Skip to content

Prepare first release workflow and docs deploy#160

Merged
VincentShipsIt merged 539 commits into
masterfrom
develop
May 24, 2026
Merged

Prepare first release workflow and docs deploy#160
VincentShipsIt merged 539 commits into
masterfrom
develop

Conversation

@VincentShipsIt
Copy link
Copy Markdown
Contributor

What changed

  • Adds a release-quality gate to the publish workflow before Vercel, desktop, Homebrew, and npm publishing jobs run.
  • Fixes Vercel CLI usage so builds/deploys run from the linked repo root while still bundling synced docs.
  • Adds the Nextra theme patch needed for docs export and keeps generated tool output out of Biome checks.

Why

The first production release should run tests, linting, typecheck, docs export, web build, CLI build, and desktop code build before publishing. Docs export was blocked by Nextra theme schema validation, and the Vercel workflow was using the wrong cwd for the linked project.

Validation

  • bun run sync:docs
  • vercel pull --yes --environment=production && vercel build --prod
  • bun --filter @shipcode/docs test && bun --filter @shipcode/web test
  • bun run typecheck
  • bun run format:check
  • git diff --check

…-144120-status-fields

Stop using labels for workflow status
… Update issue creation and editing functions to accept `prdMetadata` for complexity and blast radius. Remove reliance on labels for these attributes, aligning with native GitHub project fields. Adjust related documentation and tests accordingly.
Continuation retries (test/verification re-runs) now use a fixed 1s
delay via computeRetryDelayMs({ reason: 'continuation' }). Planning
failure retries keep exponential backoff. All retry paths cancel any
existing timer before scheduling a new one to prevent timer leaks.
Polls running pipelines every 30s, fetches GitHub issue state via
gh CLI. Cancels pipeline if issue closed or tagged with terminal label
(wontfix, duplicate, invalid). Non-fatal on API errors — logs and
retries next tick. Wired into desktop app with cleanup on close.
Defines FeatureQaState and FeatureQaResult types with Zod schemas.
Adds extractFeatureQaState() parser that reads a ## QA State section
from PRD body, validates the fenced JSON block, and surfaces
missing/invalid state via buildQaStateGapMessage(). Phase 1 of 3:
contract + parser + gap surfacing. Phases 2-3 will wire into
verification runs and QA result recording.
WORKFLOW.md front matter now accepts `agent.max_concurrent_agents_by_state`
(map of phase → positive int). Dispatcher enforces both global and per-state
caps before dispatching. Keys normalized to lowercase; invalid values
silently dropped.
When verify retries exhaust, the pipeline now checks if turnCount < maxTurns
before failing. If a turn is available, it resets retries, increments turnCount,
emits turn_started/turn_completed events, and re-enters planning with a
continuation prompt. Default maxTurns: 20 (configurable via WORKFLOW.md
agent.max_turns). Also adds continuation_prompt template support.
- Replace directory picker flows with a browsable add-project explorer
- Add add-project start directory setting and batch plan status lookup
- Virtualize large terminal transcripts for better scroll performance
migrateV45 adds the agent_conversations table for structured logging
of every prompt/response exchanged between pipeline phases and providers.
Includes FK cascade on thread deletion, indexes on (thread_id, created_at)
and (thread_id, phase, round), conversation_id FK on pipeline_step_log,
query module with insert/list/count/filter, IPC channel type, and 12 tests.
Runtime wrapper + UI tab follow separately.
- Add speech recognition support to the create issue modal
- Replace shared icon exports with direct lucide-react imports
- Update tests for voice input behavior
migrateV46 adds feature_qa_results table with thread FK cascade.
FeatureQaResultQueries supports insert, listByThread, listByFeature,
and latestByFeature. IPC channels defined for renderer consumption.
12 new tests (8 query + 4 schema).
Log prompt/response pairs inside runProviderPhase (single choke point
for all 5 pipeline phases). Writes are try/catch-guarded so failures
never block the pipeline. Links conversation_id to pipeline_step_log.

Adds ConversationsTab with phase filters, speaker/model badges,
token/cost metadata, copy-as-markdown, and collapsible long turns.
Tab conditionally appears when a thread is active.

Closes #90
…pdates

Replace all Loader2 spinners and "Loading..." text with layout-matching
Skeleton components across ActivityView, InboxView, SkillsView,
PlanHistoryTab, and CostsTab. Add Suspense fallback skeletons for lazy
view transitions in App.tsx. Restructure CostsView from single data gate
to per-section progressive loading. Add optimistic cancel in ThreadPanel,
parallel git branches query with 30s staleTime, and dashboard:get-stats
staleTime fix in ProjectSidebar. Parallelize telemetry-status fetch.
…generation script

