
a partitioned copy instead of not needing one, and the two remaining shorthand
mentions of XSS exposure now name the token exposure they mean.
The mechanism paragraph said the server pair being refused is what lets the
widget's partitioned pair land. That is false: CHIPS makes the partition key
part of a cookie's identity, so the two are different cookies and coexist, and
#2218 measured all four at once on Chromium. Firefox is the exception because
Total Cookie Protection files the server cookie under the embedder's partition,
which makes the keys collide, and a script may not replace an HttpOnly cookie it
collides with. The section now reports the outcome per engine and stops
asserting a causal link the measurements do not show.
PartitionedCookies was called the better answer for either path with no limits
attached. Two apply. The option is global, so Service.Set puts it on the OAuth
callback too, and a cookie partitioned to the popup's own top-level context is
one the frame cannot see, which regresses OAuth on the permissive browsers
where it works today. And HttpOnly removes bearer-token theft, not authenticated
action during an XSS, since the XSRF value stays readable by design and script
on the widget origin can still make requests the browser attaches the cookie to.
The evidence claim was broader than any single run supports. The criterion asks
for sign-in, a post and a reload; the permanent suite does all three but only on
Chromium's default policy against a stack that is not the recommended recipe,
and the cross-browser campaign covered sign-in and reload on the recommended
recipe without posting. Both halves are now stated.
Also: 70 runnable top-level tests, not 71, which counted TestMain; and three
engines across four browser targets, since Safari is a WebKit browser.
A review pass found the measured section had introduced a contradiction while
fixing one. It said Chromium, WebKit and Safari all refuse the server pair
because the default emits no SameSite attribute, then said two paragraphs later
that Safari blocks third-party cookies whatever the attribute says. Only the
refusal was measured on all three; the cause is the attribute on Chromium and
third-party blocking on WebKit and Safari, and the section now says which is
which.
Three more places stated a single engine's behaviour as every engine's: the
claim that the browser drops the server pair, which Firefox does not; the
Firefox session described as riding on an unpartitioned cookie, when Total
Cookie Protection stores it partitioned despite the missing attribute, which is
why it survives; and the flat claim that master satisfies the criterion, which
Firefox's block-all mode is the exception to.
OAuth off-domain is no longer called impossible outright, since an unpartitioned
cookie is still delivered on a permissive browser with AUTH_SAME_SITE=none; it
fails wherever third-party cookies are blocked or partitioned, and under the
recommended recipe everywhere. The Storage Access route is marked as reasoned
from browser policy instead of measured, because nothing in the campaign called
requestStorageAccess, and Firefox is added to the list of implementers.
Also drops four passages narrating earlier drafts of this document, which the
reader never saw, and refreshes counts that had gone stale against 7de51ad2:
143 and 158 source files, twenty-one and not twenty, and one anchor commit
instead of two.
The R1 mechanism was reasoned from the code and checked on Chromium. Running it
on two genuinely different registrable domains with real certificates, across
Chromium, Firefox, WebKit and Safari 27, shows the arrangement working
everywhere except Firefox's opt-in block-all, and working by two different
mechanisms.
Chromium, WebKit and Safari refuse the server's pair, because AUTH_SAME_SITE
defaults to emitting no SameSite attribute and a cross-site cookie without one
is rejected; that refusal is what lets the widget's partitioned pair land.
Firefox accepts it, and since that cookie is HttpOnly the browser then forbids
the widget's script from replacing it, so Firefox holds no partitioned copy and
rides on an ordinary third-party cookie even with the flag on. Safari blocks
third-party cookies with nothing configured, which makes AUTH_SAME_SITE=none
alone already broken there rather than deprecated.
It also changes what the upstream Partitioned work is worth, which this section
had written off twice. Building go-pkgz/auth with the option and running the
same matrix gives the same persistence with the JWT still HttpOnly: on Safari,
document.cookie inside the frame returns the token under the header flag and
does not under the partitioned build. The header path's XSS cost is avoidable,
not inherent, so both paths are better with the upstream change even though
neither depends on it.
An end-to-end pass against current master found the document stale in places
where it is used as a factual base for a decision, and found two places where
this branch had overstepped.
The two overreaches first. The acceptance criteria narrowed R1 from any
configured provider to three flows, which is a product-scope decision and not
the factual correction it was presented as, especially while the Path B
constraints still say fixing #1139 must not get harder. And the criterion is
met for anonymous and email by measurement but for Telegram by inference, which
sits badly with a standing requirement being a test a proposal passes. Both are
now written as open decisions with the alternatives spelled out.
