typebot.io/packages
Baptiste Arnaud e7be877bc1
🐛 Fix Android camera for image extension uploads (#2558)
## What changed

- Detect image extensions in file upload allowlists using the shared
`extensionFromMimeType` table.
- Add the corresponding image MIME hints while preserving the original
extensions and the existing `capture=camera` Android workaround.
- Normalize casing and leading dots, deduplicate equivalent entries, and
prefer valid dotted extensions regardless of input order.
- Add focused unit coverage for image-only, mixed, non-image, duplicate,
and casing scenarios.
- Bump the JavaScript and React embed packages to `0.10.6` and ignore
local Revue comments.

## Why

The Android camera workaround was only enabled when the configured
allowlist already contained an `image/*` MIME type. Bots configured with
image extensions such as `.jpg`, `.jpeg`, and `.png` therefore never
received the workaround.

## Impact

Android users can access the existing camera option when a file upload
block is configured with image extensions. Browser hints are enriched
only on the client; server-side validation remains based on the block's
original options.

The `capture=camera` token remains a non-standard Android-specific
workaround and may continue to vary across browsers.

## Validation

- `bunx nx test @typebot.io/js` — 7 tests passed
- `bunx nx typecheck @typebot.io/js`
- `bunx nx format-and-lint`
- `git diff --check`

The repository-wide pre-commit affected test suite could not complete
locally because unrelated packages required missing environment
variables and existing SSRF tests failed. The targeted package tests,
typecheck, and repository formatting checks passed.
2026-07-13 11:35:47 +02:00
..
ai 🔒️ Upgrade vulnerable deps (ai v5, nodemailer v8, otel sdk-node 0.217) (#2491) 2026-05-19 16:30:36 +02:00
auth 🐛 Harden email login codes (#2542) 2026-06-27 15:36:28 +02:00
billing 🔧 Restore OpenAPI docs generation pipeline (#2553) 2026-07-03 20:19:08 +02:00
blocks 🔧 Restore OpenAPI docs generation pipeline (#2553) 2026-07-03 20:19:08 +02:00
bot-engine 🔧 Restore OpenAPI docs generation pipeline (#2553) 2026-07-03 20:19:08 +02:00
chat-api 🔧 Remove "baseUrl": "." from tsconfigs 2026-03-25 16:40:12 +01:00
chat-session 🔧 Remove "baseUrl": "." from tsconfigs 2026-03-25 16:40:12 +01:00
conditions 🔧 Remove "baseUrl": "." from tsconfigs 2026-03-25 16:40:12 +01:00
config 🔧 Restore OpenAPI docs generation pipeline (#2553) 2026-07-03 20:19:08 +02:00
credentials 🐛 Fix WhatsApp webhook verification (#2498) 2026-05-21 16:45:32 +02:00
deprecated/legacy 🔒️ Upgrade vulnerable deps (ai v5, nodemailer v8, otel sdk-node 0.217) (#2491) 2026-05-19 16:30:36 +02:00
emails Fix Dependabot vulnerabilities 2026-06-29 08:19:20 +02:00
embeds 🐛 Fix Android camera for image extension uploads (#2558) 2026-07-13 11:35:47 +02:00
env 🐛 Fix WhatsApp webhook verification (#2498) 2026-05-21 16:45:32 +02:00
events 🔧 Remove "baseUrl": "." from tsconfigs 2026-03-25 16:40:12 +01:00
forge 🔧 Prepare Ask Assistant migration campaign 2026-07-04 16:12:30 +02:00
groups 🔧 Remove "baseUrl": "." from tsconfigs 2026-03-25 16:40:12 +01:00
lib 🔧 Restore OpenAPI docs generation pipeline (#2553) 2026-07-03 20:19:08 +02:00
logs 🔧 Remove "baseUrl": "." from tsconfigs 2026-03-25 16:40:12 +01:00
partykit 🔧 Remove "baseUrl": "." from tsconfigs 2026-03-25 16:40:12 +01:00
playwright 🔧 Hash API tokens (#2492) 2026-05-19 18:17:11 +02:00
prisma 🐛 Harden email login codes (#2542) 2026-06-27 15:36:28 +02:00
radar 🔧 Remove "baseUrl": "." from tsconfigs 2026-03-25 16:40:12 +01:00
results 🐛 Fix S3 operations without full config (#2533) 2026-06-18 17:30:39 +02:00
rich-text 🔧 Remove "baseUrl": "." from tsconfigs 2026-03-25 16:40:12 +01:00
runtime-session-store 🔧 Remove "baseUrl": "." from tsconfigs 2026-03-25 16:40:12 +01:00
schemas 🔧 Remove "baseUrl": "." from tsconfigs 2026-03-25 16:40:12 +01:00
scripts 🔧 Prepare Ask Assistant migration campaign 2026-07-04 16:12:30 +02:00
services/feature-flags 🔧 Remove "baseUrl": "." from tsconfigs 2026-03-25 16:40:12 +01:00
settings 👌 Configure WhatsApp webhook forwarding URL (#2529) 2026-06-17 15:56:16 +02:00
shared-core 🔧 Remove "baseUrl": "." from tsconfigs 2026-03-25 16:40:12 +01:00
spaces 📝 Document status page and analytics completion criteria (#2480) 2026-05-01 11:10:10 +02:00
telemetry 🔒️ Upgrade vulnerable deps (ai v5, nodemailer v8, otel sdk-node 0.217) (#2491) 2026-05-19 16:30:36 +02:00
templates 🔧 Remove "baseUrl": "." from tsconfigs 2026-03-25 16:40:12 +01:00
theme 🔧 Remove "baseUrl": "." from tsconfigs 2026-03-25 16:40:12 +01:00
typebot 🐛 Fix cross-workspace credential theft via preview endpoint (#2430) 2026-04-07 16:21:17 +02:00
ui 🔒️ Fix TAC scan header findings (#2549) 2026-06-29 16:16:36 +02:00
user 🔧 Remove "baseUrl": "." from tsconfigs 2026-03-25 16:40:12 +01:00
variables 🐛 Fix SSRF bypass via DNS rebinding in HTTP request and script fetch flows (#2461) 2026-04-15 09:28:06 +00:00
whatsapp 🔧 Restore OpenAPI docs generation pipeline (#2553) 2026-07-03 20:19:08 +02:00
workspaces 🔧 Remove "baseUrl": "." from tsconfigs 2026-03-25 16:40:12 +01:00