Fixes star history - #3152
Open
Mubelotix wants to merge 1 commit into
Open
Conversation
This new provider requires no token
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
2 Skipped Deployments
|
gameroman
added
the
needs discussion
Contributor
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe README Star History embed now uses ChangesStar History embed
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@README.md`:
- Around line 201-205: Update the CSP image-source allowlist in the security
headers configuration to permit https://star-history.dera.page, and update the
security headers test to assert this origin is allowed. Remove
https://api.star-history.com only if no remaining page uses it.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 540760b2-5edb-4b00-be33-6ed0df94fbf3
📒 Files selected for processing (1)
README.md
Comment on lines
+201
to
+205
| <a href="https://star-history.dera.page/#npmx-dev/npmx.dev&type=date&legend=top-left"> | ||
| <picture> | ||
| <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=npmx-dev/npmx.dev&type=date&theme=dark&legend=top-left&sealed_token=1RI8ZdgQL3NncQeMm3sTwgYPL_7_ELdIGe5yiswir2iZipZwBtsYd4Y6zkO2fZLUP3wRcDN38GLKA4B1b3JE3pxEg7x_w8uOivwT3rL8Jcr-866HKSRMpjqmEwPavKp57ZdTyo04KHRbKthXVe360AJhcjmbXWxKVO9EDFh995ssNIH32hNArVB4MwAm" /> | ||
| <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=npmx-dev/npmx.dev&type=date&legend=top-left&sealed_token=1RI8ZdgQL3NncQeMm3sTwgYPL_7_ELdIGe5yiswir2iZipZwBtsYd4Y6zkO2fZLUP3wRcDN38GLKA4B1b3JE3pxEg7x_w8uOivwT3rL8Jcr-866HKSRMpjqmEwPavKp57ZdTyo04KHRbKthXVe360AJhcjmbXWxKVO9EDFh995ssNIH32hNArVB4MwAm" /> | ||
| <img alt="Star History Chart" src="https://api.star-history.com/chart?repos=npmx-dev/npmx.dev&type=date&legend=top-left&sealed_token=1RI8ZdgQL3NncQeMm3sTwgYPL_7_ELdIGe5yiswir2iZipZwBtsYd4Y6zkO2fZLUP3wRcDN38GLKA4B1b3JE3pxEg7x_w8uOivwT3rL8Jcr-866HKSRMpjqmEwPavKp57ZdTyo04KHRbKthXVe360AJhcjmbXWxKVO9EDFh995ssNIH32hNArVB4MwAm" /> | ||
| <source media="(prefers-color-scheme: dark)" srcset="https://star-history.dera.page/svg?repos=npmx-dev/npmx.dev&type=date&theme=dark&legend=top-left" /> | ||
| <source media="(prefers-color-scheme: light)" srcset="https://star-history.dera.page/svg?repos=npmx-dev/npmx.dev&type=date&legend=top-left" /> | ||
| <img alt="Star History Chart" src="https://star-history.dera.page/svg?repos=npmx-dev/npmx.dev&type=date&legend=top-left" /> |
Contributor
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Allow the new image origin in the page CSP before merging.
The <picture> sources and fallback <img> now request https://star-history.dera.page. modules/security-headers.ts:36-47 only lists https://api.star-history.com in img-src, so the rendered page can block the new chart images.
Add the new origin to the CSP allowlist. Update test/e2e/security-headers.spec.ts:3-22 to assert the new origin. Retain the legacy origin only if another page still uses it.
Suggested follow-up
const cspOnlyImgOrigins = [
'https://api.star-history.com',
+ 'https://star-history.dera.page',
]
-expect(cspContent).toContain('https://api.star-history.com')
+expect(cspContent).toContain('https://star-history.dera.page')🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@README.md` around lines 201 - 205, Update the CSP image-source allowlist in
the security headers configuration to permit https://star-history.dera.page, and
update the security headers test to assert this origin is allowed. Remove
https://api.star-history.com only if no remaining page uses it.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This new provider requires no token
🔗 Linked issue
Fixes #3042
🧭 Context
📚 Description