release: v1.0.17 — maintenance, security, and build reliability

.github/workflows/security.yml

@@ -18,12 +18,14 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
-          node-version: 22
+          node-version: 24
           cache: npm
           cache-dependency-path: frontend/package-lock.json
 
@@ -53,5 +55,11 @@ jobs:
               ;;
           esac
 
+      - name: Test janitor transport
+        run: node --test scripts/shop-janitor-restock-stale.test.mjs
+
       - name: Install dependencies
         run: npm ci --include=dev
+
+      - name: Check application and test types
+        run: npm run typecheck

.github/workflows/shop-janitor-restock-stale.yml

@@ -23,12 +23,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
-          node-version: "20"
+          node-version: "24"
+
+      - name: Test janitor transport
+        run: node --test scripts/shop-janitor-restock-stale.test.mjs
 
       - name: Guard config (skip if secrets missing)
         id: guard

CHANGELOG.md

@@ -1166,3 +1166,41 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 - Applied the missing `0035_daffy_captain_cross.sql` production migration so authenticated Q&A viewed and bookmarked progress can load and persist
 - Isolated dashboard Q&A progress loading so a temporary failure in the optional learning-progress section no longer prevents the entire dashboard from rendering
 - Bumped the frontend package version to `1.0.16`
+
+## [1.0.17] - 2026-09-08
+
+### Added
+
+- Janitor transport regression coverage for authenticated non-browser requests, HTTP errors, rate limits, redirects, and response timeouts
+- Nodemailer compatibility coverage that composes shop notification emails without sending messages
+- Server-side quiz answer cache tests replacing coverage for the retired encrypted-answer module
+- `npm run typecheck` to generate Next.js route types and check application and test TypeScript in GitHub Actions
+
+### Changed
+
+- Updated Next.js and its ESLint configuration to `16.3.4`, React and React DOM to `19.2.8`, Drizzle ORM to `0.45.2`, next-intl to `4.14.2`, Sentry to `10.73.0`, and the Tiptap packages to `3.31.3`
+- Updated Nodemailer to `10.0.1` and removed the obsolete standalone type package
+- Refreshed the lockfile with compatible transitive security patches
+- Upgraded GitHub checkout/setup-node actions to v6 and CI and Netlify staging to Node.js 24
+- Refreshed seven application screenshots and all nine README image descriptions, including the corrected login image label and expanded feature descriptions
+- Clarified Vercel production (`main`) and Netlify staging (`develop`) hosting, environment configuration, migrations, release verification, and rollback guidance
+- Bumped the frontend package and lockfile version to `1.0.17`
+
+### Fixed
+
+- Fixed scheduled stale-order cleanup receiving `403 ORIGIN_BLOCKED`: the caller now uses native HTTPS requests without the browser metadata added by Node.js fetch
+- Preserved janitor secret authentication and timeout handling; redirects are rejected instead of forwarding credentials
+- Fixed production builds blocked by outdated blog, quiz, and AI-helper test contracts without disabling TypeScript checks
+- Migrated blog test fixtures to current IDs, string slugs, category objects, and Tiptap content; consolidated navigation coverage around the current component
+- Updated quiz guest-flow, session-state, and AI-helper authentication/action mocks to match current application behavior
+
+### Verification
+
+- Passed targeted janitor, email, blog, quiz, and AI-helper regression tests
+- Passed full application and test type checking and ESLint for the repaired test files
+- Verified local production and Netlify-style staging builds with synthetic configuration; confirmed a published Netlify staging deployment
+- Production dependency audit reported no known vulnerabilities; four moderate development-tool findings remain in the Drizzle Kit/esbuild dependency chain
+- No database schema changes or migrations are included in this release
+
+- Required HTTPS with certificate verification for janitor credentials; added tests rejecting plaintext HTTP and untrusted certificates
+- Disabled checkout credential persistence in the security workflow

INSTRUCTIONS.md

@@ -36,6 +36,15 @@ DevLovers helps developers prepare for technical interviews in a structured way.
 
 The interface and available content support three languages: English, Ukrainian, and Polish.
 