- Updated layout metadata to include Open Graph and Twitter card details for better social sharing.
- Modified install command for desktop to correct the installation path.
- Improved UI for the InstallCommand component with better styling and layout.
- Introduced a new script to generate the Open Graph image dynamically.
- Update hero, footer, and mockup styling on the web site
- Add new Open Graph image and README launch screenshot
- Bump desktop and pipeline dependencies
- Bump versions for several dependencies including `@tanstack/react-query`, `lucide-react`, and `electron`.
- Add new dependencies `@resvg/resvg-js` and `satori` for improved rendering and styling.
- Update global styles to include smooth scrolling and hide scrollbars in specific components.
- Enhance the Hero component with new CTAs and improved layout.
- Add new social media links in the Footer component.
- Introduce a new Open Graph image and SVG screenshot for better visual representation.
Extract QA contract from PRD during planning, inject into execute +
verify prompt materials, parse <qa_results> from verification output,
persist flow-level results to feature_qa_results table, and render
a QA Results section in PipelineTab with per-flow pass/fail badges.

Wiring: FeatureQaResultQueries added to Queries, PipelineDeps, desktop
index, and CLI context. IPC handlers for list-by-thread + latest-by-feature.

Pipeline: featureQaState on PipelineContext, qa_contract PromptMaterialKind
with execute+verify phase policies, QA flow evaluation prompt appended to
verification, extractQaFlowResults parser with Zod validation.

Closes #110
Header px-3 → px-4 to match transcript body padding. Floating
"Scroll to bottom" pill button appears when user scrolls away from
the latest output — smooth-scrolls back and re-engages auto-stick.
- Upgrade `@shipshitdev/ui` to 0.7.0 across desktop, web, and docs
- Move `LoadingButtonContent` imports to the shared common entrypoint
- Add compare URL helper and tighten a few modal and settings layouts
- Link automation runs to the project Git tab and GitHub compare view
- Preserve Kanban focus state when the board mounts
- Add retry button for failed inbox notifications
- Cover GitHub compare URL parsing cases
- Update Kanban keyboard tests for focus behavior
- Retry verification with focused test-fix context
- Surface test failure summaries in notifications
- Add a UI action to create a draft PR from a completed run
- Modify CI workflow to run tests in a CI-specific mode for improved performance.
- Update coverage command to utilize sharded coverage reporting and set minimum coverage threshold to 95%.
- Add new test cases and enhance existing ones for better coverage and reliability.
- Update .gitignore to exclude vitest reports from apps and packages directories.
- Refactor GitHub handler tests to improve clarity and structure.
Infrastructure refactor: add PipelineRunQueries and PipelineWakeRequestQueries
to context initialization, improve error handling via markInterruptedForThread,
and bump dependencies (@types/node, @tanstack/react-query, vitest).
Bulk --ours conflict resolution in prior commit dropped 'runs' tab from
IssueDetailTab union while leaving stash references in IssueDetailTabs.tsx.
Restoring stash intent to fix typecheck.
- New migrateV59 adds run_id FK on terminal_events, prompt_telemetry,
  agent_conversations, pipeline_phase_log, pipeline_step_log plus
  pipeline_started_at on github_issue_cache.
- Pipeline execution-phases now checks the issue execution lock before
  emitPhase('executing'); runtime claimExecutionIfNeeded early-returns
  when the lock is held by another run.
- IssueCardParts moves Pause into the row menu and simplifies the
  Copy branch button.
- Tests updated: CLI context mock exports PipelineRunQueries, desktop
  index mock adds PipelineRunQueries/PipelineWakeRequestQueries plus
  markInterruptedForThread on QueryMock, IssueDetail tab order
  includes 'Runs'.
* fix(cli): handle fast terminal process exits

* fix(ci): use react doctor inspect action
grepTool agent test spawns rg directly; ubuntu-latest doesn't include
ripgrep by default, causing 3 grepTool tests to fail with ENOENT.
Packaged Electron on macOS/Linux inherits minimal PATH from Finder/Dock,
breaking git/bun/codex/claude resolution in child processes. fixMainProcessPath
runs the user's login shell with -ilc and prepends the resulting PATH onto
process.env.PATH so all subsequent spawnSync/execFileSync calls inherit
the corrected environment. No-op on Windows and in dev.
Schema permits decision='reject' but the planning-phases handler only
branched on approve/request_changes, so a reject fell through to the
'unexpected decision' error. Reject now halts at the approval gate
(never auto-executes, never loops revisions), surfacing the rejection
to the user with reviewDecision='reject' + reason 'reviewRejected'.
Automation ticks synthesize a stub plan with empty files/steps.files
arrays. The executor skill instructs 'touch every file listed in the
plan's files array', causing the executor to no-op on automation runs.

