Skip to content

feat(email): shared live cross-promo block + newsletter welcome - #80

Merged
ralyodio merged 1 commit into
mainfrom
feat/cross-promo-package
Nov 11, 2026
Merged

ralyodio merged 1 commit into
mainfrom
feat/cross-promo-package

Conversation

@ralyodio

Copy link
Copy Markdown
Collaborator
  • _shared/networkPromo.ts now wraps npm:@profullstack/cross-promo (audience makers, dark theme): live catalog from jsDelivr with bundled fallback; SaaSRow never promotes itself; per-recipient rotation after built.indie + pwamart.
  • Submission (send-management-link) and approval emails switched to it; newsletter welcome now carries it too (was the only one without).
  • Vitest aliases the npm: specifier and pins CROSS_PROMO=bundled.

Tests: functions 50/50. Full suite 298 pass; the 21 failures are __tests__/api/* needing live Supabase env (same on main without .env). Probe function confirmed the import works inside supabase/edge-runtime v1.76.2 on dev2.

Functions deploy by docker cp after merge (deploy-dev2.yml ships only the Next app).

🤖 Generated with Claude Code

…og), add it to the newsletter welcome

networkPromo.ts now renders the shared Profullstack catalog (jsDelivr @latest, bundled
fallback) instead of a hardcoded list, so new properties appear without a redeploy;
SaaSRow never promotes itself. Submission, approval and newsletter welcome emails use it.
Verified loading inside supabase/edge-runtime v1.76.2 on dev2.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Added@​profullstack/​cross-promo@​0.1.0751008990100

View full report

@ralyodio
ralyodio merged commit a0932c2 into main Nov 11, 2026
8 checks passed
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

15 finding(s)

HIGH/CRITICAL: 2 | MEDIUM: 11 | LOW: 2

Severity Rule Location
HIGH js-ssrf-outbound-request public/sw.js:21
HIGH js-ssrf-outbound-request src/lib/edgeProxy.ts:69
MEDIUM js-unescaped-html-sink src/components/JsonLd.tsx:13
MEDIUM redos-nested-quantifier src/lib/emailMarkdown.ts:43
MEDIUM redos-nested-quantifier src/lib/emailMarkdown.ts:302
MEDIUM js-unescaped-html-sink src/views/Admin.tsx:1811
MEDIUM js-unescaped-html-sink src/views/BlogPost.tsx:168
MEDIUM js-unescaped-html-sink src/views/EmailBroadcast.tsx:429
MEDIUM js-open-redirect src/views/Featured.tsx:279
MEDIUM js-unescaped-html-sink src/views/NewsPost.tsx:137
MEDIUM js-open-redirect src/views/SoftwareDetail.tsx:160
MEDIUM redos-nested-quantifier supabase/functions/_shared/emailMarkdown.ts:43
MEDIUM redos-nested-quantifier supabase/functions/_shared/emailMarkdown.ts:302
LOW secret-generic-credential __tests__/lib/webhooks/supabaseStore.test.ts:11
LOW secret-generic-credential cli/test/cli.test.mjs:309

Snippets are redacted; ThreatCrush never prints matched credential material.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant