Changelog - Dev - 07.27.2026
All notable changes to this project will be documented in this file.
The format is based on Keep a Changelog.
[Unreleased] - 2026-07-27
Fixed
- Guard CI workflows against skip directives in squash commit messages: Resolved an issue where CI workflows were being skipped unintentionally when squash-merge commit messages quoted the changelog bot's skip-ci directive. The fix prevents GitHub from honoring skip directives that appear in explanatory text rather than as intentional directives. (#732)
devops
Update - 2026-07-27 15:44 UTC
Security
- Make wave decline invisible to sender: Fixed a privacy leak where senders could detect when recipients declined their waves by reading the wave document status or inferring rejection through re-wave behavior. Firestore read rules now prevent senders from seeing declined status on their own waves. (#734)
bugprivacysecurity
Update - 2026-07-27 17:02 UTC
Security
- Migrate admin portal to react-router v7: Resolves GHSA-jjmj-jmhj-qwj2, a critical open-redirect XSS vulnerability (CVSS 6.9) in react-router-dom v6 with no patched v6 release available. The admin portal was the only affected component; this migration retires the long-standing audit allowlist exception. (#736)
securitydependencies
Update - 2026-07-27 21:02 UTC
Changed
- Consolidate analytics pipeline to BigQuery only: Removed the unused Firestore analytics_events mirror and now write directly to BigQuery with batching. This eliminates redundant infrastructure costs and simplifies the analytics pipeline as part of Phase 1 of the hardening plan. (#737)
enhancementanalytics
Update - 2026-07-27 21:21 UTC
Fixed
- Remove dead analytics import that crashed container at boot: A leftover import of a removed configuration constant in the metrics service caused the Analytics API container to fail at startup. The fix removes the dead import and adds a CI guard to prevent similar issues. No user impact as Cloud Run continued serving the previous version. (#738)
bugdevops