Repository navigation
Sync ako/mxcli: mongo-driver CVE upgrade, ALTER PAGE in Accordion groups, SET Label/textbox fixes - #1507
Merged
Conversation
A canvas on which a user and an agent sketch a Mendix app through five layers (sketch, notes, impression, spec & tests, model) and three lenses (security, integration, architecture), with requirements in the project brain and the model built through mxcli's existing MDL, check, exec and run --local. Proposes per-requirement status in brain plan --json. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WGkvWsVVLHHP6JsDmKgztC
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WGkvWsVVLHHP6JsDmKgztC
ALTER PAGE could not address a DataGrid 2, or any widget, inside a
pluggable widget's object-list item such as an Accordion group or a
Pop-up menu item:
set (Caption: 'Quantity') on Qty
-> widget "Qty" not found ... available columns: Name, Qty
set (Caption: 'Quantity') on g1.Qty
-> widget "g1" not found
findInWidgetChildren descended into a pluggable widget's own widget
properties and into DataGrid 2 columns, but not into other object
lists, whose items keep widgets at Objects[].Properties[].Value.Widgets.
The not-found message is built by a generic walk that does descend, so
it listed the columns the resolver had just refused.
Add objectListItemValues and use it in the finder (skipping `columns`,
which keeps its derived-name-first lookup) and in the widget-scope
collector, matching the descent findNearestDSInChildren got for #935.
Control: with the fix stashed, the new tests and the unfixed binary
fail with the reporter's exact messages; fixed, mx check (11.12.1)
reports 0 errors.
Refs #1274
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018d9s3aLWW7MCos2mfNnXYo
sync-mods called rsync unconditionally, so `make build` failed with Error 127 on a machine without rsync, while sync-skills and sync-skill-packs fall back to rm + cp -R. The mods sync also excludes tests, type stubs and tsconfig, so its fallback prunes those after the copy. Verified with rsync hidden from PATH: the fallback's tree is identical (diff -r) to rsync's, including with each excluded pattern planted in mods/, and a stale file in the target is removed as --delete would. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018d9s3aLWW7MCos2mfNnXYo
…binding (#1291) `describe page` printed an association combo box with an On change microflow without `Attribute:` or `CaptionAttribute:` on nightly-20260927-95091765. Already fixed on main by 64a38bf (the generic pluggable branch's OnChange term gated with !isKnownCustomWidgetType), but that fix landed in a merge resolution with no bug-test script. Adds the issue's shape as mdl-examples/bug-tests (0 errors on 11.12.1; with the guard reverted the re-executed description fails CE0642 'Entity' and 'Caption' required) and a finding on the triage route. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XmLAPLPxDSCeeF5hfTt1KH
The bracketed spelling is MDL-DEPR125 and failed the conformance gate. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XmLAPLPxDSCeeF5hfTt1KH
…thing mendixlabs#292: "ALTER PAGE SET Title / SET Label silently succeeds but change does not persist". Title and an already-shown label were fixed earlier; setWidgetLabelMut still returned a bare nil for two shapes: - an input widget that shows no label stores `LabelTemplate: null`; the label is now created as the same Forms$ClientTemplate create page writes - a widget with no label slot (a button), or a pluggable widget whose LabelTemplate is null, is refused: "widget has no Label property" The refusal also reaches `mxcli check --references` through the setter probe. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CS3jxiq2vnQdHsNSQMqUtV
…dation `alter page … set Placeholder = '…' on <textbox>` was refused with "property \"Placeholder\" is not a property of this built-in widget", though CREATE writes `Placeholder:` and DESCRIBE prints it (mendixlabs#414). Password, Validation and ValidationMessage — the textbox's other CREATE-only keys — fell through to the same refusal, because setRawWidgetPropertyMut had no case for any of them. setInputWidgetPropertyMut writes them into the stored shape CREATE uses (PlaceholderTemplate, IsPasswordBox, Forms$WidgetValidation), guarded on the stored key so a pluggable widget's own `placeholder`/`validation` keeps the pluggable route and a widget without one keeps the refusal. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RJXsMAJtFtFdSC5ZqfvLE7
The conformance gate refused the deprecated spellings (SAVE_CHANGES,
`set X = …`, `Params: { … }`); rewritten with `mxcli fmt --upgrade`.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CS3jxiq2vnQdHsNSQMqUtV
A customer's release scan (Sonatype Lifecycle, blocking at CVSS >= 7) refused the published .exe over three CVEs in go.mongodb.org/mongo-driver/v2 v2.6.0. go.mongodb.org/mongo-driver/v2 v2.6.0 -> v2.9.2 go.mongodb.org/mongo-driver v1.17.9 -> v1.17.10 Reachability, checked per CVE rather than per module: - CVE-2026-81521 (Client.BulkWrite namespace confusion) is NOT reachable. mxcli imports only the BSON packages (v2/bson in 271 files, v2/x/bsonx/bsoncore in 9, v1 bson and bson/primitive); no mongo client package is imported anywhere. - CVE-2026-107324 (bson.Raw.Validate) and CVE-2026-107325 (bson.RawArray.Validate) ARE reachable. Both are called on bytes read from a .mpr: modelsdk/canon/attributeref.go:92, modelsdk/mprread/generic.go:121, modelsdk/mpr/reader_raw.go:242 and cmd/mxcli/cmd_fix_hashes.go:167, each of them defensively, expecting an error for bytes that are not a valid document. A panicking Validate turns a malformed project file into a crash of the CLI — denial of service