Jesse Hallam

Add URL validation to LinkMetadata cache and store

5

#### Summary Add URL validation to LinkMetadata cache and store to prevent hash collision issues. #### Ticket Link Fixes: https://mattermost.atlassian.net/browse/MM-64450 #### Release Note ```release-note NONE ``` 🤖 Generated with [Claude...

Always require signatures for prepackaged plugins

5

#### Summary We have always required signatures for packages installed via the marketplace -- whether remotely satisfied, or sourced from the prepackaged plugin cache. However, prepackaged plugins discovered and automatically...

Replace SELECT * with explicit column lists in sqlstore

3

## Summary Migrates away from `SELECT *` patterns to explicit column lists in the SQL store layer for better performance, maintainability, and schema safety. This follows the pattern established in...

MM-65959: Add FIPS indicator to about dialog

1

#### Summary Adds a "(FIPS)" indicator to the server version in the About dialog when the server is running in FIPS mode. This change complements the server-side PR that exposes...

Reject Invalid Parameters

2

### Describe the feature or problem you’d like to solve For better or worse, Claude Code will periodically try to find the pull request for my current branch using this:...

#### Summary Fixed `PluginAPI.SavePluginConfig` to use the unsanitized config as the base when saving, preventing it from deleting configurations for plugins whose manifests aren't currently loaded. When a plugin's manifest...

Limit test parallelism when coverage is enabled to prevent OOM

4

#### Summary The "Generate Test Coverage" CI job has been experiencing OOM (Out of Memory) kills, causing ~174 test failures with `signal: killed` (SIGKILL) terminations. **Root cause:** Coverage instrumentation significantly...

[MM-65822] Restrict ImportSettings.Directory changes via API and add validation

2

## Summary Restricts `ImportSettings.Directory` from being modified via the API. This now requires `mmctl --local` to change, or directly editing `config.json`. ## Test Coverage - `updateConfig`: System admin blocked, local...

MM-62151 avoid select * for post store

2

#### Summary Complete the set of changes to eliminate (and vet!) `SELECT *`, a class of problem that creates backwards incompatibilities when new columns are added to existing tables. The...

[MM-66789] Add directory conflict checks for plugin and import uploads

6

## Summary Adds validation at the REST API level to prevent security issues where plugin uploads could write into the import directory (or subdirectories) and vice versa. This builds on...