chore(web): pin @profullstack/autoblog to npm 0.5.0 by ralyodio · Pull Request #182 · profullstack/pairux.com

ralyodio · 2026-11-07T10:38:54Z

What

apps/web: @profullstack/autoblog moves from github:profullstack/autoblog#75e54af (0.4.0) to the published npm 0.5.0, exact pin.
Lockfile: only the autoblog entry changes, plus its new dependency @profullstack/ai-providers@0.1.0. No unrelated drift.

Why

0.5.0 routes the gatePost quality score through c0mpute first (via @profullstack/ai-providers, reading C0MPUTE_API_KEY from the env at runtime). The Anthropic key the webhook passes is now only the paid fallback.

API check

verifyAndParse({ headers, body, opts: { secret } }): unchanged.
gatePost(post, { allowedNiches, heuristics, minQualityScore?, anthropicApiKey? }): unchanged; anthropicApiKey is now optional.
buildRssXml from /feeds: unchanged.

So app/api/webhooks/autoblog/route.ts needs no code change.

Tests

pnpm typecheck (apps/web): clean.
pnpm test (apps/web): 117 files, 1194 tests pass.
Local smoke against the installed 0.5.0: signed event verifies, wrong secret gets 401, heuristic gate passes a 700-word post.

🤖 Generated with Claude Code

Replaces the github:profullstack/autoblog#75e54af pin with the published 0.5.0 release. Quality scoring in gatePost now routes through c0mpute first via @profullstack/ai-providers, with the Anthropic key only as a paid fallback. The verifyAndParse and gatePost signatures are unchanged, so the webhook call needs no change. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

socket-security · 2026-11-07T10:39:19Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@profullstack/autoblog@0.5.0

View full report

socket-security · 2026-11-07T10:39:20Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert (click "▶" to expand/collapse)	Action
	Publisher changed: npm `@profullstack/autoblog` is now published by moshcoder Author: moshcoder From: apps/web/package.json → `npm/@profullstack/autoblog@0.5.0` ℹ Read more on: This package \| This alert \| What is unstable ownership? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@profullstack/autoblog@0.5.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Low adoption: npm `@profullstack/autoblog` Location: Package overview From: apps/web/package.json → `npm/@profullstack/autoblog@0.5.0` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@profullstack/autoblog@0.5.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

github-actions · 2026-11-07T10:39:26Z

ThreatCrush Security Scan

50 finding(s)

