Repository navigation
chore: Update deps. - #32
Merged
Merged
Conversation
Member
Author
|
Downgraded Vinext again, too much vibe coding there, can't figure out what's up, not important for this PR. |
cpojer
force-pushed
the
update-deps
branch
2 times, most recently
from
March 26, 2026 05:23
43d21a6 to
788fc91
Compare
Member
Author
|
This update exposed an implicit-to-any cast of |
cpojer
enabled auto-merge (squash)
March 26, 2026 05:47
cpojer
commented
Mar 26, 2026
Comment on lines
+99
to
+100
| // This module is augmented by users, keep it as external so tsdown does not rewrite it. | ||
| "void/routes", |
Member
Author
There was a problem hiding this comment.
This is the fix for dts generation. Without it, tsdown rewrites void/routes to the internal stub.
Brooooooklyn
approved these changes
Mar 26, 2026
cpojer
pushed a commit
that referenced
this pull request
Sep 11, 2026
Only link a new OAuth provider to an existing account when the email is verified. Previously, unverified GitHub emails could be used to hijack accounts. Also fixes the case where GitHub users with a public email set on their profile never got verified status because the /user/emails endpoint was skipped. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **High Risk** > Changes the OAuth callback flow for GitHub/Google account linking and user updates, which is security-critical and could affect login/signup behavior if verification signals are incorrect or missing. > > **Overview** > **Gates OAuth account linking on verified emails.** The callback flow now only links a newly-authenticated provider to an existing user (by email match) when the provider reports the email as verified, and new-user creation/allowlist checks treat unverified emails as `null`. > > GitHub and Google user fetches now surface an `emailVerified` signal (GitHub via `/user/emails` `verified`, Google via `verified_email`), and the user update path avoids overwriting a stored email unless the newly-fetched email is verified. > > Adds an integration test suite covering GitHub linking behavior for unverified emails, verified private emails, and verified public profile emails. > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 15b0cd38800f360faa8847232664a69794a3133f. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup> <!-- /CURSOR_SUMMARY -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updating deps to their latest versions. Also separated
domain.tssimilar to other commands so that we don't statically and dynamically import the file incli.ts. Migrated the pnpm config intopnpm-workspace.yaml.Will migrate to Vite+ later.