chore: sync Development → main (v1.3.5) by dbwg2009 · Pull Request #106 · dbwg2009/Noted

dbwg2009 · 2026-05-08T19:29:45Z

Summary

Syncs Development into main, bringing in all changes since the last Development → main merge.

Why

Routine sync to keep main up to date with infra/CI improvements that have been running on Development. No related feature issue — this is housekeeping.

Changes included in this diff

Release Please + Codecov automation (.github/workflows/release-please.yml, release-please-config.json, release-please-manifest.json)
pr-checks.yml updated to run Vitest and upload coverage to Codecov
vitest.config.ts updated to emit lcov coverage report
package.json bumped to v1.3.5 with PostCSS XSS override (postcss@^8.5.10)
CHANGELOG.md updated
.claude/memory/feedback_pr_workflow.md updated (docs only)

Note: Sentry, Docker healthcheck, Vitest scaffolding, and other infra changes from v1.3.3/v1.3.4 were already on Development before this sync — they are not new in this diff.

No release needed

Releases v1.3.3 → v1.3.5 have already been cut against the commits included here.

Test plan

Verify npm ci succeeds after merge
Confirm CI passes on main

🤖 Generated with Claude Code

Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v6) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

…pment/actions/checkout-6 Bump actions/checkout from 4 to 6

* chore: add Vitest unit tests for lib/birthdays and lib/occasions 57 tests covering date parsing, next-occurrence rollover, age calculation, money formatting, Easter algorithm, and occasion countdown logic. vitest.config.ts scopes coverage to the two tested files (85/80% thresholds). pr-checks.yml extended with a test+coverage step. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: bump CI Node version to 24 to match local npm 11 lockfile package-lock.json was generated by npm 11 (Node 24 local); npm 10 (Node 20 CI) rejects it with missing esbuild entries. Aligning CI to Node 24 resolves the npm ci lockfile sync error. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Pre-commit hook runs ESLint via lint-staged on staged ts/tsx files. Commit-msg hook validates Conventional Commits format via commitlint. prepare script ensures hooks install automatically after npm install. Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Installs @sentry/nextjs and wires up client, server, and edge configs. All three Sentry env vars are optional; init is skipped when SENTRY_DSN is unset so self-hosters who don't want Sentry are unaffected. Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Workflow triggers on Dependabot PRs only and calls gh pr merge --auto --squash for patch/minor bumps. Major bumps stay open for manual review. CI must pass before GitHub actions on the auto-merge flag. Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Scans the app image after push using aquasecurity/trivy-action. Fails on CRITICAL severity CVEs with available fixes; uploads SARIF results to the GitHub Security tab on every run. Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Adds deploy.resources.limits.memory to all four compose services: db 512m, migrate 256m, app 512m, cron 64m. Prevents OOM killer taking down Postgres on the Pi during memory pressure. Also passes SENTRY_DSN/ORG/PROJECT through to the app container. Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

)

GET /api/health returns {status:"ok"} with 200. docker-compose.yml gains a healthcheck on the app service and upgrades the cron depends_on condition to service_healthy, replacing the manual readiness poll loop in the cron entrypoint. Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

…25-68121) (#91) * fix: bump trivy-action to v0.36.0 — 0.31.0 tag does not exist (#86) * fix: strip esbuild binaries from runner image to resolve CVE-2024-24790 and CVE-2025-68121 (#90)

next 15.2.9 → 15.5.18: fixes high severity SSRF, cache poisoning, HTTP request smuggling, DoS, and content injection CVEs. next-auth beta.25 → beta.31: fixes email misdelivery CVE. drizzle-kit 0.30.x → 0.31.10: reduces esbuild advisory surface. 6 moderate vulns remain in upstream transitive deps (unfixable). Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Cancels stale CI runs when new commits push to the same branch. Critical for docker-publish given the ~10 min multi-arch build time. Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: add limit-severities-for-sarif to align Trivy exit code with CRITICAL-only scan * chore: add release helper workflow workflow_dispatch with tag/title/notes inputs that runs gh release create --latest. Keeps releases manual and phase-gated but removes the friction of remembering the exact CLI invocation. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

- package.json: 1.3.3 → 1.3.4 - CHANGELOG.md: archived 2026-05-06 and earlier entries to CHANGELOG-legacy.md

#102) * fix: upgrade Next.js, next-auth, drizzle-kit to resolve CVEs next 15.2.9 → 15.5.18: fixes high severity SSRF, cache poisoning, HTTP request smuggling, DoS, and content injection CVEs. next-auth beta.25 → beta.31: fixes email misdelivery CVE. drizzle-kit 0.30.x → 0.31.10: reduces esbuild advisory surface. 6 moderate vulns remain in upstream transitive deps (unfixable). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: force postcss >=8.5.10 via npm overrides to resolve Dependabot alert #10 Adds an npm overrides entry so Next.js's nested postcss@8.4.31 is replaced by the patched version. Bumps the direct devDep range to match. Closes #101. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * docs: correct stale vulnerability count in CHANGELOG Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * docs: resolve CHANGELOG merge conflict from rebase Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

