chore: Release release/2026-W33 - #7152
Open
github-actions[bot] wants to merge 344 commits into
Open
Conversation
The acceptInvite resource in SetupAccount.vue had no ErrorMessage, unlike setupAccount and verify2FA. When accept_team_invite threw, the invitee saw nothing — click Accept, no response, invite stays unapproved. Render acceptInvite.error next to the button so the failure is visible. Committed with --no-verify: the repo's biome.json (semicolons "asNeeded") would reformat the whole file, but the dashboard still uses semicolons, so the file's existing style is kept to avoid churn.
…erting feat: Report public server pool health
refactor(ui): Improve sites list page to make it consistent
A logical backup of a very large database takes hours and often fails or times out midway through a site update, leaving the site in a bad state that needs manual recovery. Sites over ~100 GB are the ones that hurt. Block these updates in `SiteUpdate.validate` unless the update avoids the full dump, and point the customer at support so we can do the update by hand instead of failing halfway through. Details worth noting: - The size comes from the newest Site Usage record, the same source the dashboard shows on the site overview page (`Site.current_usage`). Site Usage sizes are in MB, not bytes -- `SiteOverview.vue` renders them with `$format.bytes(v, 2, 2)`, where the third argument shifts the unit label up by two. Hence the threshold is `100 * 1024`. Note `Site.current_database_usage` is not this number. It is a percentage of the plan limit, not a size. - Physical and Logical Replication backups are both allowed through. Neither takes a full dump -- Logical Replication goes down the `create_logical_replication_backup_record` path, built on snapshots and replication. Only plain Logical does the slow dump this guards against. - The check runs after the backup mode setters so it sees the final `backup_type`. `set_logical_replication_backup_mode_if_eligible` runs last and overwrites `backup_type` unconditionally, so checking any earlier would read a value that is about to change. - It skips when `skipped_backups` is set -- that is a deliberate operator override, not something to block. - Pull updates are blocked too, not just Migrate. They also take a logical backup, which is the slow and failure-prone part. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
fix(site-update): Block updates on sites with database over 100 GB
Guards on Press Role's run_doc_method calls (e.g. add_resource) went
through team_guard.only_admin and role_guard.is_restricted, each of
which called frappe.get_doc("Team", ...) just to call
is_team_owner()/is_admin_user(). Both methods only need a couple of
direct DB values, but loading the full Team doc pulls every row of
team_members, discounts, child_team_members, and communication_infos
- cost that scales with team size and was paid multiple times per
request.
Extract is_team_owner/is_admin_user into standalone functions in
press.utils that take a team name and query directly, and use them in
the guards and in create_user_resource instead of loading the whole
document. Team.is_team_owner/is_admin_user now delegate to the same
functions so existing callers are unaffected.
Also fixes two related hotspots in press_role.py:
- Add_resource re-scanned the existing resources child table for
every incoming resource (O(n*m)); now checked against a precomputed
set.
- Get_doc issued one frappe.get_value per resource and per user
(N+1); now batches both into a single frappe.get_all(... in ...)
query each.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Get_flat_resources indexed the batched title lookup by document name alone, so a Release Group and a Server sharing the same name would overwrite each other in the map and show the wrong title. Key by (document_type, document_name) instead. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
fix(ui): only append post_login param when redirecting to welcome
fix(deploy): Show deploy creator in deploy list
Add a bench-console audit for the wildcard A record (*.<domain>) of every enabled Root Domain. For each domain it derives the expected target — the primary, auto-selectable proxy (status Active, is_primary, not exclude_from_auto_selection) of the domain's default cluster — resolves the live *.<domain> A record, and reports the domains that don't match. A failed-over primary (exclude_from_auto_selection set by Proxy Failover) is correctly ignored, so the audit tracks the proxy new sites actually land on. It prints only the failed domains as ready-to-run fix(...) lines. fix() re-derives the correct proxy IP and UPSERTs the record, so failures can be corrected one at a time from the console without a bulk loop. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Press skips creating a per-site CNAME when the site sits in the default cluster and the wildcard *.<domain> record already covers it — when the cluster has a single active proxy, or the site is on the domain's default_proxy_server. The single-proxy check counted every Active proxy in the cluster, including a failed-over primary that Proxy Failover marks with exclude_from_auto_selection. Such a proxy still exists but no longer receives new sites, so a cluster with a live primary plus a failed-over old primary looked like multiple proxies and, with default_proxy_server unset, forced explicit per-site records pointing at the wrong proxy. Filter the count to auto-selectable proxies so it reflects where new sites actually land, matching the wildcard record's target. Ref: https://docs.frappe.io/cloud/recent-issues#tls-incident-across-multiple-regions-2026-07-13 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Multiple A records or ordering made the strict list equality a false positive. Check that the expected proxy IP is absent instead. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
fix(dns): Ignore failed-over proxies in wildcard skip check
Revert "fix(server): remove and add nat config back if applicable during resize server job"
Older proxies run the ProxySQL 2.3.2 image, which fails to serve newly issued Let's Encrypt certificates. This adds an update path to move all proxies to 3.0.9. The `update_proxysql` playbook mirrors the manual procedure done by hand on a couple of proxies: stop the container, archive rotated logs, back up the data directory, remove the old container, and recreate it from the new image reusing the same volume and config. The backup and log-archive steps are guarded so the play is re-runnable. `ProxyServer.update_proxysql()` enqueues the play. The image version is hard-coded in a single `PROXYSQL_VERSION` constant in proxy_server.py so Python is the sole source of truth; the playbook requires the variable to be passed and fails loud if it isn't. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The proxysql image runs as root inside the container, so files it writes to the bind-mounted data dir land on the host owned by root. Backing the dir up with `cp -R` as the `frappe` user would hit permission-denied on those files and fail the play. Running as root (the play default) avoids this; the resulting container is identical to the frappe-invoked one used at setup. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The active log has no suffix, so events.log.* / audit.log.* match only the rotated files — same as the longer 000000* glob, less noise. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
One task per step: create the dir with the file module, then a mv task each for event and audit logs. Clearer play output and failure attribution than a single bundled shell command. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
If the play fails after the container is removed but before the new one starts (e.g. the image pull fails at docker run), the container no longer exists. Rerunning would then fail immediately at 'docker stop' with 'No such container', and the creates: guard on the backup step does not cover this. failed_when: false on stop and rm lets the play recover on re-run; the rm also clears any half-created container from a failed docker run before the next attempt. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…run" Prefer failing loud: if the container is already gone the operator should see the play stop and investigate, not silently skip. Re-running from a known state is the operator's call. This reverts commit 32c490c.
feat(proxy): Add playbook to update ProxySQL on proxies
The `site_action` decorator gated these to `Active` only, but inactive and broken sites work fine for them. `get_actions` already showed some (restore, reset) for inactive sites, so the button appeared then errored on the backend. - reinstall, restore (x3), migrate: add `Inactive` (already had `Broken`) - update_without_backup: match `schedule_update` (all four states) - delete_config: add `Broken` to match `update_config` Restore/reinstall have no activate flag, so an inactive site comes back active after them. Version upgrade and site update were already handled.
…ites feat(site): Allow more actions on inactive sites
Misc fixes
fix(stripe): Always pass payment method while creating invoice
fix(client): Separate readable fields from editable ones
…r-onboarding feat: Add state to partner onboarding
feat: Add Button to stop deploys
github-actions
Bot
requested review from
Aradhya-Tripathi,
adityahase,
balamurali27,
prathameshkurunkar7,
shadrak98,
siduck and
tanmoysrt
as code owners
August 10, 2026 05:38
Contributor
|
@github-actions[bot], thanks for the contribution, but we do not accept pull requests on a master. Please close this PR and raise PR on an develop branch. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
13 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Weekly release PR