06/07 - Daily Promotion by subrata71 · Pull Request #41946 · appsmithorg/appsmith

subrata71 · 2026-07-03T13:13:11Z

Summary

Batch security update via resolutions/version bumps.

Resolved alerts

Resolves [BUG] 'type' field once selected, no more remains an optional field. #674 — http-proxy-middleware → 2.0.10 (resolution for transitive dep)

Skipped alerts

Release v1.2.6 #676 echarts — inconclusive relationship, cannot safely classify
Fix previous name showing up in toast #675 js-yaml — inconclusive relationship, cannot safely classify
[BUG] Receiving different results on Safari, Firefox with App Link. #654 @opentelemetry/core — major version bump required (1.x → 2.x), skipped per policy

No code changes — resolutions only.

/ok-to-test tags="@tag.All"

Warning

Tests have not run on the HEAD 477e66c yet

Sun, 05 Jul 2026 23:57:17 UTC

Description

Tip

Add a TL;DR when the description is longer than 500 words or extremely technical (helps the content, marketing, and DevRel team).

Please also include relevant motivation and context. List any dependencies that are required for this change. Add links to Notion, Figma or any other documents that might be relevant to the PR.

Fixes #Issue Number
or
Fixes Issue URL

Warning

If no issue exists, please create an issue first, and check with the maintainers if the issue is valid.

Automation

/ok-to-test tags=""

🔍 Cypress test results

Caution

If you modify the content in this section, you are likely to disrupt the CI result for your PR.

Communication

Should the DevRel and Marketing teams inform users about this change?

Yes
No

## Summary Batch security update via resolutions/version bumps. ### Resolved alerts - Resolves #674 — http-proxy-middleware → 2.0.10 (resolution for transitive dep) ### Skipped alerts - #676 echarts — inconclusive relationship, cannot safely classify - #675 js-yaml — inconclusive relationship, cannot safely classify - #654 @opentelemetry/core — major version bump required (1.x → 2.x), skipped per policy No code changes — resolutions only. /ok-to-test tags="@tag.All"  > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/28616052793> > Commit: fda0f5d > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=28616052793&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.All` > Spec: > <hr>Thu, 02 Jul 2026 20:36:48 UTC  Co-authored-by: appsmith-smithes[bot] <appsmith-smithes[bot]@users.noreply.github.com>

coderabbitai · 2026-07-03T13:13:21Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (2)

pg
release

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: fac435ca-b61a-4cdd-9f98-bcb39762b3a3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch release

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

…ation (#41940) ## Description Importing or connecting an Appsmith app to a self-hosted Git repository over SSH failed with a misleading **"SSH key misconfiguration"** banner (`AE-GIT-4032`) when the remote repository had **no default branch** (no checkout-able `HEAD`) — even though the SSH key was valid and the handshake succeeded. **Root cause:** JGit's `CloneCommand` throws a `TransportException` with message `Remote branch 'HEAD' not found in upstream origin` when the cloned repo has no default branch. Both `fetchRemoteRepository` overloads in `GitFSServiceCEImpl` blanket-mapped **any** `TransportException` to `AppsmithError.INVALID_GIT_SSH_CONFIGURATION`, so this case was reported as an SSH key problem and sent users down the wrong troubleshooting path (rotating deploy keys) instead of setting a default branch. **Fix (backend-only):** - Added `AppsmithError.GIT_DEFAULT_BRANCH_NOT_FOUND` (`AE-GIT-4052`) with an actionable message: _"Couldn't find a default branch in the remote repository. Set a default branch (for example main or master) in your Git provider's repository settings, then try again."_ - Added a `isRemoteDefaultBranchMissing(Throwable)` helper that walks the cause chain and matches the stable substring `not found in upstream`, routing that case to the new error in **both** `fetchRemoteRepository` overloads (import flow and connect-existing-app flow). Genuine SSH auth failures still map to `INVALID_GIT_SSH_CONFIGURATION`. - **No frontend change required:** the deploy-key step already renders any non-`AE-GIT-4032`/`4033` backend error message in its generic error callout. Added `GitFSServiceCEImplTest` with unit coverage for the helper (matching message, cause-chain nesting, case-insensitivity, auth-failure negative, other "not found" negative, null message). Fixes #41938 ## Automation /ok-to-test tags="@tag.All" ### 🔍 Cypress test results  > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/28546840957> > Commit: 5c9b832 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=28546840957&attempt=2" target="_blank">Cypress dashboard</a>. > Tags: `@tag.All` > Spec: > <hr>Wed, 01 Jul 2026 22:02:27 UTC  ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [x] No 🤖 Generated with [Claude Code](https://claude.com/claude-code)  ## Summary by CodeRabbit * **Bug Fixes** * Improved Git import/clone error handling to detect when a remote default branch is missing, instead of treating it as an SSH configuration problem. * Added a clearer, dedicated error for “No default branch found” when the remote repository’s default branch can’t be determined. * **Tests** * Added unit test coverage for identifying the missing-remote-default-branch scenario across direct and nested exception messages, including case-insensitive matching.  --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

) (#41920) ## Description Adds a **"Copy to application"** right-click option on actions (APIs/queries) and JS objects in the editor entity explorer. It opens a modal to pick a target **Workspace → Application → Page** (filtered to ones the user can edit) and copies the entity there. **TL;DR** — Reuses the existing partial export/import endpoints, so there are **no server changes**. The client exports the single entity via the partial-export endpoint, wraps the returned `ApplicationJson` as an in-memory `File`, and imports it into the chosen target via the partial-import endpoint. Datasource reconciliation and name-collision refactoring are handled server-side by the import. The user stays in the current editor and sees a success toast. ### Notable choices - Target-workspace applications are fetched into a dedicated `ui.copyEntityToApp` redux slice rather than `ui.selectedWorkspace.applications` (which reflects the current editor's workspace and must not be clobbered mid-session). - The orchestration saga lives in `ce/sagas` with an `ee/` passthrough stub for an EE override seam (git-branched apps), matching the `NavigationSagas` convention. - Client-side permission filtering is UX-only; the server re-authorizes every target id (`MANAGE_PAGES` on the page, edit on the app/workspace). ### Known v1 limitations (surfaced in the modal via an info callout) - Copying a JS object does not auto-include the separate API/query actions it references by name. - Datasource credentials are not copied — the target reuses a datasource by name or creates a new unconfigured one. Fixes #41919 ## Automation /ok-to-test tags="@tag.All" ### 🔍 Cypress test results  > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/28448843507> > Commit: 580f4f8 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=28448843507&attempt=2" target="_blank">Cypress dashboard</a>. > Tags: `@tag.All` > Spec: > <hr>Thu, 02 Jul 2026 14:02:09 UTC  ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [x] No  ## Summary by CodeRabbit * **New Features** * Added “Copy to application” context menu options for both actions and JS objects. * Introduced a “Copy to application” modal to select a target workspace, application, and page. * Enabled cross-app copy with success/error notifications, including loading of eligible target applications and pages. * **Backend Improvements** * Improved name collision handling during partial imports by generating unique names for imported entities. * **Tests** * Added unit and UI tests for the modal, reducer state, saga export/import flow, and context-menu dispatch for both copy paths.  --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…e#9229) (#41933) ## Description Ports the **CE-safe subset** of the EE "revive Anvil" PR (appsmith-ee#9229) into CE so the hourly CE→EE sync carries these shared-file changes upstream and the EE PR merges with fewer conflicts. > [!TIP] > **TL;DR:** All changes are gated behind Anvil feature flags or are inert-by-default. Existing classic (FIXED/AUTO) UI is unaffected. This is a sync-enablement change, not a user-facing feature toggle. **Highlights:** - **Widget loader registry split:** new `widgets/registry.ts` (SCC-free loader registry) populated via an `import "widgets"` side effect at bootstrap (`src/index.tsx`, eval worker, `test/testCommon.ts`). `EvaluationsSaga` and `EditorUtils` now resolve loaders from `widgets/registry`. The four EE-only WDS widget loaders are intentionally omitted from `widgets/index.ts`. - **Feature flags (additive, matches the EE PR as-is):** keep `release_anvil_enabled`, add `license_anvil_enabled` to `ce/entities/FeatureFlag.ts` and `FeatureFlagEnum.java`. - **Applications/Anvil wiring:** app-card-list wiring (`ce/pages/Applications`), `layoutSystemType` plumbing through `WorkspaceAction`/`ApplicationSagas`, `Severity.DEBUG` revival, `BindDataButton` `WDS_TABLE_WIDGET` case, and assorted shared-file changes applied byte-identical to EE for a clean sync. **Scope