- Add isAutomationRun flag on PipelineContext (set in startFromAutomation)
- buildExecutionPrompt accepts isAutomationRun option
- When set, append an automation_override block that tells the executor
  to treat the prompt as source of truth and discover files itself.
- Update verification-prompt snapshot drift (unrelated stale snapshot)
When a repo-owned setup contract invokes bun/pnpm/yarn install
--frozen-lockfile (or npm ci) and the install fails because of
lockfile drift, resolution mismatch, or min-release-age violations,
the whole pipeline previously hard-failed. Repo lockfiles drift
quickly and blocking the pipeline on every drift is the wrong default.

buildFrozenInstallFallback inspects the failure output, and when it
matches a known drift signature, rebuilds the command without the
freeze flag and retries once. Unrelated failures (EACCES, ENOENT)
still propagate as before.
AppSettings.shellCommandTimeoutMs (default 10m, range 30s-2h) controls
the repo setup command timeout. RepoSetupContract.shellCommandTimeoutMs
overrides per project for slow installs.
- Updated terminal command tests to include a new test for successful codex terminal summary.
- Introduced terminal summary commands to print the latest saved terminal summary and handle GitHub comments.
- Adjusted coverage settings to lower the default minimum coverage threshold from 95 to 85.
- Modified the maximum workers setting for coverage shards from 2 to 1 for improved performance.
@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented May 24, 2026

Important

Review skipped

Too many files!

This PR contains 300 files, which is 150 over the limit of 150.

To get a review, narrow the scope:
• coderabbit review --type committed # exclude uncommitted changes
• coderabbit review --dir # limit to a subdirectory
• coderabbit review --base # compare against a closer base

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 7fd48f78-a650-4e0d-80f6-a65ada54e299

📥 Commits

Reviewing files that changed from the base of the PR and between 5a73104 and 133f3bd.

📒 Files selected for processing (300)
  • .agents/SESSIONS/2026-04-07.md
  • .agents/SESSIONS/2026-04-12.md
  • .agents/SESSIONS/2026-04-13.md
  • .agents/SESSIONS/2026-04-16.md
  • .agents/SESSIONS/2026-04-17.md
  • .agents/SESSIONS/2026-04-18.md
  • .agents/SESSIONS/2026-04-19.md
  • .agents/SESSIONS/2026-04-20.md
  • .agents/SESSIONS/2026-04-21.md
  • .agents/SESSIONS/2026-04-22.md
  • .agents/SESSIONS/2026-04-23.md
  • .agents/SESSIONS/2026-04-24.md
  • .agents/SESSIONS/2026-04-27.md
  • .agents/SESSIONS/2026-04-28.md
  • .agents/SESSIONS/2026-04-29.md
  • .agents/SESSIONS/2026-04-30.md
  • .agents/SESSIONS/2026-05-09.md
  • .agents/SESSIONS/2026-05-10.md
  • .agents/SESSIONS/README.md
  • .agents/SYSTEM/SUMMARY.md
  • .agents/memory/BATCH_2_CANDIDATES.md
  • .agents/memory/MEMORY.md
  • .agents/memory/agents.md
  • .agents/memory/claude-cli.md
  • .agents/memory/feedback_no_legacy_support_green_app.md
  • .agents/memory/interactive-cli-run-modes.md
  • .agents/memory/ipc-errors.md
  • .agents/memory/overview.md
  • .agents/memory/pipeline.md
  • .agents/memory/skills.md
  • .agents/memory/ui-components-first.md
  • .agents/memory/verification-retries.md
  • .agents/memory/worktree-defaults.md
  • .agents/memory/worktrees.md
  • .agents/skills/README.md
  • .agents/skills/api-design-expert/SKILL.md
  • .agents/skills/api-design-expert/api-design-expert/SKILL.md
  • .agents/skills/api-design-expert/api-design-expert/plugin.json
  • .agents/skills/api-design-expert/api-design-expert/references/full-guide.md
  • .agents/skills/api-design-expert/plugin.json
  • .agents/skills/api-design-expert/references/full-guide.md
  • .agents/skills/audit/SKILL.md
  • .agents/skills/audit/audit/SKILL.md
  • .agents/skills/biome-validator/SKILL.md
  • .agents/skills/biome-validator/biome-validator/SKILL.md
  • .agents/skills/biome-validator/biome-validator/plugin.json
  • .agents/skills/biome-validator/biome-validator/scripts/validate.py
  • .agents/skills/biome-validator/plugin.json
  • .agents/skills/biome-validator/scripts/validate.py
  • .agents/skills/bun-validator/SKILL.md
  • .agents/skills/bun-validator/bun-validator/SKILL.md
  • .agents/skills/bun-validator/bun-validator/plugin.json
  • .agents/skills/bun-validator/bun-validator/scripts/validate.py
  • .agents/skills/bun-validator/plugin.json
  • .agents/skills/bun-validator/scripts/validate.py
  • .agents/skills/clarify/SKILL.md
  • .agents/skills/clarify/clarify/SKILL.md
  • .agents/skills/claude-code-guide/SKILL.md
  • .agents/skills/claude-code-guide/claude-code-guide/SKILL.md
  • .agents/skills/component-library/SKILL.md
  • .agents/skills/component-library/component-library/SKILL.md
  • .agents/skills/component-library/component-library/plugin.json
  • .agents/skills/component-library/component-library/references/full-guide.md
  • .agents/skills/component-library/plugin.json
  • .agents/skills/component-library/references/full-guide.md
  • .agents/skills/critique/SKILL.md
  • .agents/skills/critique/critique/SKILL.md
  • .agents/skills/critique/critique/reference/cognitive-load.md
  • .agents/skills/critique/critique/reference/heuristics-scoring.md
  • .agents/skills/critique/critique/reference/personas.md
  • .agents/skills/critique/reference/cognitive-load.md
  • .agents/skills/critique/reference/heuristics-scoring.md
  • .agents/skills/critique/reference/personas.md
  • .agents/skills/debug-issue.md
  • .agents/skills/docker-expert/SKILL.md
  • .agents/skills/docker-expert/docker-expert/SKILL.md
  • .agents/skills/docker-expert/docker-expert/plugin.json
  • .agents/skills/docker-expert/plugin.json
  • .agents/skills/error-handling-expert/SKILL.md
  • .agents/skills/error-handling-expert/error-handling-expert/SKILL.md
  • .agents/skills/error-handling-expert/error-handling-expert/plugin.json
  • .agents/skills/error-handling-expert/error-handling-expert/references/full-guide.md
  • .agents/skills/error-handling-expert/plugin.json
  • .agents/skills/error-handling-expert/references/full-guide.md
  • .agents/skills/explore-codebase.md
  • .agents/skills/github-label-sync
  • .agents/skills/layout/SKILL.md
  • .agents/skills/layout/layout/SKILL.md
  • .agents/skills/mcp-builder/LICENSE.txt
  • .agents/skills/mcp-builder/SKILL.md
  • .agents/skills/mcp-builder/mcp-builder/LICENSE.txt
  • .agents/skills/mcp-builder/mcp-builder/SKILL.md
  • .agents/skills/mcp-builder/mcp-builder/plugin.json
  • .agents/skills/mcp-builder/mcp-builder/reference/evaluation.md
  • .agents/skills/mcp-builder/mcp-builder/reference/mcp_best_practices.md
  • .agents/skills/mcp-builder/mcp-builder/reference/node_mcp_server.md
  • .agents/skills/mcp-builder/mcp-builder/reference/python_mcp_server.md
  • .agents/skills/mcp-builder/mcp-builder/scripts/connections.py
  • .agents/skills/mcp-builder/mcp-builder/scripts/evaluation.py
  • .agents/skills/mcp-builder/mcp-builder/scripts/example_evaluation.xml
  • .agents/skills/mcp-builder/mcp-builder/scripts/requirements.txt
  • .agents/skills/mcp-builder/plugin.json
  • .agents/skills/mcp-builder/reference/evaluation.md
  • .agents/skills/mcp-builder/reference/mcp_best_practices.md
  • .agents/skills/mcp-builder/reference/node_mcp_server.md
  • .agents/skills/mcp-builder/reference/python_mcp_server.md
  • .agents/skills/mcp-builder/scripts/connections.py
  • .agents/skills/mcp-builder/scripts/evaluation.py
  • .agents/skills/mcp-builder/scripts/example_evaluation.xml
  • .agents/skills/mcp-builder/scripts/requirements.txt
  • .agents/skills/package-architect/SKILL.md
  • .agents/skills/package-architect/package-architect/SKILL.md
  • .agents/skills/package-architect/package-architect/plugin.json
  • .agents/skills/package-architect/plugin.json
  • .agents/skills/polish/SKILL.md
  • .agents/skills/polish/polish/SKILL.md
  • .agents/skills/prd-quality-gate
  • .agents/skills/prompt-engineering/SKILL.md
  • .agents/skills/prompt-engineering/prompt-engineering/SKILL.md
  • .agents/skills/quieter/SKILL.md
  • .agents/skills/quieter/quieter/SKILL.md
  • .agents/skills/react-component-performance/SKILL.md
  • .agents/skills/react-component-performance/agents/openai.yaml
  • .agents/skills/react-component-performance/react-component-performance/SKILL.md
  • .agents/skills/react-component-performance/react-component-performance/agents/openai.yaml
  • .agents/skills/react-component-performance/react-component-performance/references/examples.md
  • .agents/skills/react-component-performance/references/examples.md
  • .agents/skills/react-hook-form/AGENTS.md
  • .agents/skills/react-hook-form/README.md
  • .agents/skills/react-hook-form/SKILL.md
  • .agents/skills/react-hook-form/assets/templates/_template.md
  • .agents/skills/react-hook-form/react-hook-form/AGENTS.md
  • .agents/skills/react-hook-form/react-hook-form/README.md
  • .agents/skills/react-hook-form/react-hook-form/SKILL.md
  • .agents/skills/react-hook-form/react-hook-form/assets/templates/_template.md
  • .agents/skills/react-hook-form/react-hook-form/references/_sections.md
  • .agents/skills/react-hook-form/react-hook-form/references/adv-devtools-performance.md
  • .agents/skills/react-hook-form/react-hook-form/references/adv-formprovider-memo.md
  • .agents/skills/react-hook-form/react-hook-form/references/adv-testing-wrapper.md
  • .agents/skills/react-hook-form/react-hook-form/references/array-complete-default-objects.md
  • .agents/skills/react-hook-form/react-hook-form/references/array-separate-crud-operations.md
  • .agents/skills/react-hook-form/react-hook-form/references/array-unique-fieldarray-per-name.md
  • .agents/skills/react-hook-form/react-hook-form/references/array-use-field-id-as-key.md
  • .agents/skills/react-hook-form/react-hook-form/references/array-virtualization-formprovider.md
  • .agents/skills/react-hook-form/react-hook-form/references/ctrl-avoid-double-registration.md
  • .agents/skills/react-hook-form/react-hook-form/references/ctrl-controller-field-props.md
  • .agents/skills/react-hook-form/react-hook-form/references/ctrl-local-state-combination.md
  • .agents/skills/react-hook-form/react-hook-form/references/ctrl-single-usecontroller-per-component.md
  • .agents/skills/react-hook-form/react-hook-form/references/ctrl-usecontroller-isolation.md
  • .agents/skills/react-hook-form/react-hook-form/references/formcfg-async-default-values.md
  • .agents/skills/react-hook-form/react-hook-form/references/formcfg-default-values.md
  • .agents/skills/react-hook-form/react-hook-form/references/formcfg-revalidate-mode.md
  • .agents/skills/react-hook-form/react-hook-form/references/formcfg-should-unregister.md
  • .agents/skills/react-hook-form/react-hook-form/references/formcfg-useeffect-dependency.md
  • .agents/skills/react-hook-form/react-hook-form/references/formcfg-validation-mode.md
  • .agents/skills/react-hook-form/react-hook-form/references/formstate-avoid-isvalid-with-onsubmit.md
  • .agents/skills/react-hook-form/react-hook-form/references/formstate-destructure-formstate.md
  • .agents/skills/react-hook-form/react-hook-form/references/formstate-getfieldstate-for-single-field.md
  • .agents/skills/react-hook-form/react-hook-form/references/formstate-subscribe-to-specific-fields.md
  • .agents/skills/react-hook-form/react-hook-form/references/formstate-useformstate-isolation.md
  • .agents/skills/react-hook-form/react-hook-form/references/integ-mui-controller-pattern.md
  • .agents/skills/react-hook-form/react-hook-form/references/integ-shadcn-form-import.md
  • .agents/skills/react-hook-form/react-hook-form/references/integ-shadcn-select-wiring.md
  • .agents/skills/react-hook-form/react-hook-form/references/integ-value-transform.md
  • .agents/skills/react-hook-form/react-hook-form/references/sub-avoid-watch-in-render.md
  • .agents/skills/react-hook-form/react-hook-form/references/sub-deep-subscription.md
  • .agents/skills/react-hook-form/react-hook-form/references/sub-useformcontext-sparingly.md
  • .agents/skills/react-hook-form/react-hook-form/references/sub-usewatch-default-value.md
  • .agents/skills/react-hook-form/react-hook-form/references/sub-usewatch-over-watch.md
  • .agents/skills/react-hook-form/react-hook-form/references/sub-usewatch-with-getvalues.md
  • .agents/skills/react-hook-form/react-hook-form/references/sub-watch-specific-fields.md
  • .agents/skills/react-hook-form/react-hook-form/references/valid-delay-error.md
  • .agents/skills/react-hook-form/react-hook-form/references/valid-dynamic-schema-factory.md
  • .agents/skills/react-hook-form/react-hook-form/references/valid-error-message-strategy.md
  • .agents/skills/react-hook-form/react-hook-form/references/valid-inline-vs-resolver.md
  • .agents/skills/react-hook-form/react-hook-form/references/valid-native-validation.md
  • .agents/skills/react-hook-form/react-hook-form/references/valid-resolver-caching.md
  • .agents/skills/react-hook-form/references/_sections.md
  • .agents/skills/react-hook-form/references/adv-devtools-performance.md
  • .agents/skills/react-hook-form/references/adv-formprovider-memo.md
  • .agents/skills/react-hook-form/references/adv-testing-wrapper.md
  • .agents/skills/react-hook-form/references/array-complete-default-objects.md
  • .agents/skills/react-hook-form/references/array-separate-crud-operations.md
  • .agents/skills/react-hook-form/references/array-unique-fieldarray-per-name.md
  • .agents/skills/react-hook-form/references/array-use-field-id-as-key.md
  • .agents/skills/react-hook-form/references/array-virtualization-formprovider.md
  • .agents/skills/react-hook-form/references/ctrl-avoid-double-registration.md
  • .agents/skills/react-hook-form/references/ctrl-controller-field-props.md
  • .agents/skills/react-hook-form/references/ctrl-local-state-combination.md
  • .agents/skills/react-hook-form/references/ctrl-single-usecontroller-per-component.md
  • .agents/skills/react-hook-form/references/ctrl-usecontroller-isolation.md
  • .agents/skills/react-hook-form/references/formcfg-async-default-values.md
  • .agents/skills/react-hook-form/references/formcfg-default-values.md
  • .agents/skills/react-hook-form/references/formcfg-revalidate-mode.md
  • .agents/skills/react-hook-form/references/formcfg-should-unregister.md
  • .agents/skills/react-hook-form/references/formcfg-useeffect-dependency.md
  • .agents/skills/react-hook-form/references/formcfg-validation-mode.md
  • .agents/skills/react-hook-form/references/formstate-avoid-isvalid-with-onsubmit.md
  • .agents/skills/react-hook-form/references/formstate-destructure-formstate.md
  • .agents/skills/react-hook-form/references/formstate-getfieldstate-for-single-field.md
  • .agents/skills/react-hook-form/references/formstate-subscribe-to-specific-fields.md
  • .agents/skills/react-hook-form/references/formstate-useformstate-isolation.md
  • .agents/skills/react-hook-form/references/integ-mui-controller-pattern.md
  • .agents/skills/react-hook-form/references/integ-shadcn-form-import.md
  • .agents/skills/react-hook-form/references/integ-shadcn-select-wiring.md
  • .agents/skills/react-hook-form/references/integ-value-transform.md
  • .agents/skills/react-hook-form/references/sub-avoid-watch-in-render.md
  • .agents/skills/react-hook-form/references/sub-deep-subscription.md
  • .agents/skills/react-hook-form/references/sub-useformcontext-sparingly.md
  • .agents/skills/react-hook-form/references/sub-usewatch-default-value.md
  • .agents/skills/react-hook-form/references/sub-usewatch-over-watch.md
  • .agents/skills/react-hook-form/references/sub-usewatch-with-getvalues.md
  • .agents/skills/react-hook-form/references/sub-watch-specific-fields.md
