Conversation
…test-timeout-pr-20260824 test(ci): allow Angular suites time under load
…cription-change MN-C05: Re-subscribe when the browser rotates push registration
…r-median-current-date-20260824 fix(ppi): stop demo peer median at the current date
…k-secret-leak-20260824 fix(auth): scrub callback credentials before telemetry
…-mvp-validation-20260826
…tion/ontrack-mvp-validation-20260826 # Conflicts: # src/app/units/states/edit/directives/unit-tasks-editor/unit-task-editor.component.html
… into integration/ontrack-mvp-validation-20260826 # Conflicts: # src/app/api/services/peer-progress.service.ts # src/app/visualisations/progress-burndown-chart/progress-burndown-chart.component.html
…gration/ontrack-mvp-validation-20260826
…toolchain-pr-20260824 chore(toolchain): align nvm with supported Node 22
The compare call 404s once a source or target branch is deleted, and with set -euo pipefail that fails the whole weekly job instead of skipping the entry. Check both refs exist first and exit 0 when either is missing.
@angular/build, @angular/cli and ngx-monaco-editor-v2-alternative were pinned to exact versions. In a change whose purpose is remediating audit findings that is the wrong direction: it stops the next patch release arriving and stops a later npm audit fix from taking it, and @angular/build is one of the packages carrying an advisory on the base branch. Restored as ^22.0.9, ^22.0.9 and ^22.0.0. The resolved versions in the lockfile are unchanged and still satisfy the ranges, so nothing is upgraded here. The root declaration in package-lock.json is updated to match, which is what npm ci compares against. The exact dompurify pin inside overrides is deliberate and is left alone. npm audit on origin/11.0.x: 12 total, 4 high, 5 moderate, 3 low. npm audit with this branch: 0.
…y-integration-prs-20260826 ci: add weekly integration PR automation
…on-submission-only-20260826 fix: only reset dashboard after completed submission
project-dashboard.component.spec.ts came out as add/add. 11.0.x gained one via #96 covering task selection, this branch has one covering route reuse. Kept both, the describe names were already distinct. The merge also broke the build in a way neither side could see on its own. #96 added taskService as the third constructor parameter of ProjectDashboardComponent, and this branch's spec constructs the component directly rather than through TestBed, so all three call sites were passing six arguments to a seven argument constructor: TS2554: Expected 7 arguments, but got 6. An argument for 'breakpointObserver' was not provided. Added a TaskService stub in third position at each of them. It only needs taskSubmissionCompleted$, since that is the one member ngOnInit subscribes to, so a bare Subject is enough and the tests stay about routing. ng test --include **/project-dashboard.component.spec.ts: 6 passed.
…260824 fix(deps): resolve inherited npm audit findings
….x-all-features-20260824 release(web): OnTrack 11.0.x all-features handover
…-mvp-20260827 # Conflicts: # src/app/projects/states/dashboard/project-dashboard/project-dashboard.component.spec.ts
The target grade selector lost its static disabled attribute, so it was live for anyone viewing the dashboard, staff included, and the API permits the change because tutors hold :change on a project. The component already computes viewingOtherStudentProject, so the guard uses that. The Task Planner carried the same unguarded selector and now matches. Deselecting had moved into applyFilters, which is bound to the search box, so every keystroke closed the open task and rewrote the URL, losing an unsent comment with it. It now only deselects when the open task has gone or a view filter hides it. Hiding tasks above the target grade is counted by the filter badge, and a task with unread comments stays visible the way the hide-completed filter already allows, so tutor feedback cannot disappear behind the new default.
Swapping first() for takeUntil made the subscription permanent, which is what unit switching needs. It also meant every emission re-ran activateProject, which resets projectReady and clears the selected task. The portfolios progress tab re-emits on every change detection pass, because its taskSelectionUrlBase getter returned a new array each call and ngOnChanges pushed into the project subject unconditionally. The tab reset itself continuously. activateProject now returns early when the project is already the active one, the url base is memoised, and ngOnChanges only pushes when the project input actually changed.
contrastingTextColor left the always-rendered Awaiting Feedback card at 4.44:1, under the 4.5:1 AA wants for normal text. The dark foreground moves to #000000 and the dark-contrast divisor now matches it. The hidden-series legend pill fell to 2.97:1 while still being an interactive control, which misses the 3:1 in 1.4.11. It uses an explicit dimmed state rather than an opacity. Hiding a series zeroed its values instead of removing it, so the pill read as off while the chart still drew the entry. Hidden series are filtered out of the data. The clipping guard asserted a removed class string, so it could not fail for the right reason. It reads computed maxHeight and overflow instead.
…-http-comment-safety fix(web): routing, http and comment safety
…dmin-screens fix(web): staff and admin screens
…omments-session fix(web): inbox, comments and UX fixes (audit round 5)
…dation feat(theme): theme foundation, system detection, persistence and no-flash startup
feat(notifications): explain notification actions and link settings
…and_yarn/js-yaml-4.3.2 chore(deps-dev): bump js-yaml from 4.3.1 to 4.3.2
refactor: replace flex-layout with tailwindcss in unit dropdown
refactor: replace flex-layout with tailwindcss in task inbox
refactor: replace MediaObserver in global state service
…le-form refactor: replace flex-layout with tailwindcss in edit profile form
refactor: replace flex-layout with tailwindcss in audio player
refactor: replace flex-layout with tailwindcss in admin users
refactor: replace flex-layout with tailwindcss in header
refactor: replace flex-layout with tailwindcss in edit profile
…endar-2026-09 feat(calendar): land CAL-F07, F08, F09 and PR-CAL-14 on 11.0.x
FEPERF-20: Optimise comment cache reconciliation
…ixed-20260914 fix(a11y): label the task badges used by students
Both unit dropdowns bound [value] on the select, but their options are created later by @for, so the browser kept the first option selected. A staff member managing two units could see SIT111 in Manage updates while saves went to SIT222, and the filter showed All my units for ?unit=222. Mark the matching option as selected and add a regression spec that holds the reload open until the options re-render. Also open a Teams draft for a session saved without a description. The API returns null for it, which the plain text check rejected as too long.
…nnouncements-sessions feat: centralize unit updates, Teams meetings and study essentials
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Any italic text should be deleted from the final Pull Request text, including this line
Description
Updates the
qsdependency to a patched version to address Dependabot security alerts.This resolves reported vulnerabilities involving:
isBufferhandlingThe update is limited to the dependency lockfile and does not introduce application feature changes.
Fixes # (issue)
Type of change
Please delete options that are not relevant.
How Has This Been Tested?
The dependency update was verified by running:
npm.cmd run typechecknpm.cmd run lintnpm.cmd run test:ciThe installed
qsversion was also verified using:npm.cmd ls qsTesting Checklist:
Checklist: