Repository navigation
Conversation
…stion (#52) PostHog's cookieless server-hash step reads $raw_user_agent and $host straight off event.properties and drops the event with a cookieless_missing_user_agent/cookieless_missing_host ingestion warning if either is absent. createCommonProperties rebuilt an allowlisted properties object that dropped both, so every event was silently discarded at ingestion. Forward them through; never add $ip, which PostHog's capture service fills in server-side from the connection. Co-authored-by: scttbnsn <80784472+scttbnsn@users.noreply.github.com>
* fix(analytics): promote cookieless ingestion fix to production (#53) PostHog's cookieless server-hash step reads $raw_user_agent and $host straight off event.properties and drops the event with a cookieless_missing_user_agent/cookieless_missing_host ingestion warning if either is absent. createCommonProperties rebuilt an allowlisted properties object that dropped both, so every event was silently discarded at ingestion. Forward them through; never add $ip, which PostHog's capture service fills in server-side from the connection. Co-authored-by: biggest-littlest <zap_inane.2p@icloud.com> * chore(config): drop the stale Cursor rules folder * docs(config): drop dangling .cursorrules references --------- Co-authored-by: biggest-littlest <zap_inane.2p@icloud.com>
Measured over the shared PostHog project, 208 of 432 sessions across the five instrumented sites record zero duration, and PostHog's built-in Web analytics Page/Entry page/Exit page tables return zero rows. capture_pageleave was false, so a session's last recorded timestamp is its last pageview, and a five-minute read of one page scores as zero seconds. Flipping the option alone fixes nothing: sanitizeEvent allowlisted only $pageview, cta activated, and $web_vitals, so every $pageleave posthog-js emitted would have been dropped silently with no error and no ingestion warning. This adds a $pageleave branch that rebuilds the event the same way $pageview does. capture_pageview is false here (pageviews are captured by hand), so posthog-js's _shouldCapturePageleave gate needs an explicit true rather than the default. $pathname is the property PostHog's page tables actually key off, and it was never sent. It's bound to the already-sanitized `path` value, never the raw pathname, so it can't carry a route outside ALLOWED_ROUTES and adds no information the event wasn't already sending. A regression test asserts the two never diverge. No privacy option changes: cookieless_mode, person_profiles, persistence, disable_persistence, respect_dnt, save_referrer, and save_campaign_params are untouched. Part of X16 in the ops execution plan.
- fix(seo): point Organization.logo at /icon-512x512.png; the referenced /logos/codeswhat-logo-green.png never existed, so crawlers got a 404 - fix(seo): strip trailing slashes from BASE_URL and reuse it in robots.ts and sitemap.ts, so a NEXT_PUBLIC_SITE_URL set with a trailing slash can't emit //sitemap.xml-style URLs - chore(seo): disallow /studio/ in robots.txt; the capture pages already 404 in production but the exclusion shouldn't depend on that guard - chore(seo): 308 the stable *.vercel.app production aliases to codeswhat.com instead of serving duplicate content - fix(api): stop forwarding EmailOctopus error detail to subscribe clients; log it server-side and return a fixed message
One-line range bump; npm resolves next 16.3.3, which also pulls the patched transitive versions: postcss 8.5.23, nanoid 3.3.18, sharp 0.35.4. npm audit now reports zero vulnerabilities. No code changes needed: the app has no middleware, rewrites, server actions, CSP nonces, or next/image usage, so none of the fixed CVEs required app-side work.
- build(deps): pick up the root-params.d.ts reference next 16.3 adds - ci(hooks): pass --no-errors-on-unmatched to the biome pre-commit job so committing only biome-ignored files (like next-env.d.ts) doesn't fail
It was covered only by .git/info/exclude, which protects one clone and nobody else's. Without a tracked line, `git add -A` in the parent stages a nested worktree as an embedded gitlink and `git clean -ffd` deletes it.
