Skip to content

Bump zip from 2.4.2 to 6.0.0 in /core#36

Closed
dependabot[bot] wants to merge 357 commits intomainfrom
dependabot/cargo/core/zip-6.0.0
Closed

Bump zip from 2.4.2 to 6.0.0 in /core#36
dependabot[bot] wants to merge 357 commits intomainfrom
dependabot/cargo/core/zip-6.0.0

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Feb 16, 2026

Bumps zip from 2.4.2 to 6.0.0.

Release notes

Sourced from zip's releases.

v6.0.0

🐛 Bug Fixes

  • panic when reading empty extended-timestamp field (#404) (#422)
  • Restore original file timestamp when unzipping with chrono (#46)

⚙️ Miscellaneous Tasks

  • Configure Amazon Q rules (#421)

v5.1.1

🐛 Bug Fixes

  • panic when reading empty extended-timestamp field (#404) (#422)
  • Restore original file timestamp when unzipping with chrono (#46)

⚙️ Miscellaneous Tasks

  • Configure Amazon Q rules (#421)

v5.1.0

🚀 Features

  • Add legacy shrink/reduce/implode compression (#303)

v5.0.1

🐛 Bug Fixes

  • AES metadata was not copied correctly in raw copy methods, which could corrupt the copied file. (#417)

v5.0.0

🚀 Features

  • Implement by_path*() methods on ZipArchive (#382)

v4.6.1

🐛 Bug Fixes

  • Fixes an issue introduced by the swap from lzma-rs to liblzma (#407)

v4.6.0

🚀 Features

  • Allow to read zip files with unsupported extended timestamps (#400)

🐛 Bug Fixes

  • enable clamp_opt for ppmd and xz (#401)

v4.5.0

... (truncated)

Changelog

Sourced from zip's changelog.

6.0.0 - 2025-10-09

🚀 Features

  • Add by_index_with_options(), which can be used to ignore encryption in a file's metadata (#439) and may be used for other file-specific overrides in the future.

⚙️ Miscellaneous Tasks

  • [breaking] FileOptions::add_extra_data is now generic and accepts any AsRef<[u8]>. (#435)

5.1.1 - 2025-09-11

🐛 Bug Fixes

  • panic when reading empty extended-timestamp field (#404) (#422)
  • Restore original file timestamp when unzipping with chrono (#46)

⚙️ Miscellaneous Tasks

  • Configure Amazon Q rules (#421)

5.1.0 - 2025-09-10

🚀 Features

  • Add legacy shrink/reduce/implode compression (#303)

5.0.1 - 2025-09-09

🐛 Bug Fixes

  • AES metadata was not copied correctly in raw copy methods, which could corrupt the copied file. (#417)

5.0.0 - 2025-09-05

🚀 Features

  • Implement by_path*() methods on ZipArchive (#382)

4.6.1 - 2025-09-03

🐛 Bug Fixes

  • Fixes an issue introduced by the swap from lzma-rs to liblzma (#407)

4.6.0 - 2025-08-30

🚀 Features

  • Allow to read zip files with unsupported extended timestamps (#400)

... (truncated)

Commits
  • abfc23d feat: Upgrade [Extended]FileOptions::add_extra_data() data from Box<[u8]> to ...
  • eb1b586 docs: Update zip_writer documentation example (#431)
  • 26e6e08 feat: Add by_index_with_options() for ignoring encryption (#439)
  • 165415d chore(deps): update nt-time requirement from 0.10.6 to 0.12.1 (#429)
  • 1d5d4ed chore(deps): update lzma-rust2 requirement from 0.13 to 0.14 (#432)
  • 72cce40 chore(deps): update nt-time requirement from 0.10.6 to 0.12.1 (#428)
  • 2ef4d3e chore(deps): update nt-time requirement from 0.10.6 to 0.12.1 (#427)
  • 9cf28cb test(ci): Fix: rename can't be skipped
  • 5987cdd test(ci): Fix: need recursive rename
  • 74f8a3c test(ci): Need to rename more files during fuzz runs
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Steven Melendez added 30 commits February 14, 2026 15:08
The expand/collapse triangles on Plugin Data, Workspace Plugins, and
Storage Details sections were too small at ThemeFontSizeXsSm (12px).
Bumped all 6 triangle TextBlocks to ThemeFontSizeSmMd (14px) for
better visibility and click-target size.
Add X25519 envelope encryption module to privstack-crypto for cloud sync
sharing. Includes key pair generation, DEK seal/open with ephemeral DH,
passphrase-protected private key storage (Argon2id + ChaCha20-Poly1305),
and BIP39 12-word mnemonic recovery. New deps: crypto_box 0.9, bip39 2.
Docker Compose test environment with MinIO (S3-compatible) and MySQL 8
for integration testing. 20 unit tests + proptest all passing.
New crate with 12 modules: API client (JWT auth, token refresh on 401),
S3 transport (STS credentials, upload/download), credential manager
(auto-refresh), adaptive outbox (solo 60s / collab 5s flush modes),
sync engine (tokio::select event loop), envelope manager (DEK sharing
orchestration), compaction (snapshot generation, >50 batch threshold),
sharing workflow (create/accept/revoke/cascade), blob sync (encrypted
upload/download with quota tracking), config, types, and error handling.
Dependencies: aws-sdk-s3, aws-sdk-sts, reqwest, crypto_box, sha2.
Exposes the privstack-cloud crate to .NET via C ABI with 22 FFI functions
organized into 5 focused submodules (auth, workspaces, sync, sharing, devices).

New error codes: CloudSyncError(29), QuotaExceeded(30), ShareDenied(31),
EnvelopeError(32), CloudAuthError(33).

PrivStackHandle extended with cloud_api, cloud_sync_handle, cloud_envelope_mgr,
cloud_share_mgr, and cloud_config fields.

Functions use privstack_cloudsync_ prefix to avoid collision with existing
privstack_cloud_ functions (Google Drive/iCloud). All functions follow the
standard pattern: parse C strings, acquire HANDLE, block_on async, write JSON.
…r (1.25.0)

Phase 6 of the Cloud Sync Implementation Plan. Adds the .NET desktop integration layer for S3-backed cloud sync:

- CloudSyncModels.cs: DTOs for CloudSyncStatus, CloudQuota, CloudWorkspaceInfo, CloudAuthTokens, CloudShareInfo, SharedWithMeInfo, CloudDeviceInfo, and SyncTier enum
- PrivStackError.cs: Added error codes 28-33 (InvalidArgument, CloudSyncError, QuotaExceeded, ShareDenied, EnvelopeError, CloudAuthError) matching Rust FFI enum
- NativeLibrary.cs: 27 P/Invoke declarations for all privstack_cloudsync_* FFI exports (auth, key management, workspaces, sync engine, sharing, devices)
- ICloudSyncService.cs: Interface abstracting the cloud sync FFI surface for DI and testability
- CloudSyncService.cs: FFI wrapper implementing ICloudSyncService with DeserializeAndFree/MarshalAndFree helpers, lifecycle hooks (FlushIfSyncing on shutdown), and IDisposable cleanup
- Workspace.cs: Added SyncTier and CloudWorkspaceId properties
- ServiceRegistration.cs: Registered ICloudSyncService → CloudSyncService singleton
New capability interface for plugins that support per-entity sharing via PrivStack Cloud. Declares ShareableEntityTypes, IsExcludedFromSharing (default false), GetEntityTitle, and GetEntityType. Follows established capability registration pattern (Host.Capabilities.Register in OnInitializeAsync). SDK version bumped to 1.26.0 for new public API surface.
…7.2 / 1.25.1)

Phase 8 of Cloud Sync Implementation Plan — blob/datasource sync layer.

Rust FFI (privstack-ffi):
- Added cloud/blobs.rs with 4 FFI exports: upload_blob (encrypt + S3 upload + API register), download_blob (S3 download + decrypt), free_blob_data, get_entity_blobs (JSON metadata)
- Added cloud_blob_mgr and cloud_user_id to PrivStackHandle for blob operation state
- BlobSyncManager initialized alongside sync engine in start_sync, cleaned up in stop_sync
- Binary data passed via pointer+length; DEK as 32-byte raw key

.NET Desktop:
- Added 4 P/Invoke declarations with unsafe byte* marshalling for binary blob data
- Added CloudBlobMeta DTO for blob metadata deserialization
- Added blob methods to ICloudSyncService interface and CloudSyncService implementation
- UploadBlob/DownloadBlob use fixed pinning for safe pointer passing to FFI
….3 / 1.25.2)

Phase 9 of Cloud Sync Implementation Plan — compaction and maintenance.

Rust FFI:
- Added privstack_cloudsync_needs_compaction (checks >50 batch threshold)
- Added privstack_cloudsync_request_compaction (triggers server-side batch cleanup via API)
- Both functions added to cloud/sync.rs module

.NET Desktop:
- Added NeedsCompaction and RequestCompaction P/Invoke declarations
- Added compaction methods to ICloudSyncService interface and CloudSyncService implementation
…shareable behavior

Adds three test files covering the PrivStack Cloud Sync .NET layer:

- CloudSyncModelsTests (39 tests): Validates JSON serialization roundtrips for all
  cloud sync DTOs (CloudSyncStatus, CloudQuota, CloudWorkspaceInfo, CloudAuthTokens,
  CloudShareInfo, SharedWithMeInfo, CloudBlobMeta, CloudDeviceInfo), default values,
  SyncTier enum integer casts, FormatBytes boundary conditions (B/KB/MB/GB),
  SeverityColor thresholds (green at 80, yellow at 80.1, yellow at 95, red at 95.1),
  Summary formatting, StorageDisplay formatting, record equality, nullable property
  handling, and snake_case JSON property name verification.

- CloudSyncServiceTests (33 tests): Tests the ICloudSyncService interface contract
  via NSubstitute mocks since the real CloudSyncService wraps FFI calls to the Rust
  native library. Covers DEK validation behavior (16-byte and 64-byte DEKs throw
  ArgumentException), and verifies all 27 interface methods can be called and return
  expected mock values across all categories: configuration, authentication, key
  management, workspaces, sync engine, sharing, devices, blobs, and compaction.

- ShareableBehaviorTests (8 tests): Validates the IShareableBehavior capability
  interface including default IsExcludedFromSharing returning false, concrete
  implementations returning expected entity types/titles, excluded plugin override
  returning true, empty entity types list, IReadOnlyList type enforcement, and
  NSubstitute mock compatibility.

All 80 tests pass. No source code changes — test-only addition.
Adds 96 tests for the privstack-cloud crate across 6 test files:

- api_client_tests (29 tests): wiremock-based integration tests covering
  CloudApiClient auth state management, JWT authenticate/retry-on-401,
  workspace CRUD, STS credentials, cursor advance/pending changes, lock
  acquire/conflict/release, quota, sharing (create/accept/revoke/list),
  public key upload/fetch, device registration, and blob metadata.

- types_tests (26 tests): Serde JSON roundtrip serialization for all 16
  cloud sync types, StsCredentials expiry logic (is_expired, expires_within_secs
  with boundary conditions), SharePermission/ShareStatus lowercase serde
  and equality, optional field handling for BlobMeta/DeviceInfo.

- error_tests (12 tests): Display trait output verification for all 11
  CloudError variants plus From<serde_json::Error> conversion.

- outbox_tests (12 tests): Outbox push/take/flush mode transitions,
  Solo vs Collab threshold-based flushing, buffer size accumulation,
  cooldown period enforcement on mode switching.

- compaction_tests (9 tests): needs_compaction threshold boundary tests,
  S3 key format verification for snapshot/batch/blob/private_key paths.

- config_tests (8 tests): CloudConfig default values, test() helper,
  serialization roundtrip, optional endpoint_url handling.

Also bumps workspace version 1.7.3 -> 1.7.4 and Desktop 1.25.2 -> 1.25.3.
…ache

Replaced App.Services.GetService<IMasterPasswordCache>() calls in UnlockAsync and RequestLock with constructor-injected dependency. The static App.Services is null in test contexts, causing ArgumentNullException that prevented password clearing, error message clearing, and event raising — resulting in 6 failing UnlockViewModelTests. The parameter is optional (nullable) to maintain backward compatibility with existing test setup that doesn't provide it.
Cloud sync engine now encrypts/decrypts batches per-entity using a
thread-safe DekRegistry (Arc<RwLock<HashMap<String, DerivedKey>>>).
The sync engine groups outbox events by entity_id and encrypts each
group with the entity's DEK via ChaCha20-Poly1305. Per-entity cursor
tracking replaces the single cursor_position.

FFI auth.rs now persists passphrase-encrypted and mnemonic-encrypted
private keys to S3 during setup_passphrase, and retrieves them during
enter_passphrase and recover_from_mnemonic. This uses workspace-scoped
STS credentials obtained from the API's list_workspaces endpoint.

Added recovery_key_s3_key() helper to compaction.rs for the mnemonic
backup storage path. PrivStackHandle gains cloud_dek_registry and
cloud_active_workspace fields for FFI state management.
…ion (1.8.1)

Three bugs fixed in the sync engine that caused all 20 E2E relay tests to fail:

1. Relay build path: e2e_relay_tests tried `cargo build -p privstack-relay`
   from the workspace root, but the relay is a standalone crate at relay/.
   Fixed to build from the relay directory directly.

2. Entity row creation in handle_local_event: The sync engine saved events to
   the EventStore but never created corresponding entity rows in the EntityStore.
   Since entities_needing_sync() queries the entities table, no entity rows meant
   nothing was ever detected for sync (all syncs completed with 0 events).
   Fixed by calling EventApplicator::apply_event() in handle_local_event so the
   sync engine is self-contained and works without the FFI layer pre-creating
   entity rows.

3. Stale SyncCompleted events from periodic no-op syncs: The initial periodic
   sync tick (Tokio intervals fire immediately) produced SyncStarted +
   SyncCompleted{0,0} events that polluted the event channel. Tests catching
   "any SyncCompleted" would match these stale events instead of the real sync
   result. Fixed by adding an `explicit` parameter to sync_with_peer — explicit
   syncs (from SyncWithPeer commands) always emit SyncCompleted, while periodic
   and discovery-triggered no-op syncs are silent. SyncStarted is now only
   emitted when there are actual entities to sync.

Result: 20/20 E2E relay tests pass, 337 FFI tests pass, all other sync tests
unaffected. One pre-existing adversarial network test failure
(concurrent_delete_same_entity_during_partition) remains — unrelated to these
changes.
The entity pre-load spawn_blocking task can be cancelled during
shutdown races (e.g. start/stop lifecycle tests). This is expected
behavior, not a panic. Use JoinError::is_cancelled() to distinguish
cancellation from actual panics and log at debug level accordingly.
Adds 84 adversarial tests across 5 new test files targeting the
security-critical cloud sync subsystem:

- dek_registry_tests: 11 tests for concurrent access, missing entity
  errors, overwrite semantics, and clone independence
- envelope_tests: 15 tests for wrong-key rejection, tampered
  ciphertext/nonce/ephemeral key detection, cross-recipient isolation,
  and serialization roundtrips
- crypto_adversarial_tests: 24 tests for single-bit tampering at every
  byte position, truncation, wrong-nonce, empty/large plaintext,
  cross-entity key isolation, and full batch pipeline verification
- credential_manager_tests: 16 tests for STS credential expiry boundary
  conditions, margin calculations, zero/large margins, and serialization
- outbox_adversarial_tests: 18 tests for event insertion ordering, solo
  and collab mode flush thresholds, collab cooldown persistence, buffer
  size accumulation accuracy, and empty buffer edge cases

All 180 cloud crate tests pass.
…(1.8.3)

