From 5bf9b9ac8071ab8a2d3aa01d6fd94773a8789281 Mon Sep 17 00:00:00 2001
From: "usehoplite[bot]" <288093033+usehoplite[bot]@users.noreply.github.com>
Date: Wed, 2 Sep 2026 20:24:39 +0000
Subject: [PATCH 1/4] ci: run the full candidate matrix on release tags and
 diff-plan main pushes

Main pushes now plan from the pushed diff like pull requests, so untouched
surfaces skip their jobs. Release tags trigger a full CI run whose artifacts
the release workflow consumes; the tag workflow pins to that run and waits
for it. The image job derives the release version from the previous tag when
building a tag, since the tag itself has no commits after it.

From 88c1302fe3d79c34981be5e6923be402cff8c521 Mon Sep 17 00:00:00 2001
From: "usehoplite[bot]" <288093033+usehoplite[bot]@users.noreply.github.com>
Date: Wed, 2 Sep 2026 20:24:39 +0000
Subject: [PATCH 2/4] ci: run backend tests once with race and coverage

The race suite duplicated the backend suite on every backend change. One
-race -cover run keeps both signals at the cost of the slower run alone.

From a7aaf03f3d071426df8ce915f0e31a0553edb917 Mon Sep 17 00:00:00 2001
From: "usehoplite[bot]" <288093033+usehoplite[bot]@users.noreply.github.com>
Date: Wed, 2 Sep 2026 21:18:00 +0000
Subject: [PATCH 3/4] fix(deps): override qs to 6.16.0

@n8n/backend-network pins qs 6.15.2 exactly, and two new advisories
(GHSA-x5fp-wj9c-mxmx, GHSA-4mjr-xmp4-gh2g) cover everything through
6.15.3. Both are fixed in 6.16.0, so pin it in the root overrides next
to the other audited security pins.
---
 bun.lock     | 4 ++--
 package.json | 1 +
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/bun.lock b/bun.lock
index 3b083d3e2..059029aa2 100644
--- a/bun.lock
+++ b/bun.lock
@@ -1,6 +1,5 @@
 {
   "lockfileVersion": 1,
-  "configVersion": 1,
   "workspaces": {
     "": {
       "name": "openpost",
@@ -234,6 +233,7 @@
     "js-yaml": "4.3.1",
     "nanoid": "3.3.18",
     "postcss": "8.5.23",
+    "qs": "6.16.0",
     "sharp": "0.35.0",
     "tar": "7.5.22",
     "undici": "7.29.0",
@@ -2644,7 +2644,7 @@
 
     "punycode": ["punycode@2.3.1", "", {}, "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg=="],
 
-    "qs": ["qs@6.15.2", "", { "dependencies": { "side-channel": "^1.1.0" } }, "sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw=="],
+    "qs": ["qs@6.16.0", "", { "dependencies": { "es-define-property": "^1.0.1", "side-channel": "^1.1.1" } }, "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA=="],
 
     "query-selector-shadow-dom": ["query-selector-shadow-dom@1.0.1", "", {}, "sha512-lT5yCqEBgfoMYpf3F2xQRK7zEr1rhIIZuceDK6+xRkJQ4NMbHTwXqk4NkwDwQMNqXgG9r9fyHnzwNVs6zV5KRw=="],
 
diff --git a/package.json b/package.json
index fc79f5635..8f5355f13 100644
--- a/package.json
+++ b/package.json
@@ -51,6 +51,7 @@
     "js-yaml": "4.3.1",
     "nanoid": "3.3.18",
     "postcss": "8.5.23",
+    "qs": "6.16.0",
     "sharp": "0.35.0",
     "tar": "7.5.22",
     "undici": "7.29.0",

From 0c8f939f8c16299342bd2af59e40c3c3d63efa41 Mon Sep 17 00:00:00 2001
From: "usehoplite[bot]" <288093033+usehoplite[bot]@users.noreply.github.com>
Date: Wed, 2 Sep 2026 21:41:47 +0000
Subject: [PATCH 4/4] fix(changelog): keep fragment bullets on single lines

The fragment parser rejects wrapped continuation lines.
---
 changes/ci-surface-planning.md | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/changes/ci-surface-planning.md b/changes/ci-surface-planning.md
index 633da720b..1a7f22a7f 100644
--- a/changes/ci-surface-planning.md
+++ b/changes/ci-surface-planning.md
@@ -1,8 +1,4 @@
 ### Changed
 
-- CI now runs the full release-candidate matrix for release tags instead of
-  every push to `main`. Main pushes plan from the pushed diff, so untouched
-  surfaces (for example the Android candidate) skip their jobs, and the release
-  workflow waits for the tag's own CI run before promoting its artifacts.
-- Backend tests run once with the race detector and coverage together instead
-  of as two separate suites.
+- CI now runs the full release-candidate matrix for release tags instead of every push to `main`. Main pushes plan from the pushed diff, so untouched surfaces (for example the Android candidate) skip their jobs, and the release workflow waits for the tag's own CI run before promoting its artifacts.
+- Backend tests run once with the race detector and coverage together instead of as two separate suites.