Skip to content

v5.1.3 — Star-History chart fix (use official sealed_token embed)

Choose a tag to compare

View all tags
@AleksNeStu AleksNeStu released this 15 Aug 20:37
· 38 commits to dev since this release
v5.1.3
db8054e

v5.1.3 — Star-History chart fix (use official sealed_token embed)

Release date: 2026-08-15
Type: Documentation-only (no code change)

Fix

The v5.1.2 fallback to the img.shields.io static star badge is replaced with the official star-history.com embed code, which contains an encrypted sealed_token (the PAT encrypted server-side by their UI). The chart in README now renders live with the current count + growth curve.

What was wrong with the previous attempts

Version Approach Result
v5.1.1 https://api.star-history.com/svg?...&secret=<PAT> ❌ Returns placeholder ("GitHub restricted") — ?secret= is NOT the public embed path despite what their blog says
v5.1.2 img.shields.io/github/stars/...?style=social ⚠️ Works but no time-series — just a current count badge
v5.1.3 Official <picture><source srcset="...&sealed_token=..."/></picture> embed ✅ Real star history chart, encrypted token, dark/light media queries

Per their setup guide, the ?secret=<PAT> URL parameter only works in the web UI's local-storage flow. The actual README embed must be generated via the "Show real-time chart on your README.md" panel, which encrypts the token into sealed_token and embeds it in the URL.

What's in v5.1.3

  • README.md ### Star Growth section: replaced the shields badge with the official embed code (encrypted sealed_token parameter; works for both prefers-color-scheme: dark and light).
  • CHANGELOG.md: new [5.1.3] section documenting the Round 4 fix.

Verification

  • The embed renders live at https://api.star-history.com/chart?repos=AleksNeStu/ai-real-estate-assistant&type=date&theme=dark&legend=top-left&sealed_token=... (returns valid SVG, 200 OK).
  • The token is never exposed in plaintext in the repo — only the encrypted sealed_token appears in the URL.
  • The previous v5.1.2 fallback to the shields badge is no longer needed.

Carried-forward from v5.1.2

  • 6 Dependabot HIGH + 1 MEDIUM CVE closed (package.json overrides)
  • CodeQL config error fixed (removed conflicting queries: input)
  • ESLint 4 new react-hooks rules disabled
  • Private Vulnerability Reporting enabled for AleksNeStu/ai-real-estate-assistant and AleksNeStu/ai-news-scraper
  • The star-history orphan branch (last commit ba1d657) is no longer referenced from README; safe to delete via git push origin --delete star-history whenever convenient.

Migration notes

  • No data migration.
  • No code change (only README.md and CHANGELOG.md).
  • The sealed_token is the same GITHUB_TOKEN_AVN PAT — encrypted by star-history.com's web UI before being embedded in the URL. If you regenerate the token, you'll need to regenerate the embed code via the star-history.com "Add access token" panel.

Credits

Assets 2
Loading