sync

[iotinJ09]

Note

Refactors core into modular utilities and updates cards/APIs with new caching controls and options (number precision, year-filtered commits, bytes stats), alongside major docs, tests, and dependency updates.

• Core/Architecture:
  • Extracts and replaces common/utils with modular packages: color, render, ops, fmt, html, http, cache, envs, access, error, log, retryer.
  • Renames card modules: repo-card→repo, stats-card→stats, top-languages-card→top-languages, wakatime-card→wakatime, gist-card→gist.
• Features:
  • Stats card: adds number_precision, commits_year, improved rank label/apostrophe handling.
  • Top languages: adds stats_format (percentages|bytes), layout text updates.
  • WakaTime card: supports card_width, refined compact layout, percent/time display toggle.
  • Locales expanded and labels corrected across cards.
• Caching/Config:
  • Introduces CACHE_TTL, setCacheHeaders, setErrorCacheHeaders, resolveCacheSeconds; supports CACHE_SECONDS=0 to disable cache.
  • Adds env controls: WHITELIST, GIST_WHITELIST, EXCLUDE_REPO; access guarding via guardAccess.
• Docs:
  • Major README overhaul: new ToC, options (incl. new card options), locales list, deploy/token guidance, env vars section, notices and examples; theme docs wording fixes.
• Tests/Bench:
  • Updates tests/snapshots to new APIs and behaviors; replaces jest-bench with custom runAndLogStats.
• Dependencies:
  • Bumps multiple deps (ESLint, Jest 30, Testing Library, axios, dotenv, emoji-name-map), adds Express; sets Node engine to >=22.

^{Written by Cursor Bugbot for commit 45973cf. This will update automatically on new commits. Configure here.}

[vercel]

@fizahmad is attempting to deploy a commit to the iotinj09's projects Team on Vercel.

A member of the Team first needs to authorize it.

[cursor]

This PR is being reviewed by Cursor Bugbot

Details

Your team is on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle for each member of your team.

To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

[cursor]

Bug: Incorrect gh CLI command syntax with duplicate -q flags

The gh pr list command has incorrect syntax with -q is:open being misused. The -q flag is for jq expressions, not for query filters. The command uses -q twice: once incorrectly as -q is:open and once correctly as -q ".[].number". This causes the command to fail or behave unexpectedly since is:open is not a valid jq expression. The --state open flag or --search "is:open" would be the correct approach to filter open PRs (though open is already the default).

 

[cursor]

Bug: Privileged container runs as root creates security risk

The devcontainer configuration runs with "remoteUser": "root" and "privileged": true". Running containers as root with privileged mode grants full host capabilities, defeating container isolation. This could allow container escape and host compromise if the container is compromised. While acceptable for some local development scenarios, this configuration poses unnecessary security risks, especially if the devcontainer processes untrusted content.