fix(deps): resolve path-to-regexp CVE-2026-4926#6
Open
michaelmagan wants to merge 9 commits into
Open
Conversation
- Updated various dependencies in package.json and package-lock.json for better performance and security. - Added .env.example to .gitignore to prevent accidental commits of sensitive environment files. - Refactored AI initialization in gemini.ts to ensure proper handling of API key. - Enhanced chat component with user context key management and resizing functionality. - Improved markdown rendering components to support new features and better styling. - Adjusted message input components for better resource and prompt handling. - Updated TypeScript configuration for improved type checking and module resolution.
…instructions - Revised feature list to include natural language schema design, interactive ERD visualization, and multi-format code generation. - Improved setup instructions for installing dependencies and configuring environment variables. - Added sections for tech stack, AI tools, and code generation formats. - Included example prompts for users to quickly start designing databases.
- Update @tambo-ai/react from ^0.73.1 to 1.0.2 - Remove direct @tambo-ai/typescript-sdk dependency - Update all registry components via tambo CLI - Rename contextKey to userKey on TamboProvider - Rename withInteractable to withTamboInteractable
* feat: stream schemas into canvas via Tambo prop streaming Replace Gemini-backed tool system with Tambo component streaming so schemas progressively render in the canvas instead of appearing all at once. Add SchemaCanvas bridge component with full/update modes for incremental table additions. Remove all Gemini dependencies and dead code (schema-tools, database-design service, API routes). * fix: prevent diagram flashing during streaming, modularize diagram Split schema-diagram.tsx into three modules: - table-node.tsx: TableNode component - diagram-utils.ts: edge styles, fingerprinting, grid layout, edge builder - schema-diagram.tsx: diagram orchestrator Preserve node object references for unchanged tables via column fingerprinting so ReactFlow skips re-rendering them. Controlled fitView only fires when a new table appears. User drag positions persist across streaming updates. * fix: address PR review comments - Use functional setSchemaData so update-mode merges against latest state instead of a stale mount-time snapshot - Add unmount cleanup for isStreaming so it never gets stuck true - Add removedTables prop to support table removal in update mode - Cancel fitView RAF on unmount and before re-scheduling - Include target column in edge IDs to prevent collisions * fix: handle table deletion when no new tables are provided The early return bailed out when tables was empty, which meant removedTables was never processed. Now we proceed if either tables or removedTables has entries. Also updated the component description to tell the AI to use the removedTables prop. * fix: address review nits — edge fingerprinting, stable keys, stale cleanup, README updates * chore: bump components * fix: add placeholder styles for TipTap editor and improve table column key handling - Introduced CSS styles for the TipTap editor placeholder to ensure proper display when the editor is empty. - Updated the table column mapping to use a fallback index as the key, enhancing stability in rendering.
* refactor: update streaming UI components for improved styling and feedback - Enhanced the streaming status display in SchemaViewer and SchemaCanvas components. - Updated styles for better visibility and user experience, including background and text color adjustments. - Replaced loading indicators with more modern animations and adjusted text for clarity on schema updates. * Add landing page branding, demo video, and Tambo header - Redesign landing page with dark subtle aesthetic, demo video, schema preview, feature cards, export format logos, and Tambo branding section with rich SEO metadata - Add full-width header bar on chat page with Tambo lockup logo - Credit Akinkunmi as creator in the footer * Address PR review comments - Switch <img> to next/image for static assets (logos, lockup) - Add metadataBase in layout.tsx for proper OG URL generation - Use title template pattern to avoid metadata drift - Add video fallback text for unsupported browsers - Simplify schema preview from nested spans to plain text - Fix SchemaCanvas ready label: "ready" for full mode, "updated" for update mode - Correct domain to dbthing.tambo.co
Fresh lockfile resolves path-to-regexp to 8.4.2 (was 8.3.0). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
@michaelmagan is attempting to deploy a commit to the Akinkunmi Team on Vercel. A member of the Team first needs to authorize it. |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
16 issues found across 50 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="package.json">
<violation number="1" location="package.json:40">
P2: Upgrading to Next 16 while keeping `next lint` scripts will break lint commands because `next lint` is removed in Next.js 16.</violation>
</file>
<file name="src/components/tambo/elicitation-ui.tsx">
