🔖 release: common@0.0.14, server@0.2.75, mobile@1.1.23#838
Conversation
Summary of ChangesHello @cruzdanilo, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request facilitates the automated release process for the Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
There was a problem hiding this comment.
Code Review
This pull request is an automated release for @exactly/server version 0.2.75, updating package.json and CHANGELOG.md. It incorporates database indexes to foreign keys in the cards and transactions tables. While the release process is consistent and other changes adhere to security best practices, such as using parameterized queries via Drizzle ORM and robust input validation with Valibot, a potential content injection vulnerability has been identified. This vulnerability is located in the push notification logic within server/hooks/activity.ts, where untrusted token symbols from on-chain activity are used to construct messages, which could be exploited for phishing.
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughBump server package version 0.2.74 → 0.2.75, remove processed changeset Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 2✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
5868532 to
411f5dd
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #838 +/- ##
==========================================
+ Coverage 69.49% 70.20% +0.70%
==========================================
Files 212 212
Lines 7760 8203 +443
Branches 2508 2682 +174
==========================================
+ Hits 5393 5759 +366
- Misses 2139 2214 +75
- Partials 228 230 +2
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
411f5dd to
6e73545
Compare
b7cf287 to
f164a51
Compare
c71744d to
3266294
Compare
3266294 to
13abdd9
Compare
4babcfd to
635285e
Compare
635285e to
a251e06
Compare
This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.
Releases
@exactly/mobile@1.1.23
Patch Changes
#846
8405759Thanks @cruzdanilo! - 🧵 fix onesignal init race condition#847
fb12f95Thanks @cruzdanilo! - 🚸 expand pay asset selector hit areaUpdated dependencies [
a2b93e2,8a0ed97,9dcaf93]:@exactly/common@0.0.14
Patch Changes
8a0ed97Thanks @cruzdanilo! - 🔧 setup all onesignal domains@exactly/server@0.2.75
Patch Changes
#837
a2b93e2Thanks @cruzdanilo! - 🗃️ index foreign keys on cards and transactions#848
9dcaf93Thanks @cruzdanilo! - 📈 skip sentry tracing for static assets