….3.5 Also updates CHANGELOG entry to mention the version bump. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: add Release Please, Codecov, and Socket Security automation - Release Please workflow + config watches main branch for conventional commits and auto-opens versioning PRs (CHANGELOG + package.json bump) - Codecov upload step added to pr-checks.yml; lcov reporter added to vitest config so coverage/lcov.info is generated on each run - Socket Security is a GitHub App install (see issue #104 for link) Closes #104 * fix: pin GitHub Actions to full commit SHAs for supply-chain security

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

coderabbitai · 2026-05-08T19:29:58Z

📝 Walkthrough

Walkthrough

PR introduces Release Please automation for Node releases, adds Codecov coverage tracking integration, updates package version to 1.3.5, enforces postcss ^8.5.10 via npm overrides to address Next.js nested vulnerability, and clarifies post-merge PR workflow handling for automated bot checks.

Changes

Release Automation Setup

Layer / File(s)	Summary
Release Please Configuration `.github/release-please-config.json`, `.github/release-please-manifest.json`	Release Please configured for Node releases with changelog sections (feat, fix, perf, refactor, chore, docs) and PR title template; manifest tracks root version at `1.3.5`.
Version and Dependency Updates `package.json`	Package version bumped to `1.3.5`; postcss dependency overridden to `^8.5.10` (both in overrides and devDependencies) to resolve Next.js nested vulnerability.
Release Workflow `.github/workflows/release-please.yml`	New workflow triggers on main branch pushes with write permissions, runs googleapis/release-please-action v4 configured for Node release automation.
Release Documentation `.claude/memory/feedback_pr_workflow.md`, `CHANGELOG.md`	PR workflow instructions expanded to describe bot-comment handling, issue addressing, and review gating; changelog entries document postcss override fix and vulnerability reduction.

Coverage Reporting Infrastructure

Layer / File(s)	Summary
Vitest Coverage Config `vitest.config.ts`	Coverage reporter array extended to emit both `text` and `lcov` formats.
Codecov Upload Step `.github/workflows/pr-checks.yml`	PR checks workflow adds codecov-action step that uploads `./coverage/lcov.info` with repository token authentication; configured to not fail CI on upload errors.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related issues

#101 — postcss override and version bump directly address this vulnerability fix issue.

Possibly related PRs

dbwg2009/Noted#102: Modifies same postcss override and package version updates to address PostCSS vulnerability.
dbwg2009/Noted#103: Updates same release-related files (package.json version, CHANGELOG.md) for coordinated releases.

Suggested labels

chore, area: docs

Poem

🐰 A Release Please hops into the night,
Coverage reports glow lcov-bright,
PostCSS patched, vulnerabilities flight,
Version bumped to 1.3.5—all is right! 🎉

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: syncing Development into main with version 1.3.5, which directly matches the raw summary and PR objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The PR description covers the key required sections (What, Why, Changes) and provides clear context for the sync, though it deviates from the template structure by using a custom format.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch Development

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

codacy-production · 2026-05-08T19:30:00Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric Results

Complexity 0

Duplication 0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

codacy-production

Pull Request Overview

While this PR successfully implements security overrides for PostCSS and integrates Codecov, it contains a critical error in package-lock.json that will cause npm ci to fail due to version/integrity mismatches. Additionally, there is a systemic conflict between the new release-please automation and the existing manual workflow instructions.

Note: The PR description references Sentry error tracking, Docker healthchecks, and Vitest unit tests, but these files are missing from the current diff. These must be included or the description corrected before merging.

About this PR

The PR description mentions including 'Sentry error tracking', 'Docker healthcheck', and 'Vitest unit tests', but the corresponding implementation files (e.g., Sentry config, healthcheck routes, or actual test files) are not present in this diff. Please verify if these were intended for this release.

Test suggestions

Verify that the npm override forces 'postcss' to version ^8.5.10 globally.
Ensure Vitest is configured to generate lcov reports for Codecov consumption.
Validate the Codecov GitHub Action is correctly triggered in the CI check pipeline.
Confirm Release Please configuration is valid for a Node.js project.

_{TIP Improve review quality by adding custom instructions}
_{TIP How was this review? Give us feedback}

codacy-production · 2026-05-08T19:31:03Z

    },
    "node_modules/error-ex": {
-      "version": "1.3.4",
+      "version": "1.3.5",


_{🔴 HIGH RISK}

The version for error-ex was accidentally updated to 1.3.5, creating a mismatch with the resolved tarball version (1.3.4). This appears to be an accidental result of a global find-and-replace for the project version (1.3.4 -> 1.3.5). This mismatch will cause npm ci to fail with integrity errors.

Suggested change

"version": "1.3.5",

"version": "1.3.4",

codacy-production · 2026-05-08T19:31:03Z

@@ -0,0 +1,16 @@
+{


_{🟡 MEDIUM RISK}

Suggestion: Introducing release-please conflicts with the established manual CHANGELOG format and the versioning workflow defined in .claude/memory/feedback_pr_workflow.md. Once active, release-please will attempt to manage these files automatically using its own standard format, which will overwrite your custom 'By/What/Why' metadata entries. You should update the project instructions to reflect the new automated process or remove the action to maintain manual control.

codecov · 2026-05-08T19:32:33Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

dependabot Bot and others added 24 commits May 7, 2026 19:11

Merge pull request #53 from dbwg2009/dependabot/github_actions/Develo…

230743b

…pment/actions/checkout-6 Bump actions/checkout from 4 to 6

chore: bump version to 1.3.3

a088869

Merge branch 'main' into Development

d71b2b3

fix: bump trivy-action to v0.36.0 — 0.31.0 tag does not exist (#86) (#87

aa583f9

)

fix: strip esbuild binaries from runner image (CVE-2024-24790, CVE-20…

a8ec880

…25-68121) (#91) * fix: bump trivy-action to v0.36.0 — 0.31.0 tag does not exist (#86) * fix: strip esbuild binaries from runner image to resolve CVE-2024-24790 and CVE-2025-68121 (#90)

chore: add concurrency groups to pr-checks and docker-publish (#95)

90b34b7

Cancels stale CI runs when new commits push to the same branch. Critical for docker-publish given the ~10 min multi-arch build time. Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

chore: bump version to 1.3.4 and compact CHANGELOG

ebc1629

- package.json: 1.3.3 → 1.3.4 - CHANGELOG.md: archived 2026-05-06 and earlier entries to CHANGELOG-legacy.md

Merge branch 'main' into Development

a40fb7d

Merge branch 'main' into Development

8ceda00

chore: bump version to 1.3.5

85aee71

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: resolve package-lock.json conflict markers and sync version to 1…

64320c5

….3.5 Also updates CHANGELOG entry to mention the version bump. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docs: add bot-comment review step to PR workflow memory

3b43e47

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

github-actions Bot added the chore Version bumps, config, dependencies label May 8, 2026

github-actions Bot added area: infra Docker, CI, GitHub Actions, config area: docs Markdown, design docs, README labels May 8, 2026

dbwg2009 self-assigned this May 8, 2026

codacy-production Bot reviewed May 8, 2026

View reviewed changes

github-actions Bot added chore Version bumps, config, dependencies and removed chore Version bumps, config, dependencies labels May 8, 2026

Merge branch 'main' into Development

52c3903

github-actions Bot added chore Version bumps, config, dependencies and removed chore Version bumps, config, dependencies labels May 8, 2026

dbwg2009 closed this May 8, 2026

dbwg2009 reopened this May 8, 2026

dbwg2009 merged commit b3ba051 into main May 8, 2026
19 checks passed

This was referenced May 10, 2026

chore: release 1.5.0 #137

Closed

chore: release 1.5.0 #138

Closed

chore: release 1.5.0 #141

Closed

chore: release 1.4.1 #151

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: sync Development → main (v1.3.5)#106

chore: sync Development → main (v1.3.5)#106
dbwg2009 merged 25 commits into
mainfrom
Development

dbwg2009 commented May 8, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented May 8, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Possibly related issues

Possibly related PRs

Suggested labels

Poem

Uh oh!

codacy-production Bot commented May 8, 2026 •

edited

Loading

Uh oh!

codacy-production Bot left a comment

Uh oh!

codacy-production Bot May 8, 2026

Uh oh!

codacy-production Bot May 8, 2026

Uh oh!

codecov Bot commented May 8, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dbwg2009 commented May 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Why

Changes included in this diff

No release needed

Test plan

Uh oh!

coderabbitai Bot commented May 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related issues

Possibly related PRs

Suggested labels

Poem

Uh oh!

codacy-production Bot commented May 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Up to standards ✅

Uh oh!

codacy-production Bot left a comment

Choose a reason for hiding this comment

Pull Request Overview

About this PR

Test suggestions

Uh oh!

codacy-production Bot May 8, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot May 8, 2026

Choose a reason for hiding this comment

Uh oh!

codecov Bot commented May 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dbwg2009 commented May 8, 2026 •

edited

Loading

coderabbitai Bot commented May 8, 2026 •

edited

Loading

codacy-production Bot commented May 8, 2026 •

edited

Loading

codecov Bot commented May 8, 2026 •

edited

Loading