Merge v17 into v18 (2026-09-08) - #1081
Merged
Merged
Conversation
Path.GetFileName/GetDirectoryName only recognize the current OS's path separator, so a Windows-style path (backslashes) passed to ToAppSafeFileName on Linux was left completely untouched instead of having app.config/web.config renamed - GetFileName returned the whole string unchanged since there was no '/' to split on, so the bad-name check never matched. Discovered while testing whether the build/test workflows could move to ubuntu-latest runners: PathNameTests.BadFileNamesAreAppended failed on Linux for exactly this reason. Now splits on both '\' and '/' manually so the result doesn't depend on which OS is parsing the path. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
@hey-api/openapi-ts's own json-schema-ref-parser dependency still resolves js-yaml to the vulnerable 4.2.0, same issue v17 fixed in #1073. The other dependabot alerts postcss/uuid/nanoid/brace-expansion fixed alongside it there had already been resolved independently on v18. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Enabling GitHub's default setup for code scanning at the repo level (matching v17's #1075) applies across all branches, and blocks uploads from any advanced/workflow-based CodeQL run - this workflow's PR runs on v18 were failing with "CodeQL analyses from advanced configurations cannot be processed when the default setup is enabled". Default setup now covers v18 the same way it already covers v17. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Forward-ports the v17 work landed after the last forward merge (#1072)
that was still outstanding.
ToAppSafeFileNameonly split on the current OS's path separator, so aWindows-style path parsed on Linux was left untouched instead of having
app.config/web.configrenamed. v18 was on the older implementationthat had the same bug.
(postcss/uuid/nanoid/brace-expansion/js-yaml) in
usync-assetsandhistory-client. Checked v18's lockfiles directly: postcss, uuid,nanoid and brace-expansion had already reached patched versions
independently, but both projects were still resolving js-yaml to the
vulnerable 4.2.0 (pulled in transitively via
@hey-api/openapi-ts→json-schema-ref-parser). Added the sameoverridespin (^4.3.1) v17 used and regenerated both lockfiles —js-yaml now resolves to 4.3.2 in both.
.github/workflows/codeql.yml— this PR's own CI runsurfaced it failing with "CodeQL analyses from advanced configurations
cannot be processed when the default setup is enabled". GitHub's
default setup for code scanning (enabled repo-wide alongside v17's
Switch CodeQL to default setup, remove advanced-setup workflow #1075) blocks uploads from any workflow-based CodeQL run, on any
branch. v18's workflow file was dead weight from that point on, same
as v17's
codeql-2.ymlwas before Switch CodeQL to default setup, remove advanced-setup workflow #1075 removed it.Not ported (already superseded on v18, or the documented
reverse-direction exception):
dotnet-build.yml/package-build.ymlhave already been modernizedindependently and further than these v17 changes.
release.ymlalready having been copied into v17; nothing to bringback the other way.
@hey-api/openapi-tsbump and generated-client regen in Fix npm dependabot alerts in usync-assets and history-client #1073 —v18 is already on
^0.99.0.Test plan
dotnet build ./uSync.slnx -c Release— succeeds, 0 errorsdotnet test ./uSync.Tests/uSync.Tests.csproj -c Release— 218/218 passedusync-assets:npm install && npm run typescript:build— succeeds, js-yaml confirmed at 4.3.2, no longer flagged bynpm audithistory-client:npm install— succeeds, js-yaml confirmed at 4.3.2CodeQLworkflow failure on this PR's own run, matching the "default setup enabled" error, before removing the filePlease merge with a merge commit, not squash, so the next forward-port run can find this baseline directly from ancestry.
🤖 Generated with Claude Code