Skip to content

release - #156

Merged
supnate merged 34 commits into
releasefrom
main
Sep 8, 2026
Merged

supnate merged 34 commits into
releasefrom
main

Conversation

@supnate

@supnate supnate commented Sep 8, 2026

Copy link
Copy Markdown
Contributor

No description provided.

supnate and others added 30 commits March 19, 2026 13:49
MUSE-1194 fix vite dev mode issue
MUSE-1223 add integration guides for Muse ui plugins
MUSE-1252 added MSP mgmt APIs
MUSE-1251 added sync latest API
MUSE-1252 add msp registry schema
MUSE-1244 upgrade tool in muse-dev-utils
MUSE-1280 update to latest antd, react
MUSE-1269 - Remove approval for prod env message
MUSE-1312 ensure lib plugin load sequence
MUSE-1310 add msp meta to plugin release.
MUSE-1309 validate msp when deployment
MUSE-1331 show MSP mismatch error when deploy validation
MUSE-1308 fix vanilla vite plugin
MUSE-1308 allow config msp for app and env
MUSE-1336 fix lib plugin build performance issue in watch mode
MUSE-1359, MUSE-1359, MUSE-1360, MUSE-1361, MUSE-1362 upgrade examples plugin to msp2606
MUSE-1391 antd v5 -> v6 migration
## Summary

Fixes the following React warning produced when rendering menus with `activeMatch`:

```text
Warning: React does not recognize the `activeMatch` prop on a DOM element.
If you accidentally passed it from a parent component, remove it from the DOM element.
```

## Root cause

`MetaMenu` uses the Muse-specific `activeMatch` property to calculate the active menu keys. After evaluating it, the original menu-item objects are passed to Ant Design unchanged.

Ant Design/rc-menu does not recognize `activeMatch` as a menu property and forwards it to the underlying `<li>`, which triggers the React warning.

## Fix

Before passing items to Ant Design, `MetaMenu` now recursively clones the menu tree and removes `activeMatch`.

The original internal items are retained for route matching, so existing active-menu behavior is unchanged. Recursive sanitization covers both top-level submenu items and nested children.

## Testing

- Added regression coverage for parent and nested menu items containing `activeMatch`.
- Verified that unsanitized items produce the React warning while sanitized items do not.
- Confirmed the `muse-lib-antd` production build succeeds.
MUSE-1428 Add environment variable security warning and pre-check before saving
Prevent activeMatch from being forwarded to menu DOM elements
supnate and others added 4 commits September 7, 2026 13:31
Render untrusted boot errors as text, validate plugin name/type/version, and only apply forcePlugins in local/dev or Muse e2e.

Co-authored-by: Cursor <cursoragent@cursor.com>
Prevent DOM XSS in muse-boot-default error UI and restrict forcePlugins.
@supnate
supnate merged commit 4cb4ba3 into release Sep 8, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants