Release OpenProject 16.6.6

Author: oliverguenther

app/controllers/repositories_controller.rb

@@ -233,7 +233,7 @@ def diff
       end
 
       filename = "changeset_r#{@rev}"
-      filename << "_r#{@rev_to}" if @rev_to
+      filename += "_r#{@rev_to}" if @rev_to
       send_data @diff.join,
                 filename: "#{filename}.diff",
                 type: "text/x-patch",

app/helpers/work_packages_helper.rb

@@ -36,116 +36,27 @@ module WorkPackagesHelper
   # Examples:
   #
   #   link_to_work_package(package)                            # => Defect #6: This is the subject
-  #   link_to_work_package(package, all_link: true)            # => Defect #6: This is the subject (everything within the link)
-  #   link_to_work_package(package, truncate: 9)               # => Defect #6: This i...
-  #   link_to_work_package(package, subject: false)            # => Defect #6
-  #   link_to_work_package(package, type: false)               # => #6: This is the subject
-  #   link_to_work_package(package, project: true)             # => Foo - Defect #6
-  #   link_to_work_package(package, id_only: true)             # => #6
-  #   link_to_work_package(package, subject_only: true)        # => This is the subject (as link)
-  #   link_to_work_package(package, status: true)              # => #6 New (if #id => true)
-  def link_to_work_package(package, options = {})
-    if options[:subject_only]
-      options.merge!(type: false,
-                     subject: true,
-                     id: false,
-                     all_link: true)
-    elsif options[:id_only]
-      options.merge!(type: false,
-                     subject: false,
-                     id: true,
-                     all_link: true)
-    else
-      options.reverse_merge!(type: true,
-                             subject: true,
-                             id: true)
-    end
-
-    parts = { prefix: [],
-              hidden_link: [],
-              link: [],
-              suffix: [],
-              title: [],
-              css_class: link_to_work_package_css_classes(package, options) }
-
-    # Prefix part
-
-    parts[:prefix] << package.project.to_s if options[:project]
-
-    # Link part
-
-    parts[:link] << h(options[:before_text].to_s) if options[:before_text]
-
-    parts[:link] << h(package.type.to_s) if options[:type]
-
-    parts[:link] << "##{h(package.id)}" if options[:id]
-
-    parts[:link] << h(package.status).to_s if options[:id] && options[:status] && package.status_id
-
-    # Hidden link part
-
-    if package.closed? && !options[:no_hidden]
-      parts[:hidden_link] << content_tag(:span,
-                                         I18n.t(:label_closed_work_packages),
-                                         class: "sr-only")
+  #   link_to_work_package(package, link_subject: true)        # => Defect #6: This is the subject (everything within the link)
+  #   link_to_work_package(package, display_project: true)     # => Foo - Defect #6: This is the subject
+  def link_to_work_package(work_package, display_project: false, link_subject: false) # rubocop:disable Metrics/AbcSize
+    output = "".html_safe
+    output << "#{work_package.project} - " if display_project && work_package.project_id
+
+    link = link_to(work_package_path(work_package),
+                   title: work_package.subject,
+                   class: link_to_work_package_css_classes(work_package)) do
+      link_parts = []
+      link_parts << work_package.type.to_s if work_package.type_id
+      link_parts << "##{work_package.id}:"
+      link_parts << content_tag(:span, I18n.t(:label_closed_work_packages), class: "sr-only") if work_package.closed?
+      link_parts << work_package.subject if link_subject
+
+      safe_join(link_parts, " ")
     end
 
-    # Suffix part
-
-    if options[:subject]
-      subject = if options[:subject]
-                  subject = package.subject
-                  if options[:truncate]
-                    subject = truncate(subject, length: options[:truncate])
-                  end
-
-                  subject
-                end
-
-      parts[:suffix] << h(subject)
-    end
-
-    # title part
-
-    parts[:title] << (options[:title].nil? ? package.subject : options[:title])
-
-    # combining
-
-    prefix = parts[:prefix].join(" ")
-    suffix = parts[:suffix].join(" ")
-    link = parts[:link].join(" ").strip
-    hidden_link = parts[:hidden_link].join
-    title = parts[:title].join(" ")
-    css_class = parts[:css_class].join(" ")
-
-    # Determine path or url
-    work_package_link =
-      if options.fetch(:only_path, true)
-        work_package_path(package)
-      else
-        work_package_url(package)
-      end
-
-    if options[:all_link]
-      link_text = [prefix, link].reject(&:empty?).join(" - ")
-      link_text = [link_text, suffix].reject(&:empty?).join(": ")
-      link_text = [hidden_link, link_text].reject(&:empty?).join
-
-      link_to(link_text.html_safe,
-              work_package_link,
-              title:,
-              class: css_class)
-    else
-      link_text = [hidden_link, link].reject(&:empty?).join
-
-      html_link = link_to(link_text.html_safe,
-                          work_package_link,
-                          title:,
-                          class: css_class)
-
-      [[prefix, html_link].reject(&:empty?).join(" - "),
-       suffix].reject(&:empty?).join(": ")
-    end.html_safe
+    output << link
+    output << " #{work_package.subject}" unless link_subject
+    output
   end
 
   def work_package_list(work_packages, &)
@@ -176,7 +87,7 @@ def work_package_formatted_dates(work_package)
     "#{start_date} - #{due_date}"
   end
 
-  def send_notification_option(checked = false)
+  def send_notification_option(checked: false)
     content_tag(:label, for: "send_notification", class: "form--label-with-check-box") do
       (content_tag "span", class: "form--check-box-container" do
         boxes = hidden_field_tag("send_notification", "0", id: nil)
@@ -220,10 +131,10 @@ def last_work_package_note(work_package)
 
   def work_packages_columns_options
     @work_packages_columns_options ||= Query
-                                         .new
-                                         .displayable_columns
-                                         .sort_by(&:caption)
-                                         .map { |column| { name: column.caption, id: column.name.to_s } }
+      .new
+      .displayable_columns
+      .sort_by(&:caption)
+      .map { |column| { name: column.caption, id: column.name.to_s } }
   end
 
   def selected_work_packages_columns_options
@@ -232,13 +143,14 @@ def selected_work_packages_columns_options
   end
 
   def protected_work_packages_columns_options
+    protected_columns = %w[id subject]
     work_packages_columns_options
-      .select { |column| column[:id] == "id" || column[:id] == "subject" }
+      .select { |column| protected_columns.include?(column[:id]) }
   end
 
   private
 
-  def truncated_work_package_description(work_package, lines = 3)
+  def truncated_work_package_description(work_package, lines = 3) # rubocop:disable Metrics/AbcSize
     description_lines = work_package.description.to_s.lines.to_a[0, lines]
 
     if description_lines[lines - 1] && work_package.description.to_s.lines.to_a.size > lines
@@ -261,24 +173,9 @@ def truncated_work_package_description(work_package, lines = 3)
     end
   end
 
-  def info_user_attributes(work_package)
-    responsible = if work_package.responsible_id.present?
-                    "<span class='label'>#{WorkPackage.human_attribute_name(:responsible)}:</span> " +
-                      h(work_package.responsible.name).to_s
-                  end
-
-    assignee = if work_package.assigned_to_id.present?
-                 "<span class='label'>#{WorkPackage.human_attribute_name(:assigned_to)}:</span> " +
-                   h(work_package.assigned_to.name).to_s
-               end
-
-    [responsible, assignee].compact.join("<br>").html_safe
-  end
-
-  def link_to_work_package_css_classes(package, options)
+  def link_to_work_package_css_classes(package)
     classes = ["work_package"]
     classes << "closed" if package.closed?
-    classes << options[:class].to_s
 
     classes
   end

app/views/versions/index.html.erb

@@ -66,7 +66,7 @@ See COPYRIGHT and LICENSE files for more details.
             <div>
               <ul>
                 <%- issues.each do |issue| -%>
-                  <li><%= link_to_work_package(issue, project: (@project != issue.project)) %></li>
+                  <li><%= link_to_work_package(issue, display_project: (@project != issue.project)) %></li>
                 <%- end -%>
               </ul>
             </div>

docker/ci/Dockerfile

@@ -11,7 +11,9 @@ RUN apt-get update -qq && \
   apt-get install -y wget gnupg lsb-release curl && \
   wget --quiet -O- https://www.postgresql.org/media/keys/ACCC4CF8.asc | gpg --dearmor -o /usr/share/keyrings/postgrsql.gpg - && \
   echo "deb [signed-by=/usr/share/keyrings/postgrsql.gpg] http://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg  main" > /etc/apt/sources.list.d/pgdg.list
-ENV CHROME_SOURCE_URL="https://dl.google.com/dl/linux/direct/google-chrome-stable_current_amd64.deb"
+# Temporarily use a mirror for Chrome until the official one no longer has issues with xeokit. Can be tested by running
+# rspec ./modules/bim/spec/features/bcf/create_spec.rb:107 after switching to the official package source.
+ENV CHROME_SOURCE_URL="https://mirror.cs.uchicago.edu/google-chrome/pool/main/g/google-chrome-stable/google-chrome-stable_142.0.7444.134-1_amd64.deb"
 RUN --mount=type=cache,target=/var/cache/apt export f="/tmp/chrome.deb" && wget --no-verbose -O $f $CHROME_SOURCE_URL && \
   apt-get update -qq && apt-get install -y "$f" postgresql-$PGVERSION postgresql-client-$PGVERSION time imagemagick default-jre-headless firefox-esr && \
   rm -f "$f" && apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* /var/lib/postgresql && find /usr/share/locale/* -maxdepth 0 -type d ! -name 'en' -exec rm -rf {} \;

docs/release-notes/16-6-6/README.md

@@ -0,0 +1,27 @@
+---
+title: OpenProject 16.6.6
+sidebar_navigation:
+    title: 16.6.6
+release_version: 16.6.6
+release_date: 2026-01-27
+---
+
+# OpenProject 16.6.6
+
+Release date: 2026-01-27
+
+We released OpenProject [OpenProject 16.6.6](https://community.openproject.org/versions/2261).
+The release contains security related bug fixes and we strongly urge you to update to the newest version.
+Below you will find a complete list of all changes and bug fixes.
+
+<!--more-->
+
+## Bug fixes and changes
+
+<!-- Warning: Anything within the below lines will be automatically removed by the release script -->
+<!-- BEGIN AUTOMATED SECTION -->
+
+- Bugfix: Fix revision parsing in git diff output \[[#71019](https://community.openproject.org/wp/71019)\]
+
+<!-- END AUTOMATED SECTION -->
+<!-- Warning: Anything above this line will be automatically removed by the release script -->

docs/release-notes/README.md

@@ -13,6 +13,13 @@ Stay up to date and get an overview of the new features included in the releases
 <!--- New release notes are generated below. Do not remove comment. -->
 <!--- RELEASE MARKER -->
 
+## 16.6.6
+
+Release date: 2026-01-27
+
+[Release Notes](16-6-6/)
+
+
 ## 16.6.5
 
 Release date: 2026-01-16

lib/open_project/journal_formatter/cause.rb

@@ -161,7 +161,7 @@ def related_work_package_changed_message
     if related_work_package
       I18n.t(
         "journals.cause_descriptions.#{cause['type']}",
-        link: html? ? link_to_work_package(related_work_package, all_link: true) : "##{related_work_package.id}"
+        link: html? ? link_to_work_package(related_work_package, link_subject: true) : "##{related_work_package.id}"
       )
 
     else

lib/open_project/object_linking.rb

@@ -125,7 +125,7 @@ def link_to_project(project, options = {}, html_options = nil, show_icon = false
         link_to(project_name, project_path_or_url(project, options), html_options)
       else
         project_name
-      end.html_safe
+      end
     end
 
     # Like #link_to_user, but will render a Primer link instead of a regular link.

lib/open_project/scm/adapters/git.rb

@@ -404,12 +404,7 @@ def build_revision_args(path, identifier_from, identifier_to, options)
         end
 
         def diff(path, identifier_from, identifier_to = nil)
-          args = []
-          if identifier_to
-            args << "diff" << "--no-abbrev-commit" << "--no-color" << identifier_to << identifier_from
-          else
-            args << "show" << "--no-abbrev-commit" << "--no-color" << identifier_from
-          end
+          args = build_diff_range(identifier_from, identifier_to)
           args << "--" << scm_encode(@path_encoding, "UTF-8", path) unless path.empty?
           capture_git(args).lines
         rescue Exceptions::CommandFailed
@@ -468,6 +463,20 @@ def format_identifier
 
         protected
 
+        ##
+        # Build diff range given one or two user inputs
+        # first resolving them to actual commits.
+        def build_diff_range(identifier_from, identifier_to = nil)
+          from_sha = resolve_commit(identifier_from)
+
+          if identifier_to
+            to_sha = resolve_commit(identifier_to)
+            ["diff", "--no-abbrev-commit", "--no-color", to_sha, from_sha]
+          else
+            ["show", "--no-abbrev-commit", "--no-color", from_sha]
+          end
+        end
+
         ##
         # Builds the full git arguments from the parameters
         # and return the executed stdout as a string
@@ -520,6 +529,12 @@ def build_git_cmd(args, opts = {})
           args.unshift("--git-dir", git_dir) unless checkout? && !opts[:no_chdir]
           args
         end
+
+        # Resolve any user-provided commit-ish (branch, tag, HEAD~1, etc.) to a commit SHA,
+        # so we can be sure to work with a valid commit identifier.
+        def resolve_commit(rev)
+          capture_git(["rev-parse", "--verify", "--quiet", "--end-of-options", "#{rev}^{commit}"]).strip
+        end
       end
     end
   end

lib/open_project/version.rb

@@ -33,7 +33,7 @@ module OpenProject
   module VERSION # :nodoc:
     MAJOR = 16
     MINOR = 6
-    PATCH = 5
+    PATCH = 6
 
     class << self
       # Used by semver to define the special version (if any).