Skip to content

[1.0.3-hotfix] Handle malformed Unicode in generated avatars - #136

Merged
ThaminduDilshan merged 4 commits into
thunder-id:1.0.3-hotfixfrom
NipuniBhagya:unicode-fix
Oct 26, 2026
Merged

[1.0.3-hotfix] Handle malformed Unicode in generated avatars#136
ThaminduDilshan merged 4 commits into
thunder-id:1.0.3-hotfixfrom
NipuniBhagya:unicode-fix

Conversation

@NipuniBhagya

@NipuniBhagya NipuniBhagya commented Oct 26, 2026

Copy link
Copy Markdown
Contributor

Purpose

Backports the fix for malformed Unicode in generated avatars (#113) to the 1.0.3 maintenance line, so it can ship as a 1.0.3-hotfix.1 release.

Approach

Cherry-picks 974c486 from #113 unchanged with git cherry-pick -x. The original author is kept. The change touches only @thunderid/browser: generateAvatarDataUri.ts and its test.

When releasing, select both browser and react in the Hotfix Release workflow (#135). The workflow pins react's dependency on browser to an exact version, so react only picks up the fix if it's released together with browser.

Related Issues

  • N/A

Related PRs

Checklist

  • Followed the contribution guidelines.
  • Manual test round performed and verified. @thunderid/browser builds and typechecks on this branch, and generateAvatarDataUri.test.ts passes (27 tests).
  • Documentation provided. (Add links if there are any)
  • Tests provided. (Add links if there are any)
    • Unit Tests
    • Integration Tests
  • Breaking changes. (Fill if applicable)
    • Breaking changes section filled.
    • breaking change label added.
  • Cross-SDK parity. Exactly one of parity/prs-raised or parity/prs-not-needed added.
    • If parity/prs-raised, the port links are posted as a reply on the parity check's comment.

Security checks

  • Followed secure coding standards.
  • Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.

🤖 Generated with Claude Code

@coderabbitai

coderabbitai Bot commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review: 1
  • main

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions

github-actions Bot commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown

🔀 Cross-SDK feature parity, no ports needed

This pull request is labelled parity/prs-not-needed: nothing here has to ship in the other ThunderID SDKs. If that changes, swap the label for parity/prs-raised.

@ThaminduDilshan ThaminduDilshan added parity/prs-raised Ports exist in the other SDKs, or are recorded as not applying there parity/prs-not-needed Nothing here reaches another SDK and removed parity/prs-raised Ports exist in the other SDKs, or are recorded as not applying there labels Oct 26, 2026
@NipuniBhagya
Bump dompurify to 3.4.17
0e83548 
Fixes GHSA-cg2g-xh64-v4q7 (critical), GHSA-mrv2-3pqr-j5jr (high) and lower
severity DOMPurify advisories. @thunderid/react and @thunderid/vue pin
dompurify exactly via the catalog, so the hotfix releases would otherwise
ship a vulnerable version. Matches the version already on main.
@NipuniBhagya
Backport dependency security fixes from main
6ecc082 
Makes `pnpm audit --audit-level=high` pass on the 1.0.3 maintenance branch.

- Port main's overrides (brace-expansion, devalue, js-yaml, nanoid, postcss,
  sharp, shell-quote, source-map-js, svgo, tar, vite 8) and its justified
  audit ignores (node-forge, braces, simple-git), and bump the body-parser pin
  to 1.20.9.
- Pin browserslist, launch-editor, proxy-addr, seroval, undici 8, vite 6/7,
  vue and zod to their patched releases. Main picked these up through
  lockfile refreshes; here they are pinned so the lockfile doesn't drift.
- Bump packages/nextjs's `next` devDependency to 15.5.28 (as on main) and the
  Next.js sample's floor to ^15.5.28.

All of these reach the workspace through devDependencies or the samples, so
they don't change what the published SDKs install.
@NipuniBhagya
Bump pinned pnpm to 11.25.0
89161a2 
Fixes GHSA-vx52-2968-3vc6, GHSA-c59q-g84q-2gj5 and GHSA-vq4v-j7r6-jq4m in
pnpm <11.11.0, which pnpm audit reports through the devEngines
packageManager pin. Matches the version pinned on main.

Signed-off-by: NipuniBhagya <nipunib@wso2.com>
@ThaminduDilshan
ThaminduDilshan merged commit afab039 into thunder-id:1.0.3-hotfix Oct 26, 2026
5 of 6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ThaminduDilshan ThaminduDilshan ThaminduDilshan approved these changes

Assignees

No one assigned

Labels

parity/prs-not-needed Nothing here reaches another SDK

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@NipuniBhagya @ThaminduDilshan @ThumulaPerera