<violation number="1" location="src/components/tambo/elicitation-ui.tsx:460">
P2: `formData`/`touchedFields` are initialized from the first request only and are not reset when `request` prop changes, allowing stale values to leak into later `accept` payloads.</violation>
</file>
<file name="src/components/tambo/thread-history.tsx">
<violation number="1" location="src/components/tambo/thread-history.tsx:435">
P2: Rename is still presented to users, but submit does nothing, resulting in a misleading no-op feature.</violation>
</file>
<file name="src/components/tambo/scrollable-message-container.tsx">
<violation number="1" location="src/components/tambo/scrollable-message-container.tsx:96">
P2: Caller-provided `onScroll` can override the internal `handleScroll`, breaking autoscroll state tracking.</violation>
</file>
<file name="src/components/tambo/text-editor.tsx">
<violation number="1" location="src/components/tambo/text-editor.tsx:310">
P2: Mention duplicate detection uses display label instead of resource ID, causing incorrect blocking of distinct resources with the same name.</violation>
</file>
<file name="src/components/tambo/diagram-utils.ts">
<violation number="1" location="src/components/tambo/diagram-utils.ts:86">
P2: Edges are created with `targetHandle` IDs that may not exist because target handles are only rendered for primary-key columns, but `buildEdges` does not validate handle availability.</violation>
</file>
<file name="src/components/tambo/message-input.tsx">
<violation number="1" location="src/components/tambo/message-input.tsx:165">
P2: `MessageInput` always auto-renders staged images while also exposing/documenting manual staged-image composition, which can cause duplicate staged image UI when consumers include the component as a child.</violation>
</file>
<file name="src/components/tambo/markdown-components.tsx">
<violation number="1" location="src/components/tambo/markdown-components.tsx:97">
P2: Copy success state is never reset, so the checkmark can remain stuck after a successful copy.</violation>
<violation number="2" location="src/components/tambo/markdown-components.tsx:276">
P2: Resource mention name extraction stringifies React child nodes, which can render corrupted labels like `[object Object]` for formatted link text.</violation>
</file>
<file name="src/components/tambo/schema-canvas.tsx">
<violation number="1" location="src/components/tambo/schema-canvas.tsx:59">
P2: In `full` mode, an empty `tables` payload is ignored, so schema state cannot be cleared to zero tables and stale tables remain.</violation>
<violation number="2" location="src/components/tambo/schema-canvas.tsx:73">
P2: Effect cleanup is used as if unmount-only, but it runs on every dependency change and repeatedly resets `isStreaming`.</violation>
</file>
<file name="src/components/tambo/message-suggestions.tsx">
<violation number="1" location="src/components/tambo/message-suggestions.tsx:150">
P2: Using `Array.prototype.toReversed()` can break in supported target browsers (e.g., Firefox 111) because this API is not guaranteed/polyfilled by default.</violation>
<violation number="2" location="src/components/tambo/message-suggestions.tsx:267">
P2: `isGenerating` no longer shows any status UI unless `isStreaming` is true, causing a blank loading state during suggestion generation.</violation>
</file>
<file name="src/components/tambo/graph.tsx">
<violation number="1" location="src/components/tambo/graph.tsx:70">
P2: Error boundary state is never reset, so one render error can permanently lock the chart into fallback UI.</violation>
<violation number="2" location="src/components/tambo/graph.tsx:151">
P2: `GraphProps` was narrowed to `z.infer<typeof graphSchema>`, making `data`/`title` required and dropping generic `div` attributes, which is a breaking API/type-contract change inconsistent with current component behavior.</violation>
</file>
<file name="src/app/chat/page.tsx">
<violation number="1" location="src/app/chat/page.tsx:78">
P2: `TamboProvider` user identity changes after mount because `userKey` starts with a shared fallback and then switches to a per-user key, which can split/reset thread context.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
| "next": "^15.5.2", | ||
| "lucide-react": "^0.563.0", | ||
| "motion": "^12.31.0", | ||
| "next": "^16.1.6", |
There was a problem hiding this comment.
P2: Upgrading to Next 16 while keeping next lint scripts will break lint commands because next lint is removed in Next.js 16.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At package.json, line 40:
<comment>Upgrading to Next 16 while keeping `next lint` scripts will break lint commands because `next lint` is removed in Next.js 16.</comment>
<file context>
@@ -12,40 +12,54 @@
- "next": "^15.5.2",
+ "lucide-react": "^0.563.0",
+ "motion": "^12.31.0",
+ "next": "^16.1.6",
"radix-ui": "^1.4.3",
- "react": "^19.1.1",
</file context>
| () => request.requestedSchema.required ?? [], | ||
| [request.requestedSchema.required], | ||
| ); | ||
| const [formData, setFormData] = useState<Record<string, unknown>>(() => { |
There was a problem hiding this comment.
P2: formData/touchedFields are initialized from the first request only and are not reset when request prop changes, allowing stale values to leak into later accept payloads.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At src/components/tambo/elicitation-ui.tsx, line 460:
<comment>`formData`/`touchedFields` are initialized from the first request only and are not reset when `request` prop changes, allowing stale values to leak into later `accept` payloads.</comment>
<file context>
@@ -0,0 +1,624 @@
+ () => request.requestedSchema.required ?? [],
+ [request.requestedSchema.required],
+ );
+ const [formData, setFormData] = useState<Record<string, unknown>>(() => {
+ const initial: Record<string, unknown> = {};
+ fields.forEach(([name, schema]) => {
</file context>
| console.error("Failed to rename thread:", error); | ||
| } | ||
| // Thread renaming is not supported in V1 API | ||
| setEditingThread(null); |
There was a problem hiding this comment.
P2: Rename is still presented to users, but submit does nothing, resulting in a misleading no-op feature.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At src/components/tambo/thread-history.tsx, line 435:
<comment>Rename is still presented to users, but submit does nothing, resulting in a misleading no-op feature.</comment>
<file context>
@@ -403,53 +402,37 @@ const ThreadHistoryList = React.forwardRef<
- console.error("Failed to rename thread:", error);
- }
+ // Thread renaming is not supported in V1 API
+ setEditingThread(null);
};
</file context>
| return ( | ||
| <div | ||
| ref={scrollContainerRef} | ||
| onScroll={handleScroll} |
There was a problem hiding this comment.
P2: Caller-provided onScroll can override the internal handleScroll, breaking autoscroll state tracking.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At src/components/tambo/scrollable-message-container.tsx, line 96:
<comment>Caller-provided `onScroll` can override the internal `handleScroll`, breaking autoscroll state tracking.</comment>
<file context>
@@ -29,34 +29,75 @@ export const ScrollableMessageContainer = React.forwardRef<
return (
<div
ref={scrollContainerRef}
+ onScroll={handleScroll}
className={cn(
"flex-1 overflow-y-auto",
</file context>
| tiptapCommand: (attrs: { id: string; label: string }) => void, | ||
| ) => | ||
| (item: ResourceItem) => { | ||
| if (checkMentionExists(editor, item.name)) return; |
There was a problem hiding this comment.
P2: Mention duplicate detection uses display label instead of resource ID, causing incorrect blocking of distinct resources with the same name.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At src/components/tambo/text-editor.tsx, line 310:
<comment>Mention duplicate detection uses display label instead of resource ID, causing incorrect blocking of distinct resources with the same name.</comment>
<file context>
@@ -0,0 +1,849 @@
+ tiptapCommand: (attrs: { id: string; label: string }) => void,
+ ) =>
+ (item: ResourceItem) => {
+ if (checkMentionExists(editor, item.name)) return;
+ tiptapCommand({ id: item.id, label: item.name });
+ onSelect(item);
</file context>
Comment on lines
+150
to
+151
| ? (messages.toReversed().find((msg) => msg.role === "assistant") ?? | ||
| null) |
There was a problem hiding this comment.
P2: Using Array.prototype.toReversed() can break in supported target browsers (e.g., Firefox 111) because this API is not guaranteed/polyfilled by default.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At src/components/tambo/message-suggestions.tsx, line 150:
<comment>Using `Array.prototype.toReversed()` can break in supported target browsers (e.g., Firefox 111) because this API is not guaranteed/polyfilled by default.</comment>
<file context>
@@ -140,15 +138,18 @@ const MessageSuggestions = React.forwardRef<
- : null;
+ const lastAiMessage =
+ messages.length > 0
+ ? (messages.toReversed().find((msg) => msg.role === "assistant") ??
+ null)
+ : null;
</file context>
Suggested change
| ? (messages.toReversed().find((msg) => msg.role === "assistant") ?? | |
| null) | |
| ? (messages | |
| .slice() | |
| .reverse() | |
| .find((msg) => msg.role === "assistant") ?? | |
| null) |
| <p>Generating suggestions...</p> | ||
| </div> | ||
| ) : null} | ||
| {isStreaming && <MessageGenerationStage />} |
There was a problem hiding this comment.
