copy as markdown , /{endpoint}.md , open in chat platform - #16
Merged
Conversation
|
@aquaticcalf is attempting to deploy a commit to the Charan's projects Team on Vercel. A member of the Team first needs to authorize it. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
- Add monochrome brand marks (ai-tool-icons) as default icons for every AI tool in AiToolMenu and ViewOptionsPopover; icons prop still overrides - VS Code MCP install URI now includes type:http (required for URL servers) - Playful one-shot wiggle animation on icon hover with reduced-motion guard
- Tiny CSS confetti burst when a copy action succeeds (reduced-motion safe) - Copy buttons show 'Copied command' (CLI tools) / 'Copied Markdown' without changing width or switching to primary color - Markdown copy label centered in the button
- MarkdownCopyButton: only cache successful fetches (a failure no longer poisons the cache) and reject non-OK responses instead of copying them - remarkPlainMarkdown: splice directive children in place instead of reassigning parent.children mid-visit - Fix createMarkdownHandler docstring: correct mount path + example that matches the shipped route files; drop the duplicated module-docstring copy - Remove dead code: aiTool(), safeBase64 export, unused directory prop, dead defaultIcon(), unused .fw-page-action--copied CSS - Unify ViewOptionsPopover icons prop to AiToolId keys; no Lucide mention - Correct stale reserve-span comment (centered / Copied Markdown)
- Extract CopyGlyph/CheckGlyph/ExternalGlyph/TextGlyph into glyphs.tsx and copyText into clipboard.ts; ai-tool-menu and page-actions now share them - Confetti piece colors are --fw-confetti-* local tokens on .fw-confetti (layout.css) instead of hardcoded hex in TSX - PAGE ACTIONS section divider now uses the box-drawing style used by the other stylesheet sections
aquaticcalf
marked this pull request as ready for review
August 8, 2026 13:40
CharanMN7
self-requested a review
August 8, 2026 23:50
CharanMN7
approved these changes
Aug 9, 2026
CharanMN7
left a comment
CharanMN7
left a comment
Contributor
There was a problem hiding this comment.
Ayy, love the update! thanks for the PR!
i see that you're updated all the examples and templates as well!
everything looks good. only confused what exactly does the stripeLeadingH1 function does. other than that, it's all good. do drop a comment about it when you see this, and i'll patch up the vulnerabilities stuff so the CI check passes, later today.
WHAT CHANGED fast-uri 3.1.4 -> 3.1.5 (HIGH, GHSA-7p8r-x3mc-p8w7) js-yaml 3.15.0 -> 3.15.1 (HIGH, GHSA-5p4m-2wfm-xmqj) nanoid 3.3.16 -> 3.3.18 (HIGH, GHSA-2v37-7h3g-55p8) hono 4.12.32-> 4.13.1 (MODERATE, GHSA-8j4g-w8fx-2239 + GHSA-f23p-vx2j-j53r, GHSA-54fx-42gc-7vw4, GHSA-79qm-7rj5-m7r9) Plus one source change: the root `js-yaml` override moved from `^3.15.0` to `^3.15.1`. That override was declaring a floor that is itself the vulnerable version — 3.15.0 is inside the advisory's `>= 3.0.0, < 3.15.1` range — so it could have silently pinned the tree back onto a vulnerable release on a fresh resolve. The floor now sits on the patched version. WHY THESE, AND WHY NOW CI's last run on this PR was red on exactly one step — `npm audit --audit-level=high` — with every other step (lint, typecheck, test, build) green. These four advisories are that failure. They are also 4 of the 5 distinct packages on the repo's Dependabot alert page. All four are transitive, and every one of them was already permitted to reach its patched version by its parent's existing semver range: fast-uri <- ajv (^3.0.1 -> 3.1.5 in range) js-yaml <- gray-matter (^3.13.1 -> 3.15.1 in range) nanoid <- postcss (^3.3.16 -> 3.3.18 in range) hono <- @modelcontextprotocol/sdk (^4.11.4 -> 4.13.1 in range) So this is a lockfile refresh, not a dependency change: no declared dependency range in any package.json moved, and no new override was added. `npm update <pkg>` for exactly these four names; the resulting diff touches 4 version/resolved/integrity triples and nothing else. WHY NO NEW OVERRIDES The existing overrides block pins transitive deps to EXACT versions (postcss 8.5.23, sharp 0.35.3, @hono/node-server 2.0.12). Adding fast-uri/nanoid/hono to it would freeze them at today's patch and stop future security patches from flowing in on their own — the opposite of what's wanted. The standing guard is the `npm audit --audit-level=high` step already in CI, which goes red the moment a new high advisory lands against anything in the tree. js-yaml is the one exception because its override already existed and its floor was wrong. WHY hono LANDED ON 4.13.1 AND NOT 4.12.34 4.12.34 is the advisories' minimum patched version; 4.13.1 is the newest release inside the MCP SDK's declared `^4.11.4`, and is what a clean resolve produces. Holding it back to 4.12.34 would have required a new override to pin it BELOW what upstream permits — a stale pin someone would later have to remember to remove. hono is also off this framework's runtime path entirely: the MCP server (packages/framework/ src/mcp/server.ts) uses WebStandardStreamableHTTPServerTransport, which is web-standard Request/Response, so hono ships in the tree as an unused transitive of the SDK's other transports. @hono/node-server@2.0.12's peer range is `hono ^4`, which 4.13.1 satisfies. IMPACT - `npm audit --audit-level=high` now exits 0 (was exit 1 — the sole red step on this PR). 0 vulnerabilities at any severity. - No API, behavior, or bundle-shape change. Verified green after the bump on the same four steps CI runs: lint, typecheck (6 workspaces), test (96 tests / 13 files, all passing), build (6 workspaces compiled + pagefind index built). - Runtime risk is confined to js-yaml (via gray-matter's frontmatter parsing, a patch release) and nanoid (via postcss, a patch release). fast-uri (ajv) and hono (unused SDK transport) are not on any code path this framework executes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
… alerts)
WHAT CHANGED
One line in each of the six archived templates — aurora, base, cedar,
fern, galley, mono:
"next": "16.2.10" -> "next": "16.2.12"
Nothing else in archive/ is touched.