Two costs were wrong in Path B's favour and against it. The R1 line claimed a
server-rendered fragment has no client-side writer, contradicting Path B's own
task list, which retains the existing auth through htmx:configRequest; fetcher.ts
already turns X-JWT into the partitioned pair, so the upstream Partitioned work
is mandatory only for a server-set default-on solution. And the XSRF caution
rested on GET /deleteme as though it were unprotected: it sits under radmin
behind Auth, AdminOnly and matchSiteID, and the handler needs a signed token
carrying delete_me, so exempting GET removes one gate of three. The caution
stands but now asks for an audit instead of leaning on that example.
Task 2's backlog was sending someone to write tests that exist: the cross-origin
page, comments.html and its injection case, and the config surface are all
covered now. What is left is hash deep links, max_shown_comments, Telegram, the
storage-denied trigger, and a path-prefixed deployment that #2219 makes concrete.
Also refreshes the figures to 7de51ad2, and adds two items master made
necessary: the published locale list names 17 languages against 24 shipped, and
Path B has to keep the explicit height report #2213 added on panel close.
The section sold it as a permission prompt on top of the existing flow. A
browser denies requestStorageAccess outright when the embedded origin has no
recent first-party interaction to grant against, and remark42 never gets one:
the reader interacts on the provider's origin, and the callback returns to a
document whose first statement is window.close() under ?selfClose. So the real
cost is changing the first-party experience, either by having the callback
collect a click before closing or by establishing interaction some other way,
which is a different order of cost from the other two routes.
Also states the grant correctly. It lets the frame's requests carry the cookie;
it does not make it script-readable, and the JWT cookie is HttpOnly regardless,
which is what the OAuth paragraph above already says.
Two more from the review. The section declared that no frontend change could
bring OAuth inside the criterion, which writes off the Storage Access API: an
embedded frame can ask the browser, on a user gesture, for access to its own
unpartitioned first-party cookies, and both Safari and Chrome implement it.
That would read the cookie the callback already set with no backend work, at
the cost of a revocable permission prompt. It belongs in the comparison, and it
is the only one of the three routes that is not a backend feature.
And the constraint bullet still offered CHIPS or a token not relying on ambient
cookies as alternatives, when the header path relies on one as soon as the page
reloads. Both routes rest on the same attribute; they differ over who writes the
cookie and what that costs.
A reviewer pass found the central claim inverted. The text said the token
never travels as a third-party cookie because fetcher.ts writes it inside the
frame. It does travel as one: activeJwtToken is a module-level variable filled
only from the response header, nothing reads the JWT cookie back, and getCookie
is called once in the whole app for XSRF-TOKEN, so the first request after a
reload sends no header and the token arrives ambiently. What spares it from
blocking is the Partitioned attribute authCookieOptions sets, which is what
#2214's control cookie exists to prove.
Consequences elsewhere in the section. Saying the upstream Partitioned work
buys no flow that does not already work was false: AUTH_SEND_JWT_HEADER ships
off, so in the default configuration nothing writes a partitioned cookie at
all. The OAuth handoff was described only in the shape that needs that upstream
work, when answering the redemption with X-JWT needs nothing upstream. The
partition-key description was a counterfactual, since a cookie with no
Partitioned attribute has no partition key, and the SameSite clause did not
apply to a top-level callback navigation under AUTH_SAME_SITE=none.
Also: the documentation gap is two edits, since the parameters page documents
the flag but still promises SameSite=Strict and a __Host- prefix that #2197
removed; #2214 adds three TLS functions and only two are table-driven; the task
list still claimed R1 has no e2e coverage; the constraint bullet still described
setAuthCookie's pre-#2197 behaviour; and the Path B cost line had swapped the
real upstream dependency for an invented one. Wrapped to 100 columns.
#2214 turned its two TLS cases into tables over anonymous and email, so both
are exercised in a third-party frame with the reload and again under enforced
partitioning. Telegram is the only one of the three still resting on the
writer keying off X-JWT and not off the provider, with #2208 as the reason it
cannot be measured and go-pkgz/auth#316 as what would change that.
#2214's two TLS cases both sign in anonymously, so anonymous is the only one
of the three named flows exercised in a third-party frame. Email is covered
over http and never embedded, and Telegram is covered nowhere and cannot be
until #2208 makes the API base URL configurable. The expectation that all
three behave alike rests on the client-side writer keying off X-JWT and not
off the provider, which is an inference and now reads as one.
