From d30784f1d1897f27e1bc9da7ede9e5b0297ab82e Mon Sep 17 00:00:00 2001
From: Philip <philip@arantic.com>
Date: Tue, 8 Sep 2026 23:07:33 +0200
Subject: [PATCH 1/2] feat: add GitHub webhook route to API router

- Integrated GitHub webhook routes into the API router.
- Updated test suite to verify the correct mount order for GitHub webhook handling.
---
 src/server/routes/index.ts                    |  4 +--
 .../routes/github-webhook.routes.test.ts      | 26 +++++++++++++++++++
 2 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/src/server/routes/index.ts b/src/server/routes/index.ts
index 38047c4..ec7f61a 100644
--- a/src/server/routes/index.ts
+++ b/src/server/routes/index.ts
@@ -38,6 +38,7 @@ export function createApiRouter(): Hono {
   api.route('/integrations', integrationsRoutes);
   api.route('/notification-preferences', notificationPreferences);
   api.route('/license', licenseRoutes);
+  api.route('/webhooks/github', githubWebhookRoutes);
 
   // Mount EE routes first if available (they take priority over CE routes)
   // EE routes handle the actual feature implementation when licensed
@@ -77,9 +78,6 @@ export function createApiRouter(): Hono {
   // Mount widget routes (public)
   api.route('/widget', widgetRoutes);
 
-  // Mount GitHub webhook routes (public, no auth)
-  api.route('/webhooks/github', githubWebhookRoutes);
-
   // Mount public files routes (public, no auth)
   api.route('/public/files', publicFilesRoutes);
 
diff --git a/tests/server/routes/github-webhook.routes.test.ts b/tests/server/routes/github-webhook.routes.test.ts
index eff1a90..76dafec 100644
--- a/tests/server/routes/github-webhook.routes.test.ts
+++ b/tests/server/routes/github-webhook.routes.test.ts
@@ -357,4 +357,30 @@ describe('github-webhook routes', () => {
       expect(res.status).toBe(200);
     });
   });
+
+  describe('API router mount order', () => {
+    it('reaches the GitHub handler when mounted before authenticated /webhooks', async () => {
+      const { webhooksRoutes } = await import('../../../src/server/routes/api/webhooks');
+      const app = new Hono();
+      app.route('/webhooks/github', githubWebhookRoutes);
+      app.route('/webhooks', webhooksRoutes);
+
+      const res = await app.request('http://localhost/webhooks/github/int_1', {
+        method: 'POST',
+        headers: {
+          'content-type': 'application/json',
+          'x-github-event': 'ping',
+          'x-github-delivery': 'delivery_1',
+        },
+        body: JSON.stringify({ zen: 'test' }),
+      });
+
+      const body = (await res.json()) as { error?: string; message?: string };
+
+      expect(body.error).not.toBe('UNAUTHORIZED');
+      expect(body.message).not.toBe('Authentication required');
+      expect(res.status).toBe(401);
+      expect(body.error).toBe('Missing signature');
+    });
+  });
 });

From edee074713db277397a752c2452d9ee3992faf54 Mon Sep 17 00:00:00 2001
From: Philip <philip@arantic.com>
Date: Tue, 8 Sep 2026 23:18:53 +0200
Subject: [PATCH 2/2] docs: update changelog v1.2.2

---
 Changelog/v1.2.2.md | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100644 Changelog/v1.2.2.md

diff --git a/Changelog/v1.2.2.md b/Changelog/v1.2.2.md
new file mode 100644
index 0000000..178050f
--- /dev/null
+++ b/Changelog/v1.2.2.md
@@ -0,0 +1,24 @@
+# Changelog v1.2.2
+
+### Heads up before upgrading
+
+- A database migration adds a `widget_version_observations` table. It runs automatically on first launch; no manual step is required.
+
+### Features
+
+#### Widget package compatibility warnings
+
+- Administrators now see an independently dismissible warning when recently active npm widget deployments use a package version older than the server's supported minimum.
+- The warning identifies affected projects, observed versions, and deployment counts, and links directly to the package versions page.
+- Programmatic `BugPin.init()` integrations report their package version during the existing configuration request. Hosted `/widget.js` integrations remain unchanged.
+- Compatibility checks are local and continue to work when remote BugPin update checks are disabled.
+
+#### Reporter prefill
+
+- Widget integrations can prefill the editable reporter name and email through `BugPin.init()` or script-tag data attributes.
+- Reporter-prefilled drafts are scoped by reporter email to avoid restoring another reporter's saved form data.
+- The Admin Console's Test Widget page now lets administrators edit the test reporter and switch between reporter and logged-out modes.
+
+### Fixes
+
+- GitHub webhook deliveries to `POST /api/webhooks/github/:integrationId` are no longer rejected with session `UNAUTHORIZED` before signature validation. The inbound GitHub route is mounted ahead of authenticated outbound webhook management, so GitHub authenticates with `X-Hub-Signature-256` as intended.