WHY
These six manifests are the source of 54 of the repo's 63 open Dependabot
alerts — 9 distinct Next.js advisories x 6 templates, all with the same
`>= 16.0.0, < 16.2.11` vulnerable range:
HIGH GHSA-m99w-x7hq-7vfj DoS in App Router using Server Actions
HIGH GHSA-6gpp-xcg3-4w24 Middleware/Proxy bypass (Turbopack, single locale)
HIGH GHSA-p9j2-gv94-2wf4 SSRF in rewrites via attacker-controlled host
HIGH GHSA-89xv-2m56-2m9x SSRF in Server Actions on custom servers
MED GHSA-955p-x3mx-jcvp Unauthenticated disclosure of Server Function endpoints
MED GHSA-q8wf-6r8g-63ch DoS in Image Optimization API using SVGs
MED GHSA-4c39-4ccg-62r3 Unbounded Server Action payload in Edge runtime
MED GHSA-68g3-v927-f742 Cache confusion of response bodies
MED GHSA-4633-3j49-mh5q Cache confusion on invalid UTF-8 request bodies
WHY 16.2.12 AND NOT THE PATCHED MINIMUM 16.2.11
16.2.12 is the newest 16.2.x stable, and it is already what every live
workspace pins — templates/{canopy,galley,shadcn} and
examples/{inkform-docs,markdown-docs,pokeapi-docs}. Landing the archive on
the same version makes "what Next does this repo use" a single answer
instead of two, and clears the advisories with the same one-line edit.
IMPACT, AND ONE PRE-EXISTING PROBLEM THIS SURFACED
archive/templates/* is outside the npm workspaces array, so these six are
not installed, typechecked, or built by `npm ci` or by CI. This commit
therefore cannot affect the CI result or any shipped artifact — it changes
a version string in six manifests Dependabot reads and nothing else does.
To confirm the bump is safe rather than assume it, archive/templates/base
was installed and built standalone twice — once on 16.2.10, once on
16.2.12 — and the two runs compared:
next 16.2.10: tsc exit 1, 10 errors | next build exit 1
next 16.2.12: tsc exit 1, 10 errors | next build exit 1
tsc output: byte-identical
build output: byte-identical (modulo the version string itself)
So the bump provably changes nothing — but note what the control run
proves on its own: these archived templates ALREADY do not build, on
either version. They import `@inkform/framework/ai`,
`@inkform/framework/openapi-render`, `@inkform/framework/openapi-engine/
{nav,parse}` and pass `contentType` / read `DocsTab.apiReference`, none of
which exist in the `@inkform/framework@^0.3.0` their manifests depend on.
The published 0.3.0 predates those APIs; the repo's own framework is now
0.4.0, which `^0.3.0` cannot reach.
That breakage is pre-existing, is about framework API drift rather than
Next.js, and is deliberately left alone here: fixing it means re-pointing
the archive at ^0.4.0 and rewriting archived template source, which is a
functional change to archived code and does not belong in a security
patch. Flagging it rather than silently folding it in.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…y still get security bumps
WHAT CHANGED
Adds archive/README.md. No code, no dependency, no config change.
WHY
The preceding commit bumped `next` in all six archived templates to clear
54 Dependabot alerts. Verifying that bump was safe turned up something
worth writing down: those templates already do not build, on the old
version or the new one.
They depend on `@inkform/framework: ^0.3.0`. A caret range on a 0.x
version cannot cross the minor, so `^0.3.0` can only ever resolve to the
published 0.3.0 — but the source in those directories was written against
the API that shipped in 0.4.0. So they fail at module resolution on
`@inkform/framework/{ai,openapi-render,openapi-engine/nav,openapi-engine/
parse}`, plus two API-shape mismatches (`contentType` on DocsShell,
`apiReference` on DocsTab).
That's normal for archived code and is not a regression — but it is
invisible, because nothing installs or builds archive/ (it sits outside
the workspaces array, so `npm ci` and CI both skip it). Left undocumented,
the failure mode is someone opening a template that advertises a current
Next.js version, assuming it is maintained, and spending an afternoon
finding out otherwise.
The README also states the inverse, which is the non-obvious half:
Dependabot scans every package.json in the repo whether or not it is a
workspace, so these manifests keep raising alerts and keep needing
patches even though no build consumes them. A version bump here is
alert hygiene, and explicitly does not mean the template was retested.
IMPACT
Documentation only — a maintainer-facing note in a directory that had
none. Nothing reads this file at build time; nothing in CI changes. Kept
as its own commit so it can be dropped independently of the security
fixes if a reviewer would rather not carry it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
@CharanMN7 check this out -
copy-as-markdown-endpoint.md-open-in-chat-platform-demo-720p.mp4