Conversation
- Introduced EngineSection, InterstitialBanner, and WorkflowSection components to modularize the FeaturesSection. - Added AnimatedCounter for dynamic number display. - Implemented DeployPreview and FileTreePreview for showcasing deployment details. - Created TerminalPreview for simulating terminal commands and results. - Developed RaceChart for visualizing performance metrics. - Added useInView hook for handling element visibility in the viewport. - Updated FeaturesSection tests to reflect component changes and improve coverage.
- Updated coverage thresholds in test scripts. - Added tests for AnimatedCounter, DeployPreview, GithubWorkflowPreview, RaceChart, TerminalPreview, WorkflowSection, useInView, and useCountUp components. - Improved existing tests for Navbar, ExplorerResults, ReviewCard, and DownloadChart components. - Mocked additional dependencies and improved error handling in SWRProvider tests. - Refactored Navbar tests for better clarity and coverage.
…on, EngineSection, InterstitialBanner, and WorkflowSection
…nerable deps - aws-lc-sys: CRL distribution point scope check / name constraints bypass - rand: unsound custom logger with rand::rng() - lru: IterMut Stacked Borrows violation (via aws-sdk-s3 bump) - meilisearch-sdk 0.27 -> 0.31: pulls jsonwebtoken 10.3.0, fixing type confusion
|
Warning Review limit reached
Next review available in: 55 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe changes add shared image URL validation to profile and media previews, restrict GitHub Actions permissions, update dependency constraints and overrides, and change the footer copyright year to 2026. ChangesImage URL safety
CI and dependency configuration
Footer metadata
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…ed as HTML' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
frontend/lib/validation.ts (1)
102-110: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd direct tests for the URL allowlist.
Cover
null/undefined, each allowed scheme, and rejectedjavascript:,data:, protocol-relative, and malformed values. This helper is the shared security boundary for both preview components.As per coding guidelines, frontend code must maintain 80% line/function and 75% branch coverage.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@frontend/lib/validation.ts` around lines 102 - 110, Add direct tests for isSafeImageUrl covering null and undefined inputs, https://, http://, and blob: allowlisted schemes, plus rejected javascript:, data:, protocol-relative, and malformed values. Ensure the tests exercise the shared helper’s branches and preserve the required frontend coverage thresholds.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@frontend/lib/validation.ts`:
- Around line 102-110: Add direct tests for isSafeImageUrl covering null and
undefined inputs, https://, http://, and blob: allowlisted schemes, plus
rejected javascript:, data:, protocol-relative, and malformed values. Ensure the
tests exercise the shared helper’s branches and preserve the required frontend
coverage thresholds.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: da224521-c351-4630-bf28-ff3d2bb3c393
⛔ Files ignored due to path filters (2)
api/Cargo.lockis excluded by!**/*.lockfrontend/package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (8)
.github/workflows/ci.yml.github/workflows/docker.ymlapi/Cargo.tomlfrontend/app/profile/page.tsxfrontend/components/layout/Footer.tsxfrontend/components/plugins/MediaUpload.tsxfrontend/lib/validation.tsfrontend/package.json
2 participants
This pull request includes several improvements focused on security, dependency updates, and workflow configuration. The key changes are the introduction of stricter image source validation in the frontend to prevent unsafe image rendering, updates to dependencies for better compatibility and security, and adjustments to CI/CD workflow permissions.
Frontend Security Improvements:
isSafeImageUrlutility infrontend/lib/validation.tsto restrict image rendering to safe URL schemes (https://,http://,blob:), preventing potential JavaScript or data URI injection attacks. This check is now applied to avatar previews infrontend/app/profile/page.tsxand media uploads infrontend/components/plugins/MediaUpload.tsx. [1] [2] [3] [4] [5] [6]Dependency Updates:
meilisearch-sdkfrom version 0.27 to 0.31 inapi/Cargo.tomlfor improved features and bug fixes.postcssandsharpoverrides infrontend/package.jsonto ensure consistent versions and resolve potential dependency issues.Workflow and Configuration Updates:
permissionsin GitHub Actions workflows (.github/workflows/ci.ymland.github/workflows/docker.yml) to follow best practices for least privilege. [1] [2]Other Updates:
frontend/components/layout/Footer.tsx.Summary by CodeRabbit
Bug Fixes
Style
Security