… bounded UTM labels (#68) * fix(analytics): set $pathname on web vitals from the sanitized path * feat(analytics): add project CTA, newsletter and client error events * feat(analytics): record campaign labels through a bounded UTM vocabulary
* fix(analytics): set $pathname on web vitals from the sanitized path * feat(analytics): add project CTA, newsletter and client error events * feat(analytics): record campaign labels through a bounded UTM vocabulary * feat(site): add /support page with GitHub Sponsors, Stripe tiers and supporters list Six tiers mirror GitHub Sponsors and Stripe, with links read only from CODESWHAT_SUPPORT_LINKS. Support clicks go through the existing PostHog sanitizer under the support placement, and /support joins the route allowlist. * feat(site): replace the 3D scene design with the Catalogue design Homepage, /projects/<slug> specimen pages and /support now use the Catalogue shell, sprites and fonts. One light/dark theme via the nonce'd init script. Drops the WebGL scene from the shipped routes and the Tailwind/shadcn layer; three stays only for the dev-only /studio capture tools. * fix(site): replace the old tagline and em dashes in site copy * feat(site): render Catalogue share cards for every page * fix(site): match the share-card wordmark to the site header * fix(site): drop the wind-down policy from the support page * style(site): remove the unused notice signature rule * fix(site): make the homepage support section a plain ask
# Conflicts: # frontend/app/layout.tsx # frontend/test/site-browser.test.mjs
…nd deploy notes (#71)
Next 16.3.3 -> 16.4.3 (critical: image optimization SSRF, SSG/ISR cache poisoning), dompurify 3.4.13 -> 3.4.17 via posthog-js (critical), sharp 0.35.4 -> 0.35.5 (high), plus transitive lockfile patches. npm audit --omit=dev is clean on this head. CodeRabbit review delivered with no actionable comments; verify and Vercel preview green.
…the roadmap (#73) - ci(website): run support contracts and stop duplicate verify runs - ci(website): stop persisting the checkout credential - ci(website): verify fork branches named dev - ci(website): pin workflow actions to immutable revisions - ci(website): give push runs a unique concurrency group - refactor(repo): remove the stray portfolio app, old launcher and log junk - docs(roadmap): record the 2026-10-25 status and retire the superseded 3D items Review: Codex (two P2s, one fixed in-branch, one recorded as no-action) and CodeRabbit (no actionable comments). verify and Vercel preview green on f3ea2d7.
- test(analytics): resolve posthog-core by package specifier and fail clearly if an upgrade drops PostHog#_runBeforeSend - test(analytics): replace the stale body check in the production browser contract; require real Flight scripts before excluding them - docs(deploy): run the browser contract after each promotion - docs(roadmap): record the #72 and #73 promotion to production Two CodeRabbit passes: one finding on the first (Flight-script filter too loose), fixed in 2801dc4; none on the second. verify and Vercel green on 2801dc4. Browser contract 1/1 against https://codeswhat.com.
…t-in (#77) - fix(site): reject cross-site (Sec-Fetch-Site or foreign Origin, 403) and non-JSON (415) requests before the rate limit - fix(site): create EmailOctopus contacts as pending (double opt-in) - test(site): cover cross-site, headerless and text/plain bodies, and same-origin JSON reaching validation - docs(deploy): note the double opt-in dependency, what the origin check does and doesn't cover, and the per-instance limit Two CodeRabbit passes: two findings on the first (README overstated the check; the headerless case wasn't headerless), fixed in 15592c0; none on the second. verify green on 15592c0 after one transient Playwright install timeout on the previous head.
|
Deployment failed for project codeswhat-website with the following error: Learn More: https://vercel.com/codeswhat?upgradeToPro=build-rate-limit |
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 54 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
biggest-littlest
approved these changes
Oct 27, 2026
ALARGECOMPANY
approved these changes
Oct 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Publishes #77. The dev tree matches the reviewed #77 head (15592c0) exactly; the reconcile commit changes ancestry only.
/api/subscriberejects requests marked cross-site or carrying a foreignOrigin(403), and anything that isn'tapplication/json(415), before the rate limit. Atext/plainform post from any page used to reach the provider call.pending, so EmailOctopus's confirmation email gates the list.After deploy: production should return 415 for a
text/plainbody and 403 for a foreignOrigin, and invalid same-origin JSON should still get 400. A real signup should get the confirmation email.