Before submitting
Area
apps/web
Steps to reproduce
- Connect T3 Code to a private GitHub Enterprise Server instance on a different site from the T3 web client.
- Open a pull request with activity from users who have avatar URLs.
- View the pull request activity timeline.
- The browser rejects the GHES session cookies for the cross-site avatar requests because they use
SameSite=Lax or SameSite=Strict.
Expected behavior
If an avatar image cannot load, T3 Code should show its existing actor-initial fallback so the activity timeline remains readable.
Actual behavior
PullRequestActorAvatar only falls back when avatarUrl is null. A non-null GHES URL that fails in the browser remains a broken image in every activity row.
| Before |
After |
| Broken images remain in the timeline. |
Failed images fall back to actor initials. |
 |
 |
Impact
Cosmetic issue
Version or commit
main @ 8ef478e
Environment
T3 Code web or desktop client connected to a private GHES host on a different site. Reproduced in Firefox, where the console reports the GHES authentication cookies being rejected in a cross-site context.
Workaround
No client-side workaround. Opening the pull request directly on GHES keeps the request first-party, but the avatars remain broken inside T3 Code.
Before submitting
Area
apps/web
Steps to reproduce
SameSite=LaxorSameSite=Strict.Expected behavior
If an avatar image cannot load, T3 Code should show its existing actor-initial fallback so the activity timeline remains readable.
Actual behavior
PullRequestActorAvataronly falls back whenavatarUrlis null. A non-null GHES URL that fails in the browser remains a broken image in every activity row.Impact
Cosmetic issue
Version or commit
main @ 8ef478e
Environment
T3 Code web or desktop client connected to a private GHES host on a different site. Reproduced in Firefox, where the console reports the GHES authentication cookies being rejected in a cross-site context.
Workaround
No client-side workaround. Opening the pull request directly on GHES keeps the request first-party, but the avatars remain broken inside T3 Code.