feat: replace homepage frameworks with fun rotating "n p m x" picks#1616
feat: replace homepage frameworks with fun rotating "n p m x" picks#1616
Conversation
Show 4 randomly-selected packages whose names contain the letters n, p, m, X, with the matching
letter highlighted in bold + accent colour (one distinct colour per letter when no user accent is
set).
Selection algorithm:
1. Fetch top 500 popular packages from the Algolia search index (empty query, default popularity
ranking). Algolia doesn't support filtering by name substring (and doesn't know about our social
likes), so we filter these results down after the fact (not deprecated, >=10k downloads/30d,
modified <2yrs).
2. For each letter (n, p, m, x)
1. Take 30 random candidates whose name contains that letter and check their social like count.
2. If there are candidates with >=5 community likes, keep only those; otherwise, keep all.
3. Randomly pick one remaining candidate.
4. If there are no remaining candidates, pick the hardcoded default for this letter (nuxt, pnpm,
module-replacements, oxfmt).
Results are cached for 1 hour via with SWR, so all users see the same picks for about an hour, and
no user ever experiences a cache miss (and Algolia/constellation slowness).
|
The latest updates on your projects. Learn more about Vercel for GitHub.
2 Skipped Deployments
|
serhalp
changed the title
serhalp
changed the title
Lunaria Status Overview🌕 This pull request will trigger status changes. Learn moreBy default, every PR changing files present in the Lunaria configuration's You can change this by adding one of the keywords present in the Tracked Files
Warnings reference
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| } | ||
|
|
||
| // Algolia npm-search API - return mock popular packages | ||
| if (host.endsWith('-dsn.algolia.net') && pathname.endsWith('/query')) { |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 20 hours ago
General fix: when matching a host, don’t rely on arbitrary suffix checks that permit uncontrolled subdomains. Instead, either (a) match against an explicit allowlist of exact hostnames, or (b) if you must use suffix logic, ensure the parent domain is exactly the expected one (e.g., *.algolia.net where the registrable domain is validated).
Best fix here without changing intended functionality: replace host.endsWith('-dsn.algolia.net') with an explicit whitelist of Algolia DSN hosts actually used by the app/tests. If you can’t rely on that knowledge here, a safe compromise is to accept only hosts whose registrable domain is algolia.net and whose immediate label before that ends with -dsn (or matches expected patterns). Staying minimal and not assuming extra project context, the clearest improvement that addresses CodeQL’s complaint is to require that the host is either exactly algolia.net (for safety) or has algolia.net as its parent domain:
- Split
hoston.. - Ensure the last two labels are exactly
['algolia', 'net']. - Optionally, ensure there is at least one label before that and that it ends with
-dsn. - Keep the rest of the logic intact.
Within modules/runtime/server/cache.ts, around line 244, we’ll compute const hostParts = host.split('.'), check that hostParts.length >= 3, verify hostParts.slice(-2).join('.') === 'algolia.net', and check that the immediate subdomain ends with -dsn. Then we use this boolean instead of the broad host.endsWith('-dsn.algolia.net') condition. No new imports are needed; all functionality can be implemented with built-in string methods.
| @@ -241,7 +241,13 @@ | ||
| } | ||
|
|
||
| // Algolia npm-search API - return mock popular packages | ||
| if (host.endsWith('-dsn.algolia.net') && pathname.endsWith('/query')) { | ||
| const algoliaHostParts = host.split('.') | ||
| const isAlgoliaDsnHost = | ||
| algoliaHostParts.length >= 3 && | ||
| algoliaHostParts.slice(-2).join('.') === 'algolia.net' && | ||
| algoliaHostParts[algoliaHostParts.length - 3].endsWith('-dsn') | ||
|
|
||
| if (isAlgoliaDsnHost && pathname.endsWith('/query')) { | ||
| return { | ||
| data: { | ||
| hits: [ |
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
|
Since 4 packages are displayed, I think the original width of the wrapper could be restored (#1591 reduced max-w to wrap the long list) |
2 participants
🔗 Linked issue
😶 discussed on Discord
🧭 Context
📚 Description
Show 4 randomly-selected packages whose names contain the letters n, p, m, x, with the matching letter highlighted in bold + accent colour (one distinct colour per letter when no user accent is set).
Selection algorithm:
Results are cached for 1 hour via with SWR, so all users see the same picks for about an hour, and no user ever experiences a cache miss (and Algolia/constellation slowness).