release: develop → main (v0.9.1 — hosted skill-CORS hotfix)#763
Merged
Conversation
chore: sync main → develop after v0.9.0
…#732) (#760) createSkill (POST /skills), updateSkillPackage (PUT /skills/:id) and setSkillVersionDeprecation (PATCH .../versions/:version) are raw-fetch callers that each set `credentials: "include"`. They authenticate via the `Authorization: Bearer` header — never cookies — so the flag is dead weight. It is also fatal on hosted: the NyxID proxy returns `Access-Control-Allow-Origin: *`, and a credentialed request (credentials mode "include") forbids a wildcard ACAO, so Chrome blocks the preflight before the request leaves the page. Users could generate a skill but not save it ("Failed to fetch"); package update (#565) and version deprecation hit the same wall. #528 removed the dead X-User-* headers from these callers but left the credentials flag; #709 cleared the identical trap in activityApi.ts. This applies the same one-line removal to the three skillApi.ts siblings — the last credentialed raw-fetch callers in the SPA. Verified against prod: deployed 0.9.0 proxy returns ACAO `*` + ACAC `true` (an invalid combo) on OPTIONS /api/v1/skills. Dropping credentials makes the request non-credentialed so the wildcard ACAO is accepted. Closes #732.
Adds the dated release-notes file (.github/release-notes-20260530.md) for the v0.9.1 patch cut. Single hotfix since v0.9.0: #732 CORS fix (drop credentials:include from skill create/update/deprecate), so both packages go 0.9.0 → 0.9.1 in fixed mode. Dated 20260530 deliberately: v0.9.0 shipped earlier the same UTC day with .github/release-notes-20260529.md, and both release workflows select the lexically-greatest 8-digit dated file (`sort -r | head -1`). A second 20260529 file is impossible (same name) and overwriting v0.9.0's historical notes is wrong, so the next sortable date is used. The gate only validates the most-recent file, not that its date equals today. Ships an empty changeset (docs/CI-only) to satisfy check-changeset, same as the v0.9.0 prep PR. Closes #761.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Patch release. Single hotfix on develop since v0.9.0 → both packages
0.9.0 → 0.9.1in fixed mode.After merge, the changeset-release workflow will: open
release/v0.9.1PR (consuming the CORS changeset + the empty prep changeset), bump to0.9.1; on bump-PR merge tagv0.9.1, publish a Release from.github/release-notes-20260530.md, then open a sync PR back to develop (merge with Create a merge commit, never squash).What ships
Fixed
skillApi.tswas sendingcredentials:"include"on three Bearer-authed raw-fetch calls; combined with the NyxID proxy's wildcardAccess-Control-Allow-Origin: *, the browser blocked every request at the CORS layer. ([Bug] [Hosted Skill Creation] Saving generated skills still fails with NyxID proxy CORS after #528 was closed #732, via fix(web): drop credentials:include from skill create/update/deprecate (#732) #760)Issues closed
Test plan
release/v0.9.1PR — squash-merge it.v0.9.1+ Release publish; sync PR opens — merge with a merge commit (NOT squash)..github/release-notes-20260530.md.ornn-web; verify hosted skill save works (no CORS error).