The acceptance criteria promised sign-in with any configured provider under
third-party cookie blocking, which OAuth as built cannot satisfy: the callback
runs in a popup, a top-level context of its own, so the cookie it sets is keyed
to the auth host and the frame embedded on the other domain is a different
partition that never sees it. The criteria now name email, Telegram and
anonymous, and OAuth carries its own paragraph explaining why it is out and what
would bring it in, which is the server-mediated one-time code the constraints
below already describe.
Two claims went stale alongside it. Master meets the criterion today with
AUTH_SEND_JWT_HEADER on, because fetcher.ts writes the cookie from inside the
frame and the token never travels as a third-party cookie, so the remaining gap
for those flows is documentation and not code. The server-set cookies still lack
Partitioned, but nothing depends on them surviving in a third-party frame any
more, so the upstream work they were waiting on buys no flow that does not
already work.
* Drop the frontend workspace root and re-resolve the lockfile
`frontend/` carried a `package.json`, a `pnpm-workspace.yaml` and the lockfile
for a workspace of exactly one package. Two manifests meant two places to
declare a version, and the app pin was the one that did not win: `preact` and
`@babel/core` were each written twice, and a bump to the app manifest alone
would have been a silent no-op, since `pnpm.overrides` decides and it lived at
the root.
Everything pnpm reads now lives in `frontend/apps/remark42`: dependencies,
`packageManager`, `engines` and the overrides. `frontend/` keeps `.nvmrc`,
`.husky` and `CLAUDE.md`, none of which pnpm reads. The directory nesting
stays: every path in the repository points at `frontend/apps/remark42`,
including the published contributing docs, so moving the package up would have
rewritten 14 files to no benefit.
Moving the manifest kept the old resolutions verbatim, which left optional peer
subtrees the tree no longer reaches: `ts-node` under jest, `@swc/core` under
webpack, `vitest` under `@testing-library/jest-dom`, `tslib` under
`webpack-dev-server`. None is referenced by any config or source file here.
Re-resolving drops 137 packages and moves 59 to versions already permitted by
the ranges in the manifest, 1446 to 1308, with no direct dependency changing
version: the five that look changed differ only in their peer suffix. Every
file `pnpm build` produces is identical in size before and after.
The frontend-deps stage of the Dockerfile sets `CI=true` so the `prepare`
script skips husky, which has no git repository to install hooks into there.
* Stop markdown-only changes triggering heavy workflows, and check the documented versions
`ci-backend.yml`, `ci-build.yml` and `ci-frontend.yml` all end their path
filters with `!**.md`. The e2e workflow did not, so a change to any markdown
file under `frontend/` or `backend/` matched its `frontend/**` and `backend/**`
entries and started a docker build and the whole browser suite. The release
filter had the same hole and two of its own: it names `README.md` and `LICENSE`
on purpose, since `.goreleaser.yml` packages both, so it now excludes markdown
under `backend/` and `frontend/` only. `CLAUDE.md` and the installation page
were listed as well, and neither is packaged.
`ci-site.yml` goes on matching markdown, which is right, since the site is
built from it. It excludes `CLAUDE.md`, so a future `site/CLAUDE.md` cannot
start a site build, and `site/README.md`, which documents how to build the site
rather than being part of it.
The installation page tells a reader that a source build needs Go 1.25, Node
24+ and PNPM 10. Nothing kept those in step with `backend/go.mod`,
`engines.node`, `packageManager` and `.nvmrc`, and the drift is silent: a wrong
version in the docs builds and tests exactly as well as a right one. `.nvmrc`
is the pin with form here, having sat at 16 through the whole node 20 migration
because nothing red ever pointed at it. The check compares each stated version
against its source and holds `.nvmrc` to `engines.node`, and it fails when the
page states no version at all, so removing the claims cannot turn it into a
check that passes by comparing nothing.
Its own workflow rather than a step in an existing one, since the inputs span
the backend module, the frontend manifest and the site.
* Fix the cookie fallback page, asset path, message senders, auth teardown and cookies
Two defects with the same origin: 5825a55b, the January 2021 frontend
rewrite, first released in v1.7.0.
It removed the build entry for comments.html while leaving both the
template and the link to it in place, so the page the auth panel offers
when third-party cookies are blocked has been a 404 ever since, for
exactly the reader who has no other way in. The template needed no
changes; it is built again, and an e2e case now opens it on a thread
carrying a comment and waits for that comment, so the page being served,
its inline script running and it asking for the thread named in its own
query string are all covered. Against an image built without the plugin
entry that case fails on the 404, which is the regression it exists for.
It also fixed the public path to the domain root, so an instance mounted
under a prefix, which manuals/separate-domain documents, asked for
/web/google.svg when its own icons live under that prefix. Fifteen
provider icons in remark.mjs and one in last-comments.mjs. The path is
now derived from the url the bundle was loaded from, which is correct for
both arrangements, and the file loader no longer overrides it.
The host page also accepted postMessage from any window: every frame on a
page can reach window.parent, and the handler resizes the widget, scrolls
the page and opens the profile overlay. It now ignores anything that did
not come from a frame this module created.
A fourth, in the same family: the OAuth flow never tore its polling down.
`subscribed` was declared, checked and cleared but never set, so the guard
against a second subscription was dead code and every provider click
attached another listener pair. The five minute deadline then rejected
without unsubscribing, leaving those listeners and a retry that
reschedules itself for as long as getUser returns null. Cross-domain is
where getUser never stops returning null, so a reader on the arrangement
manuals/separate-domain documents was left polling /auth/user once a
minute for the life of the page, against a route capped at 2 req/s. It
also rejected with no argument, and the caller stores that as the error
state, so the interface had undefined to render. The deadline now tears
the subscription down and rejects with an error.
The message check had a second half. Hardening the parent left the widget
document trusting any sender, and it acts on signout and theme, so
anything holding a reference to the frame could sign a reader out.
`auth.hooks` already checked `event.source !== window.parent`; that check
is now a shared `isFromParent` and the three listeners that lacked it use
it too. The origin cannot stand in for it, since the host page is
whatever site embeds the widget and `ALLOWED_HOSTS` is enforced server
side through `frame-ancestors`.
And createInstance stacked its listeners. It reuses the marked iframe
instead of building one, but installed three listeners plus a title
observer on every call, while destroy could only reach the newest
closure, so a second call without a destroy stranded a set for good. The
listeners of the current instance are now detached before the next set
goes on. Reuse and the ignored config are unchanged: that contract is
open in the backlog note and not settled here.
The auth cookies the embedded case needs were not being delivered, in
both halves of the client's own writer. The name was decorated:
setAuthCookie prefixed with __Host- whenever the page was https, so a
real deployment wrote __Host-JWT and __Host-XSRF-TOKEN while the backend
looks for JWT and the fetcher reads XSRF-TOKEN, and nothing anywhere
reads a prefixed name. Nothing caught it because the prefix is applied
from the page protocol and every test and the dev server run on http;
there is now a second suite pinned to an https page, which is the only
condition that shows it. And the attributes could not be delivered: both
were SameSite=Strict, judged against the top-level site and not the
request's own origin, so a Strict cookie is never sent from a
third-party frame, which is the entire configuration this code exists
for. They now follow the embedding, Strict while the widget shares its
page origin and None with Secure and Partitioned once it does not, since
that is the only third-party form browsers still accept. Over http in a
third-party frame no combination works, and the strict form is written
instead of one the browser would reject outright.
That leaves the client half of #1877 working, whose reporter wanted
AUTH_SEND_JWT_HEADER for exactly this arrangement, and whose first half
merged as #1929. The server's own cookies still carry no Partitioned;
that is upstream work in go-pkgz/auth.
Two plan changes. A review pass corrected its central Path B premise,
which said the first document render is anonymous permanently, in every
configuration: it is anonymous in the configuration remark42 ships,
go-pkgz/auth exposing XSRFIgnoreMethods and remark42 leaving it unset.
The door is not shut, it is closed by a setting, and opening it is
scoped security work and not a flag flip, because GET /deleteme
deletes every comment a user has written and is a GET so the emailed
link works. And the separate-domain arrangement is promoted from a
constraint bullet to a named requirement with acceptance criteria, since
a test that signs in and posts without reloading passes while
persistence is entirely broken.
Review found a seventh, and it was reachable only because of the first:
comments.ejs built its title with innerHTML from the url query
parameter, so restoring the build entry made a reflected XSS live on the
instance origin, where the page is a top-level document, frame-ancestors
does not apply and the /web CSP allows unsafe-inline. The anchor is now
built through the DOM with textContent, and only http and https reach
href, since escaping alone leaves a javascript: url working. Two e2e
subtests pin both halves, and mutation testing separates them: restoring
innerHTML fails four assertions, while keeping the escaping and dropping
only the scheme guard fails the href one alone.
Review also found the poll teardown test did not exercise the poll.
handleWindowVisibilityChange is reachable only from the two listeners
and from the retry it schedules itself, and the test dispatched neither,
so no request was ever made and the assertion compared zero to zero; it
passed with the teardown reverted. It now dispatches focus, asserts
requests are being made and keep coming, and only then that they stop.
