{"commits":[{"author":{"email":"thibaultleouay@gmail.com","name":"Thibault Le Ouay Ducasse","when":"2026-09-22T17:48:32.000000+02:00"},"committer":{"email":"thibaultleouay@gmail.com","name":"Thibault Le Ouay Ducasse","when":"2026-09-22T18:22:35.000000+02:00"},"extraHeaders":[{"key":"change-id","value":"okpsntwuywkvvropuypqvqwlnooxwvmx"}],"message":"update\n","oid":"41e7bbd368a6cd0f86d46340398e38cb8a3d7f34","parents":["e03ac3245b57ab9c2faa3e3be61b76a449393d35","efcd9cda0246a555c9eff1788c8c7dda0472a480"],"tree":"e0bd7d78bca3f306abd1d60796c6689a0b5d8ade"},{"author":{"email":"thibaultleouay@gmail.Com","name":"Thibault Le Ouay","when":"2026-09-22T11:48:57.000000+02:00"},"committer":{"email":"noreply@github.com","name":"GitHub","when":"2026-09-22T11:48:57.000000+02:00"},"extraHeaders":[{"key":"gpgsig","value":"-----BEGIN PGP SIGNATURE-----\n\nwsFcBAABCAAQBQJqsk8JCRC1aQ7uu5UhlAAAmTcQAC3lSxPaN/QCZp6IkRXjhSfV\nezR+N5XxgNvAY6isCqosurCnTrToPgGRQcMiBvyI6yolsd/5ON7VBV8+we0AWbyl\n0LXFHxxIlIrrOazrjp59nPa0PCtaRe/8GzNNJQi5V6mGvU5rzMDLvRBfOj9vhCq+\nzyQO3/G4gW/Brlunn/DJTYyiI8FM8Fke+Sapa/d0NbDCdCI5HI5suMLbGqeJv9uY\n3Dcbjy0G0NqSw37t3tV9MEKVfVE9AYltkwzf8YmVxUJ6f1MWQYF6LvWmRQUaFWEc\n/58Hfb1qXpnDyEiRiVYTc9OajMZ3++ecbpYwi3vT5s4CJ6kQRrWnM4Um2Pqdfdv9\nMWxOoocFZelFmCY5s/NoEWOCravzHZBRosRzlGeHQv81hn5Ya2stKElJOfcGABp5\nvfI9O5+yZ59XE4PuWezSDUgLIwHiyBNdN8y2qPW57Lm7PPc9/7U8E1whRhe7nQ2i\nMVQgKPWZH2RXAenhw+fmz8OT6DxkM+sFfVf7V6ptyZPupFxqaOw+/v5ehcl8CUn7\npbWVru2CzM8kfg/i4pFCiypFeeAMMcb9DvLbjrwCl7pWP/2K1+W248kb7XI73fGv\n6ibNOYMuy8ZZuGErm8aYKyU3SXdUhivjUQC62ZRcw9KZ0woIymCiD0ZaMV6YichW\nbR7R4PwOtmwo94WA2H5O\n=FQvd\n-----END PGP SIGNATURE-----\n\n"}],"message":"Push ywvzwsykssxq (#2746)\n\n* ci: build matrix legs without include so selected services actually build\n\nMatrix include entries whose service is not in the selected list are\nnot merged into a combination — GitHub creates a new combination from\nthem. In the old workflow that silently built all seven images on every\npush; after the per-platform split those stray combinations had no\nrunner, so the whole build job was rejected and merge ran with no\ndigests.\n\nExpand service × platform (with context, dockerfile, runner) in the\nprepare job with jq and feed it to the build job as an explicit\ninclude list. Also drop the empty-string entry produced when no\nservice matched.\n\n\n\n* ci: speedup\n\n---------","oid":"efcd9cda0246a555c9eff1788c8c7dda0472a480","parents":["1e81be7a44992c39d2a95c209e7db1e2d716af19"],"tree":"5b9b02449d89e14e5e9a62cd12b67531f5cb6318"},{"author":{"email":"thibaultleouay@gmail.Com","name":"Thibault Le Ouay","when":"2026-09-22T11:29:36.000000+02:00"},"committer":{"email":"noreply@github.com","name":"GitHub","when":"2026-09-22T11:29:36.000000+02:00"},"extraHeaders":[{"key":"gpgsig","value":"-----BEGIN PGP