@mastra/github-signals 0.1.4-alpha.0 → 0.2.0-alpha.0

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # @mastra/github-signals
 
+## 0.2.0-alpha.0
+
+### Minor Changes
+
+- Random bump ([#18178](https://github.com/mastra-ai/mastra/pull/18178))
+
+### Patch Changes
+
+- Updated dependencies [[`7c0d868`](https://github.com/mastra-ai/mastra/commit/7c0d868d97d0fdbc04c14d0166dbf44d4c5a4a62), [`d9d2273`](https://github.com/mastra-ai/mastra/commit/d9d2273c702690c9a26eab2aebea879701d4355a), [`b04369d`](https://github.com/mastra-ai/mastra/commit/b04369d6b167c698ef103981171a8bf92808e756), [`8f3c262`](https://github.com/mastra-ai/mastra/commit/8f3c262587b335588a02d96b17fd6aca34c885b3)]:
+  - @mastra/core@1.45.0-alpha.0
+
+## 0.1.4
+
+### Patch Changes
+
+- Security remediation for the 2026-06-17 "easy-day-js" supply-chain incident. Patch bump to publish clean versions and move the `latest` dist-tag forward, superseding the compromised versions that declared the malicious `easy-day-js` dependency. ([#18056](https://github.com/mastra-ai/mastra/pull/18056))
+
+- Sanitize PR comment bodies at ingestion by stripping all XML/HTML-like markup — HTML comments (including the large base64 machine-state blobs review bots like CodeRabbit hide inside them), `<details>` sections (delimiters and their collapsed inner content), and any leftover partial markup — and stop persisting the full comment body in notification metadata (the truncated excerpt is retained). Markdown code spans and fenced code blocks are preserved, so human-authored code examples such as `` `<Component>` `` or fenced JSX survive sanitization. This prevents oversized bot payloads from bloating notifications and overflowing agent context windows. The sanitizer uses `indexOf`-based block scanning with no backtracking regex to avoid catastrophic backtracking (ReDoS) on adversarial input. ([#18094](https://github.com/mastra-ai/mastra/pull/18094))
+
+- Updated dependencies [[`339c57c`](https://github.com/mastra-ai/mastra/commit/339c57c5b2c6dbe75a125e138228e0556528976f), [`1dd4117`](https://github.com/mastra-ai/mastra/commit/1dd4117dcbd8e031ede9f0489436bfbc6f0315b8), [`2b11d1f`](https://github.com/mastra-ai/mastra/commit/2b11d1f6ac7024c5dd2b2dd12a48a956ac9d63bd), [`77a2351`](https://github.com/mastra-ai/mastra/commit/77a2351ee79296e360bce822cb3391f7cfd6489d), [`b7dff0a`](https://github.com/mastra-ai/mastra/commit/b7dff0a3d1022eb6868f48dc40a2b1febd5c277f), [`02087e1`](https://github.com/mastra-ai/mastra/commit/02087e1fbc54aa07f3071f7a200df1bf5be601a8), [`49af8df`](https://github.com/mastra-ai/mastra/commit/49af8df589c4ff71a5015a4553b377b32704b691), [`30ce559`](https://github.com/mastra-ai/mastra/commit/30ce55902ecf819b8ab8697398dd68b108228063), [`c241b92`](https://github.com/mastra-ai/mastra/commit/c241b929dc8c8d6a7b7219c99ed13ac1f3124a77), [`7d6ff70`](https://github.com/mastra-ai/mastra/commit/7d6ff708727297a0526ca0e26e93eeb5bbaaa187), [`ab975d4`](https://github.com/mastra-ai/mastra/commit/ab975d4dd9488752f05bda7afa03166d207e3e2a), [`9d6aa1b`](https://github.com/mastra-ai/mastra/commit/9d6aa1bae407e2afa6a089abc2a6accbbcb287b8)]:
+  - @mastra/core@1.44.0
+
+## 0.1.4-alpha.1
+
+### Patch Changes
+
+- Sanitize PR comment bodies at ingestion by stripping all XML/HTML-like markup — HTML comments (including the large base64 machine-state blobs review bots like CodeRabbit hide inside them), `<details>` sections (delimiters and their collapsed inner content), and any leftover partial markup — and stop persisting the full comment body in notification metadata (the truncated excerpt is retained). Markdown code spans and fenced code blocks are preserved, so human-authored code examples such as `` `<Component>` `` or fenced JSX survive sanitization. This prevents oversized bot payloads from bloating notifications and overflowing agent context windows. The sanitizer uses `indexOf`-based block scanning with no backtracking regex to avoid catastrophic backtracking (ReDoS) on adversarial input. ([#18094](https://github.com/mastra-ai/mastra/pull/18094))
+
+- Updated dependencies [[`b7dff0a`](https://github.com/mastra-ai/mastra/commit/b7dff0a3d1022eb6868f48dc40a2b1febd5c277f), [`02087e1`](https://github.com/mastra-ai/mastra/commit/02087e1fbc54aa07f3071f7a200df1bf5be601a8), [`ab975d4`](https://github.com/mastra-ai/mastra/commit/ab975d4dd9488752f05bda7afa03166d207e3e2a)]:
+  - @mastra/core@1.44.0-alpha.1
+
 ## 0.1.4-alpha.0
 
 ### Patch Changes

package/dist/index.cjs

@@ -150,8 +150,53 @@ function getPrLabel(subscription, snapshot) {
 function getMergedNotificationSummary(label) {
   return `${label} was merged. This thread has been automatically unsubscribed from this PR. Resubscribe if you still need updates.`;
 }
+function stripBlocks(text, open, close) {
+  const haystack = text.toLowerCase();
+  const openLower = open.toLowerCase();
+  const closeLower = close.toLowerCase();
+  let result = "";
+  let cursor = 0;
+  for (; ; ) {
+    const start = haystack.indexOf(openLower, cursor);
+    if (start === -1) {
+      result += text.slice(cursor);
+      return result;
+    }
+    result += text.slice(cursor, start);
+    const end = haystack.indexOf(closeLower, start + openLower.length);
+    if (end === -1) return result;
+    cursor = end + closeLower.length;
+  }
+}
+var CODE_TOKEN_PREFIX = "\0CODE";
+var CODE_TOKEN_SUFFIX = "\0";
+function preserveMarkdownCode(text) {
+  const preserved = [];
+  const stash = (match) => {
+    const token = `${CODE_TOKEN_PREFIX}${preserved.length}${CODE_TOKEN_SUFFIX}`;
+    preserved.push(match);
+    return token;
+  };
+  const protectedText = text.replace(/```[\s\S]*?```/g, stash).replace(/(`{2,})(?!`)[\s\S]*?[^`]\1(?!`)/g, stash).replace(/`[^`\n]*`/g, stash);
+  return {
+    text: protectedText,
+    restore: (sanitized) => sanitized.replace(/\u0000CODE(\d+)\u0000/g, (_, index) => preserved[Number(index)] ?? "")
+  };
+}
+function sanitizeCommentText(body) {
+  const { text: protectedBody, restore } = preserveMarkdownCode(body);
+  let text = stripBlocks(protectedBody, "<!--", "-->");
+  text = stripBlocks(text, "<details", "</details>");
+  const stripped = text.replace(/<\/?[a-zA-Z][^<>]*>/g, "").replace(/<[!/a-zA-Z][\s\S]*$/g, "").replace(/</g, "").replace(/\n{3,}/g, "\n\n").trim();
+  return restore(stripped);
+}
+function sanitizeCommentBody(body) {
+  if (body === void 0) return void 0;
+  const sanitized = sanitizeCommentText(body);
+  return sanitized.length > 0 ? sanitized : void 0;
+}
 function getCommentExcerpt(body) {
-  const excerpt = body.replace(/\s+/g, " ").trim();
+  const excerpt = sanitizeCommentText(body).replace(/\s+/g, " ").trim();
   return excerpt.length > 240 ? `${excerpt.slice(0, 237)}...` : excerpt;
 }
 function getCommentNotificationSummary(pr, snapshot) {
@@ -503,14 +548,14 @@ var GitcrawlSyncClient = class {
         latestCommentAuthor: readString(latestComment?.author_login),
         latestCommentAuthorType: readString(latestComment?.author_type),
         latestCommentIsBot: latestComment?.is_bot === 1,
-        latestCommentBody: readString(latestComment?.body),
+        latestCommentBody: sanitizeCommentBody(readString(latestComment?.body)),
         latestCommentUrl: readString(latestComment?.html_url),
         latestCommentUpdatedAt: readString(latestComment?.updated_at),
         latestComments: latestComments.map((comment) => ({
           author: readString(comment.author_login),
           authorType: readString(comment.author_type),
           isBot: comment.is_bot === 1,
-          body: readString(comment.body),
+          body: sanitizeCommentBody(readString(comment.body)),
           url: readString(comment.html_url),
           updatedAt: readString(comment.updated_at)
         }))
@@ -1012,7 +1057,9 @@ var GithubSignals = class extends signals.SignalProvider {
           latestCommentAuthor: input.snapshot.latestCommentAuthor,
           latestCommentAuthorType: input.snapshot.latestCommentAuthorType,
           latestCommentIsBot: input.snapshot.latestCommentIsBot,
-          latestCommentBody: input.snapshot.latestCommentBody,
+          // Intentionally omit the full latestCommentBody here: persisting it verbatim bloats
+          // notification payloads (a single CodeRabbit comment can exceed 100KB) and can overflow
+          // agent context windows when listed. The 240-char latestCommentExcerpt is stored instead.
           latestCommentExcerpt,
           latestCommentUrl: input.snapshot.latestCommentUrl,
           latestCommentUpdatedAt: input.snapshot.latestCommentUpdatedAt,
@@ -1334,5 +1381,6 @@ exports.GitRemoteRepositoryResolver = GitRemoteRepositoryResolver;
 exports.GitcrawlSyncClient = GitcrawlSyncClient;
 exports.GithubSignals = GithubSignals;
 exports.normalizeGithubChecksForSnapshot = normalizeGithubChecksForSnapshot;
+exports.sanitizeCommentText = sanitizeCommentText;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map