Release (#473)

[Shramkoweb]

• Fix/sentry (Fix/sentry #469)

• fix: handle unhandled fetch rejections on view counter calls and filter Google Translate proxy errors in Sentry

• fix: harden CSP and security headers

• Replace connect-src wildcard with explicit allowlist to prevent data exfiltration
• Remove unsafe-eval from production script-src (keep for dev HMR only)
• Add missing directives: object-src, base-uri, form-action, frame-ancestors, upgrade-insecure-requests
• Add google-analytics.com to script-src and img-src for GTM chain-loading and tracking pixels
• Drop data: from worker-src to prevent code execution bypass
• Set X-XSS-Protection to 0 per OWASP recommendation
• Upgrade Referrer-Policy to strict-origin-when-cross-origin
• Add Permissions-Policy header to disable unused browser APIs

• fix: move commitlint from pre-commit to commit-msg hook

The hook was in pre-commit where the commit message doesn't exist yet, causing commitlint to validate previous commits instead of the current one. Also fix argument from $2 to $1 as commit-msg receives the message file path as the first argument.

• fix: restore unsafe-eval in CSP for production runtime

A bundled dependency uses new Function() during useMemo in blog post rendering, causing EvalError on Vercel preview deployments.

• chore: bump prisma, sentry, and pnpm versions

• chore: regenerate sitemap

• fix: remove deprecated Sentry build options for v10 + Turbopack (fix: remove deprecated Sentry build options for v10 + Turbopack #471)

• chore: approve pnpm 10 build scripts for native dependencies (chore: approve pnpm 10 build scripts for native dependencies #472)

Summary by CodeRabbit

• New Features

  • New blog category pages for Advanced React, AI, and specialized topics now available.
  • New code snippet utilities added including clipboard, local storage, throttling, and media query helpers.

• Bug Fixes

  • Improved error handling for analytics tracking across multiple pages.

• Security

  • Enhanced content security policies and strengthened security headers.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
portfolio	Ready	Preview	Mar 29, 2026 1:44am

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 67223856-0623-42b9-be4f-2197f0a6333e

📥 Commits

Reviewing files that changed from the base of the PR and between 50bc049 and c0f4e18.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (9)

• .git-hooks/commit-msg
• .git-hooks/pre-commit
• instrumentation-client.ts
• next.config.js
• package.json
• pages/quizlet-list/index.tsx
• pages/snippets/[slug].tsx
• pages/udemy-reset-progress.tsx
• public/sitemap.xml

---

📝 Walkthrough

Walkthrough

This PR updates git hooks configuration to enforce commitlint via commit-msg instead of pre-commit, strengthens Next.js security policies (CSP headers and Sentry denials), bumps dependency versions (Prisma, Sentry, pnpm), adds error handling to view-tracking fetch calls, and regenerates the sitemap with updated timestamps and new URL entries.

Changes

Cohort / File(s)	Summary
Git Hooks Configuration .git-hooks/commit-msg, .git-hooks/pre-commit	Relocated commitlint validation from pre-commit hook to a newly created commit-msg hook; pre-commit hook entirely removed.
Sentry & Security Configuration instrumentation-client.ts, next.config.js	Added /translate\.goog/i to Sentry denyUrls; overhauled CSP directives (restricted img-src, narrowed connect-src, removed data: from worker-src, added object-src/base-uri/form-action/frame-ancestors/upgrade-insecure-requests); updated security headers (Referrer-Policy, X-XSS-Protection, new Permissions-Policy); simplified Sentry build options.
Dependency Updates package.json	Bumped pnpm from 10.32.1 to 10.33.0; upgraded Prisma packages (@prisma/adapter-pg, @prisma/client, prisma) from 7.5.0 to 7.6.0; bumped @sentry/nextjs from 10.45.0 to 10.46.0; added pnpm.onlyBuiltDependencies configuration.
View Tracking Error Handling pages/quizlet-list/index.tsx, pages/snippets/[slug].tsx, pages/udemy-reset-progress.tsx	Added .catch(() => {}) to fetch calls for view-registration endpoints to prevent unhandled promise rejections.
Sitemap Regeneration public/sitemap.xml	Updated all <lastmod> timestamps to 2026-03-28T17:40:06; added new URL entries for blog categories and snippets (e.g., blog/category/advanced-react, snippets/copy-to-clipboard).

Possibly Related PRs

• Fix/sentry #469: Makes identical code-level changes across the same files (git hooks, Sentry config, CSP headers, fetch error handling, package.json updates).
• Fix/perf #451: Refactors view registration POST behavior to fire-and-forget and updates SWR usage, addressing similar view-tracking concerns as the fetch error handling in this PR.
• fix: sentry fetch error #412: Modifies Sentry denyUrls configuration and adds .catch() error handling to view-registration fetch calls, overlapping with security and error-handling changes here.

Estimated Code Review Effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 A rabbit hops through config land,
Linting commits with steady hand,
CSP walls stand proud and tall,
Error catches break the fall,
Fresh dependencies, sitemaps new—spring arrives after all! 🌱

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch main

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}