Appearance
September 2026
26 September 2026
CI passes again
Two checks were failing on every pull request, neither caused by the change under review.
The security scan refused a weak-confidence warning on the signing-providers screen, where a list of setting names was joined and marked html_safe. Each name was already escaped, so the output was safe — but the line asserted that, and the next edit would have inherited the assertion whether or not it still held. It now uses safe_join, which escapes rather than promises.
A database test built its own connection and left out the password. Local Postgres does not ask for one, so it passed everywhere except CI, which does. It now passes every credential the configuration carries — verified against CI's exact environment, since a local run could not have failed either way.
A third appeared while those were being fixed. The gem audit began failing on mail 2.9.0, for an advisory published after the last passing run (CVE-2026-63435, medium: address spoofing through malformed encoded-words). Verity sends mail for team invitations and password resets. Updated to 2.9.1, and nothing else in the lockfile moved.
That one is worth remembering: a pull request that changes nothing can still turn red, because the audit checks the dependencies against advisories published today.
See what CI refuses.
Also in this branch, from 31 August
The freelancer path, template export and import, the letterhead, and the permissions migration are described in August. They merge together with this.