Skip to content

chore: update POT file - #766

Merged
surajshetty3416 merged 1 commit into
frappe:developfrom
mardausdennis:pot_develop_2026-08-17
Aug 19, 2026
Merged

chore: update POT file#766
surajshetty3416 merged 1 commit into
frappe:developfrom
mardausdennis:pot_develop_2026-08-17

Conversation

@mardausdennis

@mardausdennis mardausdennis commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

Regenerated builder/locale/main.pot from develop. The committed file was last updated on 2026-08-13, so it predates the strings wrapped in #746 and #750 and the AI rewrite in #754.

This is the first successful extraction since #758. I ran the same steps as .github/helper/update_pot_file.sh on a plain ubuntu-latest runner, which also confirms that the fix in #758 works: bench generate-pot-file --app builder now completes instead of raising RuntimeError: object is not bound. The run took 1m42s.

The result is 1165 strings, up from 929.

One aside while comparing: Drop image to attach disappears from the POT because it is now plain template text in frontend/src/components/BuilderAIChatPanel.vue rather than a __() call. It looks like the wrapper was lost in the rewrite. Not touched here, since this PR is only the regenerated file, but it is worth a look.

The next scheduled run is Sunday. This PR just gets the current strings into the catalog now, so translators are not a week behind.

@greptile-apps

greptile-apps Bot commented Aug 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Reviews (3): Last reviewed commit: "chore: update POT file" | Re-trigger Greptile

@mardausdennis
mardausdennis force-pushed the pot_develop_2026-08-17 branch from faf6c57 to d87c156 Compare August 17, 2026 16:37
@mardausdennis

mardausdennis commented Aug 17, 2026

Copy link
Copy Markdown
Contributor Author

The failing Server check is not caused by this PR. It looks like develop is currently broken against frappe/develop.

Evidence:

  • This PR changes exactly one file, builder/locale/main.pot. A gettext template cannot affect block styles or script escaping.
  • develop is still at 6a26ad71, and the push run for that same commit passed all 275 tests at 10:24 UTC today.
  • frappe/frappe merged frappe#41626 (fix/sanitize-json-content) at 10:59 UTC, which touches frappe/utils/html_utils.py.
  • Builder CI installs frappe from develop unpinned, so every run after 10:59 gets the new sanitizer.
  • I re-ran this PR with an identical tree at 14:07 and again at 16:40 UTC. Both fail the same two assertions, so it is not flaky.

The two failures both involve content that passes through HTML sanitization:

AssertionError: 'var(--new-brand, #eee)' not found in
'[{"blockId": "root", "baseStyles": {"color": "var(--new-brand)", ...

AssertionError: '<\/script><p>Component Script</p>' not found in '<!DOCTYPE html> ...

The design token fallback is gone and the </script> escaping is no longer applied.

As far as I can tell this PR is just the first one tested after that frappe merge, since develop has not been pushed since 10:24. Worth checking independently of this PR.

@mardausdennis

mardausdennis commented Aug 17, 2026

Copy link
Copy Markdown
Contributor Author

Root cause, and it is not a frappe regression.

frappe#41626 deliberately removed the JSON bypass in sanitize_html:

 	if not always_sanitize:
-		if is_json(html):
-			return html
-
 		if not bool(BeautifulSoup(html, "html.parser").find()):
 			return html

The old docstring already called that bypass risky, and the new tests assert that {"x": "<script>alert(1)</script>"} no longer passes through. The change is intentional and correct.

What it means here: builder_page.blocks and draft_blocks are Long Text, and the script and html fields are Code. Their content is block JSON carrying markup, so it used to take the JSON bypass and reach the database untouched. Now nh3 rewrites it. That is why the design token fallback , #eee disappears, and why the </script> escaping no longer appears: Builder escapes on render, so the sanitizer was never the security boundary for these fields. It was simply never reached before.

Two directions, and the choice is a security call I would rather not make on your behalf:

  1. Set ignore_xss_filter: 1 on the affected fields. Builder already does this for route, so the mechanism is established. It makes the previous behaviour explicit instead of accidental.
  2. Move blocks and draft_blocks to the JSON fieldtype, matching builder_component.block. Cleaner semantically, but a schema change.

I can send either as a PR if you say which direction you want. I can also verify the candidate first by running server-tests on a fork before proposing it, so it would not arrive untested.

Independent of this PR, every Builder PR tested after 10:59 UTC today will hit the same two failures.

@mardausdennis
mardausdennis force-pushed the pot_develop_2026-08-17 branch from d87c156 to 970ddee Compare August 18, 2026 15:55
@codecov

codecov Bot commented Aug 18, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 66.21%. Comparing base (948631c) to head (970ddee).
⚠️ Report is 4 commits behind head on develop.

Additional details and impacted files 
@@           Coverage Diff            @@
##           develop     #766   +/-   ##
========================================
  Coverage    66.21%   66.21%           
========================================
  Files           90       90           
  Lines        10018    10018           
========================================
  Hits          6633     6633           
  Misses        3385     3385

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@surajshetty3416
surajshetty3416 merged commit c9bedb7 into frappe:develop Aug 19, 2026
11 checks passed
@mergify

mergify Bot commented Aug 19, 2026

Copy link
Copy Markdown
Contributor

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

  • Queue this pull request

@github-actions

github-actions Bot commented Aug 28, 2026

Copy link
Copy Markdown

🎉 This PR is included in version 1.33.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@surajshetty3416 surajshetty3416 surajshetty3416 approved these changes

Assignees

No one assigned

Labels

released

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@mardausdennis @surajshetty3416