only, no code execution. v2.9.2 is the floor for all three: CVE-2026-81521 was fixed in v2.8.2, regressed out of v2.9.0 and v2.9.1, and restored in v2.9.2. The upgrade also raises the declared github.com/klauspost/compress requirement from v1.17.6 to v1.19.2, which the same scan flagged. That module is pulled in by the driver for wire-protocol compression and is compiled into no mxcli build: it has no go.sum entry and no `go version -m bin/mxcli` line. Note that govulncheck reports "No vulnerabilities found" against the affected tree — these CVEs are absent from the Go vulnerability database (an OSV query for mongo-driver/v2@2.6.0 returns a bare {}), so a clean govulncheck here is a data-source gap, not evidence. Regression test with a control, per the CLAUDE.md evidence bar: TestRawUnitName_MalformedBSONDoesNotPanic drives the malformed bytes through rawUnitName, mxcli's own call site. Against v2.6.0 it fails with "runtime error: slice bounds out of range [:-2147483641]", the reported symptom; against v2.9.2 it passes. It therefore detects a downgrade of the driver, not merely the absence of a crash. No source change and no API change; BSON encoding and decoding are unaffected. Verified: go build ./... clean, 104 test packages pass, go vet clean (bar the pre-existing generated ANTLR parser warnings), and `go version -m bin/mxcli` shows v2.9.2 / v1.17.10. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Rer1mzP69XxbXKxQqheipM
test: regression case for describe dropping a combobox's association binding (#1291)
`group g1 (Caption: 'Group one')` inside an Accordion passed check, exec reported success, and the group kept the package default header text 'Header'. The group's header is `headerText`; `Caption` matches nothing. Object-list items (Accordion groups, DataGrid 2 columns, chart series, HTMLElement attributes) were exempt from both unknown-property checks, on the grounds that the object-list engine validates them. It does not: buildObjectListItem walks the item's schema and looks each key up in the MDL bag, so a key matching no schema property is never visited. validateObjectListItemUnknownProps derives the item's vocabulary from its mapping (schema keys, MDL aliases, the <name>Params companion of a text template, a chart series' DataSource:) and reports anything else as MDL-WIDGET01. It deliberately does not reuse the top-level allowance for builtin names such as Caption and Class; that allowance is the hole. A sweep of every repo .mdl with `check -p` against a project holding the stock packages (baseline vs new) found 6 new reports, all real drops confirmed by exec + bson dump: the two #891 repros (Caption on a group), two doctype examples putting designproperties on a column (a column has none; the grid carries the same values), and the #1135 repro writing attributeValue, which HTMLElement stores as attributeValueTemplate / attributeValueExpression. Those examples are corrected here. For a truncated key like that, keys extending it are now suggested ahead of the nearest by edit distance, which had proposed attributeName. Control: with the check unwired, TestAccordionGroupCaptionIsRefused fails ("no MDL-WIDGET01 for `Caption` on an Accordion group"). Refs #1274 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018d9s3aLWW7MCos2mfNnXYo
fix(deps): upgrade mongo-driver for the October 2026 BSON advisories go.mongodb.org/mongo-driver/v2 v2.6.0 -> v2.9.2 and go.mongodb.org/mongo-driver v1.17.9 -> v1.17.10, clearing CVE-2026-107324, CVE-2026-107325 and CVE-2026-81521 from a customer's blocking release scan. The two bson.Raw/RawArray.Validate panics were reachable on bytes read from a .mpr; the BulkWrite CVE was not, as no mongo client package is imported. Adds a regression test with a control that fails against v2.6.0 with the reported panic.
fix(pages): address widgets inside Accordion groups; refuse dropped item properties (#891)
Proposal: Mendix whiteboard — sketch an app with an agent, from napkin to running model
fix: ALTER PAGE SET writes a textbox's Placeholder, Password and Validation
fix(alter page): SET Label no longer reports success while storing nothing
AI Code ReviewCritical IssuesNone found. Moderate IssuesNone found. Minor IssuesNone found. What Looks Good
RecommendationApprove the PR. All changes are well-tested, address real issues, and maintain consistency with the project's architecture and conventions. The security upgrade is necessary and properly validated. The functional fixes resolve long-standing bugs with appropriate test coverage. No critical or moderate issues were identified. Automated review via OpenRouter (Nemotron Super 120B) — workflow source |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Syncs
ako/mxcli:maininto upstream: 11 commits from fork PRs ako#1366, ako#1368–ako#1372.Security
go.mongodb.org/mongo-driver/v2goes from v2.6.0 to v2.9.2, andgo.mongodb.org/mongo-driverfrom v1.17.9 to v1.17.10. A customer's release scan blocked the published.exeover CVE-2026-107324, CVE-2026-107325 and CVE-2026-81521.Validatepanics were reachable on bytes read from a.mpr, so a malformed project file could crash the CLI. This is denial of service only.ALTER PAGE
set … on Qtyandset … on g1.Qtyused to fail with "not found" for a DataGrid 2 inside a group.check --referencesreports the same refusal.check
group g1 (Caption: …)passed check and exec, but the value was silently dropped..mdlfiles found six real drops. The affected doctype and bug-test examples are corrected here.Tests, docs and build
make sync-modsgets the samecpfallback thatsync-skillshas, for systems without rsync.silent-property-dropbug-pattern page was synced, and thealter-pagedocs and CHANGELOG were updated