The test step now manages docker compose lifecycle automatically:
starts MinIO + MySQL containers before tests and tears them down after.
When --persist is passed, containers and data are left running so you
can audit bucket contents via the MinIO console (localhost:9001) or
query MySQL directly (localhost:3307). Prints connection details and
the teardown command for convenience.
The minio-setup init container exits after creating the bucket, which
causes docker compose up --wait to return non-zero and silently kill
the script under set -euo pipefail. Now starts minio and mysql with
--wait first, then runs minio-setup separately with --rm.
The test shared an entity but never recorded an event in the stores,
so entities_needing_sync returned empty and the orchestrator emitted
SyncCompleted instead of SyncStarted. Added record_event_with_stores
call to match the pattern used by all other orchestrator sync tests.
…semantics

PersonalSyncPolicy::on_event_send allows all events when the
peer_entities map is empty (no selective sharing configured). The test
incorrectly expected empty results from a fresh policy. Updated to
first verify allow-all behavior, then activate selective sharing by
sharing a different entity, and verify the unshared entity is blocked.
Same issue as policy_store_tests: PersonalSyncPolicy allows all events
when the peer_entities map is empty. Share a different entity first to
activate selective sharing, then verify the unshared entity is blocked.
Add 3 integration test files and a shared helper module that exercise
the S3Transport, full encrypt-upload-download-decrypt pipeline, and
cross-system verification against a real MinIO instance started by
docker-compose.test.yml.

Tests cover: upload/download roundtrip, exists/list_keys, expired
credential rejection, overwrite semantics, large object (5MB)
transfers, batch/snapshot/blob key format roundtrips with real
ChaCha20-Poly1305 encryption, wrong-DEK failure, multi-entity
isolation, concurrent uploads, multi-device download, entity prefix
isolation, and batch ordering.

Also adds Express integration test step to build.sh and bumps
workspace version to 1.8.4.
Each test binary compiles its own copy of the support module, so
functions only used by some test files trigger false-positive
dead_code warnings. Adding #![allow(dead_code)] at module level.
MinIO rejects fake session tokens when authenticating with root
credentials. The AWS SDK includes an X-Amz-Security-Token header
whenever a non-empty session_token is set, and MinIO validates it
as an STS token (which fails). Using an empty string avoids the
header entirely.
Add protocol_e2e.rs with 7 integration tests exercising the complete
crypto+sharing protocol against real MinIO S3: envelope seal/open
roundtrip, multi-recipient independent decryption, DEK rotation on
revocation, bidirectional sync with shared DEK, blob shared access,
and key recovery via passphrase and BIP39 mnemonic. These tests
bridge the gap between unit-level crypto tests and full system
integration by proving the X25519 envelope encryption works
end-to-end through S3 transport with real serialization.
BIP39 12-word mnemonic-based master password recovery system that allows
users to regain access to their encrypted data without a full data wipe.

Rust core:
- privstack-crypto: RecoveryBlob type with create/open/reencrypt functions
  that encrypt the master key with a mnemonic-derived key
- privstack-vault: setup_recovery(), has_recovery(), and
  reset_password_with_recovery() methods on Vault and VaultManager, with
  full re-encryption of all vault blobs on password reset
- privstack-ffi: Three new FFI functions (setup_recovery, has_recovery,
  reset_with_recovery) with error codes RecoveryNotConfigured=34 and
  InvalidRecoveryMnemonic=35, including entity_store and blob_store
  re-encryption

C# desktop:
- Native bindings: P/Invoke declarations, IAuthService interface methods,
  and PrivStackService implementations for all three recovery operations
- EmergencyKitPdfService: QuestPDF-based A4 PDF generator with numbered
  word grid, security warnings, and recovery instructions
- Setup wizard: New EmergencyKit step after Password for new installs,
  displaying recovery words and requiring PDF download before proceeding
- Recovery flow: Two-step RecoveryViewModel (enter 12 words, set new
  password) with RecoveryView, wired into UnlockViewModel and App.axaml.cs
  navigation. Unlock screen shows conditional recovery link when configured
- Settings: Emergency Kit section in Security expander showing status
  indicator, generate/regenerate button, word display, and PDF download
Steven Melendez added 23 commits February 19, 2026 12:18
PluginSidebar used ThemeSurfaceRecessedBrush which is visually darker
than the main content area (ThemeBackgroundBrush), creating a jarring
contrast — especially in Lavender theme where the sidebar looked like
a separate darker panel and the content area looked like a floating
white page. Now both use the same background level for a seamless look.