  • .agents/skills/react-hook-form/references/valid-delay-error.md
  • .agents/skills/react-hook-form/references/valid-dynamic-schema-factory.md
  • .agents/skills/react-hook-form/references/valid-error-message-strategy.md
  • .agents/skills/react-hook-form/references/valid-inline-vs-resolver.md
  • .agents/skills/react-hook-form/references/valid-native-validation.md
  • .agents/skills/react-hook-form/references/valid-resolver-caching.md
  • .agents/skills/react-patterns/SKILL.md
  • .agents/skills/react-patterns/react-patterns/SKILL.md
  • .agents/skills/react-refactor/AGENTS.md
  • .agents/skills/react-refactor/README.md
  • .agents/skills/react-refactor/SKILL.md
  • .agents/skills/react-refactor/assets/templates/_template.md
  • .agents/skills/react-refactor/react-refactor/AGENTS.md
  • .agents/skills/react-refactor/react-refactor/README.md
  • .agents/skills/react-refactor/react-refactor/SKILL.md
  • .agents/skills/react-refactor/react-refactor/assets/templates/_template.md
  • .agents/skills/react-refactor/react-refactor/references/_sections.md
  • .agents/skills/react-refactor/react-refactor/references/arch-composition-over-props.md
  • .agents/skills/react-refactor/react-refactor/references/arch-compound-components.md
  • .agents/skills/react-refactor/react-refactor/references/arch-container-presentational.md
  • .agents/skills/react-refactor/react-refactor/references/arch-feature-colocation.md
  • .agents/skills/react-refactor/react-refactor/references/arch-headless-pattern.md
  • .agents/skills/react-refactor/react-refactor/references/arch-interface-segregation.md
  • .agents/skills/react-refactor/react-refactor/references/arch-push-client-low.md
  • .agents/skills/react-refactor/react-refactor/references/arch-render-props-to-hooks.md
  • .agents/skills/react-refactor/react-refactor/references/couple-barrel-free-features.md
  • .agents/skills/react-refactor/react-refactor/references/couple-break-circular-deps.md
  • .agents/skills/react-refactor/react-refactor/references/couple-dependency-injection.md
  • .agents/skills/react-refactor/react-refactor/references/couple-stable-imports.md
  • .agents/skills/react-refactor/react-refactor/references/data-context-module-pattern.md
  • .agents/skills/react-refactor/react-refactor/references/data-granular-error-boundaries.md
  • .agents/skills/react-refactor/react-refactor/references/data-server-first-fetch.md
  • .agents/skills/react-refactor/react-refactor/references/data-tanstack-query-client.md
  • .agents/skills/react-refactor/react-refactor/references/decomp-complete-extraction.md
  • .agents/skills/react-refactor/react-refactor/references/decomp-extract-by-change-reason.md
  • .agents/skills/react-refactor/react-refactor/references/decomp-extract-pure-functions.md
  • .agents/skills/react-refactor/react-refactor/references/decomp-inline-premature.md
  • .agents/skills/react-refactor/react-refactor/references/decomp-scroll-test.md
  • .agents/skills/react-refactor/react-refactor/references/decomp-separate-view-logic.md
  • .agents/skills/react-refactor/react-refactor/references/hook-avoid-object-deps.md
  • .agents/skills/react-refactor/react-refactor/references/hook-composition-over-nesting.md
  • .agents/skills/react-refactor/react-refactor/references/hook-dependency-stability.md
  • .agents/skills/react-refactor/react-refactor/references/hook-extract-when-nameable.md
  • .agents/skills/react-refactor/react-refactor/references/hook-naming-conventions.md
  • .agents/skills/react-refactor/react-refactor/references/hook-single-responsibility.md
  • .agents/skills/react-refactor/react-refactor/references/safety-characterization-tests.md
  • .agents/skills/react-refactor/react-refactor/references/safety-extract-pure-testability.md
  • .agents/skills/react-refactor/react-refactor/references/safety-integration-over-unit.md
  • .agents/skills/react-refactor/react-refactor/references/safety-snapshot-free.md
  • .agents/skills/react-refactor/react-refactor/references/safety-test-behavior.md
  • .agents/skills/react-refactor/react-refactor/references/state-colocate-with-consumers.md
  • .agents/skills/react-refactor/react-refactor/references/state-context-for-static.md
  • .agents/skills/react-refactor/react-refactor/references/state-derive-dont-sync.md
  • .agents/skills/react-refactor/react-refactor/references/state-lift-only-when-shared.md
  • .agents/skills/react-refactor/react-refactor/references/state-machines-for-workflows.md
  • .agents/skills/react-refactor/react-refactor/references/state-reducer-for-complex.md
  • .agents/skills/react-refactor/react-refactor/references/state-url-as-state.md
  • .agents/skills/react-refactor/references/_sections.md
  • .agents/skills/react-refactor/references/arch-composition-over-props.md
  • .agents/skills/react-refactor/references/arch-compound-components.md
  • .agents/skills/react-refactor/references/arch-container-presentational.md
  • .agents/skills/react-refactor/references/arch-feature-colocation.md
  • .agents/skills/react-refactor/references/arch-headless-pattern.md
  • .agents/skills/react-refactor/references/arch-interface-segregation.md
  • .agents/skills/react-refactor/references/arch-push-client-low.md
  • .agents/skills/react-refactor/references/arch-render-props-to-hooks.md
  • .agents/skills/react-refactor/references/couple-barrel-free-features.md
  • .agents/skills/react-refactor/references/couple-break-circular-deps.md
  • .agents/skills/react-refactor/references/couple-dependency-injection.md
  • .agents/skills/react-refactor/references/couple-stable-imports.md
  • .agents/skills/react-refactor/references/data-context-module-pattern.md
  • .agents/skills/react-refactor/references/data-granular-error-boundaries.md
  • .agents/skills/react-refactor/references/data-server-first-fetch.md
  • .agents/skills/react-refactor/references/data-tanstack-query-client.md
  • .agents/skills/react-refactor/references/decomp-complete-extraction.md
  • .agents/skills/react-refactor/references/decomp-extract-by-change-reason.md
  • .agents/skills/react-refactor/references/decomp-extract-pure-functions.md
  • .agents/skills/react-refactor/references/decomp-inline-premature.md
  • .agents/skills/react-refactor/references/decomp-scroll-test.md
  • .agents/skills/react-refactor/references/decomp-separate-view-logic.md
  • .agents/skills/react-refactor/references/hook-avoid-object-deps.md
  • .agents/skills/react-refactor/references/hook-composition-over-nesting.md
  • .agents/skills/react-refactor/references/hook-dependency-stability.md
  • .agents/skills/react-refactor/references/hook-extract-when-nameable.md
  • .agents/skills/react-refactor/references/hook-naming-conventions.md
  • .agents/skills/react-refactor/references/hook-single-responsibility.md
  • .agents/skills/react-refactor/references/safety-characterization-tests.md

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch develop

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@socket-security
Copy link
Copy Markdown

socket-security Bot commented May 24, 2026

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm @internationalized/date is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/@internationalized/date@3.12.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@internationalized/date@3.12.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm @sentry-internal/feedback is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/@sentry/electron@7.13.0npm/@sentry-internal/feedback@10.50.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@sentry-internal/feedback@10.50.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm @sentry/core is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/@sentry/electron@7.13.0npm/@sentry/core@10.50.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@sentry/core@10.50.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm @sentry/node-core is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/@sentry/electron@7.13.0npm/@sentry/node-core@10.50.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@sentry/node-core@10.50.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm @tanstack/table-core is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/@shipshitdev/ui@0.7.0npm/@tanstack/table-core@8.21.3

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tanstack/table-core@8.21.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm caniuse-lite is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/next@16.2.6npm/caniuse-lite@1.0.30001792

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/caniuse-lite@1.0.30001792. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm caniuse-lite is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/next@16.2.6npm/caniuse-lite@1.0.30001792

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/caniuse-lite@1.0.30001792. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm caniuse-lite is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/next@16.2.6npm/caniuse-lite@1.0.30001792

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/caniuse-lite@1.0.30001792. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm caniuse-lite is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/next@16.2.6npm/caniuse-lite@1.0.30001792

