Chore/sync upstream jul 2026 by VinneyJ · Pull Request #66 · CodeForAfrica/dub

VinneyJ · 2026-07-20T12:49:52Z

Summary

Merges all upstream dubinc/dub changes into our fork through July 2026 (up to PR Soft-fail logo upload so it doesn't block program creation dubinc/dub#4168)
Fixes merge conflict: missing ResendBulkEmailOptions import
Resolves package version conflict (fast-xml-parser 5.7.0)

What's included

Key upstream changes brought in:

Domain renewals & Stripe domain billing flows
Partner fraud detection & identity verification
Program onboarding improvements & image upload fixes
Social metrics bounties visibility
API log route coverage & secret masking
Payouts upgrade messaging
QStash withCron wrapper across cron handlers
Various bug fixes and UI improvements

Test plan

Verify app builds without errors
Smoke test login and workspace loading
Check domain and partner flows still work

…rove efficiency

…kspaces

Move "link.clicked" webhook to workspace level

…ntity Bound eventQuantity to a positive integer with a max

…form-response Rate limit SAML verify and unify not-found/no-SSO response

Allow min payout for whitelisted workspaces

Removed the update logic for partner bank account when application access is revoked. Added a TODO to recompute payout state if necessary.

…op-2026-07-16 # Conflicts: # apps/web/app/(ee)/api/events/export/route.ts # apps/web/app/(ee)/api/events/route.ts # apps/web/next.config.js # packages/email/src/resend/constants.ts # packages/email/src/send-via-resend.ts # pnpm-lock.yaml

Left out of the import when resolving the merge conflict in packages/email/src/send-via-resend.ts; caught by tsc --noEmit.

vercel · 2026-07-20T12:50:03Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
dub	Error		Jul 29, 2026 6:55am

…v var

- Add FORWARD_QUERY directives to datasources with schema changes (dub_click_events, dub_sale_events, dub_lead_events, dub_api_logs, dub_links_metadata) - Add partner_tag_ids to dub_links_metadata_pipe explicit column list - Add dub_regular_links_metadata_latest datasource and materialization - Add v2 endpoint pipes from Classic workspace (endpoints/ directory) - Add tinybird.config.json for Forward workspace configuration - Add backup script for pre-migration data export

…ation Migrate Tinybird workspace from Classic to Forward

…endpoints

…P endpoints

… migration

VinneyJ · 2026-07-28T12:01:09Z

Of course, the review for this would be a long shot. But the approval is still important before the merge. @kilemensi , @maquchizi

kilemensi · 2026-07-28T12:10:19Z

Reviewing this is not difficult @VinneyJ , it is impossible! But as long as we don't introduce any changes all should be good.

Lets see if codex can do:

@codex review if this PR only pull changes from upstream repo or introduces own changes.

chatgpt-codex-connector · 2026-07-28T12:14:16Z

💡 Codex Review

dub/packages/tinybird/tinybird.config.json

Lines 1 to 4 in fb38e90

    
           { 
        
             "dev_mode": "manual", 
        
             "folder": "." 
        
           }

Split the Tinybird migration from the upstream sync

The preserved branch history shows that this configuration was added by the downstream commit a73faa6f (“Migrate Tinybird workspace from Classic to Forward”), after upstream commit 28b7f9cc had already been merged, and was followed by several additional downstream Tinybird commits. This means the proposed commit includes an independent data-infrastructure migration rather than only upstream changes; it should be removed from this sync and reviewed separately.

dub/packages/utils/src/constants/main.ts

Lines 6 to 7 in fb38e90

    
           "app.fyi.codeforafrica.org", 
        
           "dub.dev.codeforafrica.org",

Split the downstream hostname additions from the sync

These Code for Africa hostnames are not present in the synced upstream tree: repository history attributes them to downstream commit f97b055f, created after the upstream merge. They change which requests the middleware treats as application traffic, so this commit is not an upstream-only pull unless these lines are removed or moved to a separately reviewed change.

dub/apps/web/lib/auth/options.ts

Lines 385 to 387 in fb38e90

    
           domain: VERCEL_DEPLOYMENT 
        
           ? process.env.NEXTAUTH_COOKIE_DOMAIN || ".dub.co" 
        
           : undefined,

Split the configurable cookie-domain behavior from the sync

The NEXTAUTH_COOKIE_DOMAIN fallback was introduced by downstream commit efd9b4fc after the upstream merge, rather than by upstream through PR dubinc#4168. Because this changes the scope of production session cookies and is independent behavior not mentioned as an upstream change, it should be separated from an upstream-only synchronization.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

VinneyJ · 2026-07-28T13:20:11Z

@codex, review once more and check whether P1 is still in this PR. P2 should be fine for this PR.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d03cf63a71

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-07-28T13:23:16Z

@@ -326,8 +383,8 @@ export const authOptions: NextAuthOptions = {
        path: "/",
        // When working on localhost, the cookie domain must be omitted entirely (https://stackoverflow.com/a/1188145)
        domain: VERCEL_DEPLOYMENT
-          ? `.${process.env.NEXT_PUBLIC_APP_DOMAIN}`
-          : undefined,
+        ? process.env.NEXTAUTH_COOKIE_DOMAIN || ".dub.co"


Preserve the self-hosted session cookie domain

On any Vercel-backed self-host whose hostname is outside dub.co—including the newly added app.fyi.codeforafrica.org and dub.dev.codeforafrica.org hosts—this defaults the cookie to Domain=.dub.co unless the new NEXTAUTH_COOKIE_DOMAIN variable is manually configured. Browsers reject that cookie because its domain does not match the response host, so authentication cannot persist. A repo-wide search at this commit finds no declaration or example for the new variable, while the previous implementation derived the domain from the existing required NEXT_PUBLIC_APP_DOMAIN; retain that fallback or include and migrate the required configuration.

Useful? React with 👍 / 👎.

VinneyJ · 2026-07-28T13:34:23Z

@kilemensi I think it's good now.

steven-tey and others added 30 commits July 3, 2026 15:42

increase delay in fundFinancialAccount

91ce7a2

Merge branch 'main' into refactor-link-clicked-webhook

2e4125a

linkTarget → linkScope

3b098ff

add createdAt column

5d0b43b

deprecate webhookIds field, rename to send-link-clicked-webhooks, imp…

e5e9f86

…rove efficiency

Update find-link.ts

797108a

missed a few more linkTarget → linkScope

39d7de1

Update folder-selector.tsx

85093e5

finalize sync-click-workspaces cron

7768e56

final changes, renamed webhookClickWorkspaces → linkClickedWebhookWor…

f7ec3f4

…kspaces

fix barrel import issue

af49d9e

allow min payout for whitelisted workspaces

83975d5

code improvements

b597789

prefix workspace

401315b

bound eventQuantity to a positive integer with a max

3708359

max 100

230033e

Merge pull request dubinc#4083 from dubinc/refactor-link-clicked-webhook

0904503

Move "link.clicked" webhook to workspace level

rate limit SAML verify and unify not-found/no-SSO response

e77de5e

simplify ProgramPromoBanner/Card

60d121e

Merge pull request dubinc#4126 from dubinc/track-lead-bound-event-qua…

80b9b15

…ntity Bound eventQuantity to a positive integer with a max

Merge pull request dubinc#4127 from dubinc/saml-verify-rate-limit-uni…

4e3f29f

…form-response Rate limit SAML verify and unify not-found/no-SSO response

improve process crons to be more robust & resilient

91ff0db

simplify cleanupRedundantLinkWebhookEntries

030b220

reduce frequency to */5 * * * *

21d9b91

Merge branch 'main' into extended-min-payout-200

6106a20

simplify

0cde548

improve error message

aa7ca97

Merge pull request dubinc#4125 from dubinc/extended-min-payout-200

73909e4

Allow min payout for whitelisted workspaces

Clear partner Stripe Connect data on revoked access error

ab82537

Remove partner update on access revocation

338548c

Removed the update logic for partner bank account when application access is revoked. Added a TODO to recompute payout state if necessary.

VinneyJ added 3 commits July 16, 2026 10:01

Fix missing ResendBulkEmailOptions import from merge

7d02181

Left out of the import when resolving the merge conflict in packages/email/src/send-via-resend.ts; caught by tsc --noEmit.

chore: resolve merge conflicts with main (fast-xml-parser version)

6e49efd

vercel Bot deployed to Preview July 20, 2026 12:52 View deployment

Add CFA hostnames to APP_HOSTNAMES so middleware routes them to app

f97b055

vercel Bot deployed to Preview July 23, 2026 17:57 View deployment

Make session cookie domain configurable via NEXTAUTH_COOKIE_DOMAIN en…

efd9b4f

…v var

vercel Bot deployed to Preview July 23, 2026 18:45 View deployment

VinneyJ and others added 2 commits July 27, 2026 13:53

Merge pull request #67 from CodeForAfrica/chore/tinybird-forward-migr…

5db1b1f

…ation Migrate Tinybird workspace from Classic to Forward

vercel Bot deployed to Preview July 27, 2026 11:17 View deployment

VinneyJ added 2 commits July 27, 2026 14:46

Move v4 Tinybird pipes to endpoints/ so Forward exposes them as HTTP …

4b897d4

…endpoints

Add TYPE endpoint to v4 Tinybird pipes so Forward exposes them as HTT…

17084c0

…P endpoints

vercel Bot deployed to Preview July 27, 2026 11:55 View deployment

Remove FORWARD_QUERY blocks from datasources after Classic to Forward…

01c64f3

… migration

vercel Bot deployed to Preview July 27, 2026 12:57 View deployment

Move v4 Tinybird pipes back to pipes/ to match upstream structure

fb38e90

vercel Bot deployed to Preview July 28, 2026 06:18 View deployment

VinneyJ requested review from kilemensi and maquchizi July 28, 2026 11:57

Revert Tinybird Forward migration commits (moved to PR #68)

d03cf63

vercel Bot had a problem deploying to Preview July 28, 2026 13:20 Failure

chatgpt-codex-connector Bot reviewed Jul 28, 2026

View reviewed changes

VinneyJ mentioned this pull request Aug 10, 2026

chore: sync upstream dubinc/dub to 2026-07-16 #69

Open

4 tasks

Navigation Menu

Uh oh!

Chore/sync upstream jul 2026 - #66

Chore/sync upstream jul 2026#66
VinneyJ wants to merge 3002 commits into
mainfrom
chore/sync-upstream-jul-2026

VinneyJ commented Jul 20, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Jul 20, 2026 •

edited

Loading

Uh oh!

VinneyJ commented Jul 28, 2026

Uh oh!

kilemensi commented Jul 28, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Jul 28, 2026

Uh oh!

VinneyJ commented Jul 28, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Jul 28, 2026

Uh oh!

VinneyJ commented Jul 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Uh oh!

Conversation

VinneyJ commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What's included

Test plan

Uh oh!

vercel Bot commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

VinneyJ commented Jul 28, 2026

Uh oh!

kilemensi commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Jul 28, 2026

💡 Codex Review

Uh oh!

VinneyJ commented Jul 28, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jul 28, 2026

Choose a reason for hiding this comment

Uh oh!

VinneyJ commented Jul 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

VinneyJ commented Jul 20, 2026 •

edited

Loading

vercel Bot commented Jul 20, 2026 •

edited

Loading

kilemensi commented Jul 28, 2026 •

edited

Loading