Discourse

Recent Commits

• Sérgio Saquetim (10 Jul 26)

  FIX: Make a11y.announce safe to call during render (#41629) `a11y.announce` updated its tracked announcement map synchronously, so calling it during render — for example from an async data resolution that announces its result count — tripped Ember's backtracking-rerender assertion ("attempted to update … already used in the same computation") and broke the render. This defers the tracked write to the runloop with `next`, so it lands after the current render. Validation (message / type / delay) still throws synchronously, and `settled()` still awaits the deferred update, so callers and tests observe the announcement as before. A live region is polled asynchronously by screen readers, so the one-tick delay is imperceptible. Adds a regression test that announces from a getter read during render (alongside `<A11yLiveRegions />`) and asserts the announcement renders without a backtracking error.

• Kris (10 Jul 26)

  FIX: only show first paragraph of localized category descriptions (#41511) Reported here: https://meta.discourse.org/t/category-description-truncates-to-first-paragraph-for-primary-base-language-but-not-for-localizations-panel-languages/406801 In a number of places we only show the first paragraph of a category description by default, but when someone manually adds a category description translation we show the full content. This results in translated content being much longer in some places where only a single paragraph is expected (/categories pages, category headers, etc). This change cooks the translated description and applies the same single paragraph rule where relevant. `Category.first_paragraph_description` has been extracted to be used in both the default and translated descriptions so the behavior remains consistent.

• Keegan George (10 Jul 26)

  DEV: Introduce `enable_local_logins_via_code` as an alpha upcoming change (#41624) **Previously**, login with email codes was gated behind a hidden site setting, invisible to admins and checked via raw `SiteSetting` reads that would ignore upcoming-change auto-promotion. **In this update**, registered the setting as an alpha upcoming change (with preview image and learn-more link), moved server-side checks to `UpcomingChanges`, and hid the change on sites where it cannot be enabled.

• Keegan George (10 Jul 26)

  FIX: Make user field checkboxes usable on the code login page (#41626) **Previously**, required checkbox (`confirm`) user fields shown during the email-code login flow were stretched to full width by the shared `.input-group input` rule, rendering them as an unclickable bar because the checkbox size override was scoped only to `.signup-fullpage`/`.invite-page`. **In this update**, extended the override to `.login-fullpage` so checkbox user fields render at their correct size on the code login page. Added a system spec covering the scenario (required `confirm` field → `/login` → email code → user-fields step), which asserts the checkbox renders at a usable width, is toggleable, and persists. Verified as a true regression test: it fails (checkbox width 404px) without the CSS change and passes with it. --------- Co-authored-by: Penar Musaraj <[email protected]>

• Kris (10 Jul 26)

  UX: update review queue icon to link (#41622) This icon got caught up in other updates, it should remain a link rather than the share icon, as it copies the link before <img width="800" alt="image" src="https://github.com/user-attachments/assets/b086070f-d7d7-436b-b939-f4aec7930ed3" /> after <img width="800" alt="image" src="https://github.com/user-attachments/assets/9c51048e-495f-4542-b93f-050684aa77cb" />

• Gabriel Grubba (10 Jul 26)

  FEATURE: Add AI agent suspend/silence tools with inline approval review (#41497) Previously, AI agents had no way to suspend or silence users, and approving any moderation tool action meant leaving the conversation for the `/review` queue. This change adds `suspend_user`/`silence_user` tools that always require moderator approval, and lets moderators approve or reject those actions from an inline review card right in the bot conversation — credited to the approving moderator (not the bot) in the staff action log — instead of switching to the `/review` queue. Demo of this feature: https://github.com/user-attachments/assets/b9605511-e53d-483d-b435-b212694cdf53 https://github.com/user-attachments/assets/383bda5d-93ee-4758-a51e-6162ea0d57ee --------- Co-authored-by: Penar Musaraj <[email protected]>

• Natalie Tay (10 Jul 26)

  FIX: Print site setting descriptions and setting enums correctly (#41617) For site setting descriptions, we have the ability to link to another site setting via defining `{{setting. ... }}` in the i18n description. Presentation of this was not extended to AI settings, resulting in it being poorly displayed. Also, setting enums were not being displayed properly either.

• Penar Musaraj (10 Jul 26)

  UX: Tweaks to default theme screenshots (#41592)

• David Battersby (10 Jul 26)

  FIX: close post reaction menu on route change (#41619) When the reaction menu is open and the user navigates to a new page — we should force close the menu.

• Joffrey JAFFEUX (10 Jul 26)

  FIX: Bind workflow modal responses to their target user (#41620) Modal nodes publish an approve/reject modal to a single resolved target user over a per-user MessageBus channel. Each button carried an HMAC-signed action token, but the token only proved it was issued by the server, not who it was for: any logged-in user who obtained a valid token could POST it and resume the execution under their own account. In practice this was hard to pull off as only the valid user would get the message bus event (and the modal to show), but this is an important defense in depth fix to apply.

