Skip to content

Add two new security researchers & Version 7.7.4 - #330

Open
ildyria wants to merge 4 commits into
masterfrom
future
Open

Add two new security researchers & Version 7.7.4#330
ildyria wants to merge 4 commits into
masterfrom
future

Conversation

@ildyria

@ildyria ildyria commented Aug 17, 2026

Copy link
Copy Markdown
Member

Summary by CodeRabbit

  • New Features

    • Added release notes for Lychee v7.7.4, including improved empty-mail feedback, more accurate frame detection, configurable frame timing, and safer advisory-version handling.
    • Added security release information for v7.7.4 and updated v7.7.3’s classification.
  • Bug Fixes

    • Fixed a vulnerability that could allow guest users to access baskets improperly.
  • Documentation

    • Added acknowledgements for security researchers who contributed to the release.

@coderabbitai

coderabbitai Bot commented Aug 18, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Warning

Review limit reached

@ildyria, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 6 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 24d3af33-9381-46a2-90ac-aa6da56ae4e6

📥 Commits

Reviewing files that changed from the base of the PR and between c9221d9 and 9eb9ea6.

📒 Files selected for processing (1)
  • src/content/docs/docs/getting-started/releases.md
📝 Walkthrough

Walkthrough

The update publishes Lychee v7.7.4 security release notes, reclassifies v7.7.3, and adds two external security researchers to the support page.

Changes

Release publication

Layer / File(s) Summary
Security release publication
src/data/releases.ts, src/content/docs/docs/getting-started/releases.md, src/pages/support.astro
Adds v7.7.4 as a security release, reclassifies v7.7.3, documents four fixes, and adds two external security researchers with avatar images and alt text.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: 🟡 Moderate · up to c9221

The PR adds v7.7.4 release information, but the update endpoint could advertise that release before it is available, causing users to be directed to an unavailable version. Researcher avatar names are also not preserved as image text, and minor release-note typos remain; merge should wait for the release-timing issue to be resolved or explicitly accepted.

Poem

A rabbit hops through release notes bright,
Four fixes tucked in clean moonlight.
Security badges now align,
Two helpers join the credit line.
Sproing! The new release is ready to shine.

🚥 Pre-merge checks | ✅ 1
✅ Passed checks (1 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@ildyria ildyria changed the title Add two new security researcher Add two new security researcher & Version 7.7.4 Aug 18, 2026
@ildyria ildyria changed the title Add two new security researcher & Version 7.7.4 Add two new security researchers & Version 7.7.4 Aug 18, 2026
@ildyria
ildyria marked this pull request as ready for review August 18, 2026 22:27

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 4


ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4185f0ab-0541-4c79-865d-218e0173b277

📥 Commits

Reviewing files that changed from the base of the PR and between 8a4896c and c9221d9.

📒 Files selected for processing (3)
  • src/content/docs/docs/getting-started/releases.md
  • src/data/releases.ts
  • src/pages/support.astro

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

Comment thread src/content/docs/docs/getting-started/releases.md Outdated
Comment thread src/content/docs/docs/getting-started/releases.md Outdated
Comment thread src/data/releases.ts
Comment thread src/pages/support.astro
Comment on lines +363 to +378
},
{
title: 'd3do-23 (Wu Wenhao)',
image: {
src: 'https://avatars.githubusercontent.com/u/73107878?v=4',
alt: 'd3do-23',
},
},
{
title: 'skeletonsec',
image: {
src: 'https://avatars.githubusercontent.com/u/298925831?v=4',
alt: 'skeletonsec',
},
}

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Preserve the avatar metadata when rendering.

The new entries provide image.alt, but ItemGrid4 currently renders a raw <img> with hard-coded alt="A bird."; Features5 forwards these items to that renderer. (raw.githubusercontent.com) This discards the researcher names and bypasses src/components/common/Image.astro. Update src/components/ui/ItemGrid4.astro to use the shared component and pass alt={image.alt}.

Proposed renderer fix
+import Image from '~/components/common/Image.astro';
+
-<img src={image.src} alt="A bird." class=" rounded-full h-20 w-20" />
+<Image src={image.src} alt={image.alt} width={80} height={80} layout="fixed" class="rounded-full h-20 w-20" />

Sources: Coding guidelines, MCP tools

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant