Include tests and coverage

[guibranco]

📑 Description

Include tests and coverage

✅ Checks

• My pull request adheres to the code style of this project
• My code requires changes to the documentation
• I have updated the documentation as required
• All the tests have passed

☢️ Does this introduce a breaking change?

• Yes
• No

---

Summary by CodeRabbit

• Chores

  • Upgraded Node.js runtime from 22 to 24 in CI/CD pipelines
  • Added comprehensive code-coverage collection and artifact upload in CI/CD
  • Integrated external quality-reporting with coverage data
  • Updated project test runner and build-related configuration; ignored coverage output

• Tests

  • Added multiple new test suites covering app behavior and utilities
  • Removed an outdated test and simplified test setup/configuration

[coderabbitai]

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Free

Run ID: 6e35f9e4-9491-424b-bb1c-818cbf821b8f

📥 Commits

Reviewing files that changed from the base of the PR and between d622469 and 8625d77.

📒 Files selected for processing (2)

• .github/workflows/build.yml
• .github/workflows/deploy.yml

✅ Files skipped from review due to trivial changes (1)

• .github/workflows/build.yml

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/deploy.yml

---

Walkthrough

CI workflows updated to Node.js 24 and now run Vitest-based coverage (npm run test:coverage), upload coverage/ artifacts, and report coverage to DeepSource; project gains Vitest + React Testing Library, multiple new test files, and tests are included in TS compilation.

Changes

Cohort / File(s)	Summary
GitHub Actions Workflows .github/workflows/build.yml, .github/workflows/deploy.yml	Switch Node.js 22 → 24; run npm run test:coverage instead of npm test; upload coverage/ artifact; install/run DeepSource CLI reporting with coverage/lcov.info using DEEPSOURCE_DSN; add pull-requests: read permission and minor quoting/format tweaks.
Test config & tooling package.json, vite.config.ts, tsconfig.app.json, tests/setup.ts	Add Vitest scripts and devDependencies (vitest, @vitest/coverage-v8, jsdom, testing-library); change Vite import to vitest/config and add test block (jsdom, setupFiles, globals, v8 coverage reporters including lcov); include tests in TS compile scope; remove jest-dom extension from test setup.
New tests tests/App.test.tsx, tests/context/AuthContext.test.tsx, tests/utils/avatar.test.ts, tests/utils/events.test.ts	Introduce component, context, and utility tests validating rendering, auth provider/hook behavior, avatar URL formatting, and event grouping logic.
Removed / housekeeping .gitignore, tests/example.test.tsx	Add /coverage/ to .gitignore; remove old tests/example.test.tsx Button tests.

Sequence Diagram(s)

sequenceDiagram
    participant Dev as Developer (push/PR)
    participant GH as GitHub Actions
    participant Runner as Actions Runner (Node 24)
    participant Store as Artifact Storage
    participant DS as DeepSource

    Dev->>GH: push/PR triggers workflow
    GH->>Runner: start job (Node 24)
    Runner->>Runner: npm run test:coverage (Vitest -> produce coverage/lcov.info, coverage/)
    Runner->>Store: upload coverage/ artifact
    Runner->>Runner: download DeepSource CLI
    Runner->>DS: ./bin/deepsource report --lcov=coverage/lcov.info (using DEEPSOURCE_DSN)
    DS-->>Runner: report accepted/response
    GH-->>Dev: workflow status

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 Nose a-twitch, I bounded in,
New tests ready — let them begin,
Coverage carrots, lcov bright,
DeepSource reads them through the night,
A hop, a pass — the pipeline’s grin.

---

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting https://app.coderabbit.ai/login.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sourcery-ai]

Hi @guibranco! 👋

Your private repo does not have access to Sourcery.

Please upgrade to continue using Sourcery ✨

[deepsource-io]

DeepSource Code Review

We reviewed changes in fb86199...8625d77 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
JavaScript		Apr 16, 2026 8:13p.m.	Review ↗
Secrets		Apr 16, 2026 8:13p.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[penify-dev]

Failed to generate code suggestions for PR

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	jsdom@​29.0.2
	vitest@​4.1.4
	@​vitest/​coverage-v8@​4.1.4
	@​testing-library/​user-event@​14.6.1
	@​testing-library/​react@​16.3.2
	@​testing-library/​jest-dom@​6.9.1

View full report

[socket-security]

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Block		Obfuscated code: npm entities is 91.0% likely obfuscated Confidence: 0.91 Location: Package overview From: package-lock.json → npm/jsdom@29.0.2 → npm/entities@6.0.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/entities@6.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Dynamic code execution: npm @asamuzakjp/nwsapi Eval Type: Function Location: Package overview From: package-lock.json → npm/jsdom@29.0.2 → npm/@asamuzakjp/nwsapi@2.3.9 ℹ Read more on: This package | This alert | What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@asamuzakjp/nwsapi@2.3.9. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: npm @emnapi/core in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package-lock.json → npm/vitest@4.1.4 → npm/@emnapi/core@1.9.2 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/core@1.9.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Dynamic code execution: npm @emnapi/core Eval Type: Function Location: Package overview From: package-lock.json → npm/vitest@4.1.4 → npm/@emnapi/core@1.9.2 ℹ Read more on: This package | This alert | What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/core@1.9.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Dynamic code execution: npm @emnapi/core Eval Type: eval Location: Package overview From: package-lock.json → npm/vitest@4.1.4 → npm/@emnapi/core@1.9.2 ℹ Read more on: This package | This alert | What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/core@1.9.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Dynamic code execution: npm @emnapi/runtime Eval Type: Function Location: Package overview From: package-lock.json → npm/vitest@4.1.4 → npm/@emnapi/runtime@1.9.2 ℹ Read more on: This package | This alert | What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/runtime@1.9.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: npm @tybys/wasm-util in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package-lock.json → npm/vitest@4.1.4 → npm/@tybys/wasm-util@0.10.1 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tybys/wasm-util@0.10.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Dynamic code execution: npm @vitest/snapshot Eval Type: Function Location: Package overview From: package-lock.json → npm/vitest@4.1.4 → npm/@vitest/snapshot@4.1.4 ℹ Read more on: This package | This alert | What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@vitest/snapshot@4.1.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Dynamic code execution: npm css-tree Eval Type: Function Location: Package overview From: package-lock.json → npm/jsdom@29.0.2 → npm/css-tree@3.2.1 ℹ Read more on: This package | This alert | What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/css-tree@3.2.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		System shell access: npm detect-libc in module child_process Module: child_process Location: Package overview From: package-lock.json → npm/vitest@4.1.4 → npm/vite@5.4.21 → npm/detect-libc@2.1.2 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/detect-libc@2.1.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Trivial package: npm is-potential-custom-element-name has 7 lines of code Location: Package overview From: package-lock.json → npm/jsdom@29.0.2 → npm/is-potential-custom-element-name@1.0.1 ℹ Read more on: This package | This alert | What are trivial packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/is-potential-custom-element-name@1.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Dynamic code execution: npm istanbul-lib-coverage Eval Type: Function Location: Package overview From: package-lock.json → npm/@vitest/coverage-v8@4.1.4 → npm/istanbul-lib-coverage@3.2.2 ℹ Read more on: This package | This alert | What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/istanbul-lib-coverage@3.2.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: npm jsdom in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package-lock.json → npm/jsdom@29.0.2 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/jsdom@29.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Dynamic code execution: npm jsdom Eval Type: eval Location: Package overview From: package-lock.json → npm/jsdom@29.0.2 ℹ Read more on: This package | This alert | What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/jsdom@29.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Dynamic code execution: npm jsdom Eval Type: Function Location: Package overview From: package-lock.json → npm/jsdom@29.0.2 ℹ Read more on: This package | This alert | What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/jsdom@29.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Dynamic code execution: npm magicast Eval Type: Function Location: Package overview From: package-lock.json → npm/@vitest/coverage-v8@4.1.4 → npm/magicast@0.5.2 ℹ Read more on: This package | This alert | What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/magicast@0.5.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Trivial package: npm min-indent has 8 lines of code Location: Package overview From: package-lock.json → npm/@testing-library/jest-dom@6.9.1 → npm/min-indent@1.0.1 ℹ Read more on: This package | This alert | What are trivial packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/min-indent@1.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Dynamic code execution: npm pretty-format Eval Type: Function Location: Package overview From: package-lock.json → npm/@testing-library/react@16.3.2 → npm/@testing-library/user-event@14.6.1 → npm/pretty-format@27.5.1 ℹ Read more on: This package | This alert | What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/pretty-format@27.5.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: npm rolldown in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package-lock.json → npm/vitest@4.1.4 → npm/rolldown@1.0.0-rc.15 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rolldown@1.0.0-rc.15. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Network access: npm undici in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: package-lock.json → npm/jsdom@29.0.2 → npm/undici@7.25.0 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/undici@7.25.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Dynamic code execution: npm whatwg-url Eval Type: eval Location: Package overview From: package-lock.json → npm/jsdom@29.0.2 → npm/whatwg-url@16.0.1 ℹ Read more on: This package | This alert | What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/whatwg-url@16.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Minified code present: npm @adobe/css-tools with 100.0% likelihood Confidence: 1.00 Location: Package overview From: package-lock.json → npm/@testing-library/jest-dom@6.9.1 → npm/@adobe/css-tools@4.4.4 ℹ Read more on: This package | This alert | What's wrong with minified code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: In many cases minified code is harmless, however minified code can be used to hide a supply chain attack. Consider not shipping minified code on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@adobe/css-tools@4.4.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Embedded URLs or IPs: npm @asamuzakjp/dom-selector URLs: https://datatracker.ietf.org/doc/html/rfc4647#section-3.3.1, http://www.w3.org/2000/svg Location: Package overview From: package-lock.json → npm/jsdom@29.0.2 → npm/@asamuzakjp/dom-selector@7.0.10 ℹ Read more on: This package | This alert | What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@asamuzakjp/dom-selector@7.0.10. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Embedded URLs or IPs: npm @asamuzakjp/nwsapi URLs: http://www.w3.org/1999/xhtml, https://drafts.csswg.org/css-syntax/#typedef-eof-token, https://drafts.csswg.org/css-syntax-3/#ident-token-diagram Location: Package overview From: package-lock.json → npm/jsdom@29.0.2 → npm/@asamuzakjp/nwsapi@2.3.9 ℹ Read more on: This package | This alert | What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@asamuzakjp/nwsapi@2.3.9. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Minified code present: npm @bramus/specificity with 100.0% likelihood Confidence: 1.00 Location: Package overview From: package-lock.json → npm/jsdom@29.0.2 → npm/@bramus/specificity@2.4.2 ℹ Read more on: This package | This alert | What's wrong with minified code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: In many cases minified code is harmless, however minified code can be used to hide a supply chain attack. Consider not shipping minified code on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@bramus/specificity@2.4.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Embedded URLs or IPs: npm @bramus/specificity URLs: https://www.w3.org/TR/selectors-4/#specificity-rules, https://developer.mozilla.org/en-US/docs/Web/CSS/Pseudo-elements#index Location: Package overview From: package-lock.json → npm/jsdom@29.0.2 → npm/@bramus/specificity@2.4.2 ℹ Read more on: This package | This alert | What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@bramus/specificity@2.4.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
See 108 more rows in the dashboard

View full report

[github-actions]

Infisical secrets check: 🚨 Secrets leaked!

Caution

The Infisical CLI tool found secrets leaked in your repository.
Please review the scan results and take the necessary actions.
Secrets found: 6

💻 Scan logs

2026-04-16T20:12:27Z INF scanning for exposed secrets...
8:12PM INF 74 commits scanned.
2026-04-16T20:12:27Z INF scan completed in 368ms
2026-04-16T20:12:27Z WRN leaks found: 6

---

🔎 Detected secrets in your GIT history

RuleID	Commit	File	SymlinkFile	Secret	Match	StartLine	EndLine	StartColumn	EndColumn	Author	Message	Date	Email	Fingerprint	Tags	Link
generic-api-key	2e15220	src/pages/Integrations.tsx		REDACTED	"apiKey: ""REDACTED"""	12	12	8	43	deepsource-autofix[bot]	"style: format code with Prettier (#35)\n\nThis commit fixes the style issues introduced in f85b623 according to the output\nfrom Prettier.\n\nDetails: None\n\nCo-authored-by: deepsource-autofix[bot] <62050782+deepsource-autofix[bot]@users.noreply.github.com>\nCo-authored-by: gstraccini[bot] <150967461+gstraccini[bot]@users.noreply.github.com>\nCo-authored-by: Guilherme Branco Stracini guilherme@guilhermebranco.com.br"	2025-09-04T11:22:37Z	62050782+deepsource-autofix[bot]@users.noreply.github.com	2e15220:src/pages/Integrations.tsx:generic-api-key:12		gstraccini-bot-portal/src/pages/Integrations.tsx Line 12 in 2e15220 apiKey: "sonar_12345678901234567890",
generic-api-key	2e15220	src/mockData.ts		REDACTED	"apiKey: ""REDACTED"""	505	505	6	41	deepsource-autofix[bot]	"style: format code with Prettier (#35)\n\nThis commit fixes the style issues introduced in f85b623 according to the output\nfrom Prettier.\n\nDetails: None\n\nCo-authored-by: deepsource-autofix[bot] <62050782+deepsource-autofix[bot]@users.noreply.github.com>\nCo-authored-by: gstraccini[bot] <150967461+gstraccini[bot]@users.noreply.github.com>\nCo-authored-by: Guilherme Branco Stracini guilherme@guilhermebranco.com.br"	2025-09-04T11:22:37Z	62050782+deepsource-autofix[bot]@users.noreply.github.com	2e15220:src/mockData.ts:generic-api-key:505		gstraccini-bot-portal/src/mockData.ts Line 505 in 2e15220 apiKey: "sonar_12345678901234567890",
generic-api-key	2e15220	src/pages/RepositoryDetail.tsx		REDACTED	"apiKey: ""REDACTED"""	124	124	8	43	deepsource-autofix[bot]	"style: format code with Prettier (#35)\n\nThis commit fixes the style issues introduced in f85b623 according to the output\nfrom Prettier.\n\nDetails: None\n\nCo-authored-by: deepsource-autofix[bot] <62050782+deepsource-autofix[bot]@users.noreply.github.com>\nCo-authored-by: gstraccini[bot] <150967461+gstraccini[bot]@users.noreply.github.com>\nCo-authored-by: Guilherme Branco Stracini guilherme@guilhermebranco.com.br"	2025-09-04T11:22:37Z	62050782+deepsource-autofix[bot]@users.noreply.github.com	2e15220:src/pages/RepositoryDetail.tsx:generic-api-key:124		gstraccini-bot-portal/src/pages/RepositoryDetail.tsx Line 124 in 2e15220 apiKey: "sonar_12345678901234567890",
generic-api-key	2e15220	src/pages/RepositoryDetail.tsx		REDACTED	"apiKey: ""REDACTED"""	160	160	8	44	deepsource-autofix[bot]	"style: format code with Prettier (#35)\n\nThis commit fixes the style issues introduced in f85b623 according to the output\nfrom Prettier.\n\nDetails: None\n\nCo-authored-by: deepsource-autofix[bot] <62050782+deepsource-autofix[bot]@users.noreply.github.com>\nCo-authored-by: gstraccini[bot] <150967461+gstraccini[bot]@users.noreply.github.com>\nCo-authored-by: Guilherme Branco Stracini guilherme@guilhermebranco.com.br"	2025-09-04T11:22:37Z	62050782+deepsource-autofix[bot]@users.noreply.github.com	2e15220:src/pages/RepositoryDetail.tsx:generic-api-key:160		gstraccini-bot-portal/src/pages/RepositoryDetail.tsx Line 160 in 2e15220 apiKey: "codacy_12345678901234567890",
generic-api-key	2e15220	src/pages/RepositoryDetail.tsx		REDACTED	"apiKey: ""REDACTED"""	178	178	8	42	deepsource-autofix[bot]	"style: format code with Prettier (#35)\n\nThis commit fixes the style issues introduced in f85b623 according to the output\nfrom Prettier.\n\nDetails: None\n\nCo-authored-by: deepsource-autofix[bot] <62050782+deepsource-autofix[bot]@users.noreply.github.com>\nCo-authored-by: gstraccini[bot] <150967461+gstraccini[bot]@users.noreply.github.com>\nCo-authored-by: Guilherme Branco Stracini guilherme@guilhermebranco.com.br"	2025-09-04T11:22:37Z	62050782+deepsource-autofix[bot]@users.noreply.github.com	2e15220:src/pages/RepositoryDetail.tsx:generic-api-key:178		gstraccini-bot-portal/src/pages/RepositoryDetail.tsx Line 178 in 2e15220 apiKey: "snyk_12345678901234567890",
generic-api-key	2e15220	src/pages/Settings.tsx		REDACTED	"apiKey: ""REDACTED"""	127	127	8	43	deepsource-autofix[bot]	"style: format code with Prettier (#35)\n\nThis commit fixes the style issues introduced in f85b623 according to the output\nfrom Prettier.\n\nDetails: None\n\nCo-authored-by: deepsource-autofix[bot] <62050782+deepsource-autofix[bot]@users.noreply.github.com>\nCo-authored-by: gstraccini[bot] <150967461+gstraccini[bot]@users.noreply.github.com>\nCo-authored-by: Guilherme Branco Stracini guilherme@guilhermebranco.com.br"	2025-09-04T11:22:37Z	62050782+deepsource-autofix[bot]@users.noreply.github.com	2e15220:src/pages/Settings.tsx:generic-api-key:127		gstraccini-bot-portal/src/pages/Settings.tsx Line 127 in 2e15220 apiKey: "sonar_12345678901234567890",

Warning

The above table only displays the first 10 leaked secrets.
You can find the full report here: secrets.csv

---

🐾 Secrets fingerprint

2e1522054d3009edd4cc682e479341776b266eb0:src/pages/Integrations.tsx:generic-api-key:12
2e1522054d3009edd4cc682e479341776b266eb0:src/mockData.ts:generic-api-key:505
2e1522054d3009edd4cc682e479341776b266eb0:src/pages/RepositoryDetail.tsx:generic-api-key:124
2e1522054d3009edd4cc682e479341776b266eb0:src/pages/RepositoryDetail.tsx:generic-api-key:160
2e1522054d3009edd4cc682e479341776b266eb0:src/pages/RepositoryDetail.tsx:generic-api-key:178
2e1522054d3009edd4cc682e479341776b266eb0:src/pages/Settings.tsx:generic-api-key:127

Tip

If you want to ignore these leaked secrets, add the above fingerprint content to a file named .infisicalignore at the repository root level.