SIGNATURE-----\n\nwsFcBAABCAAQBQJqskqACRC1aQ7uu5UhlAAA87sQAHSkZgIWdJ3oreGd83tC2CZE\nLQHPSmD2n9LKPNMt+bdigVigpec+7AQrpp12I2vppEzs/c7nL2m+nHA37FaSzlaK\nFEwZw6tzESfuJ+y0StC+lEEeptwaCXIcXOdgXfj1dVIjEuzYajN73j34dHgqcGvB\nvMp3nE3tSsWEZ9sngpF2oZ9z9A2X6HGMCRUJ8TkVW+rIEmlvggVIAqLS+m+sMbTV\nUy7ISAVRhs/XlHgl3yjH8dNdYpXkAAxE+m3L84P7AtQl4lucBVuu4GVXsN8RUgp8\n4nJFbIfOqiBhSPe0d50QNcfv9tGjpyfU9tQI1MIPPxLIRKYecC3TJhiqPY94mVo2\noN7iZIWsSeHLJgz08B0aJWzDTstr4vLOuszJ0qR+j30yc/esRAFa2IreEsGRHBPa\n4MFaONl5LyXld6hyJ2GCRoxN2G7i/BNr9LK25iZextfh8pfE/PNiX5hGNTC35Umb\n5eIEJQaIwIPCUqiuzC+nG1kPbKu+Iw32UxJu2Ou/ldH3uz4L0tbKdcfyj5QQ7CAI\n7nimXY7zZlHBzp0zKwzpoEx6paH/kWgwmvy6u3XpBvN3buc4Tjm8ea/VuJjMOgxu\nvb3HAHb1jRE/kZKrtpqTuEDCWjtu9E1W+kEalAz7nPSXtuTLfilLftuiQYc9/rjc\n+M1KaUOnHDLLDgNzzmbo\n=hlYd\n-----END PGP SIGNATURE-----\n\n"}],"message":"ci: speedup (#2745)\n\n* ci: speedup\n\n* ci: don't let one failed build leg block publishing the other services\n\nThe merge job depended on the whole build matrix, so a single failed\nservice/arch leg skipped tag publication for every service. Run merge\nwith !cancelled() and fail a service's own merge when it doesn't have\nboth digests, so a partial (single-arch) manifest is never tagged.\n\nCo-Authored-By: Claude Opus 5 (1M context) \n\n---------\n\nCo-authored-by: Claude Opus 5 (1M context) ","oid":"1e81be7a44992c39d2a95c209e7db1e2d716af19","parents":["3944b5cb457193a9245e88c6b67d2bd0f001e1dc"],"tree":"d6fc6709fafb67a5dff8b87e59ee870a9181671b"},{"author":{"email":"56969857+mxkaske@users.noreply.github.com","name":"Maximilian Kaske","when":"2026-09-22T08:11:38.000000+02:00"},"committer":{"email":"noreply@github.com","name":"GitHub","when":"2026-09-22T08:11:38.000000+02:00"},"extraHeaders":[{"key":"gpgsig","value":"-----BEGIN PGP SIGNATURE-----\n\nwsFcBAABCAAQBQJqshwaCRC1aQ7uu5UhlAAAxvQQABEoSL0cOPP1kLTCElVuIW5Y\nGFJKI64iM8nSEfmrSXxSeHn29JkzFG1izrbGKLjIPGdYcvuyA7nfF0PtfyiNgdvT\npb6KLFX8PfqkHS7j58nfc+KcgJRd1e+DvD/RRjCZZWzEBLlbfEj6A93AKTvQmio5\nZPztqDH9q6FYbkhubomHvh6WZyDe2W2l31tnJ2iWLR+Dw12mPlkuyPbTMb/6Yh+y\n4jrPWeN6WCooHmpRlt828r3pe6dKF5erB0lCFpY+5b0bjbFpQG9IqyHEJYXZpEnU\nTY0KgjPwFcYlDgWXTlnv/gm8wXx+go2UWnfJqNHqEJyg3pIMavaK2Va6WQ7jiaUs\nv+HwFwdFvhZ6WwvwQfnsbqBAUr7KGQgBkNyKFFh8RoHUptgzPf41eM0KY+YyPcQY\nJvIL7giW7OrALEf+5k/97PeU/lRmoo6yo49Mv3UwPptohwNLyrC3vTzXANG8we7r\n7vYSzaQPMQ2OGtBEv8n8WUwO5F6XPwdGC46UQkxKLOw1/exhP0os178prSX4s/Sq\nsjqxFkAHpWNuvNI2UmSqX5T+MKF8FwZ+jSUNYt9FAxZj8N8q1BS7oJv4OLuVLrDh\nUOlwDF8g+ZJO/IU943lj+U1M2qYF15lzMEc3+UyLrnoaRL7OdNtbKulmvWYtmbK3\n+ni3g1e7NC2APEHu0Rk6\n=vqL/\n-----END PGP SIGNATURE-----\n\n"}],"message":"fix: page viewer access and more (#2743)\n\n* fix: page viewer access and more\n\n* fix: address review feedback\n\n- check page access before the pending-subscription lookup\n- report failed grafana-oncall and ntfy test sends\n- webhook delivery never follows redirects\n- align query password handling across procedures\n- isolate and tighten tests\n\nCo-Authored-By: Claude Fable 5.1 \n\n* fix: address second round of review feedback\n\n- follow same-host 307/308 redirects for outbound webhooks\n- share the page access cookie key from a single source\n- make the domain router tests cover the path encoding\n\nCo-Authored-By: Claude Fable 5.1 \n\n* fix: only follow webhook redirects to the same service\n\nSame host and port, and never from https to http.\n\nCo-Authored-By: Claude Fable 5.1 \n\n---------\n\nCo-authored-by: Claude Fable 5.1 ","oid":"3944b5cb457193a9245e88c6b67d2bd0f001e1dc","parents":["926f31257884508b07f4f24e5b36053a43324fbd"],"tree":"7d587b9b7979d8c00ee45f40577a8e141cbec4ca"},{"author":{"email":"56969857+mxkaske@users.noreply.github.com","name":"Maximilian Kaske","when":"2026-09-21T16:40:47.000000+02:00"},"committer":{"email":"noreply@github.com","name":"GitHub","when":"2026-09-21T16:40:47.000000+02:00"},"extraHeaders":[{"key":"gpgsig","value":"-----BEGIN PGP SIGNATURE-----\n\nwsFcBAABCAAQBQJqsUHvCRC1aQ7uu5UhlAAAw1cQAK354NoUn6ZvLjPTjp4N+BzP\nCD4nOWAeHZsURl4wdemXy0eqeuC9+lD+iuTNXOJM7/JYlTNtoFRcFzZZHFS7ksF4\nho9f/NmKDHRW3klqjG8cUtwEdzKqss1DyB3x7LcU+AJlsDvnRXLA8DYvNxbSI2Nn\n5mdTTYDkPZSgToR5NZgPC79WosYqXiCtm8qwXNAPdpn+cJ8qiE61iDIl5TMKlcE1\n2t3jfqG2yDGV4/hmuBkJgF2bFjWYBKEHFCoqmtbmjb+/dMrwaGccF32mF29mnnCE\nYiTfsq3JP1vWcRa4xlY6lf2lkHksiymK7XGPTSNz4+zwOZ4CxEu6nj/d75GAapwg\nWAfALfxaNzH8g3G72ovIwsGIc+XbNRerGBR1TLssbktHIkUuGoEoIUeGa4RQYxRK\n9vfkvfCGVfFDssuQxzufvmp1iEMj1+oEBWzzGkgrxU/sPObWeKyHJVS7Ov5gX+2K\nh1lA97g4bR+weYlmfRd2kSQn99zyrUJ7JHU6aafwfiAYObWco67jPc2MqYVxyrRs\nr2vywFX3lSg/Xah8aNiSyfzRnQbONJLFtQlhm/JsEnYj/MfzCZ22Bp1e7QXNlEjM\ndWOeqkRXhmyz4RgsRD6t4piVDypLDQI6poNN9vxbLQDRTnoWex1Z6MLc4fFI4Es9\nqJMTaFGJY7mvFuFblRP2\n=ylL4\n-----END PGP SIGNATURE-----\n\n"}],"message":"feat(emails): wave 1 billing emails (downgrade, cancellation, trial) (#2742)\n\n* feat(emails): wave 1 billing emails\n\nStop the silent destruction around a subscription ending.\n\n- plan-downgraded (replaces sso-disabled): what the cascade removed, deleted\n status pages by name, what survived, re-subscribe link; sent to workspace\n owners and the Stripe customer email\n- member-removed: every member trimmed by a downgrade is told\n- cancellation-scheduled (raw) on the cancel_at_period_end flip, plus a\n plan-ending-soon reminder scheduled through Resend 3 days before period\n end; the Resend id lives in the subscription metadata so a resume cancels it\n- trial-ending (raw) on customer.subscription.trial_will_end\n- downgradeWorkspaceToFree returns what it trimmed; previewWorkspaceDowngrade\n reports the same before anything is removed\n- sendEmail takes idempotencyKey and scheduledAt; webhook sends are keyed\n stripe::

Commits on typescript7