HIGH/CRITICAL: 4 | MEDIUM: 24 | LOW: 22

Severity	Rule	Location
HIGH	`sh-eval-expansion`	`.githooks/pre-commit`:33
HIGH	`js-electron-node-integration`	`apps/desktop/src/main/window.ts`:49
HIGH	`sh-unquoted-expansion-destructive`	`apps/installer/scripts/install.sh`:717
HIGH	`sh-unquoted-expansion-destructive`	`apps/installer/scripts/install.sh`:948
MEDIUM	`sh-remote-script-execution`	`apps/installer/scripts/install.sh`:693
MEDIUM	`sh-remote-script-execution`	`apps/installer/scripts/install.sh`:840
MEDIUM	`sh-remote-script-execution`	`apps/installer/scripts/install.sh`:842
MEDIUM	`sh-remote-script-execution`	`apps/installer/scripts/install.sh`:1138
MEDIUM	`sh-remote-script-execution`	`apps/installer/scripts/install.sh`:1140
MEDIUM	`sh-remote-script-execution`	`apps/livekit/setup-livekit-server.sh`:93
MEDIUM	`sh-remote-script-execution`	`apps/turn/deploy-droplet.sh`:62
MEDIUM	`js-unescaped-html-sink`	`apps/web/src/app/blog/[slug]/page.tsx`:52
MEDIUM	`js-unescaped-html-sink`	`apps/web/src/app/blog/[slug]/page.tsx`:79
MEDIUM	`js-unescaped-html-sink`	`apps/web/src/app/c/[handle]/page.tsx`:199
MEDIUM	`js-open-redirect`	`apps/web/src/app/cli/authorize/consent.tsx`:68
MEDIUM	`js-unescaped-html-sink`	`apps/web/src/app/l/[joinCode]/page.tsx`:146
MEDIUM	`js-unescaped-html-sink`	`apps/web/src/app/l/[joinCode]/page.tsx`:230
MEDIUM	`js-unescaped-html-sink`	`apps/web/src/app/layout.tsx`:150
MEDIUM	`js-unescaped-html-sink`	`apps/web/src/app/live/page.tsx`:154
MEDIUM	`js-unescaped-html-sink`	`apps/web/src/app/page.tsx`:98
MEDIUM	`js-unescaped-html-sink`	`apps/web/src/app/pricing/page.tsx`:262
MEDIUM	`js-open-redirect`	`apps/web/src/app/settings/copilot/copilot-settings.tsx`:144
MEDIUM	`js-unescaped-html-sink`	`apps/web/src/app/u/[username]/page.tsx`:285
MEDIUM	`js-open-redirect`	`apps/web/src/components/billing/useCheckout.ts`:81
MEDIUM	`js-unescaped-html-sink`	`apps/web/src/components/universal-footer.tsx`:29
MEDIUM	`js-open-redirect`	`apps/web/src/hooks/useDesktopHandoff.ts`:24
MEDIUM	`redos-nested-quantifier`	`apps/web/src/lib/deliverable.ts`:11
MEDIUM	`sql-template-interpolation`	`packages/ai-core/src/prompts.ts`:36
LOW	`secret-generic-credential`	`apps/desktop/src/main/agent-cli/commands.test.ts`:138
LOW	`secret-generic-credential`	`apps/desktop/src/main/agent-cli/commands.test.ts`:139
LOW	`secret-generic-credential`	`apps/desktop/src/main/agent-cli/commands.test.ts`:340
LOW	`secret-generic-credential`	`apps/desktop/src/main/agent-cli/commands.test.ts`:341
LOW	`secret-generic-credential`	`apps/desktop/src/main/agent-cli/commands.test.ts`:371
LOW	`secret-generic-credential`	`apps/desktop/src/main/agent-cli/commands.test.ts`:372
LOW	`secret-generic-credential`	`apps/desktop/src/main/agent-cli/commands.test.ts`:383
LOW	`secret-generic-credential`	`apps/desktop/src/main/agent-cli/commands.test.ts`:397
LOW	`secret-generic-credential`	`apps/desktop/src/main/agent-cli/commands.test.ts`:398
LOW	`secret-generic-credential`	`apps/desktop/src/main/agent-cli/commands.test.ts`:405
LOW	`secret-generic-credential`	`apps/desktop/src/main/agent-cli/commands.test.ts`:415
LOW	`secret-generic-credential`	`apps/desktop/src/main/agent-cli/commands.test.ts`:416
LOW	`secret-generic-credential`	`apps/desktop/src/main/agent-cli/commands.test.ts`:453
LOW	`secret-generic-credential`	`apps/desktop/src/main/agent-cli/commands.test.ts`:454
LOW	`secret-generic-credential`	`apps/desktop/src/main/agent-cli/copilot.test.ts`:92
LOW	`secret-generic-credential`	`apps/livekit/fly.toml`:12
LOW	`secret-generic-credential`	`apps/turn/fly.toml`:11
LOW	`secret-openai-key`	`apps/web/src/lib/copilot/keys.test.ts`:62
LOW	`secret-generic-credential`	`apps/web/src/lib/youtubeAutoLive.test.ts`:90
LOW	`sh-predictable-temp-path`	`appstores/firetv/emulator-test.sh`:23
LOW	`secret-generic-credential`	`docs/API.md`:747
LOW	`secret-generic-credential`	`docs/API.md`:753

Snippets are redacted; ThreatCrush never prints matched credential material.

ralyodio merged commit 3081cf0 into master Nov 7, 2026
15 checks passed

sh1pt-actions-fleet Bot deleted the chore/autoblog-0.5.0 branch November 7, 2026 10:46

Navigation Menu

Repository navigation

chore(web): pin @profullstack/autoblog to npm 0.5.0 - #182

chore(web): pin @profullstack/autoblog to npm 0.5.0#182
ralyodio merged 1 commit into
masterfrom
chore/autoblog-0.5.0

ralyodio commented Nov 7, 2026

Uh oh!

socket-security Bot commented Nov 7, 2026

Uh oh!

socket-security Bot commented Nov 7, 2026

Uh oh!

github-actions Bot commented Nov 7, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

ralyodio commented Nov 7, 2026

What

Why

API check

Tests

Uh oh!

socket-security Bot commented Nov 7, 2026

Uh oh!

socket-security Bot commented Nov 7, 2026

Uh oh!

github-actions Bot commented Nov 7, 2026

ThreatCrush Security Scan

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant