Skip to content

2026.05.13 Release - #5902

Merged
rtibbles merged 799 commits into
masterfrom
hotfixes
May 13, 2026
Merged

2026.05.13 Release#5902
rtibbles merged 799 commits into
masterfrom
hotfixes

Conversation

@rtibbles

@rtibblesrtibbles commented May 13, 2026

Copy link
Copy Markdown
Member
PRIssuesCategoryNotes
#5719#5697, #5698Backendmigrate to uv for Python dependency management
#5737N/ABackendhandle empty/missing cache gracefully
#5722N/ADependenciesbump jsonschema
#5723N/ADependenciesbump babel group
#5724N/ADependenciesbump packaging
#5684#5632Design systemVuetify→KDS migration: convert Forgot Password unit tests to Vue Testing Library
#5721#5463ESoCCshow version history in the channel publish side panel
#5745N/ABackendadd GitHub workflow for pull request events
#5716#5455ESoCCadd submission details page
#5744#5743RTElocalize MathLive screen reader announcements
#5742#5580, #5581Fixedchannels admin filters
#5739#5720RTEfocus fixes in the editor
#5729#5461, #5629ESoCCshow draft tokens in Studio
#5677#5385RTEadd text alignment toggling buttons
#5361N/ADependenciesbump latex2mathml
#5752N/ABackendrefresh Dockerfiles for uv migration
#5756#5754Fixedcopy path needing one more /contentcuration
#5757N/ABackendrollback Dockerfile to hotfixes version
#5759N/AESoCCadd draft_channels feature flag
#5762#5755Fixedbroken links in the privacy modal
#5767N/ABackenddowngrade grpcio after upstream yank of 1.78.1
#5771N/ARelease housekeepingmerge hotfixes into unstable
#5736N/ADependenciesbump gunicorn 23 → 25 (major)
#5769N/AFixedhandle Channel.DoesNotExist in remove_self
#5758#5746Design systemVuetify→KDS migration: content library filter bar
#5772N/AESoCCchannel version tokens on v1 public channel endpoint
#5770N/AESoCCcommunity channels page
#5793N/ABackendswitch Celery to thread runners for dev on macOS
#5788N/ADependenciesbump cryptography 46.0.5 → 46.0.6
#5799#5796ESoCCchange ChannelVersion.size field to FloatField
#5785N/ADependenciesbump requests
#5787N/ADesign systemupgrade KDS to 5.6.0
#5798N/ABackendset pnpm minReleaseAge to reduce supply-chain risk
#5792N/ADependenciesbump pygments
#5800N/ADependenciesbump docker/login-action 3 → 4
#5801N/ADependenciesbump docker/build-push-action 6 → 7
#5802N/ADependenciesbump docker/setup-buildx-action 3 → 4
#5803N/ADependenciesbump docker/metadata-action 5 → 6
#5804N/ADependenciesbump pnpm/action-setup 4 → 5
#5773#5766ESoCCfix duplicate community library submission
#5809#5795ESoCCupdate community library page
#5813N/ASearch recommendationsadd advertising banner
#5820N/AESoCCadd details to submit panel about acceptance criteria
#5810N/APaid storageStripe subscription integration
#5825#5822ESoCCfix add-to-community-library change making channel publishable
#5828#5821ESoCCadd library field to v1 and v2 public channel APIs, gate v1 ChannelVersion lookup
#5823#5740FixedTypeError in LanguageDropdown in multiple-select mode
#5341N/ADependenciesbump jest group
#5818N/ADependenciesbump cryptography 46.0.6 → 46.0.7
#5826N/ADependenciesbump pytest 9.0.2 → 9.0.3
#5830N/ADependenciesbump pillow 12.1.1 → 12.2.0
#5734N/ADependenciesbump pycountry 24 → 26 (major)
#5819N/AESoCCupdate ESoCC strings after UX writing review
#5827N/ADependenciesbump lodash 4.17.23 → 4.18.1
#5833#5832Fixedguard against None version in _get_version_notes
#5831N/ABackendmigrate i18n tooling to crowdin-cli via shared kolibri-build / kolibri-i18n packages
#5834#9722Dependenciesbump celery 5.6.0 → 5.6.3
#5836N/ADependenciesbump docker/setup-qemu-action 3 → 4
#5835N/ADependenciesbump @babel/preset-env
#5837N/ADependenciesbump axios 1.13.5 → 1.15.0
#5614N/ADependenciesbump workbox-precaching
#5840N/ADesign systemUX writing string updates
#5829N/ABackendhardcoded cache-control on /content/storage
#5838#5705FixedAdministration bug: deleted users still listed in users table
#5848N/ABackendapprove unrs-resolver build used by Jest
#5851#5850ESoCCpopulate channel snapshot fields on draft ChannelVersion during draft publish
#5853#5852ESoCCwrite version=0 in ChannelMetadata for draft publishes
#5854N/ARelease housekeepingCrowdin translation sync
#5855N/ABackendremove expires header from GCS response
#5760N/ABackendmanagement command to address licensing metadata issues
#5858#5797ESoCCadd guards for channel version computed values
#5844#5843ESoCCrobust solution for filtering unpublishable changes on frontend
#5856N/AESoCCrevert "Temporarily hide draft button"
#5857N/AESoCCfix lookup not finding draft tokens
#5861N/ARelease housekeepingCrowdin translation sync
#5862N/ABackendexclude .po and .json from end-of-file-fixer hook
#5709N/ADependenciesbump ajv
#5871N/AFixedignore topics in CSV for Khan channels (topics aren't present)
#5874N/ADependenciesbump pnpm/action-setup 5 → 6.0.3
#5875N/ADependenciesbump pytest-django
#5876N/ABackendadd opened to pull-request-target trigger types
#5878N/AESoCCfill the deploy-migrate command with ESoCC migrations
#5881N/ARelease housekeepingmerge hotfixes into unstable
#5750N/ARelease housekeepingpromote unstable to hotfixes for Q1 major release
#5891#5887RTEalign markdown output with Perseus grammar
#5892#5883RTEcleanup related to pre/post-test types not yet implemented in Studio
#5897#5895RTEstrip <img> tags from pasted HTML in TipTap editor
#5899#5894RTEupdate editor toolbar and mobile toolbar to remove unsupported buttons during stabilization

bjesterand others added 30 commits March 3, 2026 08:38
Avoid failure on empty/missing cache
…ema-4.26.0
chore(deps): bump jsonschema from 4.25.1 to 4.26.0
…n/babel-42adf62c6e
chore(deps-dev): bump the babel group with 4 updates
…ng-26.0
chore(deps): bump packaging from 25.0 to 26.0
…hildren by calling serializeChildren directly
[Remove Vuetify from Studio] Convert 'Forgot password' unit tests to Vue Testing Library
Add autofocus prop to TipTapEditor, threaded through to the TipTap
Editor constructor. AssessmentItemEditor sets shouldAutofocusQuestion
when it mounts with an empty question (i.e. a newly created one),
which passes autofocus=true to the TipTapEditor so the ProseMirror
view receives focus as soon as it initializes.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Monkey-patch mathlive's hardcoded English screen reader announcements
to support localization for all Studio-supported locales. This is a
temporary workaround until the upstream fix lands (arnog/mathlive#2948).
- Add MathLiveA11yStrings.js with translatable strings for all known
mathlive announcement patterns (prefixes and relation names)
- Add mathLiveA11yLocalize.js with regex-based post-processing to
replace English patterns with translated equivalents
- Add useMathLiveA11yAnnounce.js composable using MutationObserver
to intercept and localize aria-live region updates
- Wire composable into FormulasMenu.vue alongside existing locale setup
- Add comprehensive unit tests for localization logic and observer behavior
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Use lodash/camelCase instead of custom camelCase implementation
- Pre-compute relation name to translator key map for hot-path efficiency
- Use Set for deduplication instead of O(n²) indexOf filter
- Fix interceptor cleanup to properly restore textContent descriptor
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Show version history in the channel publish side panel
rtibblesand others added 23 commits April 29, 2026 16:48
…n/ajv-8.18.0
chore(deps): bump ajv from 8.17.1 to 8.18.0
Ignore topics since they will not be present in the CSV for Khan channels
Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup) from 5 to 6.0.3.
- [Release notes](https://github.com/pnpm/action-setup/releases)
- [Commits](pnpm/action-setup@v5...v6.0.3)
---
updated-dependencies:
- dependency-name: pnpm/action-setup
dependency-version: 6.0.3
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Bumps [pytest-django](https://github.com/pytest-dev/pytest-django) from 4.11.1 to 4.12.0.
- [Release notes](https://github.com/pytest-dev/pytest-django/releases)
- [Changelog](https://github.com/pytest-dev/pytest-django/blob/main/docs/changelog.rst)
- [Commits](pytest-dev/pytest-django@v4.11.1...v4.12.0)
---
updated-dependencies:
- dependency-name: pytest-django
dependency-version: 4.12.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
…ons/pnpm/action-setup-6.0.3
chore(deps): bump pnpm/action-setup from 5 to 6.0.3
…jango-4.12.0
chore(deps-dev): bump pytest-django from 4.11.1 to 4.12.0
Add 'opened' to pull-request-target trigger types
Fill the deploy-migrate command with ESoCC migrations
unstable to hotfixes, Q1 major release
Perseus's simple-markdown (kolibri-perseus-viewer) treats `__text__` as
`<u>`, while marked (CommonMark) treats it as `<strong>`. The serializer
now emits `__text__` for the underline mark, and `preprocessMarkdown`
rewrites `__text__` to `<u>text</u>` before marked sees it so the
round-trip back into TipTap preserves underline instead of converting
it to bold.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
fix(texteditor): align markdown output with Perseus grammar
Since pre-post-test creation and editing is not implemented in studio…
Pasted <img> tags survived into the editor doc and the saved markdown.
Remote image references then blocked channel publish (#5895).
Adds a single sync transformer (transformPastedHTML) wired into both
native paste (via editorProps.transformPastedHTML) and the toolbar
Paste button. Existing Word/Office sanitization is preserved and now
applies to both paths — previously only the toolbar ran it.
Fixes#5895
Strip <img> tags from pasted HTML in TipTap editor
Update editor toolbar and mobile toolbar to remove unsupported buttons
Comment on lines +7 to +12
name: Call shared workflow
uses: learningequality/.github/.github/workflows/contributor-pr-reply.yml@main
secrets:
LE_BOT_APP_ID: ${{ secrets.LE_BOT_APP_ID }}
LE_BOT_PRIVATE_KEY: ${{ secrets.LE_BOT_PRIVATE_KEY }}
SLACK_COMMUNITY_NOTIFICATIONS_WEBHOOK_URL: ${{ secrets.SLACK_COMMUNITY_NOTIFICATIONS_WEBHOOK_URL }}
Comment on lines +7 to +11
name: Call shared workflow
uses: learningequality/.github/.github/workflows/pull-request-target.yml@main
secrets:
LE_BOT_APP_ID: ${{ secrets.LE_BOT_APP_ID }}
LE_BOT_PRIVATE_KEY: ${{ secrets.LE_BOT_PRIVATE_KEY }}
Comment on lines +8 to +87
name: Download translations and update files
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v6

- name: Install uv
uses: astral-sh/setup-uv@v7
with:
python-version: '3.10'
activate-environment: "true"
enable-cache: "true"

- name: Install Python dependencies
run: uv pip sync requirements.txt

- name: Use pnpm
uses: pnpm/action-setup@v6.0.3

- name: Use Node.js
uses: actions/setup-node@v6
with:
node-version: '20.x'
cache: 'pnpm'

- name: Setup Java for crowdin-cli
uses: actions/setup-java@v5
with:
distribution: 'temurin'
java-version: '17'

- name: Install gettext
run: sudo apt-get update && sudo apt-get install -y gettext

- name: Install JavaScript dependencies
run: pnpm install --frozen-lockfile

- name: Download translations
env:
CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_API_KEY }}
run: make i18n-download

- name: Generate App Token
id: generate-token
uses: actions/create-github-app-token@v3
with:
app-id: ${{ secrets.LE_BOT_APP_ID }}
private-key: ${{ secrets.LE_BOT_PRIVATE_KEY }}

- name: Create Pull Request
uses: peter-evans/create-pull-request@v8
with:
token: ${{ steps.generate-token.outputs.token }}
commit-message: |
Update translations from Crowdin

This includes:
- Updated translation files (.po and .json)
- Compiled Django messages (.mo files)
- Updated frontend i18n files
branch: i18n-update-${{ github.ref_name }}
base: ${{ github.ref_name }}
delete-branch: true
title: 'Update translations from Crowdin for ${{ github.ref_name }}'
body: |
## Summary of changes

This PR updates translations downloaded from Crowdin.

### Changes included:
- Updated translation files (`.po` and `.json`)
- Compiled Django messages (`.mo` files)
- Updated frontend i18n files

### Testing checklist:
- [ ] Verify that translations are not obviously empty or untranslated in the message files
- [ ] Switch to a few different languages and navigate the app
labels: |
i18n
TAG: user strings
Comment on lines +8 to +50
name: Extract and upload strings to Crowdin
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v6

- name: Install uv
uses: astral-sh/setup-uv@v7
with:
python-version: '3.10'
activate-environment: "true"
enable-cache: "true"

- name: Install Python dependencies
run: uv pip sync requirements.txt

- name: Use pnpm
uses: pnpm/action-setup@v6.0.3

- name: Use Node.js
uses: actions/setup-node@v6
with:
node-version: '20.x'
cache: 'pnpm'

- name: Setup Java for crowdin-cli
uses: actions/setup-java@v5
with:
distribution: 'temurin'
java-version: '17'

- name: Install gettext
run: sudo apt-get update && sudo apt-get install -y gettext

- name: Install JavaScript dependencies
run: pnpm install --frozen-lockfile

- name: Extract and upload strings to Crowdin
env:
CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_API_KEY }}
run: |
make i18n-upload
make i18n-pretranslate-approve-all
Comment threadcontentcuration/contentcuration/views/subscription.py Fixed
Comment threadcontentcuration/contentcuration/views/subscription.py Fixed
Addresses CodeQL "Information exposure through an exception" findings in
views/subscription.py and viewsets/channel.py. Logs the traceback server
side via logger.exception so Sentry still captures it.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Stop exposing exception details in HTTP responses

@bjesterbjester left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

:shipit:

@rtibbles
rtibbles merged commit 720e6e6 into masterMay 13, 2026
34 checks passed
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

17 participants

@rtibbles@bjester@marcellamaki@github-advanced-security@AlexVelezLl@habibayman@AadarshM07@AllanOXDi@nucleogenesis@rtibblesbot@MisRob@sharma-anushka@Swoyamjeetcodes@LightCreator1007@ashnaaseth2325-oss@SheikhZaeem@akolson