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/caniuse-lite@1.0.30001792. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm caniuse-lite is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/next@16.2.6npm/caniuse-lite@1.0.30001792

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/caniuse-lite@1.0.30001792. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm commander is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/liquidjs@10.27.0npm/commander@10.0.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/commander@10.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm cytoscape is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/nextra@4.6.1npm/cytoscape@3.33.3

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/cytoscape@3.33.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm electron-winstaller is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/electron-builder@26.8.1npm/electron-winstaller@5.4.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/electron-winstaller@5.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm immer is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/immer@11.1.8

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/immer@11.1.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm jsdom is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: apps/desktop/package.jsonnpm/jsdom@29.1.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/jsdom@29.1.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm jsdom is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: apps/desktop/package.jsonnpm/jsdom@29.1.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/jsdom@29.1.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm mermaid is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/nextra@4.6.1npm/mermaid@11.15.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/mermaid@11.15.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm mermaid is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/nextra@4.6.1npm/mermaid@11.15.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/mermaid@11.15.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm mermaid is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/nextra@4.6.1npm/mermaid@11.15.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/mermaid@11.15.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm next is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: apps/docs/package.jsonnpm/next@16.2.6

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/next@16.2.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm next is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: apps/docs/package.jsonnpm/next@16.2.6

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/next@16.2.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm next is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: apps/docs/package.jsonnpm/next@16.2.6

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/next@16.2.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm next is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: apps/docs/package.jsonnpm/next@16.2.6

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/next@16.2.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm next is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: apps/docs/package.jsonnpm/next@16.2.6

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/next@16.2.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 24, 2026

React Doctor

Score: 98 / 100

react-doctor v0.2.4

✔ Select projects to scan › @shipcode/desktop, @shipcode/docs, @shipcode/web, @shipcode/ui
Scanning changes: develop → master

Scanning /home/runner/work/shipcode/shipcode/apps/desktop...



  ⚠ react-doctor/no-event-handler        ×2
      Avoid using props and effects as an event handler. Instead, move the handler to the parent component.
      → Move the side effect into the event handler that triggers it, instead of guarding on its state inside a useEffect. See https://react.dev/learn/you-might-not-need-an-effect#sharing-logic-between-event-handlers
      src/renderer/components/CleanupModal.tsx:200
      src/renderer/features/project/project-git-visualizer.tsx:52

  ⚠ react-doctor/prefer-tag-over-role
      Prefer the semantic `<output>` element over `role="status"` on a generic tag.
      → Replace `role` with the semantic HTML element when one exists.
      src/renderer/components/AssistantPanel.tsx:242

  ┌─────┐  99 / 100 Great
  │ ◠ ◠ │  ██████████████████████████████████████████████████
  │  ▽  │  React Doctor (www.react.doctor)
  └─────┘

  3 issues across 3/309 files  in 4.6s
  Full diagnostics written to /tmp/react-doctor-b7e01b92-9d9e-4c23-ab92-12240267dc8a

Scanning /home/runner/work/shipcode/shipcode/apps/docs...


No issues found!

  ┌─────┐  100 / 100 Great
  │ ◠ ◠ │  ██████████████████████████████████████████████████
  │  ▽  │  React Doctor (www.react.doctor)
  └─────┘


Scanning /home/runner/work/shipcode/shipcode/apps/web...


No issues found!

  ┌─────┐  100 / 100 Great
  │ ◠ ◠ │  ██████████████████████████████████████████████████
  │  ▽  │  React Doctor (www.react.doctor)
  └─────┘


Scanning /home/runner/work/shipcode/shipcode/packages/ui...



  ⚠ react-doctor/prefer-tag-over-role    ×3
      Prefer the semantic `<button>` element over `role="button"` on a generic tag.
      → Replace `role` with the semantic HTML element when one exists.
      src/kanban-board/IssueCardParts.tsx:347
      src/kanban-board/IssueListView.tsx:143
      src/ActivePipelineCard.tsx:69

  ⚠ react-doctor/no-event-handler        ×2
      Avoid using state and effects as an event handler. Instead, call the event handling code directly when the event occurs.
      → Move the side effect into the event handler that triggers it, instead of guarding on its state inside a useEffect. See https://react.dev/learn/you-might-not-need-an-effect#sharing-logic-between-event-handlers
      src/KanbanBoard.tsx:562
      src/KanbanBoard.tsx:562

  ┌─────┐  99 / 100 Great
  │ ◠ ◠ │  ██████████████████████████████████████████████████
  │  ▽  │  React Doctor (www.react.doctor)
  └─────┘

  5 issues across 4/72 files  in 1.2s
  Full diagnostics written to /tmp/react-doctor-79313cf6-c7ac-4569-9295-6dff5fe62cda

Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ad700c1caa

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread scripts/lint-no-raw-html.sh
Comment thread .github/workflows/publish.yml
@VincentShipsIt VincentShipsIt merged commit 5494f9c into master May 24, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant