Conversation
Document the monorepo (packages, sites, operations) and close the open security findings: drop unpatched image-size, bump sanitize-html, PostCSS, and brace-expansion, replace polynomial markup regexes, and strip CR/LF from CSP and Stripe logs. Ignore cursor/* in the feature-to-dev auto-PR workflow. Co-authored-by: Aamogh <aamoghS@users.noreply.github.com>
Reject slash-separated inline handlers to match the old word-boundary regex, strip all control characters from CSP report logs, and keep a newline-safe Stripe error message for membership-grant failures. Co-authored-by: Aamogh <aamoghS@users.noreply.github.com>
…5089 Add documentation and fix Dependabot and CodeQL alerts
github-actions
Bot
added
the
dependencies
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )
Note
High Risk
App Hosting now applies schema to the production database on every build, and the diff touches payments, membership grants, and hackathon acceptance waves—areas where mistakes affect money and access.
Overview
Docs and onboarding move most architecture, operations, and package detail out of the root
READMEinto a newdocs/tree (withCONTRIBUTING.mdas a pointer).GCP_SETUP.mdlinks into that index.Production builds now run
drizzle-kit push(non-interactive) andpnpm --filter @query/db db:checkbefore the mainweb build inapphosting.yaml, withDATABASE_URLavailable at BUILD time. Comments document Gmail SMTP limits and how to swap providers.Local observability adds an opt-in Docker
monitoringprofile (Prometheus, Grafana, ClickHouse), provisioning, payment/portal alert rules, and gitignoredmonitoring/secrets/for the prod scrape token.@query/apigainsprom-clientmetrics (exported via mainweb/api/metricswithMETRICS_TOKENin prod).Portal/API behavior expands materially: a
bootcamptRPC router and term-gated bootcamp sessions on clubevents(unique week per term, check-in rules); semester membership and bootcamp-only add-on pricing in Stripe tests/flows; hackathonacceptWave/waveStatus(SKIP LOCKED, separate from email);getByIdresolves portal slugs as well as UUID/name; registration tests addwhyAttend. Security middleware is refactored into testable classes (TokenBucketLimiter,FloodGuard, etc.) and audit retention is encapsulated inAuditRetention.CI skips auto PR-to-
devforcursor/**branches. Dependency bumps are minor (postcss,brace-expansion).Reviewed by Cursor Bugbot for commit bd69c82. Bugbot is set up for automated code reviews on this repo. Configure here.