• Joffrey JAFFEUX (10 Jul 26)

  FEATURE: Add workflow triggers for group membership changes (#41608) Adds user_added_to_group and user_removed_from_group workflow triggers, each scoped to a required group. The triggers emit user, group, and membership metadata.

• Alan Guo Xiang Tan (10 Jul 26)

  DEV: Improve RSpec agent testing guidance (#41611) This PR updates the RSpec agent skill with Discourse-specific guidance for choosing assertions, structuring fixtures, and writing reliable system tests. The copied generic RSpec style guide duplicated upstream advice that could drift from both its source and Discourse's conventions. Key changes: * Add public-boundary and test-layer guidance so specs assert behavior owned by the layer under test. * Add fabricator, system-test cost, deterministic transient-state, URL, and page-object guidance to reduce brittle tests. * Remove the copied style guide and its references so the skill only maintains Discourse-specific advice.

• Isaac Janzen (10 Jul 26)

  SECURITY: Private UserField value disclosure via directory_items `order` sort side-channel (#41598) ## Summary Prevent unauthenticated disclosure of private user custom field values via the directory items sort order. The fix restricts the `order` parameter to public fields for non-staff users and falls back to default sorting when an unauthorized field is requested. ## Source - Patch Triage: https://patch.discourse.org/patch-triage/1334 Co-authored-by: discourse-patch-triage <272280883+discourse-patch-triage[bot]@users.noreply.github.com>

• Krzysztof Kotlarek (10 Jul 26)

  FIX: Return database connections to the pool after dashboard builds (#41583) Previously, AdminDashboardSectionLoader worker threads leased a database connection on their first query and held it while idling in the shared thread pool, which exhausted the connection pool (sized 5 in development) and made subsequent requests fail with "could not obtain a connection from the pool within 5.000 seconds". This change wraps each section build in ActiveRecord::Base.with_connection(prevent_permanent_checkout: true) so the connection is checked back in as soon as the section finishes building - the flag is required because sections use ActiveRecord::Base.connection internally, which would otherwise mark the connection as permanently checked out for the thread. The regression spec lives in a separate describe block with use_transactional_tests = false because both transactional tests and fab!'s before(:all) transaction pin a single shared connection across threads, which masks the leak.

• Natalie Tay (10 Jul 26)

  FEATURE: Add category scope for AI translations (#41585) We have switched AI translations settings first from public categories, to "include" categories, then to "exclude" categories. This is not great. Some admins prefer one, and some prefer others. This PR allows admins to do either. This also updates default categories to be "public" only, when the original default was "all" (public + private). The migration covers moving existing users to - if has selected categories -> "exclude strict" + their selected categories - if no selected categories + feature enabled -> "all" to maintain status quo https://github.com/user-attachments/assets/607f2340-8fa6-4059-b13d-07d1938ad74f

• Penar Musaraj (09 Jul 26)

  DEV: Fix stylesheet watcher file matching (#41593) Previously a file with `admin` in the name, would match the admin stylesheet. Now this doesn't happen. Found this out by editing the admin-onboarding-banner file and not seeing live updates in the browser.

• Penar Musaraj (09 Jul 26)

  FIX: Avoid 500 error on rare missing topic during MB publish (#41594)

• Renato Atilio (09 Jul 26)

  DEV: Clean up workflow expression reference internals (#41545) Follow-up cleanup to #41442. No behavior change. - `NODE_REF_RE` and `parseNodeReferenceName` were duplicated verbatim in `expression-context.js` and `reference-label.js`, so the two parsers had to be kept in sync by hand. They are now exported from `expression-context.js` and imported by `reference-label.js`, and the two identical single-quote unescapers in `expression-context.js` are folded into one helper. - Drops four `register_svg_icon` calls (`diagram-project`, `right-to-bracket`, `user`, `gear`) that are already in core's always-bundled base sprite (`SvgSprite::SVG_ICONS`), so re-registering them was a no-op. Only `dollar-sign` still needs registering. The other bracket/quote scanners (`splitLastAccessor`, `resolveBracketSuffix`) are deliberately left separate: they serve different purposes (runtime value resolution vs. picker-current matching) with different escaping semantics, so merging them would change behavior rather than clean it up.

• Rafael dos Santos Silva (09 Jul 26)

  FEATURE: Add 25 default data explorer queries for traffic, health, moderation and audits (#41571) Previously, the data explorer shipped only 19 default queries, mostly focused on user engagement curiosities, leaving the most common admin needs — traffic reporting, community health trends, moderation reporting, and permission/promotion audits — to be rediscovered over and over in Meta support topics. This change adds 25 curated default queries (ids `-20` to `-44`) covering those areas, sourced from Meta's saved query library and staff-authored answers in support topics, with stale hardcoded values generalized into parameters and known bugs fixed (overlapping histogram buckets, admin-only staff filters, row-multiplying joins replaced with `reviewable_scores`-based logic). Queries that depend on optional features (locale detection, browser pageview collection) carry an explicit warning in their description naming the required setting. Beyond being directly useful, the set is deliberately written as a learning corpus for the AI agent that helps admins create new queries (and for humans modifying them): together they demonstrate nearly every parameter type and the common patterns — relative time windows, gapless `generate_series` series, `FILTER` aggregates, anti-joins, window functions, nullable optional filters — with inline comments decoding non-obvious internals such as `user_histories` action codes and bot account id conventions. All 25 queries are verified to execute against a live database, and the rebuilt flag reports were smoke-tested with real flag data. --------- Co-authored-by: Natalie Tay <[email protected]>

• Isaac Janzen (09 Jul 26)

  SECURITY: detailed_404 Security Setting Bypassed (#41549) ## Summary Prevent information disclosure of topic existence by ensuring secondary topic endpoints respect the 'detailed_404' security setting. The patch implements a normalization handler for several TopicsController actions—including post retrieval and notification updates—to return a consistent 404 status code for inaccessible topics when the setting is disabled. ## Source - Patch Triage: https://patch.discourse.org/patch-triage/1384 Co-authored-by: discourse-patch-triage <272280883+discourse-patch-triage[bot]@users.noreply.github.com>

• Gabriel Grubba (09 Jul 26)

  FEATURE: Support bulk user search in the admin users list (#41572) Admins can now search for multiple users at once in `/admin/users/list` by separating usernames or emails with commas or whitespace — useful for support workflows where a list of users needs to be checked in one go (e.g. pasted from a spreadsheet; spaces work because usernames and emails can never contain them). The search is also shareable via URL: typing keeps the address bar in sync with a `filter` query param (`/admin/users/list/active?filter=sam,[email protected]`), and visiting such a URL prefills the search box and filters the list. The old `username` query param keeps working as a read-only legacy fallback — it was a misleading name, since searches also match emails. ## Demo: https://github.com/user-attachments/assets/c85e4f30-3c06-493b-9fed-bb2057209c5d

• Kris (09 Jul 26)

  UX: category slug isn't required on edit (#41570)

• Natalie Tay (09 Jul 26)

  DEV: Site settings skills - for categories can allow for more flexible options (#41504) Adding new site settings tends to involve the same small convention checks around naming, descriptions, client exposure, admin grouping, and whether the setting reads clearly in the UI. This PR adds a generic `discourse-site-settings` skill for authoring and reviewing Discourse site settings. It includes guidance for core and plugin setting files, i18n descriptions, validators for dependent settings, browser verification of rendered setting copy, and review checks. It also documents a proposed category-list pattern using paired `xyz_category_scope` and `xyz_categories` settings, including the include, exclude, strict, public, and all modes.

• Natalie Tay (09 Jul 26)

  DEV: Turn on AI data explorer queries by default (#41581) Now that we've reached a certain level of confidence for data explorer query generation using AI, we can turn it on by default.

• Krzysztof Kotlarek (09 Jul 26)

  DEV: Bump `dashboard_improvements` upcoming change to alpha (#41536) Previously, the `dashboard_improvements` upcoming change was marked as `experimental`. This change promotes it to `alpha`.

• Mark VanLandingham (09 Jul 26)

  FEATURE: Support category-scoped upcoming events calendars (#41561) Previously, embedded upcoming events calendars always fetched all visible events and created events without a category. This change lets callers pass a category scope to `UpcomingEventsCalendar`, uses it for event fetching and composer defaults, and lets embedded callers opt out of the calendar's existing route/date syncing via `@updateRouteOnDatesChange={{false}}`. The default preserves the existing `/upcoming-events` behavior for backwards compatibility.

• Natalie Tay (09 Jul 26)

  FEATURE: Scoped AI highlights to user-selected categories (#41506) AI Highlights for the dashboard now use every category. This is problematic because some categories are staff-only and shouldn't contribute to the highlights. This PR adds a new setting to scope highlights to public categories by default.

• Alan Guo Xiang Tan (09 Jul 26)

  DEV: Enable Playwright soft reset on CI for all system tests (#41573) This PR enables the Playwright soft reset optimization for every system test target on CI, not just `core` and `chat`. The soft reset path (`PlaywrightSoftReset` in `spec/support/system/capybara_patches.rb`, gated on the `CAPYBARA_PLAYWRIGHT_SOFT_RESET` env var) reuses the browser context between examples instead of tearing it down, speeding up system specs. It was previously scoped to only the `core` and `chat` targets in `.github/workflows/tests.yml` while it was proven out; the other system targets still paid the full-reset cost. Key changes: * Set `CAPYBARA_PLAYWRIGHT_SOFT_RESET` to `1` for all `system` build types, dropping the `core`/`chat` target condition, now that the approach has proven stable on those targets.

• Martin Brennan (09 Jul 26)

  DEV: Fix headings for theme setting docs (#41574) Headings are wrong levels for https://meta.discourse.org/t/add-settings-to-your-discourse-theme/82557

• Penar Musaraj (08 Jul 26)

  FIX: apply featured-links treatment to topics even when they have content (#41550) Previously, a link pasted in the title field would be treated as a featured link only if the topic had no content. With this change, this applies even if topic has content. Pasting a link in the title will assign it as a featured link and append the link to the topic content.