release: promote development → master (v1.24.0) #280

Merged

developer merged 8 commits from development into master 2026-07-16 19:23:04 +00:00

Conversation 1 Commits 8 Files Changed 15

+1108 -49

developer commented 2026-07-16 19:18:22 +00:00

Owner

Copy Link

Copy Source

Промоушен development → master для прод-релиза v1.24.0.

Состав (сверх текущего master):

• #278 — VK Bridge storage для клиентских настроек (фикс потери настроек в VK desktop iframe / Firefox) + профиль показывает только email внутри Mini App хоста (ToS-гейт VK/TG). Клиентское изменение.
• #279 — guard: validateProduct отклоняет HTML-спецсимволы (& < > " ') в названии продукта (VK payment sign-what-you-send баг). Backend-валидация.
• #277 — docs: план нативного iOS/iPadOS приложения (apple/PLAN.md).

Свойства релиза:

• Ни схемы, ни wire, ни миграций → прод-деплой image-only, без maintenance-окна, rollback-safe.
• CI на обоих исходных PR зелёный; контур раскатан.

После апрува + CI green: мерж в master → тег v1.24.0 → ручной prod-deploy.yaml (confirm=deploy), rolling + health-gated + auto-rollback на оба хоста.

Промоушен development → master для прод-релиза **v1.24.0**. Состав (сверх текущего master): - **#278** — VK Bridge storage для клиентских настроек (фикс потери настроек в VK desktop iframe / Firefox) + профиль показывает только email внутри Mini App хоста (ToS-гейт VK/TG). Клиентское изменение. - **#279** — guard: `validateProduct` отклоняет HTML-спецсимволы (`& < > " '`) в названии продукта (VK payment sign-what-you-send баг). Backend-валидация. - **#277** — docs: план нативного iOS/iPadOS приложения (`apple/PLAN.md`). Свойства релиза: - **Ни схемы, ни wire, ни миграций** → прод-деплой **image-only**, без maintenance-окна, rollback-safe. - CI на обоих исходных PR зелёный; контур раскатан. После апрува + CI green: мерж в master → тег `v1.24.0` → ручной `prod-deploy.yaml` (`confirm=deploy`), rolling + health-gated + auto-rollback на оба хоста.

developer added 8 commits 2026-07-16 19:18:22 +00:00

docs(apple): add native iOS/iPadOS app plan (apple/PLAN.md) ... ebc413f5e5

Design/continuity doc for the from-scratch SwiftUI iPhone+iPad app: Mac
build model, engineering decisions (min iOS 18, apple/ dir, XcodeGen+SPM,
@Observable, Swift 6 strict concurrency, SF Symbols, runtime-vector tiles),
the five determining optimizations, storage/audio/testing/crash choices,
region-aware payment seam with tracked App Store risks, and the full A-L
+ game-screen UX inventory. Delivery staged; several items tracked for
follow-up sessions.

docs(apple): drop [FIXED] tags from the plan ... e04e97fb66

Decisions stay recorded; the tag implied false permanence. Open items
keep their [OPEN / TRACKED] / [GATE] markers.

docs(apple): drop remaining [FIXED ...] header tags (sections 8, 12) 3dfc0932ef

Merge pull request 'docs(apple): native iOS/iPadOS app plan' (#277) from feature/apple-ios-plan into development b285e27d55

fix(vk): persist settings via VK Bridge storage; hide competing sign-in in Mini App hosts ... 6c0daeb177

VK moderation follow-ups.

1. Settings (theme, language, board style, reduce-motion, zoom, first-run
   coachmark flags) were lost between reloads in VK's desktop iframe: Firefox
   partitions/blocks IndexedDB and localStorage in a cross-origin iframe, so the
   browser-local store is empty on every reload (a plain tab / PWA keeps them —
   first-party storage — and Telegram has its own CloudStorage sync). Mirror the
   prefs (plus the locale, which has no other durable client home on VK) and the
   coachmark flags to VK Bridge storage (VKWebAppStorageSet/Get), which travels
   over postMessage to vk.com and survives; reconcile them on the VK launch
   before the first paint. The VK identity re-derives from the signed launch
   params each load, so the values reload onto the same account.

2. Inside a proprietary Mini App host (VK or Telegram) the profile now surfaces
   only email linking — both the Telegram and VK link/unlink entries are hidden
   (signInProvidersVisible), so a competing sign-in is never advertised (a
   platform ToS requirement; VK forbids showing a Telegram login, mirrored in
   Telegram for VK). A provider linked earlier on the web stays attached and is
   managed from the web; web/native builds show both.

Tests: vkprefs codec + signInProvidersVisible unit tests. Docs: ARCHITECTURE,
FUNCTIONAL (+_ru). No schema/wire change.

Merge pull request 'fix(vk): persist settings via VK Bridge storage; hide competing sign-in in Mini App hosts' (#278) from feature/vk-moderation-fixes into development 69246eb0c0

fix(payments): reject HTML-special chars in product titles (VK payment guard) ... f60327c1ce

A product title containing & < > " ' silently breaks VK purchases: VK
HTML-escapes the character in its order_status_change payment-callback echo
(e.g. " -> &quot;) but signs the notification over a different form, so the
gateway's signature check no longer matches ("vk callback: bad signature")
and the purchase never confirms — while get_item (whose request carries no
title) still passes.

validateProduct now rejects those characters at the admin catalog editor —
the single write path for CreateProduct/UpdateProduct/SetProductActive — so a
title can't reintroduce the break. Reject, not transform: the operator retypes
a clean title (« » guillemets, not straight quotes), so the stored value stays
identical everywhere (storefront, wallet, VK box).

Docs: docs/PAYMENTS.md §7 + agent field notes; Go Doc on validateProduct.
Test: validateProduct HTML-special-char cases. No wire/schema change.

Merge pull request 'fix(payments): reject HTML-special chars in product titles (VK payment guard)' (#279) from feature/vk-title-guard into development 0ba8fb6514

owner approved these changes 2026-07-16 19:21:19 +00:00

developer merged commit 30c6590ac1 into master 2026-07-16 19:23:04 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

owner

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

owner (Ilia) developer

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: developer/scrabble-game#280