LoginSign Up
← Back to all sparks
A

AFFiNE

COLLAB
Velocity5.0

Open-source workspace for docs, whiteboards and databases

affine.pro ↗

AFFiNE's canaries stay on upkeep: a Swift Collections bump follows CVE and migration fixes.

knowledge basecanary buildssecurity patchesself-hosteddependency maintenance
◆Current state
AFFiNE ships a canary build almost daily, and nearly all of October has been dependency and infrastructure work. The newest, canary 915, bumps Apple's Swift Collections package to 1.7.4 for the native apps. Before it came a happy-dom code-execution CVE patch, payment-record repairs during a data migration, and non-root, read-only containers with multi-architecture Windows builds.
◆Where it's heading
The feed reads like a team hardening the backend and toolchain ahead of a larger cutover: a payment-identity migration, stricter deployment defaults and steady Renovate bumps across web, server and native code. Feature work isn't visible in canaries this month; the last user-facing fix was October 12's blob-upload quota correction.
◆Prediction
Expect the data migration to finish in the next canaries, followed by a stable release that bundles it; the entries don't show which user-facing feature is next.

◆Recent moves

  1. 2d ago

    Canary 909: Windows static-link build fix

    A single fix to static linking in the Windows client build. It follows last week's multi-architecture Windows work and keeps the canary run on maintenance.

    View source ↗
  2. 3d ago

    Canary 915: Swift Collections bumped to 1.7.4

    A Renovate bump of Apple's Swift Collections package to 1.7.4, a patch release of bug fixes used by the native apps. It extends October's maintenance-only canary run with nothing users will notice.

    View source ↗
  3. 4d ago

    Canary 907: happy-dom v21 patches code-execution CVE

    A Renovate bump of happy-dom to v21 to close an incomplete fix for a host-code-execution CVE. Needed security hygiene in the test and rendering toolchain, with no visible change for users.

    View source ↗
  4. 6d ago

    Canary 908: payment-record and upload fixes for data migration

    Server-side migration fixes: payment records without a provider identity now need repair rather than legacy matching, pending uploads survive the cutover, and embedding projections refresh on content changes. It's backend groundwork for a billing and AI-index migration.

    View source ↗
  5. 7d ago

    Canary 909: hardened containers, multi-arch Windows builds

    Alongside a dependency sweep, containers now run non-root on read-only filesystems and Windows desktop builds target multiple architectures. Self-hosters get safer defaults, and Windows users on ARM get a native build.

    View source ↗
  6. 17d ago

    AFFiNE fixes blob uploads after storage quota changes

    Blob uploads now use the workspace's current storage limit, so a quota increase takes effect without a stale cap blocking uploads, and cancelling one upload no longer aborts others. It is the first user-facing fix after five dependency-only canaries.

    View source ↗