Skip to content

chore: bump Ketesa to 1.3.0; 1.155.0:0 → 1.155.0:1 - #79

Merged
helix-nine merged 8 commits into
masterfrom
next
Jul 21, 2026
Merged

chore: bump Ketesa to 1.3.0; 1.155.0:0 → 1.155.0:1#79
helix-nine merged 8 commits into
masterfrom
next

Conversation

@helix-nine

Copy link
Copy Markdown
Contributor

Summary

Bumps the bundled Admin Dashboard (Ketesa) from v1.2.1 → v1.3.0. Synapse itself is unchanged at 1.155.0, so the StartOS version goes 1.155.0:0 → 1.155.0:1.

Ketesa is downloaded as a release tarball at build time and served by the package's own nginx sidecar — not run as a container — so this is a Makefile SYNAPSE_ADMIN_VERSION + SYNAPSE_ADMIN_CHECKSUM change.

Changes

  • Makefile: SYNAPSE_ADMIN_VERSIONv1.3.0, SYNAPSE_ADMIN_CHECKSUM → SHA-256 of the new ketesa.tar.gz (ad241735…801c3).
  • startos/versions/current.ts: version1.155.0:1, release notes rewritten (all locales) to describe the Ketesa bump. In-place edit — no new migration, existing create-admin-user clear-task migration carried forward.
  • package-lock.json: npm update (no start-sdk bump — already at latest 1.5.3).

Ketesa 1.3.0 highlights

  • Security: fixed an XSS hole when opening media — only real image types open in a tab; everything else (SVG included) downloads instead.
  • Bugfix: editing a non-MAS user could trigger an accidental GDPR erase.
  • Safety: deactivate / delete / erase user actions now confirm first.
  • New "Reported users" queue in the sidebar; better Matrix Authentication Service (MAS) user management.

Full upstream notes: https://github.com/etkecc/ketesa/releases/tag/v1.3.0

Test plan

  • npm run check (tsc) green.
  • make build verification (PR review).

MattDHill and others added 6 commits July 6, 2026 09:42
…h loopback example

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PpJxhk25X42WTafMdkUx6t
Bumps @start9labs/start-sdk 2.0.1 -> 2.0.3 (dependency and lockfile only).

- 2.0.3 fixes a dependency-gated daemon wedging permanently after its
  dependency's readiness flaps: Daemon.term() unconditionally destroyed the
  daemon's SubContainer, so the next start() threw "already destroyed" and the
  daemon never recovered. Adds a non-destroying Daemon.stop() for
  dependency-driven pauses, and serializes pause/resume transitions.
- 2.0.2 runs s9pk.mk's check-deps before packing, not just before install.

No packaging API changed between 2.0.1 and 2.0.3, so no source changes were
needed. Verified with `npm run check` (tsc --noEmit).
Bumps @start9labs/start-sdk 2.0.3 -> 2.0.5 (dependency and lockfile only).

2.0.5 fixes ExVer range operations ignoring the downstream revision:
compareVersionRangePoints and adjacentVersionRangePoints compared the upstream
twice, so two points sharing an upstream but differing downstream (1.0.0:3 vs
1.0.0:15) collapsed into one. normalize() then dropped the lower of the two,
which made packed manifests advertise a canMigrateFrom/canMigrateTo range
narrower than the truth for any package whose `other` versions share current's
upstream. No upgrade path actually broke — StartOS resolves migrations through
the version graph rather than this field — but the manifests were wrong.

No packaging API changed, so no source changes were needed. Verified with
`npm run check` (tsc --noEmit).
Upstream version bump. Pins the image/build to v1.156.0 and moves the package
version 1.155.0:1 → 1.156.0:0. Release notes rewritten for the new version in all five
locales from the actual upstream release notes.

The upstream artifact was verified to exist before pinning (image manifest /
release asset resolved), not inferred from a release listing.

Verified with `npm run check` (tsc --noEmit).
Bumps @start9labs/start-sdk 2.0.5 -> 2.0.6 (dependency and lockfile only).

2.0.6 fixes s9pk.mk failing under `make` in a git repo with no index yet: it
listed $(GIT_DIR)/index as an unconditional prerequisite, but `git init` creates
no index until the first `git add`, so a freshly scaffolded package aborted with
"No rule to make target '.git/index'" before packing. GIT_DEPS now filters
through $(wildcard ...), so a missing HEAD or index drops out of the prerequisite
list instead of halting the build (s9pk pack already handles a commit-less repo).
Build plumbing only.

No packaging API changed, so no source changes were needed. Verified with
`npm run check` (tsc --noEmit).
@helix-nine
helix-nine merged commit 39bb978 into master Jul 21, 2026
3 checks passed
@helix-nine

Copy link
Copy Markdown
Contributor Author

Thanks for the review and merge, @MattDHill. Ketesa 1.3.0 and the 1.155.0:1 revision are in on master.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants