Skip to content

feat: payload cms and monorepo#54

Open
matmanna wants to merge 37 commits into
hackclub:masterfrom
quackclub:payl
Open

feat: payload cms and monorepo#54
matmanna wants to merge 37 commits into
hackclub:masterfrom
quackclub:payl

Conversation

@matmanna

@matmanna matmanna commented May 28, 2026

Copy link
Copy Markdown
Member

summary

this pr adds a key distinction in the codebase between the content and the source code. in the next version of slacker-news, content will be published and controlled from a new admin panel - the newsroom(.hackclub.com). then, using payload's headless mode, the new-old astro frontend (news.hackclub.com) will not change its functionality much in the immediate.

demo

(hosted on nest and deployed using cloudflared)

roadmap

  1. initial version
  • turborepo monorepo
  • gitignore
  • .vscode for vscod(e|ium) DX
  • newsroom sign-in with HCA
  • article versioning
  • whitelist @/eps and @/mat (myself) as admins/editors
  • basic payload admin panel
    • handle db backups,
    • better db persistence handlint, etc.
  • dns setup
  • get docker compose working on coolify instance
  • remove? cloudflared / move it to a compose profile
  • keep old mdx article archive so every new db imports it
  • credit mahad, neven, and gideon!
  1. second stage
  • admin invitations & permission levels
  • analytics (plausible) integration
  • author & mentioned entities
  • improve formatting
  • renive seedubg stuff
  • remove mdx files from repo
  • make admin panel 10x more userfirendly
  • allow all hack clubbers to contribute
  1. future
  • sign in with HCA on apps/web
  • authgated articles in apps/cms
  • article submission+review pipeliens in newsroom

@matmanna matmanna changed the title Payl feat: payload cms and turborepo May 28, 2026
@matmanna matmanna changed the title feat: payload cms and turborepo feat: payload cms and monorep May 28, 2026
@matmanna matmanna changed the title feat: payload cms and monorep feat: payload cms and monorepo May 28, 2026
@matmanna matmanna linked an issue May 30, 2026 that may be closed by this pull request
20 tasks
@matmanna matmanna added the enhancement New feature or request label May 30, 2026
@matmanna
matmanna marked this pull request as ready for review May 31, 2026 13:46
@matmanna
matmanna marked this pull request as draft May 31, 2026 13:47
@matmanna
matmanna marked this pull request as ready for review June 6, 2026 00:57
Copilot AI review requested due to automatic review settings June 6, 2026 00:57

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR restructures Slacker News into a Turborepo monorepo with two main apps: a Payload CMS (Next.js) “newsroom” backend and an Astro-based “web” frontend that consumes CMS content headlessly, alongside new Docker/CI plumbing.

Changes:

  • Introduce Turborepo workspaces and move the Astro site into apps/web.
  • Add a new apps/cms Payload CMS (Next.js) app with auth, admin UI customizations, and testing scaffolding.
  • Add Docker Compose + CI Postgres service wiring to support CMS builds and local orchestration.

Reviewed changes

Copilot reviewed 217 out of 296 changed files in this pull request and generated 9 comments.