UI.Adaptive 1.43.2 → 1.43.3, Desktop 1.45.9 → 1.45.10
Wrap the collapsed Info/Graph tab button in a transparent hit-test border
(info-tab-hover-zone). The button starts at Opacity 0 and fades to 1 on
pointerover with a 0.2s transition, keeping the right edge clean until
the user hovers near it.

Version bump: 1.45.10 → 1.45.11.
Add a transparent backdrop Border (ZIndex 9) behind the InfoPanel drawer
(ZIndex 10) that covers the full content area. When visible and clicked,
it calls InfoPanelVM.CloseCommand to dismiss the panel. The backdrop is
only visible when InfoPanelVM.IsOpen is true, which is already false on
Graph/Nexus views (controlled by IsInfoPanelAvailable), so the panel
cannot be opened there in the first place.

Users can now close the Info panel by: clicking the X button, clicking
the tab again, or clicking anywhere outside the panel.

Version bump: 1.45.11 → 1.45.12.
Phi-3 template was missing <|assistant|> and <|endoftext|> as
anti-prompts, so the executor didn't stop when the model emitted a
new turn boundary — causing it to loop and repeat the response.
Added <|start_header_id|> to Llama anti-prompts for the same reason.
The <|assistant|> token appears at the end of the prompt template, so
the executor matched it immediately and stopped before generating any
output. Removed it from anti-prompts — <|end|> is the correct stop
token for Phi-3. Leaked turn tokens are handled by the sanitizer.
Three-layer fix for the sync loop where a device's own changes were
being re-applied from the cloud indefinitely:

1. sync_engine poll_and_apply: filter out events where peer_id matches
   the local device_id, and advance the download cursor both locally
   and server-side via the new ack_download API after processing each
   entity's batches.

2. api_client: add ack_download method that POSTs to the new
   /api/cloud/cursors/ack endpoint with GREATEST() semantics.

3. FFI consume_inbound_events: defense-in-depth peer_id guard so own
   events that slip past the sync engine filter are also dropped before
   being applied to the local entity store.

Rust workspace 1.13.4 → 1.13.5, Desktop 1.45.13 → 1.45.14.
PluginSidebar: adds a 200ms CubicEaseOut width transition so
collapse/expand animates smoothly instead of snapping.

Theme files: adds ThemeTableDefaultColor string resource to all 7 themes
mapping each theme to an appropriate table color preset (Dark/Light →
Purple, Azure/Slate → Blue, Sage → Green, Lavender → Purple,
Ember → Orange). Plugins can read this resource to auto-match table
styling to the active app theme.

