Codex/refactor code quality by aeiwz · Pull Request #9 · aeiwz/metbit

aeiwz · 2026-04-15T14:42:05Z

This pull request introduces several improvements across both the frontend documentation site and the Python backend, focusing on security, maintainability, and user experience. The most significant changes include implementing input sanitization to prevent XSS and CSV injection in annotation features, updating dependencies and linting configuration for the Next.js frontend, and refactoring the scaler utility for clarity and robustness.

Security enhancements for annotation features:

Added _sanitize_annotation_text to escape HTML in annotation labels and _sanitize_csv_cell to prevent spreadsheet formula injection in CSV exports within metbit/annotate_peak.py. These functions are now used when adding annotations and exporting intensity tables, reducing the risk of XSS and CSV injection attacks. [1] [2] [3] [4]
Introduced new tests in tests/test_security_annotations.py to verify the effectiveness of the sanitization functions.

Frontend dependency and configuration updates:

Upgraded next, react, react-dom, react-icons, and related dev dependencies in package.json to their latest major versions, and updated the lint script to use eslint . instead of next lint.
Added a modern ESLint configuration using eslint-config-next and defineConfig in docs/eslint.config.mjs for improved code quality and compatibility.

Frontend UI improvements:

Switched to using the next/font API for loading the Roboto font in layout.tsx, removing manual <link> tags and applying the font via className for better performance and maintainability. [1] [2]
Improved theme persistence and initialization in ThemeToggle.tsx by introducing a getStoredMode function and simplifying the logic in the component. [1] [2]

Python backend refactoring and bug fixes:

Refactored metbit/scaler.py for clarity: added a static method to handle sparse matrix centering errors, improved attribute management in _reset, and standardized numeric literals. Also improved handling of sparse matrices in scaling methods. [1] [2] [3] [4] [5]

Version updates:

Bumped the version of the Python package to 8.7.7 in both __init__.py and setup.py, and updated the download URL accordingly. [1] [2]

vercel · 2026-04-15T14:42:29Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
metbit-docs	Error		Apr 15, 2026 3:01pm

aeiwz · 2026-04-15T14:43:20Z

@copilot resolve the merge conflicts in this pull request

Copilot · 2026-04-15T14:43:25Z

@aeiwz I'm unable to start working on this because of repository rules that prevent me from pushing to the branch:

Changes must be made through a pull request due to repository rules
Code scanning results must be provided due to repository rules

See the documentation for more details.

aeiwz · 2026-04-15T14:44:50Z

@copilot resolve the merge conflicts in this pull request

Copilot · 2026-04-15T14:44:54Z

@aeiwz I'm unable to start working on this because of repository rules that prevent me from pushing to the branch:

Changes must be made through a pull request due to repository rules
Code scanning results must be provided due to repository rules

See the documentation for more details.

Copilot

Pull request overview

This PR improves the Metbit docs site and Python backend with a focus on annotation security hardening, frontend modernization, and backend refactors (plus a package version bump).

Changes:

Add sanitization helpers for annotation labels (HTML escaping) and CSV export column naming, plus security-focused tests.
Refactor Scaler internals for clarity/consistency (attribute reset, sparse-centering guard, numeric literal cleanup).
Modernize docs app setup (Next/React upgrade, ESLint flat config, next/font, theme initialization tweaks) and bump package version.

Reviewed changes

Copilot reviewed 9 out of 40 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
`metbit/annotate_peak.py`	Adds annotation/CSV sanitizers and integrates them into annotation add/load and CSV export.
`tests/test_security_annotations.py`	Adds tests for sanitization helpers.
`metbit/scaler.py`	Refactors scaler implementation (sparse-centering checks, reset logic, formatting/literals).
`tests/__pycache__/test_utility.cpython-314-pytest-9.0.2.pyc`	Compiled bytecode added to repo (should not be committed).
`tests/__pycache__/test_spec_norm.cpython-314-pytest-9.0.2.pyc`	Compiled bytecode added to repo (should not be committed).
`tests/__pycache__/test_security_annotations.cpython-314-pytest-9.0.2.pyc`	Compiled bytecode added to repo (should not be committed).
`tests/__pycache__/test_scaler.cpython-314-pytest-9.0.2.pyc`	Compiled bytecode added to repo (should not be committed).
`tests/__pycache__/test_project_name.cpython-314-pytest-9.0.2.pyc`	Compiled bytecode added to repo (should not be committed).
`tests/__pycache__/test_normalise.cpython-314-pytest-9.0.2.pyc`	Compiled bytecode added to repo (should not be committed).
`tests/__pycache__/test_metbit_core.cpython-314-pytest-9.0.2.pyc`	Compiled bytecode added to repo (should not be committed).
`metbit/__pycache__/ui_picky_peak.cpython-314.pyc`	Compiled bytecode added to repo (should not be committed).
`metbit/__pycache__/take_intensity.cpython-314.pyc`	Compiled bytecode added to repo (should not be committed).
`metbit/__pycache__/spec_norm.cpython-314.pyc`	Compiled bytecode added to repo (should not be committed).
`metbit/__pycache__/scaler.cpython-314.pyc`	Compiled bytecode added to repo (should not be committed).
`metbit/__pycache__/pretreatment.cpython-314.pyc`	Compiled bytecode added to repo (should not be committed).
`metbit/__pycache__/pls.cpython-314.pyc`	Compiled bytecode added to repo (should not be committed).
`metbit/__pycache__/peak_processe.cpython-314.pyc`	Compiled bytecode added to repo (should not be committed).
`metbit/__pycache__/pca_ellipse.cpython-314.pyc`	Compiled bytecode added to repo (should not be committed).
`metbit/__pycache__/opls.cpython-314.pyc`	Compiled bytecode added to repo (should not be committed).
`metbit/__pycache__/calibrate.cpython-314.pyc`	Compiled bytecode added to repo (should not be committed).
`metbit/__pycache__/baseline.cpython-314.pyc`	Compiled bytecode added to repo (should not be committed).
`metbit/__pycache__/base.cpython-314.pyc`	Compiled bytecode added to repo (should not be committed).
`metbit/__pycache__/__init__.cpython-314.pyc`	Compiled bytecode added to repo (should not be committed).
`metbit/__pycache__/STOCSY.cpython-314.pyc`	Compiled bytecode added to repo (should not be committed).
`setup.py`	Bumps package version and download URL to 8.7.7.
`metbit/__init__.py`	Bumps `__version__` to 8.7.7.
`docs/package.json`	Upgrades Next/React and adjusts lint script to `eslint .`.
`docs/eslint.config.mjs`	Adds ESLint flat config using Next presets and ignores build outputs.
`docs/next-env.d.ts`	Updates Next TS references for typed routes.
`docs/app/layout.tsx`	Switches Roboto loading to `next/font` and applies font class to `<body>`.
`docs/app/components/ThemeToggle.tsx`	Refines theme persistence/init logic via `getStoredMode`.

Comments suppressed due to low confidence (1)

metbit/annotate_peak.py:610

The CSV injection hardening is only applied to the annotation-derived column header (lbl). Cells coming from meta_df are written to CSV unchanged, so a value like =HYPERLINK(...) in metadata can still trigger formula injection when the CSV is opened in a spreadsheet app. Consider sanitizing all string/object cells in meta_df (and possibly metadata column names) via _sanitize_csv_cell before to_csv.

            meta_df = self.meta.copy()
            if not isinstance(meta_df, pd.DataFrame):
                meta_df = meta_df.to_frame(name=str(meta_df.name or "Meta"))
            meta_df = meta_df.loc[self.spectra.index]

            out = pd.concat([
                meta_df,
                intensity_df
            ], axis=1)
            buf = io.StringIO()
            out.to_csv(buf, index=False)

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 9 out of 40 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-15T15:05:14Z

+  const [mode, setMode] = useState<Mode>(getStoredMode)

  useEffect(() => {
-    const saved = (localStorage.getItem('theme') as Mode) || 'system'
-    setMode(saved)
-    applyTheme(saved)
+    const current = getStoredMode()
+    applyTheme(current)

    const mq = window.matchMedia('(prefers-color-scheme: dark)')
    const onChange = () => {
-      const current = (localStorage.getItem('theme') as Mode) || 'system'
-      if (current === 'system') applyTheme('system')
+      if (getStoredMode() === 'system') applyTheme('system')
    }


useState(getStoredMode) initializes mode during SSR as 'system', and the useEffect now applies the stored theme but never calls setMode(current). This can leave the toggle UI showing the wrong active button until the user clicks (theme applied != state). Update the effect to also sync state (and consider updating state on matchMedia change when mode is system).

@copilot apply changes based on this feedback @copilot

Copilot · 2026-04-15T15:05:14Z

+    "next": "^16.2.3",
+    "react": "^19.2.4",
+    "react-dom": "^19.2.4",
+    "react-icons": "^5.6.0"
  },
  "devDependencies": {
-    "@types/node": "^20.11.30",
-    "@types/react": "^18.2.79",
-    "eslint": "^8.57.0",
-    "eslint-config-next": "^16.0.6",
-    "typescript": "^5.4.5",
-    "@mdx-js/loader": "^3.0.1",
-    "@next/mdx": "^14.2.5",
-    "@mdx-js/react": "^3.0.1"
+    "@mdx-js/loader": "^3.1.1",
+    "@mdx-js/react": "^3.1.1",
+    "@next/mdx": "^16.2.3",
+    "@types/node": "^25.5.2",
+    "@types/react": "^19.2.14",
+    "eslint": "^10.2.0",
+    "eslint-config-next": "^16.2.3",
+    "typescript": "^6.0.2"


These dependency bumps (Next 16 / ESLint 10 / TS 6) also raise the minimum supported Node.js version (e.g. next@16.2.3 requires Node >=20.9 and eslint@10.2.0 requires Node ^20.19 || ^22.13 || >=24 per the lockfile). Please declare/enforce the required Node version for the docs site (e.g. via engines in package.json and/or an .nvmrc), otherwise installs/lint/build can break on existing environments/CI.

@copilot apply changes based on this feedback

Copilot · 2026-04-15T16:07:21Z

@aeiwz I'm unable to start working on this because of repository rules that prevent me from pushing to the branch:

Changes must be made through a pull request due to repository rules
Code scanning results must be provided due to repository rules

See the documentation for more details.

Copilot · 2026-04-15T16:07:33Z

@aeiwz I'm unable to start working on this because of repository rules that prevent me from pushing to the branch:

Changes must be made through a pull request due to repository rules
Code scanning results must be provided due to repository rules

See the documentation for more details.

aeiwz added 2 commits April 8, 2026 13:13

Harden annotation exports and upgrade docs dependencies

84c3352

Upgrade Next.js packages to 16.2.3 for security fix

b3a6b46

Copilot AI review requested due to automatic review settings April 15, 2026 14:42

Copilot started reviewing on behalf of aeiwz April 15, 2026 14:42 View session

Copilot AI reviewed Apr 15, 2026

View reviewed changes

Comment thread metbit/annotate_peak.py Outdated

Update metbit/annotate_peak.py

aa950ca

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings April 15, 2026 15:01

vercel Bot had a problem deploying to Preview April 15, 2026 15:01 Failure

Copilot AI reviewed Apr 15, 2026

View reviewed changes

aeiwz closed this Apr 16, 2026

Navigation Menu

Codex/refactor code quality - #9

Codex/refactor code quality#9
aeiwz wants to merge 3 commits into
mainfrom
codex/refactor-code-quality

aeiwz commented Apr 15, 2026

Uh oh!

vercel Bot commented Apr 15, 2026 •

edited

Loading

Uh oh!

aeiwz commented Apr 15, 2026

Uh oh!

Copilot AI commented Apr 15, 2026

Uh oh!

aeiwz commented Apr 15, 2026

Uh oh!

Copilot AI commented Apr 15, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 15, 2026

Uh oh!

aeiwz Apr 15, 2026

Uh oh!

Copilot AI Apr 15, 2026

Uh oh!

aeiwz Apr 15, 2026

Uh oh!

Copilot AI commented Apr 15, 2026

Uh oh!

Copilot AI commented Apr 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

aeiwz commented Apr 15, 2026

Uh oh!

vercel Bot commented Apr 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

aeiwz commented Apr 15, 2026

Uh oh!

Copilot AI commented Apr 15, 2026

Uh oh!

aeiwz commented Apr 15, 2026

Uh oh!

Copilot AI commented Apr 15, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

aeiwz Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

aeiwz Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Apr 15, 2026

Uh oh!

Copilot AI commented Apr 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

vercel Bot commented Apr 15, 2026 •

edited

Loading