note:** EE-path files (`app/client/src/ee/**`) cannot be modified in a CE PR (enforced by the pre-push hook), so the new `ee/` stubs/mirrors and the five shared files that depend on them (`AppViewer`, `AppPage`, `Canvas`, `WDSThemePropertyPane`, `ApplicationCard`) are **not** included here. Those already exist in the EE PR; the CE-side `ee/` stubs arrive via the CE↔EE sync. **Also intentionally not ported:** design-system `Markdown.tsx`/`types.ts` (CE's Markdown is structurally divergent), `ee/widgets/wds/constants.ts` (EE-owned), and `cypress_ci_custom.config.ts` (divergent CI tuning). **Verification:** client `check-types`, ESLint, Prettier, and server `spotless:check` all pass on the included files. Related: appsmith-ee#9229 > [!NOTE] > No standalone CE issue — this PR exists to keep the CE↔EE shared-file sync clean ahead of the EE Anvil revival merge. ## Automation /ok-to-test tags="@tag.All" ### 🔍 Cypress test results  > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/28452962986> > Commit: e3c729b > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=28452962986&attempt=3" target="_blank">Cypress dashboard</a>. > Tags: `@tag.All` > Spec: > <hr>Wed, 01 Jul 2026 14:51:09 UTC  ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [x] No  ## Summary by CodeRabbit * **New Features** * Added support for Anvil apps in the Applications page, including a new section label, empty state, and create-new-app flow. * Expanded widget support so more WDS widgets appear in the editor and can be bound more consistently. * Added a new debug severity display in the console and debugger. * **Bug Fixes** * Improved feature-flag handling so selected flags can be merged without losing other existing flags. * Updated layout handling so Anvil-specific behavior is only shown when the required flags are enabled.  Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…E fixes (#41928) ## Summary Remediates reachable High CVEs in the Spring server via two dependency bumps. | Change | Version | CVE(s) | Reachability | |---|---|---|---| | spring-boot-starter-parent | 3.5.12 → 3.5.14 | CVE-2026-40973 (insecure multipart temp file) | Affected — authenticated upload path | | Netty (BOM override) | 4.1.131 → 4.1.135.Final | CVE-2026-33870, CVE-2026-42583 | Affected — request-handling path behind Caddy | | Netty (same bump, additional) | 4.1.131 → 4.1.135.Final | CVE-2026-44249, 45416, 50010 (netty-handler); 45674, 47691 (netty-resolver-dns); 42584, 42587, 42579, 33871 (codec/http2/dns) | Newly disclosed / not_affected — cleared for free | ### Why the Netty property override Spring Boot 3.5.14's BOM manages Netty `4.1.132.Final`, which is still vulnerable. `<netty.version>4.1.135.Final</netty.version>` is the canonical property the `spring-boot-dependencies` BOM consumes, so it bumps all `io.netty:*` artifacts consistently. There is no competing `netty-bom` import or direct Netty pin in the server tree. ## Validation - `mvn help:evaluate` confirms effective versions: `netty.version=4.1.135.Final`, parent `3.5.14`. - `appsmith-server` POM resolves/parses (BUILD SUCCESS). - No hardcoded Netty pin elsewhere downgrades or bypasses the override. ## CI Trigger /ok-to-test tags="@tag.All" ## Test plan - [ ] CI green - [ ] Server boots; an HTTP-backed plugin action executes (Netty/WebFlux path) - [ ] No dependency-convergence/enforcer breakage 🤖 Generated with [Claude Code](https://claude.com/claude-code)  ## Summary by CodeRabbit * **Chores** * Updated the server platform to a newer Spring Boot release. * Centralized the Netty version used by the server build. * Removed an outdated version-specific note from a plugin configuration comment.   > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/28471068281> > Commit: 9102e65 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=28471068281&attempt=4" target="_blank">Cypress dashboard</a>. > Tags: `@tag.All` > Spec: > <hr>Wed, 01 Jul 2026 14:37:32 UTC  Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

github-actions · 2026-07-03T18:52:09Z

Failed server tests

com.appsmith.server.imports.internal.ImportServiceTests#importArtifact_withoutActionCollection_succeedsWithoutError

…41947) ## Summary Remediates 17 CRITICAL/HIGH CVEs (57 scanner findings) detected by scanning the `appsmith/appsmith-ee:release` Docker image (digest `597f187a`). All fixes are same-major dependency pins — no code changes. | Dependency | Change | CVEs | |---|---|---| | spring-boot-starter-parent | 3.5.12 → 3.5.14 | CVE-2026-40973 | | jackson-bom / jackson | 2.17.0 → 2.18.8 | CVE-2026-54512, CVE-2026-54513 | | netty (pinned over Boot BOM) | → 4.1.135.Final | CVE-2026-42583, CVE-2026-42579, CVE-2026-42584, CVE-2026-42587, CVE-2026-33870, CVE-2026-33871, CVE-2026-44249, CVE-2026-45416, CVE-2026-50010, CVE-2026-45674, CVE-2026-47691 | | commons-io (dependencyManagement) | → 2.20.0 | CVE-2024-47554 (transitive via databricks-sdk-java) | | plexus-utils (dependencyManagement) | → 3.6.1 | CVE-2025-67030 | | aws-java-sdk (amazons3Plugin, awsLambdaPlugin) | 1.12.261 / 1.12.622 → 1.12.797 | CVE-2024-21634 (drops unpatched `software.amazon.ion:ion-java` entirely) | ### Verification - `mvn clean install -DskipTests` passes on this branch (CE) and on EE with this commit cherry-picked (sync simulation applied cleanly — no conflicts). - Trivy re-scan of the built server + all plugin jars (CE and EE builds) confirms every targeted CVE is gone. Remaining findings are all known non-actionable: `com.appsmith:*` self-advisories (already handled via GHSA lifecycle), `mssql-jdbc` (false positive — installed `11.2.4.jre11` **is** the patched version; scanner drops the `.jre11` suffix), `ini4j` (no fixed version exists upstream), and jackson 2.16.0 shaded **inside** the `databricks-jdbc` fat jar (not resolvable via Maven; needs a databricks-jdbc 2.6.40 → 2.7.x bump, deferred as a separate follow-up). - `mvn spotless:check` clean; pre-commit hooks passed. ### Out of scope (image-level, tracked separately) Keycloak jars (`opt/keycloak/**`), Temporal go binaries (`opt/temporal/**`), Node's bundled `undici`, and RTS `nodemailer` (major bump) — these are not fixable from this repo's poms. ## Automation /ok-to-test tags="@tag.All"  > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/28682481837> > Commit: 06ae9cc > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=28682481837&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.All` > Spec: > <hr>Fri, 03 Jul 2026 21:42:23 UTC   ## Summary by CodeRabbit * **Bug Fixes** * Updated several bundled library versions to address known security vulnerabilities. * Improved dependency consistency across the app to reduce the risk of runtime issues caused by outdated transitive packages.

…LOBSTAR (fixes storybook) (#41949) ## Problem `storybook-tests` fails. There are two independent layers, both fixed here. ### Layer 1 — `GLOBSTAR` build failure The Storybook preview build fails with: `SyntaxError: The requested module 'minimatch' does not provide an export named 'GLOBSTAR'` **Root cause:** the `resolutions` block in `app/client/package.json` had an over-broad blanket `"minimatch": "^5.1.8"` that force-downgraded *every* minimatch to 5.x — including `glob@10` / `glob@11` (ESM), which require minimatch 9/10 for the `GLOBSTAR` named export. **Fix:** replaced the blanket with the specific `minimatch@^3.x -> ^5.1.8` pins (the CVE-2022-3517 ReDoS remediation, including the exact `3.0.4` consumer). Resulting resolution: - `glob@11 -> minimatch 10.2.5`, `glob@10 -> 9.0.9` (GLOBSTAR export present) - `glob 7/8 -> 5.1.9` (unchanged) - all minimatch `>= 3.0.5` (no CVE regression — a bare blanket removal would have reintroduced vulnerable `3.0.4`, which these pins prevent) ### Layer 2 — test-runner OOM Once the build works, `test-storybook:ci` runs the Jest + Playwright test-runner, which exceeds Node's ~2GB default old-space heap and dies with `JavaScript heap out of memory` (exit 129). Added `NODE_OPTIONS=--max-old-space-size=8192` to the Storybook Tests step. ## Verification (local, Node 24) - `yarn install --immutable` clean - Resolved minimatch all `>= 3.0.5` (no vulnerable version) - Storybook builds clean (no `GLOBSTAR` error), `storybook-static` artifact produced - `glob 7/8` (used by the webpack client build) unchanged, so the client build is unaffected ## Context The identical fix landed in the EE repo (`appsmith-ee`) to unblock its CI; the blanket resolution is identical in CE, so CE's Storybook is broken the same way. Landing it here makes the fix durable (the CE->EE sync converges the two) and fixes CE's own Storybook. **Merge with a merge commit — do not squash** (preserves CE<->EE sync history). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Automation /ok-to-test tags="@tag.All"  ## Summary by CodeRabbit * **Chores** * Increased the memory limit for Storybook tests in CI to help them run more reliably. * Updated dependency resolution settings to keep compatible versions of a transitive package pinned consistently.   > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/28718473128> > Commit: 9fc1f09 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=28718473128&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.All` > Spec: > <hr>Sat, 04 Jul 2026 21:26:14 UTC  --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

subrata71 self-assigned this Jul 3, 2026

yatinappsmith changed the title ~~Daily Promotion for 6th July~~ 06/07 - Daily Promotion Jul 3, 2026

yatinappsmith self-requested a review July 3, 2026 13:38

sebastianiv21 requested a review from a team as a code owner July 3, 2026 14:03

salevine and others added 3 commits July 3, 2026 10:49

sebastianiv21 requested a review from sharat87 as a code owner July 3, 2026 18:27

sebastianiv21 approved these changes Jul 5, 2026

View reviewed changes

yatinappsmith approved these changes Jul 6, 2026

View reviewed changes

subrata71 enabled auto-merge July 6, 2026 06:36

subrata71 merged commit 26fe7c1 into master Jul 6, 2026
91 of 95 checks passed

Navigation Menu

Uh oh!

06/07 - Daily Promotion - #41946

06/07 - Daily Promotion#41946
subrata71 merged 7 commits into
masterfrom
release

subrata71 commented Jul 3, 2026 •

edited by github-actions Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 3, 2026 •

edited

Loading

Review skipped

Uh oh!

github-actions Bot commented Jul 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

subrata71 commented Jul 3, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Resolved alerts

Skipped alerts

Description

Automation

🔍 Cypress test results

Communication

Uh oh!

coderabbitai Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

github-actions Bot commented Jul 3, 2026

Failed server tests

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

subrata71 commented Jul 3, 2026 •

edited by github-actions Bot

Loading

coderabbitai Bot commented Jul 3, 2026 •

edited

Loading