chore(release): promote release to master - #42227
Merged
Merged
Conversation
…ins (#42177) ## Description The Anthropic, OpenAI, and Google AI plugins, and the Google Sheets trigger path, built their outbound HTTP clients with raw `WebClient.builder()`, skipping the SSRF host filter that `WebClientUtils.builder()` wires in for every other outbound client (the Google Sheets execute path in the same file already used the hardened builder). All request targets in these plugins are fixed provider endpoints, so this is consistency hardening rather than a fix for reachable behavior: it ensures a future configurable endpoint (custom base URL, proxy, OpenAI-compatible gateway) cannot ship without the filter. Each affected `RequestUtils` gains a regression test asserting that a request to a disallowed host is rejected by the filter with `UnknownHostException: Host not allowed.`. The tests were verified to fail against the previous builder wiring (the unfiltered client attempts a real connection instead). ### Call sites checked (all raw `WebClient.builder()` usages in main code) Changed: - `anthropicPlugin` `RequestUtils.createWebClient()` - `openAiPlugin` `RequestUtils.createWebClient()` - `googleAiPlugin` `RequestUtils.createWebClient()` - `googleSheetsPlugin` `triggerWithFlags()` Deliberately excluded: - `RTSCallerCEImpl` — its only target is the local RTS process, which the filter blocks by design (documented in the source). - `appsmithAiPlugin` `RequestUtils` — shares one client between external requests and, in some deployments, the local RTS process; filtering it requires a per-target client split and is out of scope here. ## Impact on existing instances - Fresh install: no change; all affected request targets are fixed external provider hosts, which the filter allows. - Upgrade from default: no change, same reasoning. - Upgrade from customized: none of the affected endpoints are configurable, so there is no customized state to affect. Operators who set `APPSMITH_DISABLE_SSRF_FILTER=true` get the previous unfiltered behavior everywhere, including these clients. - Rollback: reverts to the unfiltered clients; no persisted state involved. Linear: https://linear.app/appsmith/issue/APP-15866 ## Automation /ok-to-test tags="@tag.All" ### 🔍 Cypress test results <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/33426610112> > Commit: 57410c6 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=33426610112&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.All` > Spec: > <hr>Mon, 31 Aug 2026 19:43:23 UTC <!-- end of auto-generated comment: Cypress test results --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Security** * Improved protection against requests to restricted cloud metadata endpoints across supported AI integrations. * Added validation before creating outbound connections for Google Sheets actions. * **Reliability** * Standardized outbound HTTP client setup across Anthropic, Google AI, OpenAI, and Google Sheets integrations. * **Tests** * Added coverage confirming that requests to disallowed metadata hosts are rejected. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
…42224) ## Description Hardens column handling in the WHERE clause of UQI in-memory filtering (used by the Google Sheets and Amazon S3 plugins). - `FilterDataServiceCE.filterDataNew()` checks every column referenced in the WHERE condition, including nested AND/OR groups, against the columns present in the data before building the query. Unknown columns return a validation error. - Quote characters in column identifiers are escaped in the generated filter expression. Advisory: [GHSA-cm7r-f7h3-q33p](https://github.com/appsmithorg/appsmith/security/advisories/GHSA-cm7r-f7h3-q33p) Part of https://linear.app/appsmith/issue/APP-15874 ## Testing - [x] Server unit tests New tests in `FilterDataServiceTest`: - `testWhereWithUnknownColumn_throwsException` - `testWhereWithUnknownColumnInNestedGroup_throwsException` - `testWhereWithColumnNameContainingQuote_throwsException` - `testWhereWithKnownColumn_filtersRows` - `testGenerateLogicalExpression_quotesColumnNameContainingQuote` ## Impact on existing instances - Working queries: no change. - A WHERE condition on a column that isn't in the data already failed; it now fails before the query is built, with `<column> not found in the known column names`, instead of an in-memory database error. - Rollback: restores the previous behavior. ## Automation /ok-to-test tags="@tag.All" ## Communication - [x] No 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/34604046075> > Commit: 5633f15 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=34604046075&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.All` > Spec: > <hr>Fri, 11 Sep 2026 14:25:05 UTC <!-- end of auto-generated comment: Cypress test results --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Filtering now rejects conditions that reference unknown or invalid column paths. * Nested `AND` and `OR` conditions are validated consistently. * Column names containing quotation marks are handled safely when generating filter queries. * Valid filters continue to work as expected. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
…esponsive" (#42219) ## Description Two user-facing problems on the workspace applications screen. **1. ANVIL applications were filed under an "AI Agents" heading.** `ApplicationsSection` renders a single `anvilApplications` card list whose title was picked by a ternary: ```tsx title={createMessage( isAiAgentFlowEnabled ? AI_AGENTS_APPLICATIONS : ANVIL_APPLICATIONS, )} ``` With `license_ai_agent_enabled` on, every ANVIL application was filed under a heading calling it an AI agent. They are not AI agents — they are ANVIL-layout applications that happen to share the list. The `emptyStateMessage` directly above used the same ternary. Both are removed; the heading and empty state are now unconditional. **2. The user-facing name for the ANVIL layout system becomes "responsive".** | Constant | Was | Now | |---|---|---| | `ANVIL_APPLICATIONS` | `Anvil apps` | `Responsive applications` | | `NEW_ANVIL_APP` | `Anvil app` | `Responsive application` | | `ANVIL_APPLICATION_CARD_LIST_ZERO_STATE` | `There are no Anvil apps in this workspace yet.` | `There are no responsive applications in this workspace.` | Sentence case and "applications" rather than "apps", to match every sibling rendered on the same screen — `APPLICATIONS`, `NEW_APP`, `APPLICATION_CARD_LIST_ZERO_STATE`. "responsive" stays lowercase mid-sentence because it is a descriptor, not a brand name. Note `FIXED_APPLICATIONS` ("Classic Applications") is **dead code** — defined but referenced nowhere — so it is not the title-cased counterweight it appears to be. The headings that actually render are "Applications", this one, "Packages" and "Workflows". Fixes https://linear.app/appsmith/issue/APP-15954 ## Scope — user-facing strings only The **internal** name stays "Anvil" everywhere: the persisted `appPositioning.type == ANVIL` enum, `LayoutSystemTypes.ANVIL`, the feature flags, module paths and every `data-testid`. Renaming the persisted enum would require a migration and would silently un-gate every existing Anvil application, since the paid-entitlement gate keys on that literal value. ## Testing Adds `ce/pages/Applications/tests/ApplicationsSection.test.tsx` — two tests, both verified **red against pre-fix source**: ```text ✕ titles the ANVIL application list 'Responsive applications', not 'AI Agents', … ✕ uses the responsive empty-state copy when the workspace has no ANVIL applications TestingLibraryElementError: Unable to find an element with the text: Responsive applications. ``` with the printed DOM showing the heading as `AI Agents` and the zero state as `There are no AI Agents in this workspace.` It renders `ApplicationsSection` deliberately, **not** `ApplicationCardList` — that component forwards `title` verbatim to `CardList`, so a test there would prove only "the component renders the title it was handed" and would pass both before and after the fix. The decision being fixed lives in `ApplicationsSection`. Reverting *only* the ternary while leaving the string rename applied isolates the mis-filing decision from the rename. ## Known issue, deliberately not fixed here The render gate on that block is wrong, and this PR does not change it. `isAnvilEnabled` resolves through `getIsAnvilLayoutEnabled`, which reads the **retired** `release_anvil_enabled` flag — no longer in the server's `FeatureFlagEnum`, so never served, and defaulted to `false`. The gate therefore collapses to `isAiAgentFlowEnabled` alone. Consequence: an organization licensed for Anvil **without** the AI-agent flag never renders this section at all, and because `anvilApplications` is partitioned out of `nonAnvilApplications`, its applications appear in neither list. That is pre-existing, is a behaviour change to fix, and needs its own test — so it is tracked separately rather than folded in here. `getIsAnvilLayoutEnabled`'s JSDoc also claims it is `@deprecated DEAD / RETIRED (M5)` with "ZERO production callers", which is false — `ApplicationsSection` is a live caller. Worth correcting alongside that fix. ## Impact on existing instances Label-only. No schema change, no migration, no persisted-data change, no flag change. Existing applications are unaffected functionally; ANVIL ones move from an "AI Agents" heading to "Responsive applications". Rollback is a revert. Companion EE change (removing the unused **AI Agent** create-menu item, and renaming the EE license-gate copy and instance-setting label) ships separately in `appsmith-ee` and depends on this landing first, since the create-menu label lives in this file. ## Automation /ok-to-test tags="@tag.All" <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/34511756341> > Commit: 9212b47 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=34511756341&attempt=1" target="_blank">Cypress dashboard</a>. > Tags: `@tag.All` > Spec: > <hr>Thu, 10 Sep 2026 19:07:42 UTC <!-- end of auto-generated comment: Cypress test results --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Updates** - Updated application labels to use “Responsive” terminology, including “Responsive applications” and “Responsive application.” - Standardized application list headings and empty states to display responsive application messaging consistently. - Corrected a display issue where AI-agent labels could appear for responsive applications. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
appsmith-smithes
Bot
added
the
hacktron-exclude
Contributor
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
![appsmith-promotion[bot]](https://avatars.githubusercontent.com/u/67620218?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Promote
releasetomaster.Commits
Automation
/ok-to-test tags=""
Warning
Tests have not run on the HEAD 172b7c1 yet
Mon, 14 Sep 2026 06:44:04 UTC