P2: isGenerating no longer shows any status UI unless isStreaming is true, causing a blank loading state during suggestion generation.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At src/components/tambo/message-suggestions.tsx, line 267:
<comment>`isGenerating` no longer shows any status UI unless `isStreaming` is true, causing a blank loading state during suggestion generation.</comment>
<file context>
@@ -267,14 +264,7 @@ const MessageSuggestionsStatus = React.forwardRef<
- <p>Generating suggestions...</p>
- </div>
- ) : null}
+ {isStreaming && <MessageGenerationStage />}
</div>
</div>
</file context>
Suggested change
| {isStreaming && <MessageGenerationStage />} | |
| {isStreaming ? ( | |
| <MessageGenerationStage /> | |
| ) : isGenerating ? ( | |
| <div className="flex items-center gap-2 text-muted-foreground"> | |
| <p>Generating suggestions...</p> | |
| </div> | |
| ) : null} |
| } | ||
|
|
||
| static getDerivedStateFromError(error: Error) { | ||
| return { hasError: true, error }; |
There was a problem hiding this comment.
P2: Error boundary state is never reset, so one render error can permanently lock the chart into fallback UI.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At src/components/tambo/graph.tsx, line 70:
<comment>Error boundary state is never reset, so one render error can permanently lock the chart into fallback UI.</comment>
<file context>
@@ -1,18 +1,110 @@
+ }
+
+ static getDerivedStateFromError(error: Error) {
+ return { hasError: true, error };
+ }
+
</file context>
| /** | ||
| * TypeScript type inferred from the Zod schema | ||
| */ | ||
| export type GraphProps = z.infer<typeof graphSchema>; |
There was a problem hiding this comment.
P2: GraphProps was narrowed to z.infer<typeof graphSchema>, making data/title required and dropping generic div attributes, which is a breaking API/type-contract change inconsistent with current component behavior.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At src/components/tambo/graph.tsx, line 151:
<comment>`GraphProps` was narrowed to `z.infer<typeof graphSchema>`, making `data`/`title` required and dropping generic `div` attributes, which is a breaking API/type-contract change inconsistent with current component behavior.</comment>
<file context>
@@ -44,52 +139,30 @@ export const graphSchema = z.object({
+/**
+ * TypeScript type inferred from the Zod schema
+ */
+export type GraphProps = z.infer<typeof graphSchema>;
-const graphVariants = cva(
</file context>
Suggested change
| export type GraphProps = z.infer<typeof graphSchema>; | |
| export type GraphProps = Omit<React.HTMLAttributes<HTMLDivElement>, "data" | "title" | "size"> & | |
| Omit<z.infer<typeof graphSchema>, "data" | "title"> & { | |
| data?: GraphDataType; | |
| title?: string; | |
| }; |
| tools={tools} | ||
| tamboUrl={process.env.NEXT_PUBLIC_TAMBO_URL} | ||
| mcpServers={mcpServers} | ||
| userKey={contextKey ?? "database-design-tool"} |
There was a problem hiding this comment.
P2: TamboProvider user identity changes after mount because userKey starts with a shared fallback and then switches to a per-user key, which can split/reset thread context.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At src/app/chat/page.tsx, line 78:
<comment>`TamboProvider` user identity changes after mount because `userKey` starts with a shared fallback and then switches to a per-user key, which can split/reset thread context.</comment>
<file context>
@@ -5,46 +5,104 @@ import { SchemaViewer } from '@/components/schema-viewer';
tools={tools}
tamboUrl={process.env.NEXT_PUBLIC_TAMBO_URL}
+ mcpServers={mcpServers}
+ userKey={contextKey ?? "database-design-tool"}
>
- <TamboMcpProvider mcpServers={mcpServers}>
</file context>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
path-to-regexpto 8.4.2 (was 8.3.0)Test plan
npm installsucceeds🤖 Generated with Claude Code
Summary by cubic
Updates dependencies to resolve the
path-to-regexpCVE and migrates to@tambo-ai/reactv1, adding a streaming schema canvas and refreshed UI.Dependencies
path-to-regexpto 8.4.2.@tambo-ai/reactto 1.x and add@tambo-ai/react-ui-base,@radix-ui/*, andtiptappackages.@libsql/client; add.env.exampleforTURSO_*andNEXT_PUBLIC_TAMBO_API_KEY.Refactors
SchemaCanvasfor incremental schema updates; remove GenAI routes andschema-tools.diagram-utils,table-node, updatedschema-diagram) with stable fingerprints and preserved node positions.getTurso()client; minor generator guards; renamewithInteractabletowithTamboInteractable.Written for commit fc0150c. Summary will update on new commits.