+### Service environments
+
+DevLovers uses separate deployment environments:
+
+- **Production:** [devlovers.net](https://devlovers.net), deployed on Vercel from the `main` branch. This is the public service for real user accounts, learning progress, and supported shop activity.
+- **Staging:** [develop-devlovers.netlify.app](https://develop-devlovers.netlify.app), deployed on Netlify from the `develop` branch. This environment is intended for testing upcoming changes and may be temporarily unavailable or contain non-production data.
+
+Do not enter real payment details or rely on staging data as a backup of production. Accounts, progress, orders, provider configuration, and database contents may differ between the two environments.
+
 ### Main sections
 
 | Section | URL | Purpose |

README.md

@@ -10,76 +10,80 @@
 
 ### Home
 
-- Minimal first landing page
-- Multi-language support
-- Theme switching
+- Interview preparation landing page with a clear call to action
+- Navigation to Q&A, quizzes, leaderboard, blog, and shop
+- English, Ukrainian, and Polish interfaces with light, dark, and system themes
 
-![Home](./assets/01-screencapture.png)
+![DevLovers home page with the interview preparation introduction and Take the First Step button](./assets/01-screencapture.png)
 
 ### Q&A
 
-- Categorized technical questions
-- AI-powered Word Helper for explanations
-- Multi-language content
+- Technical questions organized by language, framework, and tool
+- Viewed-question tracking, saved questions, and progress reset
+- Paginated question lists with adjustable page size
+- AI-powered Word Helper for explanations and multi-language content
 
-![Q&A](./assets/02-screencapture.png)
+![Q&A page with technology filters, viewed and saved questions, a progress bar, and pagination](./assets/02-screencapture.png)
 
 ### Quiz System
 
+- Quiz catalog filtered by technology, with question counts and time limits
 - Multiple-choice quizzes with countdown timer
 - Anti-cheat protection (tab switch detection, copy prevention)
 - Guest mode with post-auth sync
 - Per-quiz progress tracking
 
-![Quiz System](./assets/03-screencapture.png)
+![Quiz catalog showing Angular Fundamentals and Angular Advanced cards with question counts and time limits](./assets/03-screencapture.png)
 
 ### Leaderboard
 
 - Points system with improvement-based scoring
-- Top players podium
+- Top-three podium and a ranked table with player scores
 - Integrity-filtered rankings
 
-![Leaderboard](./assets/04-screencapture.png)
+![All-time leaderboard with a top-three podium and ranked player scores](./assets/04-screencapture.png)
 
 ### About
 
-- Mission-driven page explaining DevLovers vision, values, and interview-first approach
-- Highlights platform impact, community growth, and real preparation over guessing
+- Interview preparation mission centered on structured practice and practical skills
+- Community highlights for quizzes passed, active users, GitHub stars, and LinkedIn followers
 
-![About](./assets/05-screencapture.png)
+![About page with the Debug your skills before the recruiter does headline and community statistics](./assets/05-screencapture.png)
 
 ### Blog
 
-- Technical articles via custom in-house admin panel
+- Featured articles and a post grid covering Tech, Career, Insights, and News
+- Article previews with author, category, and publication date
 - Category and tag filtering
 - Search with pagination
 - Multi-language content (uk/en/pl)
 
-![Blog](./assets/06-screencapture.png)
+![Blog page with a featured article, category filters, and article cards](./assets/06-screencapture.png)
 
 ### Shop
 
 - Product catalog with filtering
 - Stripe checkout
 - Admin panel for orders and inventory
 
-![Shop](./assets/07-screencapture.png)
+![Shop preview with a Coming soon banner and new-arrival product cards showing prices and availability](./assets/07-screencapture.png)
 
 ### Authentication
 
 - Email/password with verification
-- OAuth (Google, GitHub)
+- Google and GitHub sign-in with a last-used provider indicator
 - Password reset flow
 
-![Shop](./assets/08-screencapture.png)
+![Login page with Google and GitHub sign-in, email and password fields, and the language selector](./assets/08-screencapture.png)
 
-## Dashboard
+### Dashboard
 
-- Personal learning dashboard with progress insights
-- Quiz history and performance overview
-- Quick access to key account activity
+- Score distribution with Mastered, Review, and Study categories
+- Activity heatmap and achievement badges
+- Quiz results with scores, accuracy, integrity, earned points, and status
+- Q&A progress by topic, saved-question counts, and links to continue learning
 
-![Dashboard](./assets/09-screencapture.png)
+![Personal dashboard showing score distribution, an activity heatmap, achievements, quiz results, and question progress by topic](./assets/09-screencapture.png)
 
 > [!IMPORTANT]
 > **Contact me:** [contact@devlovers.net](mailto:contact@devlovers.net)