Firefox Private Relay

Recent Commits

• luke crouch (10 Jul 26)

  Merge pull request #6694 from mozilla/MPP-4689-first-forwarded-email-cross-user fix(api): reject unowned masks in first-forwarded-email endpoint

• groovecoder (09 Jul 26)

  fix(api): reject unowned masks in first-forwarded-email endpoint MPP-4689: POST /api/v1/first-forwarded-email/ called _get_address(mask) with the default create=True, so a mask on another user's subdomain was created on that user's account before the ownership check ran. This let a free user write masks into a victim's inventory and bump the victim's daily abuse counter. Pass create=False and make the ownership check explicit and type-aware, so no DomainAddress is created and only a RelayAddress owned by the caller is accepted.

• luke crouch (09 Jul 26)

  Merge pull request #6693 from mozilla/mpp-4717 fix(frontend): bypass browser cache on API reads so mutations refresh

• luke crouch (09 Jul 26)

  Merge pull request #6692 from mozilla/combined-react-deps build(deps): bump react, react-dom, react-aria, and react-stately

• groovecoder (08 Jul 26)

  fix(frontend): bypass browser cache on API reads so mutations refresh (MPP-4717) MPP-4692 added Cache-Control: max-age=60 to the address and profile list endpoints to protect the origin from the autofill client. That header also made the browser serve a stale list to SWR after a delete or block/forward toggle, so the dashboard did not update until a page refresh. Deleting the same row twice then hit a 404. Set cache: "no-store" on the fetcher so SWR reads always revalidate. The Cache-Control header still helps the autofill client, and the per-user throttle still caps the origin.

• groovecoder (08 Jul 26)

  fix(frontend): align AppPicker onAction type with react-aria 3.50.0 react-aria 3.50.0 changed the menu-level onAction from (key) => void to (key, value) => void, so AriaMenuOptions["onAction"] no longer matches the menu-item AriaMenuItemProps["onAction"]. AppPicker typed its trigger onAction as the menu-level AriaMenuOptions type and passed it into MenuPopupProps, which uses the item-level type, breaking next build's type check. Type it as AriaMenuItemProps["onAction"] to match UserMenu and AliasGenerationButton, the other two consumers of the shared useMenu hook. The single-arg handler is still assignable where AriaMenuOptions is expected inside useMenu.

• groovecoder (08 Jul 26)

  build(deps): bump react, react-dom, react-aria, and react-stately Combines three Dependabot PRs into one: - react and react-dom 19.2.6 -> 19.2.7 (#6622) - react-aria ^3.49.0 -> ^3.50.0 (#6667) - react-stately ^3.46.0 -> ^3.48.0 (#6671) Regenerated the lockfile with npm install, then ran npm dedupe so a single hoisted [email protected] satisfies both the frontend workspace and the root peer deps. Without dedupe, npm nests react 19.2.7 in the frontend workspace while leaving react 19.2.6 hoisted at the root. The duplicate React copies break the jest suite with "Invalid hook call". Dependabot never caught this because it skips the frontend test job. The dedupe also refreshes a handful of unrelated transitive dev deps to newer in-range patches. That churn is unavoidable: CI installs with npm ci, so the lockfile must be a consistent npm-generated resolution. Verified locally: npm ci reproduces a single react, and licensecheck, lint, and all 520 jest tests pass.

• mozilla-blender[bot] (08 Jul 26)

  Merge pull request #6688 from mozilla/dependabot/npm_and_yarn/prettier-3.9.4 build(deps-dev): bump prettier from 3.8.4 to 3.9.4

• mozilla-blender[bot] (08 Jul 26)

  BLEnder fix(prettier): reformat WaitlistPage union type for prettier 3.9.4 Prettier 3.9.4 changed how a short type union that fits on one line is formatted, collapsing the leading-pipe multiline BasketResponseBody union onto a single line. Applied prettier --write to WaitlistPage.tsx so the lint format check passes. This also unblocks the Coveralls job, which only failed because the frontend test job aborted before uploading coverage.

• mozilla-blender[bot] (08 Jul 26)

  Merge pull request #6680 from mozilla/dependabot/npm_and_yarn/eslint-5dfef5780d build(deps-dev): bump eslint from 10.5.0 to 10.6.0 in the eslint group

• mozilla-blender[bot] (08 Jul 26)

  Merge pull request #6681 from mozilla/dependabot/pip/boto-cd07398d20 build(deps): bump the boto group with 2 updates

• mozilla-blender[bot] (08 Jul 26)

  Merge pull request #6682 from mozilla/dependabot/npm_and_yarn/immutable-5.1.9 build(deps): bump immutable from 5.1.7 to 5.1.9

• mozilla-blender[bot] (08 Jul 26)

  Merge pull request #6683 from mozilla/dependabot/pip/testing-libraries-2bce264215 build(deps): bump model-bakery from 1.23.5 to 1.24.0 in the testing-libraries group

• mozilla-blender[bot] (08 Jul 26)

  Merge pull request #6684 from mozilla/dependabot/npm_and_yarn/stylelint-17.14.0 build(deps-dev): bump stylelint from 17.13.0 to 17.14.0

• mozilla-blender[bot] (08 Jul 26)

  Merge pull request #6685 from mozilla/dependabot/pip/typing-stubs-01cc406ab4 build(deps): bump django-stubs from 6.0.5 to 6.0.6 in the typing-stubs group

• mozilla-blender[bot] (08 Jul 26)

  Merge pull request #6686 from mozilla/dependabot/npm_and_yarn/typescript-eslint-8.62.1 build(deps-dev): bump typescript-eslint from 8.62.0 to 8.62.1

• mozilla-blender[bot] (08 Jul 26)

  Merge pull request #6687 from mozilla/dependabot/pip/ruff-0.15.20 build(deps): bump ruff from 0.15.16 to 0.15.20

• mozilla-blender[bot] (08 Jul 26)

  Merge pull request #6689 from mozilla/dependabot/github_actions/docker/setup-buildx-action-4.1.0 build(deps): bump docker/setup-buildx-action from 4 to 4.1.0

• mozilla-blender[bot] (08 Jul 26)

  Merge pull request #6690 from mozilla/dependabot/github_actions/ruby/setup-ruby-1.315.0 build(deps): bump ruby/setup-ruby from 1.314.0 to 1.315.0

• mozilla-blender[bot] (08 Jul 26)

  Merge pull request #6691 from mozilla/dependabot/github_actions/mozilla/deploy-actions/dot-github/workflows/build-and-push.yml-6.7.0 build(deps): bump mozilla/deploy-actions/.github/workflows/build-and-push.yml from 6.6.3 to 6.7.0

• dependabot[bot] (08 Jul 26)

  build(deps): bump mozilla/deploy-actions/.github/workflows/build-and-push.yml Bumps [mozilla/deploy-actions/.github/workflows/build-and-push.yml](https://github.com/mozilla/deploy-actions) from 6.6.3 to 6.7.0. - [Release notes](https://github.com/mozilla/deploy-actions/releases) - [Commits](https://github.com/mozilla/deploy-actions/compare/20256256ac0d19735926dc7975a86dbbb7a06e5f...ef0f037316873ff408a598f1cd98876dd7851e53) --- updated-dependencies: - dependency-name: mozilla/deploy-actions/.github/workflows/build-and-push.yml dependency-version: 6.7.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>

• dependabot[bot] (08 Jul 26)

  build(deps): bump ruby/setup-ruby from 1.314.0 to 1.315.0 Bumps [ruby/setup-ruby](https://github.com/ruby/setup-ruby) from 1.314.0 to 1.315.0. - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](https://github.com/ruby/setup-ruby/compare/v1.314.0...v1.315.0) --- updated-dependencies: - dependency-name: ruby/setup-ruby dependency-version: 1.315.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>

• dependabot[bot] (08 Jul 26)

  build(deps): bump docker/setup-buildx-action from 4 to 4.1.0 Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 4 to 4.1.0. - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/v4...v4.1.0) --- updated-dependencies: - dependency-name: docker/setup-buildx-action dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>

• dependabot[bot] (08 Jul 26)

  build(deps-dev): bump prettier from 3.8.4 to 3.9.4 Bumps [prettier](https://github.com/prettier/prettier) from 3.8.4 to 3.9.4. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.4...3.9.4) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.4 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>

• dependabot[bot] (08 Jul 26)

  build(deps): bump ruff from 0.15.16 to 0.15.20 Bumps [ruff](https://github.com/astral-sh/ruff) from 0.15.16 to 0.15.20. - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](https://github.com/astral-sh/ruff/compare/0.15.16...0.15.20) --- updated-dependencies: - dependency-name: ruff dependency-version: 0.15.20 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]>

• dependabot[bot] (08 Jul 26)

  build(deps-dev): bump typescript-eslint from 8.62.0 to 8.62.1 Bumps [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) from 8.62.0 to 8.62.1. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.62.1/packages/typescript-eslint) --- updated-dependencies: - dependency-name: typescript-eslint dependency-version: 8.62.1 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]>

• dependabot[bot] (08 Jul 26)

  build(deps): bump django-stubs in the typing-stubs group Bumps the typing-stubs group with 1 update: [django-stubs](https://github.com/typeddjango/django-stubs). Updates `django-stubs` from 6.0.5 to 6.0.6 - [Release notes](https://github.com/typeddjango/django-stubs/releases) - [Commits](https://github.com/typeddjango/django-stubs/compare/6.0.5...6.0.6) --- updated-dependencies: - dependency-name: django-stubs dependency-version: 6.0.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: typing-stubs ... Signed-off-by: dependabot[bot] <[email protected]>

• dependabot[bot] (08 Jul 26)

  build(deps-dev): bump stylelint from 17.13.0 to 17.14.0 Bumps [stylelint](https://github.com/stylelint/stylelint) from 17.13.0 to 17.14.0. - [Release notes](https://github.com/stylelint/stylelint/releases) - [Changelog](https://github.com/stylelint/stylelint/blob/main/CHANGELOG.md) - [Commits](https://github.com/stylelint/stylelint/compare/17.13.0...17.14.0) --- updated-dependencies: - dependency-name: stylelint dependency-version: 17.14.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>

• dependabot[bot] (08 Jul 26)

  build(deps): bump model-bakery in the testing-libraries group Bumps the testing-libraries group with 1 update: [model-bakery](https://github.com/model-bakers/model_bakery). Updates `model-bakery` from 1.23.5 to 1.24.0 - [Release notes](https://github.com/model-bakers/model_bakery/releases) - [Changelog](https://github.com/model-bakers/model_bakery/blob/main/CHANGELOG.md) - [Commits](https://github.com/model-bakers/model_bakery/compare/1.23.5...1.24.0) --- updated-dependencies: - dependency-name: model-bakery dependency-version: 1.24.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: testing-libraries ... Signed-off-by: dependabot[bot] <[email protected]>

• dependabot[bot] (08 Jul 26)

  build(deps): bump immutable from 5.1.7 to 5.1.9 Bumps [immutable](https://github.com/immutable-js/immutable-js) from 5.1.7 to 5.1.9. - [Release notes](https://github.com/immutable-js/immutable-js/releases) - [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md) - [Commits](https://github.com/immutable-js/immutable-js/compare/v5.1.7...v5.1.9) --- updated-dependencies: - dependency-name: immutable dependency-version: 5.1.9 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]>