SDK/UI.Adaptive version 1.43.3 → 1.44.0.
Map sticky_note node type to the same ThemeSecondaryBrush as notes/pages
so they render with the correct color in the graph and neuron views.
Also includes Cargo.lock refresh and unused import cleanup in FFI cloud module.
The ShowNotes toggle in the graph view now also includes sticky_note
in the allowed node types, so sticky notes appear alongside pages
and wiki sources when the Notes filter is enabled.
Self-contained mini calendar date picker that displays a compact calendar
grid in a popup. Matches the Calendar plugin's sidebar mini-calendar style
with month navigation, today highlight, and selected-day ring. Exposes
SelectedDate (DateTimeOffset?), Watermark, and DateFormat properties for
two-way binding. Drop-in replacement for Avalonia's CalendarDatePicker.
Bumps SDK version to 1.45.0.
The calendar popup now inherits the width of the trigger button so
the dropdown looks uniform and aligned with the field it belongs to.
Add ConnectionId field to ConnectionInfo record and new multi-account
methods to IConnectionService: GetConnectionsAsync, GetConnectionByIdAsync,
GetAccessTokenByIdAsync, and GetConnectionsWithScopesAsync. Existing
single-connection methods remain unchanged for backward compatibility.
This enables Google/Microsoft OAuth connections to support multiple
accounts per provider. SDK version bumped to 1.46.0.
Create OAuthProviderConfig with combined scopes (Gmail + Calendar + identity
for Google, Outlook IMAP/SMTP + identity for Microsoft). Create
OAuthBrowserFlowService consolidating the PKCE loopback flow from the Email
plugin into a reusable shell service. Expand ConnectionService with multi-account
support: ConnectOAuthAsync orchestrates the full flow, ImportConnectionAsync
enables migration from plugin-level tokens, GetAccessTokenByIdAsync auto-refreshes
expired tokens with per-connection SemaphoreSlim concurrency control,
GetConnectionsWithScopesAsync filters by required scopes. Register
OAuthBrowserFlowService in DI. Desktop version bumped to 1.46.0.
Expand ConnectionsViewModel with Google/Microsoft connection management:
ObservableCollection of OAuthConnectionItem for each provider, connect/disconnect
commands, scope summarization (Gmail, Calendar, Outlook). Add Google and Microsoft
sections to SettingsPanel.axaml with connected accounts list showing email, scope
summary, connected date, and disconnect button per account. Both sections support
multiple accounts with connecting state indicators.
Add ImportConnectionAsync method to the SDK IConnectionService interface,
allowing plugins to migrate existing refresh tokens to shell-level
connections during the transition from plugin-managed to shell-managed OAuth.
Introduces IConnectionConsumer and ConnectionRequirement types that allow plugins to declare which OAuth providers they require. The shell uses this to conditionally show connection sections in Settings, keeping the UI clean when no plugins need a particular provider.
ConnectionsViewModel now queries IConnectionConsumer capability providers to determine which OAuth sections to show. Google and Microsoft sections are hidden when no active plugin declares a need for those providers. An empty state message is shown when no plugins require OAuth connections.
Replaces inline device flow UI with a centered modal dialog featuring
Open GitHub, Copy (to clipboard), and Cancel buttons. GitHub connection
section now only appears when active plugins declare IConnectionConsumer
with provider "github". Adds IsGitHubRequired, IsDeviceFlowModalOpen,
and CodeCopied properties to ConnectionsViewModel.
Replaces the plain text-based connection rows with card-style buttons
featuring actual brand logos (GitHub Octicon, Google 4-color G, Microsoft
4-square). Each card shows the provider logo, name, and connection status.
Connected accounts appear as detail rows below the cards with disconnect
actions. Adds GitHub and Microsoft brand colors to all 7 themes.
- Changed provider cards from 3-column grid to vertical stacked rows
  with horizontal layout (icon left, text center, action right)
- Added themed rounded background to GitHub logo (dark bg in light
  mode, light bg in dark mode using ThemeGitHubBrandBrush/SurfaceBrush)
- Added TextWrapping=Wrap to settings-section-subtitle style to
  prevent text from escaping bounding boxes
- All card text now wraps properly within bounds
…undant action

- Added HorizontalAlignment=Stretch to all card buttons for full-width rows
- Removed redundant "Connect" action text from GitHub card (clicking the
  card itself triggers the connection)
- Fixed Google/Microsoft always showing "Connected" — ObjectConverters.Equal
  compared int Count to string "0" which never matched. Added IsGoogleConnected
  and IsMicrosoftConnected bool properties set from LoadXxxConnections() instead
- Removed unused "Connect" action text from Google/Microsoft cards (kept
  only the connecting spinner)
Replace hardcoded Google, Microsoft, and GitHub OAuth client IDs and
secrets with Environment.GetEnvironmentVariable() reads. Add .env.example
documenting the required variables. Update .gitignore to allow .env.example
while keeping .env ignored. This eliminates secret exposure in source control
and unblocks GitHub push protection.

Bump version: 1.46.2 → 1.46.3
Dependabot couldn't find the original pull request head commit, 89a059f.
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Feb 19, 2026

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot dependabot bot deleted the dependabot/cargo/core/zip-6.0.0 branch February 19, 2026 23:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

Comments