feat: add socket.dev security report link to package page#128
feat: add socket.dev security report link to package page#128
Conversation
Adds a 'Socket Security Report' link in the sidebar under resource info, linking to https://socket.dev/npm/package/{packageName}. Closes cnpm/cnpmcore#182
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request enhances the package detail page by integrating a direct link to Socket.dev security reports. This addition provides users with quick access to security information for packages, improving transparency and awareness regarding potential vulnerabilities. The changes involve updating a shared UI component to display the link and modifying the package detail page to supply the necessary package name. Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
|
Warning Rate limit exceeded
⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughAdds optional Changes
Sequence Diagram(s)(omitted) Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds a link to the Socket.dev security report on the package details page. The changes are well-implemented, introducing a packageName prop to the LinkContent component to construct the URL and passing the package name from the Home component. I have one suggestion to improve maintainability by extracting a hardcoded URL into a constant.
There was a problem hiding this comment.
Pull request overview
Adds a Socket.dev security report link to the package detail page sidebar (“资源信息”), using the package name to build the report URL.
Changes:
- Pass
manifest.namefrom the Home slug intoLinkContentaspackageName - Extend
LinkContentto construct a Socket.dev URL and render it with aSafetyCertificateFilledicon
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| src/slugs/home/index.tsx | Passes manifest.name into the sidebar link block so a Socket.dev URL can be generated. |
| src/components/LinkContnet.tsx | Adds packageName prop and renders an external Socket.dev “security report” link in the resource list. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Deploying cnpmweb with
|
| Latest commit: |
2cb979a
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://9affa12a.cnpmweb.pages.dev |
| Branch Preview URL: | https://feat-socket-dev-link.cnpmweb.pages.dev |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/components/LinkContnet.tsx`:
- Line 39: The socketUrl construction incorrectly uses full encoding; update the
logic that builds socketUrl (using the packageName variable and the socketUrl
constant) to only encode the leading '@' for scoped packages while leaving the
'/' separator unencoded — e.g., if packageName starts with '@' replace that
leading '@' with '%40' (or otherwise specifically percent-encode only '@') and
then interpolate the resulting safePackageName into
`https://socket.dev/npm/package/${safePackageName}`, leaving non-scoped names
unchanged.
- Show actual badge image from socket.dev API so security status is visible - Click badge to navigate to socket.dev security report - Encode packageName for scoped packages (@scope/name) - Add rel=noopener noreferrer for external link - Remove unused SafetyCertificateFilled import
- Badge and link now point to version-specific page: /overview/{version}
- e.g., socket.dev/npm/package/egg/overview/3.34.0
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/components/LinkContnet.tsx`:
- Around line 112-120: The Socket.dev badge URL currently appends a version
fragment when packageVersion is present which is unsupported; update the JSX
that builds the badge src (where socketUrl, encodedName and packageVersion are
used inside the <Link> / <img> block) to remove the version segment so the src
is always "https://socket.dev/api/badge/npm/package/{encodedName}" (do not
include /{encodeURIComponent(packageVersion)}), leaving socketUrl, encodedName
and the <img> rendering logic intact.
ℹ️ Review info
Configuration used: defaults
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (2)
src/components/LinkContnet.tsxsrc/slugs/home/index.tsx
🚧 Files skipped from review as they are similar to previous changes (1)
- src/slugs/home/index.tsx
- Add Tooltip for badge consistency with other sidebar items - Extract socket.dev URL bases into constants (no magic strings) - Remove version from badge API URL (undocumented), keep in link URL (verified working) - Rename LinkContnet.tsx → LinkContent.tsx (fix typo) - Update import path in home/index.tsx
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (2)
src/components/LinkContent.tsx:121
- The Socket.dev badge
srccurrently appends/${packageVersion}when a version is provided, but the PR description documents the badge API ashttps://socket.dev/api/badge/npm/package/{name}(no version segment). If the badge endpoint isn’t versioned, this will 404 for versioned pages—please either drop the version suffix for the badge image or update the documented URL format after confirming the versioned badge URL works.
src/components/LinkContent.tsx:124 - Only the new Socket.dev external link includes
rel="noopener noreferrer", but the other external links in this component (homepage/source/tarball) still open in a new tab withtarget="_blank"withoutrel, which leaves reverse-tabnabbing risk. Consider adding the samerelattributes to alltarget="_blank"links here for consistent security.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Summary
Adds a Socket.dev security badge to the package detail page sidebar, under the "资源信息" (Resource Info) section.
The badge image is loaded from Socket.dev's badge API, showing the security status at a glance. Clicking the badge navigates to the version-specific Socket.dev security report.
Changes
LinkContentcomponent: addedpackageNameandpackageVersionprops, renders Socket.dev badge image with TooltipHomeslug: passesmanifest.nameandversiontoLinkContentLinkContnet.tsx→LinkContent.tsx(typo fix)encodeURIComponentfor scoped package namesrel="noopener noreferrer"for securityURL Format
https://socket.dev/api/badge/npm/package/{name}https://socket.dev/npm/package/{name}/overview/{version}References