Issue triage 2026-10-31: 29 reviewed PRs into develop
Merges integration/issue-triage-2026-10-31 into develop: the result of a full triage of the open issues on 2026-10-31.
Every open issue was reviewed. Those already done, obsolete or answered were closed with a short comment, and the ones that would make the platform worse or more restrictive were declined. The rest were either implemented here, kept as backlog with a status note, or left open with a question for @evereq.
Each PR below was implemented in its own branch with tests and went through bot review (Copilot, Greptile, DeepScan, Codacy; CodeRabbit where its quota allowed). It was then reviewed again before it was merged into the integration branch; the larger ones (contacts, quick actions) also had an independent review. Every PR has a review comment saying what was checked.
What is in it (29 PRs)
| PR | Change | Issues |
|---|---|---|
| #11569 | Feat Auth: show sign-in codes and email links in the console in local development | closes #11568 |
| #11572 | fix(desktop): start Gauzy Server from a read-only install and load sharp on Linux | closes #7735, closes #9167 |
| #11573 | fix(auth): Sign in with LinkedIn (OpenID Connect) and X for existing users | closes #9203 |
| #11574 | feat(desktop-server): detect the server's IP and validate the server host | closes #7547, closes #7548, closes #7549, closes #7550 |
| #11575 | feat(reports): Time & Activity CSV export and weekly Spent column | closes #4735, closes #7527, refs #7201 |
| #11576 | fix(desktop): skip empty offline updates, add connectivity notices, selection prefill and web app link | closes #7811, closes #8415, closes #9517, refs #7753 |
| #11577 | fix(entitlement): race-safe grant and activation on a late order.placed | closes #11023 |
| #11578 | feat(organization): screen capture off for new organizations, EEA/UK acknowledgement to turn it on | closes #9872 |
| #11579 | feat(payroll): include payroll in export, import and factory reset; map pay cadences; cover processing | refs #10184 |
| #11580 | docs(devops): security policy, Caddy and DigitalOcean self-hosting, dev container, API debugging | closes #5570, closes #6769, closes #7010, closes #7323, closes #9573, refs #9156 |
| #11581 | feat(auth): operator switches to close sign-up, tenant creation and admin e-mail password reset | closes #5784, closes #7821 |
| #11582 | feat(time-off): take approved leave from the balance and fix the request-form download | closes #5481, refs #10183 |
| #11584 | feat(core): opt-in DB_CREATE_IF_NOT_EXISTS and LOG_HTTP_REQUESTS | closes #1769, closes #4006 |
| #11585 | fix(core): show Amounts Owed in the employee's rate currency | refs #4735 |
| #11586 | feat(desktop): screenshot popup close button, remembered mini timer position, custom and start/stop sounds | closes #6715, closes #7141, closes #7643, closes #7683 |
| #11587 | feat(ui): year date presets, task client filter, public banner hint, no fake expense receipt | closes #1869, closes #1882, closes #6847, refs #985 |
| #11588 | feat: contact notes and split contact create/delete permissions | closes #1114, closes #5468 |
| #11589 | feat(plugin-auth-oidc): sign in with any OpenID Connect provider | refs #42 |
| #11590 | fix(organization): judge the exit/logout restriction location from what is stored | refs #9873 |
| #11591 | fix: describe every permission, keep custom team roles on team edit, create goals from presets (#3912, #6569, #4825) | closes #3912, closes #4825, closes #6569 |
| #11592 | feat: deals board by stage, PM dashboard recent activity, What's New management | closes #1660, closes #3470, refs #4848 |
| #11593 | feat(i18n): complete the Simplified Chinese UI translation | closes #9448 |
| #11594 | feat(github): choose each project's sync label on the GitHub integration page | refs #7083 |
| #11595 | feat(quick-actions): let each user reorder quick actions and rebind their shortcuts | closes #7091 |
| #11596 | fix(deploy): keep Ever addresses out of the deploy templates (egress audit) | refs #9156, refs #11580 |
| #11597 | fix(desktop): keep the Gauzy Cloud API address in the main process (egress audit) | refs #9517 |
| #11598 | style(github-ui): keep muted text muted in every theme (follow-up to #11594) | refs #7083 |
| #11599 | fix(egress-audit): scan the files git sees, not generated ignored ones | — |
| #11600 | chore(ui): migrate the remaining templates to the built-in control flow (schematic) | refs #9552 |
Checks on the combined branch
- Type-check: contracts, core, auth, desktop-lib and the whole web app (
apps/gauzy/tsconfig.app.json): 0 errors. The plugin library configs show exactly the errorsdevelopalready has, from compiling core under the plugins' settings. - Egress audit: passes on the integration branch: the static scan, and all 8 browser modes on the last PR that ran them.
- Translations: all 14 UI language files parse with no duplicate keys, and Chinese is at full key parity.
- Unit tests: PR CI does not run them, so each lane ran its own suites; the counts are in each PR.
- Migrations: five new ones, all with timestamps after
develop's newest (core 1791000003630, 3660, 3870, 3880; entitlement 1791000003580). The core migration smoke test (packages/core/src/lib/database/migration-smoke.spec.ts) passes on the combined branch at1acf8570e4: every core migration applies to an empty SQLite database, 4 of 4 tests in 1,117 s. The entitlement migration is not part of that chain; #11577 ran it on real SQLite with both TypeORM and MikroORM and asserts the DDL for each dialect. None of the five has been run on Postgres or MySQL here (Docker was not available). - Develop merged in (
7b92bb4d96): #11566, #11559, #11565 and #11602 landed ondevelopmeanwhile. The one conflict was the Add task dialog: #11566 moved its fields into a side panel, and the client field from #11587 now sits right above the project field there. After the merge the web app and the subscription plugin type-check with 0 errors, and the dialog specs pass (21 of 21). - Manual runs on the integration branch (PRs into
developstart no workflows): Static Checks passed on the pre-merge tip (41185735194). Build 41198561306 and Static Checks 41198563424 run on7b92bb4d96.
Notes for the merge
- Workflow files:
.github/workflows/static-checks.ymlgains the report-only translation parity check (#11593)..github/workflows/egress-audit.ymlhasBASELINE_REWALK: 'true'for the new What's New settings route (#11592, the documented exception, same as 760b72cbac). It stays'true'until this reachesmaster, because the develop → stage → master promotion pull requests compare with a base that lacks the new entries. Set it back to'false'after that release, as 39d54cf1d8 did after #11531. - Demo deploy: a merge into
developdeploys the demo environment. Production deploys frommasterand is not affected. - Not verified in a running app: the UI flows each PR lists under "not verified" (drag and drop, desktop app flows, right-to-left layouts).
Issues
Closed by this merge:
Closes #1114
Closes #1660
Closes #1769
Closes #1869
Closes #1882
Closes #3470
Closes #3912
Closes #4006
Closes #4735
Closes #4825
Closes #5468
Closes #5481
Closes #5570
Closes #5784
Closes #6569
Closes #6715
Closes #6769
Closes #6847
Closes #7010
Closes #7091
Closes #7141
Closes #7323
Closes #7527
Closes #7547
Closes #7548
Closes #7549
Closes #7550
Closes #7643
Closes #7683
Closes #7735
Closes #7811
Closes #7821
Closes #8415
Closes #9167
Closes #9203
Closes #9448
Closes #9517
Closes #9573
Closes #9872
Closes #11023
Closes #11568
Related, left open (follow-ups or remaining parts): #42, #985, #4848, #7083, #7201, #7753, #9156, #9552, #9873, #10183, #10184
🤖 Generated with Claude Code