Conversation
streamResponseInterceptor() took an interceptor and then piped the upstream response straight to the client without ever calling it, so the host rewriting every other proxied response gets was silently skipped for text/event-stream bodies (and for chunked responses sent with x-accel-buffering: no). The upstream status code was dropped the same way, so a streamed 503 reached the browser as 200. Implement the interceptor: complete lines are forwarded as they arrive, so an SSE event is never delayed, while a trailing partial line is held back so a replaced value split across two chunks is still matched. Decoding runs through StringDecoder so a multi-byte character split across chunks stays intact, and the pending buffer is flushed once it reaches 64 KiB so a stream without line breaks neither stalls nor grows without bound. Rewriting is limited to payloads that can be decoded as text: compressed bodies (content-encoding) and non-textual content types are piped through byte for byte as before. content-length is dropped only when the body is rewritten.
…sure Two gaps in the streaming interceptor: The textual check tested the raw content-type against a pattern that only accepted json or xml at the start of the value or after a "+", so the standard application/json and application/xml types fell through to the pass-through path and kept their upstream host. Parse the media type off the parameters and match it whole. Writing the rewritten chunks by hand also dropped the backpressure that pipe() used to apply: res.write() returning false was ignored while the data listener kept the upstream flowing, so a slow client grew the response write queue without bound. Pause the upstream until the response drains.
- add visual list additional_options column editor with DnD reorder - allow drag-and-drop reorder of schema variable rows - redesign values tab as nav + scrollable detail with scroll spy - style list value items as cards with DnD reorder - show JSON diff confirmation modal before save - polish inputs (30px auto-grow), thead radius, and related UI - update commonjs test fixture template variables for list editing
- add visual list additional_options column editor with DnD reorder - allow drag-and-drop reorder of schema variable rows - redesign values tab as nav + scrollable detail with scroll spy - style list value items as cards with DnD reorder - show JSON diff confirmation modal before save - polish inputs (30px auto-grow), thead radius, and related UI - update commonjs test fixture template variables for list editing
extract-zip has an unpatched symlink path-traversal vulnerability (GHSA-jmr9-qjv8-65gv, no fixed release exists). It creates symlinks from zip entries without validating their target, so a malicious backup/asset archive could plant a symlink pointing outside the extraction directory. Reject any symlink found in the extracted tree before dist.service.ts and changelog-generator.ts read/write through it.
mi-examples repos are required to be MIT licensed. Add a LICENSE file and switch package.json's license field from ISC to MIT to match.
npm audit has no fix for extract-zip's symlink advisory (GHSA-jmr9-qjv8-65gv, already mitigated in application code), so audit-all always exited 1 and failed the CI build job regardless of the code-level mitigation. Rewrite audit-all.mjs to evaluate `npm audit --json` against a small, documented allowlist of GHSA ids instead of trusting npm's raw exit code, so a known, unfixable, mitigated advisory no longer blocks CI while any other high or critical vulnerability still fails the build.
…selectors CI never ran the unit test suite because it always failed earlier at the `build` job's npm audit step — so these bugs from the PP-4021 values-editor redesign went unnoticed until the audit-all fix let `test` actually run: - scrollToValueRow() called detail.scrollTo() unconditionally; jsdom (and potentially older WebViews) don't implement Element.prototype.scrollTo. Guard it like the existing null checks, degrading to no auto-scroll. - showJsonDiffModal() called requestAnimationFrame() unconditionally before wiring the modal's Save/Cancel button handlers; jsdom doesn't implement it either, so the whole confirm-save flow threw before those listeners were ever attached. Guard it the same way. - Two tests still queried '#content tbody input', a selector from the old table-based values tab; the redesign moved to '.ve-values-detail'. Updated both to the current markup. - save() now opens a confirmation diff modal instead of saving immediately; updated the pending-save test to click '.ve-modal-ok' before asserting the save request fired.
🔐 Fix npm audit vulnerabilities and add MIT license
…onse-rewrite fix(proxy): rewrite URLs and forward status for streamed responses
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
The workflow_run trigger set the job's GITHUB_REF to the workflow file's ref (main, the repo's default branch) instead of the branch that actually triggered it (develop), even though the checkout step explicitly checks out develop's commit. semantic-release's branch detection (env-ci) reads only GITHUB_REF, so it decided it was releasing from main, computed a stable 1.3.0 instead of a beta prerelease, and tried to push straight to main — which branch protection correctly rejected (GH006). This job's `if:` guard already restricts it to develop in both trigger paths, so hardcoding GITHUB_REF here is always correct.
…ction 🔧 Fix beta-release pushing to main instead of develop
sergak01
requested review from
MaksymovVolodymyr,
Sadilenko and
michailozdemir
August 19, 2026 11:23
MaksymovVolodymyr
approved these changes
Aug 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
npm auditfindings (deepmerge-tsbump,extract-zipsymlink mitigation)LICENSEand setpackage.jsonlicense to MIT (PP-4041)testcould run): unguardedElement.scrollTo/requestAnimationFramecalls, and stale test selectors from the pre-redesign markuptext/event-streamand chunked responses now get the same host rewriting and status-code forwarding as every other proxied response)Included commits
feat(ui): improve variables editor schema/values UXPP-4021 [Internal] PP Dev helper variables editor UI(PP-4021 #239)fix(security): reject unvalidated symlinks after zip extractionchore(deps): fix npm audit vulnerabilitieschore(deps): fix audit vulnerabilities in test fixtureschore(license): add MIT license (PP-4041)fix(ci): allowlist extract-zip's unfixable advisory in audit-allfix(variables-editor): guard missing browser APIs, update stale test selectors(🔐 Fix npm audit vulnerabilities and add MIT license #242)fix(proxy): rewrite URLs and forward status for streamed responsesfix(proxy): rewrite JSON and XML streams, and respect client backpressure(fix(proxy): rewrite URLs and forward status for streamed responses #238)Testing
develop(build + test) after all of the above mergednpm run audit:all,npm run test:unit,npm run test:integrationall cleanMerge Request:
origin/develop→origin/main