Repository navigation
chore(security): bump hono + refresh follow-redirects lockfile - #776
Merged
Merged
Conversation
PR 2 of the 8-PR Lucky redesign port plan (docs/LOVABLE_PROMPT.md §10, infrastructure phase). Pure additive extension to packages/frontend/src/ components/ui/SectionHeader.tsx — no existing props changed, no existing usages broken. New props - eyebrowIcon?: ReactNode — renders before the eyebrow text at 16×16 in the lucky-text-tertiary tone. The canonical redesign pattern (mono uppercase eyebrow + lucide icon — e.g. ShieldAlert + "Moderation Security"). - statusBand?: StatusBandTile[] — renders a responsive 2-up-md-4-up grid below the header with each tile showing uppercase mono label + colored status. Uses the new short-form tokens landed in PR #763 (bg-sidebar, border-panel, bg-canvas, bg-elevated, bg-highlight) so no further token work needed. StatusBandTone New exported type: 'success' | 'brand' | 'accent' | 'warning' | 'error' | 'muted'. Mapped to lucky-success/brand/brand-strong/warning/error/ text-tertiary respectively. Page ports pass one tone per tile based on real data (moderation health, automation count, music connection, etc.) — no mocked status strings, per LOVABLE_PROMPT.md §4.2. Tests (src/components/ui/DesignPrimitives.test.tsx) New test: "renders section header with eyebrow icon + status band". Covers eyebrowIcon render, band role=list with aria-label=Module status, per-tile label + status text, and per-tile icon slot. Existing test "renders section header with actions" kept as-is — all original props still work. Accessibility - Eyebrow icon: aria-hidden=true (decorative; the eyebrow text carries the semantics). - Status band: role=list + listitems, aria-label="Module status" for screen readers. - Tile icons: aria-hidden=true. Bundle impact: 4 new SVG icons pulled in via lucide-react in tests only; zero net bundle growth at runtime (the component imports no icons itself). Validation - npm run type:check: clean - npm run lint: clean, 0 warnings - npx vitest run src/components/ui/DesignPrimitives.test.tsx: 6/6 passing - npm run build: clean, 4.42s Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Addresses CodeRabbit minor: key={tile.label} could collide if two tiles
share a label. Adds optional id?: string to StatusBandTile interface and
falls back to a deterministic ${label}:${status}:${index} composite key.
packages/frontend/src/components/ui/SectionHeader.tsx
- StatusBandTile gains optional id field
- map callback receives (tile, index); key uses tile.id ?? composite
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
LucasSantana-Dev
enabled auto-merge (squash)
April 22, 2026 14:28
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 20 minutes and 10 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Size Change: 0 B Total Size: 363 kB ℹ️ View Unchanged
|
|
LucasSantana-Dev
added a commit
that referenced
this pull request
May 13, 2026
* feat(frontend): SectionHeader eyebrowIcon + statusBand PR 2 of the 8-PR Lucky redesign port plan (docs/LOVABLE_PROMPT.md §10, infrastructure phase). Pure additive extension to packages/frontend/src/ components/ui/SectionHeader.tsx — no existing props changed, no existing usages broken. New props - eyebrowIcon?: ReactNode — renders before the eyebrow text at 16×16 in the lucky-text-tertiary tone. The canonical redesign pattern (mono uppercase eyebrow + lucide icon — e.g. ShieldAlert + "Moderation Security"). - statusBand?: StatusBandTile[] — renders a responsive 2-up-md-4-up grid below the header with each tile showing uppercase mono label + colored status. Uses the new short-form tokens landed in PR #763 (bg-sidebar, border-panel, bg-canvas, bg-elevated, bg-highlight) so no further token work needed. StatusBandTone New exported type: 'success' | 'brand' | 'accent' | 'warning' | 'error' | 'muted'. Mapped to lucky-success/brand/brand-strong/warning/error/ text-tertiary respectively. Page ports pass one tone per tile based on real data (moderation health, automation count, music connection, etc.) — no mocked status strings, per LOVABLE_PROMPT.md §4.2. Tests (src/components/ui/DesignPrimitives.test.tsx) New test: "renders section header with eyebrow icon + status band". Covers eyebrowIcon render, band role=list with aria-label=Module status, per-tile label + status text, and per-tile icon slot. Existing test "renders section header with actions" kept as-is — all original props still work. Accessibility - Eyebrow icon: aria-hidden=true (decorative; the eyebrow text carries the semantics). - Status band: role=list + listitems, aria-label="Module status" for screen readers. - Tile icons: aria-hidden=true. Bundle impact: 4 new SVG icons pulled in via lucide-react in tests only; zero net bundle growth at runtime (the component imports no icons itself). Validation - npm run type:check: clean - npm run lint: clean, 0 warnings - npx vitest run src/components/ui/DesignPrimitives.test.tsx: 6/6 passing - npm run build: clean, 4.42s * fix(frontend): stable React keys for SectionHeader statusBand tiles Addresses CodeRabbit minor: key={tile.label} could collide if two tiles share a label. Adds optional id?: string to StatusBandTile interface and falls back to a deterministic ${label}:${status}:${index} composite key. packages/frontend/src/components/ui/SectionHeader.tsx - StatusBandTile gains optional id field - map callback receives (tile, index); key uses tile.id ?? composite --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes two
npm auditmoderates with upstream fixes available — the two remaining Dependabot alerts in the 2026-04-22 backlog map (A.2) that had a real fix path.honooverride bumped>=4.12.12→>=4.12.14(closes JSX attribute-injection moderate, CWE-79). Resolves to 4.12.14.follow-redirectslockfile refreshed to honor the pre-existing^1.15.12override (lockfile was stuck at 1.15.11 — auth-header-leak CWE-200). Resolves to 1.16.0.Post-change
npm audit --package-lock-only --json | jq '.metadata.vulnerabilities':Scope
2 files, +7/-7:
package.json— one-line override bump onhono.package-lock.json—follow-redirects(1.15.11 → 1.16.0) +hono(4.12.12 → 4.12.14) resolved-version/integrity updates only. No other deps shifted.Why only two deps
The 4 open Dependabot alerts are:
hono,@hono/node-server(CVE-2026-39406),file-type(CVE-2026-31808),follow-redirects. Of those, onlyhonoandfollow-redirectshave upstream-published patches. The other two remain monitored; the repo already overrides@hono/node-serverto the latest>=1.19.13andfile-typeto>=21.3.2, which are the highest currently available.Test plan
npm audit --package-lock-only --jsonreports 0 vulns at all severities.@prisma/devpeer rangehono@^4.12.12still satisfied by 4.12.14.npm installin CI resolves deterministically (no conflicting override).🤖 Generated with Claude Code