fix(changelog): Fix 404 on /changelog/ page and add navigation#17182
fix(changelog): Fix 404 on /changelog/ page and add navigation#17182
Conversation
- Convert DocsChangelog to client component to work with MDX bundler - Register DocsChangelog in mdxComponents instead of direct import - Add 'Docs Changelog' to Manage dropdown and mobile nav - Rename existing changelog links to 'Product Changelog' for clarity - Add GitHub Action to generate changelog data from merged PRs - Create API route to serve changelog data - Remove dependency on external sentry-content-dashboard API
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix prepared a fix for the issue found in the latest run.
- ✅ Fixed: File filter condition is too permissive using OR
- Changed filter logic from OR to AND, requiring files to both start with docs/ and match .mdx extension, consistent with getPageTitle and fileToUrl functions.
Or push these changes by commenting:
@cursor push c32dcdac49
Preview (c32dcdac49)
diff --git a/scripts/update-docs-changelog.mjs b/scripts/update-docs-changelog.mjs
--- a/scripts/update-docs-changelog.mjs
+++ b/scripts/update-docs-changelog.mjs
@@ -189,7 +189,7 @@
for (const file of files) {
// Only include doc files
- if (!file.filename.match(/\.(mdx?|tsx?)$/) && !file.filename.startsWith('docs/')) {
+ if (!file.filename.startsWith('docs/') || !file.filename.match(/\.mdx?$/)) {
continue;
}This Bugbot Autofix run was free. To enable autofix for future PRs, go to the Cursor dashboard.
|
|
||
| for (const file of files) { | ||
| // Only include doc files | ||
| if (!file.filename.match(/\.(mdx?|tsx?)$/) && !file.filename.startsWith('docs/')) { |
There was a problem hiding this comment.
File filter condition is too permissive using OR
Medium Severity
The categorizeFiles filter condition uses AND on negated clauses, which by De Morgan's law becomes an OR inclusion: files are included if they match .md/.mdx/.ts/.tsx extension (in any directory) or start with docs/ (with any extension). This is far broader than intended — the comment says "Only include doc files" and the sibling functions getPageTitle and fileToUrl both require docs/ AND .mdx?. The result is that source files like src/components/header.tsx, config files like next.config.ts, root markdown like AGENTS.md, and image files like .png all get counted and displayed in the changelog. The generated docs-changelog.json already contains these incorrect entries, inflating "files changed" counts and showing non-documentation files under "View changed pages."
- Add loop-based HTML sanitization to handle nested/malformed comments - Add data validation before writing to file to ensure expected structure
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
| if (!file.filename.match(/\.(mdx?|tsx?)$/) && !file.filename.startsWith('docs/')) { | ||
| continue; | ||
| } |
There was a problem hiding this comment.
Bug: The file filtering logic is incorrect, causing non-documentation files like images and source code to be included in the generated changelog.
Severity: HIGH
Suggested Fix
In scripts/update-docs-changelog.mjs, change the logical operator in the if condition from && to ||. This will correctly filter for files that are both within the docs/ directory and have a .md or .mdx extension.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: scripts/update-docs-changelog.mjs#L192-L194
Potential issue: The file filtering logic in the `update-docs-changelog.mjs` script
incorrectly uses an `&&` operator instead of an `||` operator. The current condition
`!file.filename.match(/\.(mdx?|tsx?)$/) && !file.filename.startsWith('docs/')` causes
the script to include any file that either has a documentation-related extension (e.g.,
`.tsx`) or is located in the `docs/` directory. This results in non-documentation files,
such as source code (`src/components/header.tsx`) and images
(`docs/product/.../img/*.png`), being added to the `docs-changelog.json` file and
displayed incorrectly in the changelog UI.
Did we get this right? 👍 / 👎 to inform future reviews.
| - name: Commit and push changes | ||
| if: steps.changes.outputs.changed == 'true' | ||
| run: | | ||
| git config --local user.email "github-actions[bot]@users.noreply.github.com" | ||
| git config --local user.name "github-actions[bot]" | ||
| git add src/data/docs-changelog.json | ||
| git commit -m "chore: Update docs changelog [skip ci]" | ||
| git push |
There was a problem hiding this comment.
Bug: The GitHub Action's git push command will fail because the default GITHUB_TOKEN cannot bypass branch protection rules on the master branch.
Severity: CRITICAL
Suggested Fix
Use a token with elevated permissions to push to the protected branch, following the pattern used in other workflows in the repository. This typically involves using the create-github-app-token action to generate a temporary token that has the required permissions.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: .github/workflows/update-docs-changelog.yml#L48-L55
Potential issue: The GitHub workflow attempts to commit and push the generated changelog
to the `master` branch using the default `GITHUB_TOKEN`. This token lacks the necessary
permissions to bypass branch protection rules, which are typically active on a `master`
branch. As a result, the `git push` command will fail, preventing the changelog from
being updated. The workflow does not include error handling for this failure, so the
changelog will become progressively stale without any notification.
Did we get this right? 👍 / 👎 to inform future reviews.
- Generate descriptions from file changes only (no PR body parsing) - Add lgtm suppression comment for intentional file write from validated API data
| // This script runs in CI with data from GitHub's trusted API. | ||
| // The data is validated above and only contains expected string/array fields. | ||
| // lgtm[js/network-data-written-to-file] | ||
| fs.writeFileSync(OUTPUT_FILE, JSON.stringify(validatedEntries, null, 2)); // CodeQL: Data is validated above |
Check warning
Code scanning / CodeQL
Network data written to file Medium
1 participant
DESCRIBE YOUR PR
Tell us what you're changing and why. If your PR resolves an issue, please link it so it closes automatically.
IS YOUR CHANGE URGENT?
Help us prioritize incoming PRs by letting us know when the change needs to go live.
SLA
Thanks in advance for your help!
PRE-MERGE CHECKLIST
Make sure you've checked the following before merging your changes: