From f4b5bb6f4995b69f03500abb88a46756996046ca Mon Sep 17 00:00:00 2001 From: linusdevx Date: Tue, 23 Jun 2026 00:06:58 +0530 Subject: [PATCH 1/3] chore(dependabot): target dev, ignore major bumps MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit After enabling Dependabot, it immediately opened 8 PRs against main — including several cross-major bumps (vite 6→8, checkout 4→7, etc.) that need human review and would have skipped the normal dev → main flow. - target-branch: dev — PRs go through dev like any other change - ignore semver-major — automated PRs are patch/minor only; majors are reviewed by a human when needed - Security advisories still open PRs regardless of these ignore rules --- .github/dependabot.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index a5a5203..2d50b87 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -2,8 +2,10 @@ version: 2 updates: # Dev dependencies — Playwright, Vite, http-server, esbuild. # No runtime npm deps ship to users, so these are dev-tool hygiene only. + # PRs target `dev` so they flow through the normal dev → main review cycle. - package-ecosystem: npm directory: / + target-branch: dev schedule: interval: weekly day: monday @@ -17,10 +19,17 @@ updates: update-types: - minor - patch + # Major bumps are reviewed by a human as needed (vite, playwright, etc.). + # Security advisories still open PRs regardless of these ignore rules. + ignore: + - dependency-name: "*" + update-types: + - version-update:semver-major # GitHub Actions used by our workflows (checkout, setup-node, codeql, scorecard, ...). - package-ecosystem: github-actions directory: / + target-branch: dev schedule: interval: weekly day: monday @@ -33,3 +42,7 @@ updates: update-types: - minor - patch + ignore: + - dependency-name: "*" + update-types: + - version-update:semver-major From f211c81a8ac084f4900f416a6285fcd17606bb97 Mon Sep 17 00:00:00 2001 From: linusdevx Date: Tue, 23 Jun 2026 07:59:01 +0530 Subject: [PATCH 2/3] fix(editor): handle --!> when stripping XML comment markers MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The toggle-comment command stripped --> but not --!>, the rare-but-legal HTML comment-end-bang form. Browsers (and the HTML spec) treat both as valid comment terminators; toggling-off a buffer that used the bang form would leave a stray --!> on the line. Side benefit: closes CodeQL alert #1 (js/bad-tag-filter) on this line. The alert was technically a false positive — the regex output is fed into Monaco's text buffer, never rendered as HTML — but the underlying incompleteness was real, so it's worth fixing rather than dismissing. --- js/editor.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/js/editor.js b/js/editor.js index 9262cdc..8218d0a 100644 --- a/js/editor.js +++ b/js/editor.js @@ -270,7 +270,8 @@ require(['vs/editor/editor.main'], () => { if (allCommented) { for (let i = startLine; i <= endLine; i++) { const line = model.getLineContent(i); - const stripped = line.replace(/^(\s*)(\s*)$/, '$1'); + // --!?> matches both --> and --!>; the latter is rare but legal per the HTML spec. + const stripped = line.replace(/^(\s*)