And the teardown could not cancel an in-flight getUser: a null resolving
after the deadline ran the code past the await and scheduled a fresh
retry with nothing left to clear it. A closure-local flag checked after
the await stops that, chosen over a second guard at the top of the
handler because only one of the two is detectable by mutation and this
is the one that prevents the stray timer rather than neutering it.
The inline handler in the iframe template accepted messages from any
window while acting on them through location.replace and document.title.
It now takes only the parent, the same check the host page side makes.
* Make backend tests wait on conditions instead of durations
The backend workflow has a long tail of runs that fail once and pass on
a rerun. Every one of them comes down to a test assuming an operation
finishes within some duration rather than waiting for the state it
needs. Three were reproducible and each was reproduced against the old
code before being changed: TestServerAuthHooks minted a token that lived
one second and never tested expiry, so a slow runner turned the first
POST into a 401; TestServerApp_AnonMode saw "connection refused" because
waitForHTTPServerStart returned silently after three seconds and left a
later assertion to fail with something unrelated; TestFsStore_Cleanup
slept 200ms against a 300ms ttl that Cleanup widens to 400ms with its
commit grace, so roughly 100ms of stall collected an image meant to
survive.
Fixed sleeps before asserting on asynchronous work are replaced with
polls on the condition itself, using require.Eventually and
require.EventuallyWithT, and require.Never where the assertion is that
something did not happen. Polling closures assert on the CollectT they
are handed rather than on t, since testify runs them on another
goroutine, and polls that issue HTTP requests stay under the rate limit
on the routes they poll through.
Where a test needs time to have passed, the clock input is pinned
instead: staging ages are stamped with os.Chtimes on both sides of the
cleanup boundary right before each call, which also makes the 100ms
commit grace an exact case rather than something no assertion reaches,
and the RSS tests set store.Comment.Timestamp explicitly rather than
racing the wall clock into the first 100ms of a second so pubDate
matches.
chooseUnusedPort takes a port from the kernel's ephemeral range. Picking
at random out of a fixed 10000-port window let two package binaries,
which go test ./... runs concurrently, land on the same number between
the probe closing and the server binding. The start helpers fail naming
the port they waited on, and the SSL tests wait on the redirect port as
well as the TLS one.
Arbitrary budgets that nothing tests are gone: ten HTTP clients with a
one-second timeout against bolt-backed import and export, the "should
take about 100msec" assertions, and a one-second bound on noticing an
already cancelled context. Shutdown stays bounded at ten seconds so a
hang is still caught.
Two assertions get stronger. TestServerAuthHooks accepted 403 or 401
from a blocked user, an alternative that existed only because the short
token could expire mid-test; it is deterministically 403 now.
TestAdmin_BlockedList asserted two users blocked while one carried the
same 150ms ttl the next step waits to lapse, so the halves raced each
other.
goleak stops reporting the regexp2 clock goroutine, which chroma pulls
in for syntax highlighting and which lives for up to a second after the
last match with a timeout; it ends on its own but a binary finishing
inside that window was reported as leaking, and this suite now finishes
sooner. The ignore for net/http.(*Server).Shutdown goes the other way:
it no longer matches anything, with both packages run fifteen times each
under CPU oversubscription to confirm.
Two gaps the change would otherwise have opened are covered directly
rather than left to the side effects that used to cover them. The
one-second token was the only thing exercising the authenticator's
ClaimsUpd hook on refresh, so TestServerApp_ClaimsUpd now calls the hook
itself and checks admin, blocked, email and restricted-name
impersonation, including the two pass-through cases. Lifting the
open-route limit removed the last incidental exercise of the rate
limiter, so TestRateLimiter drives a burst past the allowance and checks
the refusals and that the limit is per client. Both run without a wall
clock, and both were confirmed to fail when the behaviour they cover is
removed.
Production code is untouched. The two sleeps outside test code, the 429
backoff in cmd/cleanup.go and the submit poll in store/image/image.go,
are left alone: no CI failure implicates them.
Test sleeps drop from 67 to 21, all of them either inside a
testing/synctest bubble or a poll interval. The suite runs in about 22
seconds instead of 46, mostly because
TestPublic_FindCommentsCtrl_ConsistentCount no longer paces a hundred
subtests with an 80ms sleep each to stay under the open route limit. The
300s per-package budget now matches across both workflows, the race_test
target and the documented command, and CLAUDE.md records the convention.
with '#' will be ignored, and an empty message aborts the commit. # #
Date: Sat Aug 22 01:12:31 2026 +0100 # # interactive rebase in progress;
onto 7c312da1 # Last command done (1 command done): # reword deb6cbf1 #
Make backend tests wait on conditions instead of durations # Next
command to do (1 remaining command): # reword 262e6dc2 # Apply go fix
under Go 1.27 # You are currently editing a commit while rebasing branch
'fix/backend-test-flakiness' on '7c312da1'. # # Changes to be committed:
.github/workflows/release.yml # modified: CLAUDE.md # modified: Makefile
modified: backend/_example/memory_store/server/rpc_test.go # modified:
backend/app/cmd/import_test.go # modified:
backend/app/cmd/server_test.go # modified: backend/app/main_test.go #
modified: backend/app/rest/api/admin_test.go # modified:
backend/app/rest/api/middleware_test.go # modified:
backend/app/rest/api/migrator_test.go # modified:
backend/app/rest/api/rest_private_test.go # modified:
backend/app/rest/api/rest_public_test.go # modified:
backend/app/rest/api/rest_test.go # modified:
backend/app/rest/api/rss_test.go # modified:
backend/app/rest/proxy/image_test.go # modified:
backend/app/store/image/fs_store_test.go # modified:
backend/app/store/service/service_test.go # modified:
docs/backlog/api-tests-deadlock-on-macos.md #
* Apply go fix under Go 1.27
Go 1.27 extends go fix with the modernizers, so `go fix ./...` now
rewrites patterns the language has since replaced. Running it across all
three modules produces this: legacy sync/atomic calls on plain integers
become the atomic types (notify.Service.closed, image.Service.term and
submitCount, and several test counters), reverse index loops become
slices.Backward, a Split-then-index becomes strings.Cut, counted loops
become range over an int, and interface{} becomes any in the e2e suite.
The example module needed no changes. The e2e module is behind a build
tag, so it only matches with `go fix -tags e2e ./...`.
One knock-on: prealloc can see the bound of a loop once it is written as
range over an int, so the slice it feeds is now preallocated.
with '#' will be ignored, and an empty message aborts the commit. # #
Date: Sat Aug 22 01:32:09 2026 +0100 # # interactive rebase in progress;
onto 7c312da1 # Last commands done (2 commands done): # reword deb6cbf1
262e6dc2 # Apply go fix under Go 1.27 # No commands remaining. # You are
currently editing a commit while rebasing branch
'fix/backend-test-flakiness' on '7c312da1'. # # Changes to be committed:
backend/app/migrator/native.go # modified: backend/app/notify/notify.go
backend/app/rest/api/rest_private_test.go # modified:
backend/app/store/comment.go # modified:
backend/app/store/image/image.go # modified:
backend/app/store/service/service_test.go # modified:
backend/app/store/service/title_test.go # modified: e2e/e2e_test.go #
modified: e2e/widgets_test.go #
* Move the site from eleventy to hugo
The site is built by a single static binary. No node, no package manager,
no lockfile, and the toolchain it needed is gone: eleventy, tailwind,
postcss, markdown-it and its three plugins, date-fns, prism, npm-run-all,
cross-env and html-minifier-terser.
Hugo covers most of that itself. Chroma replaces prism, goldmark replaces
markdown-it, `--minify` replaces html-minifier-terser, and fingerprinted
asset URLs replace the cache-busting `version` shortcode that stamped
`Date.now()` into every stylesheet link.
`assets/styles.css` is hand-written, since tailwind was the only reason
left to keep a package manager. The palette and the light and dark values
are custom properties at the top of the file; the minified stylesheet is
15 kB against tailwind's 46 kB, and the whole build 1.0 MB against 1.2 MB.
It was matched to the old one by comparing computed styles rather than by
eye, which is how the heading weights and line heights, the list marker
colour, and the home page heading and sign-off were caught: the last of
those had been carried by tailwind utilities written into the markup.
The `::: note` container becomes a `note` shortcode taking the emoji to
show. Its closer needs a blank line after it, because a shortcode is not
a block rule the way `markdown-it-container` was, and without one goldmark
keeps the callout inside the open paragraph. The `overflow-x` wrapper
around tables and the heading anchors are goldmark render hooks.
Syntax guessing is off. Chroma detected a systemd unit file as gdscript
and a chat transcript as mysql, and colouring a snippet as the wrong
language is worse than not colouring it. The two chroma themes are scoped
to opposite sides of the theme switch rather than layered, because they do
not declare the same properties on the same tokens: github gives Error a
background github-dark never overrides, and styles Punctuation where
github-dark leaves it alone. Layered, either leaves a light value applying
on a dark page.
`[frontmatter] lastmod` resolves through git, then front matter, then file
modification time. Without that chain `.Lastmod` falls back to `.Date`,
which is zero when a page carries no date, and every page reads
`Jan 01, 0001`. `enableGitInfo` is off because the image build context is
`site/` alone, where hugo fails hard rather than degrading;
`HUGO_ENABLEGITINFO=true` gives real per-page commit dates locally.
Three fixes fall out of the move rather than being sought:
- `/docs/` redirected nowhere. The stub was a markdown file whose
permalink was a template expression while `markdownTemplateEngine` was
false, so it never rendered and the URL 404'd. It is an alias now
- `/docs/contributing/` pointed at `/docs/contributing/development/`,
which has never existed. It points at the backend page
- the 404 page was built to `/404/` and nothing served it. Hugo writes it
to `/404.html` and reproxy is told to use it
The mobile documentation menu is a checkbox and label. `visibility: hidden`
on the checkbox, which is what the old `invisible` utility set, takes it
out of the tab order, and a label is not focusable on its own, so the menu
could not be opened from the keyboard at all. The checkbox is clipped
rather than hidden, and its label shows a focus ring.
Content is unchanged. Every code block on every page is byte-identical to
the eleventy output; the only prose difference is that two example values,
`mysite.com` and a quoted `https://demo.remark42.com`, are no longer
turned into links, goldmark's linkify being narrower than markdown-it's.
`backend/README.md` and `frontend/apps/remark42/README.md` are symlinks
into the docs tree and follow it to `site/content/`, as does the path
`release.yml` watches. `frontend/CLAUDE.md` described the site as a node
and yarn project in four places.
* Keep the heading anchors markdown-it generated
Goldmark strips punctuation markdown-it kept, so 22 headings holding a
dot, slash, apostrophe, question mark, bracket or em dash would take a new
id and any link into one from outside the repository would stop resolving.
Those headings carry their previous id as well, as an empty target emitted
ahead of the heading by the render hook, from a map of content path to old
anchor in `data/anchor_aliases.json`. The map was built by matching
heading text between the two builds rather than by position, so it
survives a heading being added or moved.
The hook rather than markdown, because goldmark's `{#id}` attribute syntax
cannot express these: it accepts dots, apostrophes and em dashes but
treats a slash, a question mark, a bracket or a percent sign as heading
text, which is 11 of the 22. The ids are stored percent-decoded, since a
browser decodes a fragment before matching, so `#children%E2%80%99s-privacy`
finds `children’s-privacy`. Verified by navigating to the awkward ones
against the built image and measuring where the page settles: each lands
112px down, which is the header offset the target carries.
Three pages carried no title, so the docs template rendered an empty `<h1>`
above the heading their markdown already had. They take their titles from
that heading text, so neither the wording nor its anchor changes, and the
template's `<h1>` carries an id. One in-page link pointed at an anchor
goldmark no longer generates.
The heading render hook emits no permalink anchor. The one it replaced was
an empty `<a href>` with `pointer-events: none`, so it could not be
clicked, and its only job was a `::before` spacer that `scroll-margin-top`
on the heading already does. Being an `<a href>` it stayed in the tab
order, so every heading was an unexplained keyboard stop: eight on the
installation page alone. Fragment navigation still lands 112px down, clear
of the fixed header.
* Harden the site image build and its CI
The architecture guard could not fire. `${TARGETARCH:-amd64}` defaulted
before the `unsupported arch` branch was reachable, so a build without
buildkit put an amd64 hugo inside an aarch64 image and ran only because
Docker Desktop emulates it. Reproduced with `--build-arg TARGETARCH=`:
`/etc/apk/arch` reported aarch64 and `hugo version` linux/amd64. An empty
value is an error now. `Dockerfile.dev` had the same defect and no smoke
step to catch it, so it would have failed at `compose up`.
The hugo tarball is verified against the release's own `checksums.txt`,
and the match is asserted present before it is used: piping grep straight
into `sha256sum -c` left the guarantee resting on what the checker does
with empty input. Busybox exits 1 there, so it did fail closed, but
nothing in the line said so. Verified against a checksums file that does
not list the tarball: the build stops before the install.
Hugo exits 0 on an empty content tree and emits a two-page shell, which
would have been copied, pushed and deployed. The build asserts the home
page and a docs page exist.
