jellyfin/jellyfin-vue
1
0
Fork 0
mirror of https://github.com/jellyfin/jellyfin-vue.git synced 2026-09-03 05:10:26 +03:00
Code Issues Packages Projects Releases Wiki Activity
5,987 Commits 19 Branches 3 Tags
master
Commit Graph
386 Commits
Author SHA1 Message Date
Fernando Fernández 9682c91801 ci(renovate): vulnerable deps upgrade to highest, don't separate 2026-07-25 21:59:15 +02:00
renovate[bot] b2712276cf chore(deps): update ci (#2847) 2026-07-25 14:29:23 +02:00
Fernando Fernández 1f180f2487 ci(renovate): enable devcontainer manager 
Signed-off-by: GitHub <noreply@github.com>
 2026-07-25 12:23:05 +00:00
renovate[bot] 47a6dbde67 chore(deps): update ci (#2844) 2026-07-21 13:57:20 +02:00
renovate[bot] 6dbc52e816 chore(deps): update ci (#2838) 2026-07-06 14:33:25 +02:00
renovate[bot] 502fcd30f4 chore(deps): update ci (major) (#2836) 2026-06-24 20:48:00 +02:00
Fernando Fernández f50cbfd60e ci: harden 
After the release 3.1.0 release of eps1lon/actions-label-merge-conflict, documentation about how to harden the token was provided.
The action now uses the default GITHUB_TOKEN

Signed-off-by: Fernando Fernández <ferferga@hotmail.com>
 2026-06-05 12:43:58 +02:00
renovate[bot] 6a6f9c6ddf chore(deps): update ci (#2807) 2026-06-05 12:35:34 +02:00
Fernando Fernández 0c8e674b0a chore(pnpm): switch to pnpm ci 
Signed-off-by: GitHub <noreply@github.com>
 2026-05-16 14:40:08 +02:00
Fernando Fernández 141bcddbb0 ci(renovate): match stability days with pnpm v11 
See https://pnpm.io/supply-chain-security#delay-dependency-updates

pnpm 11 also reduces the attack surface by blocking preinstall scripts by default.
 2026-05-16 14:06:20 +02:00
renovate[bot] af3ba2894e chore(deps): update ci (#2805) 2026-05-13 23:41:16 +02:00
Fernando Fernández 3c793907dc ci(renovate): separate major pnpm updates only 
Signed-off-by: Fernando Fernández <ferferga@hotmail.com>
 2026-05-08 12:20:09 +02:00
renovate[bot] 935e75ca5f chore(deps): update ci (#2791) 2026-05-08 12:13:27 +02:00
Fernando Fernández cd73b17966 ci(renovate): extract pnpm to its own group 2026-05-08 11:48:42 +02:00
renovate[bot] 8d50552523 chore(deps): update ci (#2783) 2026-05-05 22:17:31 +00:00
renovate[bot] ad4dde43d6 chore(deps): update ci (#2778) 2026-04-16 21:37:02 +02:00
renovate[bot] c3377913b8 chore(deps): update docker/login-action action to v4.1.0 (#2765) 2026-04-08 00:08:42 +02:00
renovate[bot] d5a2895192 ci(renovate): migrate config (#2774) 2026-04-07 23:40:20 +02:00
Fernando Fernández 9a9b4252be ci(renovate): separate catalogs for runtime and development dependencies 
Signed-off-by: Fernando Fernández <ferferga@hotmail.com>
 2026-04-07 23:02:13 +02:00
Fernando Fernández de6989c152 ci(pnpm): run a check for monorepo dependency cycles, switch to pnpm i 
pnpm i is an alias to pnpm install, so the shorter version is desired

Signed-off-by: Fernando Fernández <ferferga@hotmail.com>
 2026-04-07 18:58:12 +02:00
Fernando Fernández 68673a092f chore(monorepo): move frontend under packages folder 
Signed-off-by: Fernando Fernández <ferferga@hotmail.com>
 2026-04-07 18:58:12 +02:00
Fernando Fernández f82cf2bdea ci(renovate): run pnpm dedupe on every dependency update 
Signed-off-by: Fernando Fernández <ferferga@hotmail.com>
 2026-04-07 18:58:12 +02:00
Fernando Fernández f00e60fcd3 chore: migrate to pnpm 
NPM refuses to acknowledge their limitations when working with monorepos

Signed-off-by: Fernando Fernández <ferferga@hotmail.com>
 2026-04-07 18:58:12 +02:00
Bill Thornton ed01ae9c6a chore: add min stability days for npm renovate updates (#2766) 2026-04-03 16:23:32 -04:00
renovate[bot] 8f6bcafe60 chore(deps): update ci (#2731) 2026-03-30 11:31:02 +02:00
Fernando Fernández 1c23f65588 ci: move back attestation to origin jobs 
The collector job didn't take into account attestations for multiple arches.
The fix for that would be a bit overengineered, so we make it back to the original jobs. The permissions given to the jobs are minimal (only attestattion creation would be possible), so the attack surface of scripts would be minimal

Signed-off-by: Fernando Fernández <ferferga@hotmail.com>
 2026-03-30 11:28:19 +02:00
Fernando Fernández 36088021cb ci: replace actions/attest-build-provenance with actions/attest 
Signed-off-by: Fernando Fernández <ferferga@hotmail.com>
 2026-03-30 11:06:55 +02:00
Fernando Fernández 2588d8e4ce ci: more explicit permissions, separate artifact attestations in different job 
To satisfy the requirements pointed at https://github.com/jellyfin/jellyfin-vue/pull/2735

Signed-off-by: Fernando Fernández <ferferga@hotmail.com>
 2026-03-30 11:06:55 +02:00
Fernando Fernández 0d567a1234 revert: "Mitigate pull_request_target privilege escalation (#2735)" 
This reverts commit 1a9c256903.

See https://github.com/jellyfin/jellyfin-vue/pull/2735#issuecomment-4077194367 and
https://github.com/jellyfin/jellyfin-vue/pull/2735#issuecomment-4148987114 for more details.
 2026-03-30 11:05:07 +02:00
Fernando Fernández 6c42ad1bfa ci(renovate): pin gh actions versions by sha 
Signed-off-by: Fernando Fernández <ferferga@hotmail.com>
 2026-03-30 11:05:07 +02:00
Andrew Rabert 1a9c256903 Mitigate pull_request_target privilege escalation (#2735) 
Hotfix — replaces pull_request_target with pull_request to stop
granting write permissions and secrets to fork PRs. Some workflows
will break; can be fixed properly later.
 2026-02-19 23:58:30 -05:00
renovate[bot] 76b27f3156 chore(deps): update ci (#2720) 2026-01-28 23:48:00 +01:00
Fernando Fernández 38fcd50f54 ci: use new ubuntu-slim runners 
For lightweight tasks, will probably allow for more concurrency across the entire org

Signed-off-by: Fernando Fernández <ferferga@hotmail.com>
 2026-01-28 23:38:09 +01:00
renovate[bot] 31f36a3e5d chore(deps): update ci (#2713) 2025-12-13 21:15:34 +01:00
renovate[bot] b557e31942 chore(deps): update ci (#2709) 2025-11-24 18:18:07 +00:00
Fernando Fernández 4fd64f8a26 chore: fix potential script injection in GitHub Actions [security] 
Signed-off-by: GitHub <noreply@github.com>
 2025-10-29 10:37:44 +00:00
renovate[bot] 25508b3f51 chore(deps): update ci (#2701) 2025-10-29 02:08:53 +01:00
renovate[bot] e90652fc0d chore(deps): update ci (#2688) 2025-10-12 17:41:40 +02:00
Fernando Fernández 50a217c5ea chore(package): add packageManager field 
The `actions/setup-node` makes use of this field, and I guess it
makes sense to use the new "official" way (though it's still experimental)
to hint environments of which package managers are being used
in the project.

Signed-off-by: GitHub <noreply@github.com>
 2025-10-12 15:30:24 +00:00
renovate[bot] 1530212856 chore(deps): update ci (#2685) 2025-09-02 15:07:11 +02:00
renovate[bot] 26c3a1707d chore(deps): update ci (#2674) 2025-08-26 20:40:22 +02:00
renovate[bot] 43e86a9a70 chore(deps): update ci (#2658) 2025-06-28 11:36:53 +00:00
renovate[bot] d43dc8292d chore(deps): update ci (#2651) 2025-05-27 17:08:02 +00:00
renovate[bot] 71c53f97d4 chore(deps): update ci (#2648) 2025-05-15 16:47:34 +00:00
renovate[bot] 219e671941 chore(deps): update ci (#2636) 2025-05-09 00:39:06 +02:00
Fernando Fernández ed169bd523 chore: vite as peerDependencies in @jellyfin-vue/tauri-packaging 
Vite is now a monorepo-wide package anyway

Signed-off-by: Fernando Fernández <ferferga@hotmail.com>
 2025-05-05 19:38:29 +02:00
renovate[bot] 1ce3ccc111 chore(deps): update actions/attest-build-provenance action to v2.3.0 (#2629) 2025-04-29 20:42:40 +02:00
Fernando Fernández 57bb098bd8 ci(renovate): don't pin peerDependencies 
Signed-off-by: Fernando Fernández <ferferga@hotmail.com>
 2025-04-29 20:27:08 +02:00
Fernando Fernández d668199a54 chore: remove all vue-i18n libraries 
Signed-off-by: Fernando Fernández <ferferga@hotmail.com>
 2025-04-29 20:05:38 +02:00
renovate[bot] bade0fafc7 chore(deps): update ci (#2621) 2025-04-27 17:39:34 +00:00