`site/**` pull requests were never built. The only building job is gated
on `github.ref == 'refs/heads/master'`, so on a pull request every job
skipped and rendered in the checks list the same way a pass does, and the
image was first built on the run that also deploys it. A `validate` job
builds it with `push: false`, needing no secrets so it works on a fork.
`.github/dependabot.yml` watched `/site` for npm packages that are gone.
That entry is a docker one, which tracks the alpine base. It does not
track the hugo pin and cannot: the docker ecosystem reads `FROM`
references, and `ARG HUGO_VERSION` is a bare string in a download URL, so
that one is a manual bump and `site/README.md` says so.
`Dockerfile.dev` carries a `COPY`, so the dev image works without the
compose bind mount, and compose runs as the invoking user rather than
root, which on linux left root-owned `public/` and `resources/` in the
checkout.
Recorded in the backlog: `master` has `required_status_checks` off with an
empty check list, so the new job surfaces a red X and does not block a
merge. That is a settings decision rather than a code fix.
All 23 open Dependabot alerts against frontend/pnpm-lock.yaml resolve to
packages whose override floor sat below the patched release. Every floor
now carries an explicit upper bound, as an open-ended floor lets pnpm
resolve across a major version.
rest.CORS refuses "*" together with credentials since go-pkgz/rest#52, so the
bump and the option have to land together: the option does not exist in v1.22.0
and the panic fires at construction, inside routes(), which makes it a startup
failure rather than a request-time one.
The wildcard stays. The comment widget is embedded on arbitrary third-party
sites, so the set of origins is not knowable, which is why the escape hatch was
asked for upstream instead of accepting the panic. What it costs is unchanged
and now written next to the call: any site a signed-in user visits can read
authenticated responses, so state-changing requests have to keep being protected
by something other than the origin, X-XSRF-Token today.
The example module is tidied in the same commit, as it reaches go-pkgz/rest
through the replace directive and its indirect graph would otherwise keep the
old pin and fail the readonly module check in CI.
The bump also carries testify to v1.12.0, which drops go-spew and go-difflib
from the module graph.
site/** pull requests get no build validation: ci-site.yml declares a
pull_request trigger but gates its only build job to master and tags, so
a bad site lockfile first fails on the post-merge run that deploys.
frontend pnpm override floors still admit js-yaml 3.15.0 and 5.2.0,
leaving three open advisories including the one PR 2141 closed for site/.
by @akellbl4
* create infrastructure for site
* wip
* fix docker build and add readme
* add docker-compose as a build and a run method
* rename compose file yaml -> yml
* add `src` as volume for watching changes
* update configs
* update README
* add padding at the end of the pages
* move demo settings in config
* fetch latest release from github
* update docs navigation
- add sections
- redirect from root of the section to first doc
- nice styles for navigation
- add brand colors
* cache github data from first load
* add redirects and fix link to docs
* fix docs nav styles
* add installation page placeholder
* fix demo
* add 404
* add dark theme, add theme switcher, remove unused files
* fix dark theme on main page
* fix dark theme background
* fix node version
* change installation docs
* add note block
* minor fixes
* add code highlighting styles
* fixes
* fixes
* mobile navigation, fix code highlighting colors
* fix dev server
* fix fetching error
* fix path to edit
Co-authored-by: Pavel Mineev <pavel@mineev.me>
Co-authored-by: Dmitry Verkhoturov <paskal.07@gmail.com>
The current state is a mess of user and admin
notifications, which will become worse after
implementing the new user notification methods
like a telegram.
This change makes things simpler
for the remark42 users.
This simplifies token and timeout reuse for
the notify module (used now) and for
the auth module later (not yet in the code).
SMTP credentials are already set up that way.
by @patarapolw
* allow manual init and destroy for use with Nuxt
* fix onDestroy-related methods
* avoid global scope, and use function scope instead
* add createInstance function to window.REMARK42
* 1. allow DOMNode to be put in remark_config 2. check remark_config before try to attach node
* move createInstance function outside
* update embed.ts
* avoid ?.
* 📚 Docs: doc on how to make it work with SPAs
* 📚 Docs: fix spa.md to be more flexible
* ✨ Feat: add REMARK42::ready event
* remove nuxt-specific terminologies
* tell MutationObserver to disconnect on destroy
* update docs/spa.md
* rename and combine npm scripts
* move to checkout@v2 in actions
* change dev docs
* move liststaged config to package.json because it easier to understand what husky doing
Dmitry Verkhoturov
Umputun
Vladimir RusinovandUmputun
ronanandUmputun
Pacharapol WithayasakpuntandGitHub
0xflotusandUmputun
Gürkan GürandUmputun