Show a summary per file
File Description
turbo.json Adds Turbo task pipeline for monorepo builds/dev/lint/check.
README.md Documents a Docker Compose command for rebuilding/rerunning the CMS service.
package.json Converts repo to Bun + workspaces and delegates scripts to Turbo.
Dockerfile Removes the legacy root Dockerfile (now app-specific Dockerfiles exist).
docker-compose.yml Adds local orchestration for Postgres + CMS + web + cloudflared.
.dockerignore Adds monorepo-focused Docker build ignore rules.
.gitignore Expands ignores for Payload media, Playwright artifacts, and Next.js types.
.github/workflows/build.yml Adds Postgres service + CMS env vars for CI build step.
packages/types/package.json Introduces a private internal @slacker-news/types workspace package.
packages/types/src/index.ts Placeholder for shared types entrypoint.
packages/payload-client/package.json Introduces a private internal @slacker-news/payload-client workspace package.
packages/payload-client/src/index.ts Placeholder for shared client entrypoint.
apps/web/package.json Defines the Astro web app dependencies/scripts in its own workspace.
apps/web/tsconfig.json Adds strict Astro TS config for the web app.
apps/web/Dockerfile Adds container build/runtime for the Astro server output.
apps/web/astro.config.mjs Switches Astro to server output with Node adapter + keeps redirects.
apps/web/public/robots.txt Adds robots rules (currently blocks all crawling).
apps/web/src/lib/cms.ts Adds a CMS fetch client for posts used by the Astro frontend.
apps/web/src/lib/content.ts Adds CMS→Astro content processing (excerpt/reading time/relations, etc.).
apps/web/src/lib/abacus.ts Adds Abacus view-counter URL/key helpers.
apps/web/src/layouts/PageLayout.astro Adds a reusable page layout wrapper around BaseLayout.
apps/web/src/pages/404.astro Adds a basic 404 page using BaseLayout.
apps/web/src/pages/about.astro Adds an about page that renders MDX from the pages collection.
apps/web/src/pages/submissions.astro Adds submission guidelines page rendering MDX content.
apps/web/src/pages/news.astro Adds a “News” archive page filtered by category.
apps/web/src/pages/opinion.astro Adds an “Opinion” archive page filtered by category.
apps/web/src/pages/essays.astro Adds an “Essays” archive page filtered by category.
apps/web/src/pages/changelogs.astro Adds a changelog archive page supporting short + long entries.
apps/web/src/pages/changelogs/[slug].astro Adjusts long changelog routing behavior (redirect on missing slug).
apps/web/src/pages/acknowledgements.astro Adds acknowledgements page rendering JSON acknowledgements list.
apps/web/src/pages/feed.xml.js Adds RSS feed generation (posts + long changelogs).
apps/web/src/data/site.json Adds site metadata JSON used by the web app.
apps/web/src/data/changelog.json Adds short changelog entries JSON.
apps/web/src/data/acknowledgements.json Adds acknowledgements JSON with optional Slack IDs.
apps/web/src/data/legacy-redirects.mjs Adds legacy path mapping for redirects + RSS link resolution.
apps/web/src/components/SlackMention.astro Adds Slack user mention link component.
apps/web/src/components/SlackChannel.astro Adds Slack channel link component.
apps/web/src/components/HorizontalRule.astro Adds styled horizontal rule component.
apps/web/src/components/AuthorList.astro Adds author list rendering with optional Slack IDs.
apps/web/src/components/AbacusCounter.astro Adds client-side Abacus counter “hit” behavior.
apps/web/src/content.config.ts Updates Astro content collections (removes posts collection definition).
apps/web/src/content/pages/about.mdx Adds MDX content entry for About.
apps/web/src/content/pages/submissions.mdx Adds MDX content entry for Submissions.
apps/web/src/content/posts/opinion/what-is-meta-for.mdx Adds opinion post content.
apps/web/src/content/posts/opinion/prometheus-mole.mdx Adds opinion post content.
apps/web/src/content/posts/opinion/better-goodbye.mdx Adds opinion post content.
apps/web/src/content/posts/news/welcome-to-slacker-news.mdx Adds news post content.
apps/web/src/content/posts/news/transparency-debate.mdx Adds news post content.
apps/web/src/content/posts/news/slack-survey.mdx Adds news post content.
apps/web/src/content/posts/news/slack-readme.mdx Adds news post content.
apps/web/src/content/posts/news/set-your-own-manager.mdx Adds news post content.
apps/web/src/content/posts/news/red-teams.mdx Adds news post content.
apps/web/src/content/posts/news/new-ysws-channel.mdx Adds news post content.
apps/web/src/content/posts/news/nasa-stardance.mdx Adds news post content.
apps/web/src/content/posts/news/confessions-new-owners.mdx Adds news post content.
apps/web/src/content/posts/news/community-privacy-policy.mdx Adds news post content.
apps/web/src/content/posts/changelogs/responses-and-followups.mdx Adds long changelog MDX entry.
apps/web/_posts/post template.md Adds a post frontmatter template file.
apps/cms/package.json Adds Payload CMS app package (Next.js + Payload dependencies).
apps/cms/Dockerfile Adds multi-stage container build for the CMS app.
apps/cms/tsconfig.json Adds strict TS config and path aliases for CMS.
apps/cms/next.config.ts Adds Next.js config for monorepo + Payload integration.
apps/cms/next-sitemap.config.cjs Adds sitemap/robots generation config for CMS frontend.
apps/cms/redirects.ts Adds Next.js redirects (IE incompatibility redirect).
apps/cms/playwright.config.ts Adds Playwright config for CMS e2e tests.
apps/cms/vitest.config.mts Adds Vitest config for integration tests.
apps/cms/vitest.setup.ts Adds Vitest setup (dotenv).
apps/cms/tests/int/api.int.spec.ts Adds an integration test scaffold for Payload API.
apps/cms/tests/helpers/login.ts Adds Playwright login helper for admin auth.
apps/cms/tests/helpers/seedUser.ts Adds helper to seed/cleanup a test user.
apps/cms/tests/e2e/admin.e2e.spec.ts Adds admin-panel e2e navigation coverage.
apps/cms/tests/e2e/frontend.e2e.spec.ts Adds a basic frontend page-load e2e test.
apps/cms/eslint.config.mjs Adds ESLint flat config for CMS.
apps/cms/postcss.config.js Adds PostCSS config (Tailwind 4 plugin).
apps/cms/tailwind.config.mjs Adds Tailwind config with typography customizations.
apps/cms/components.json Adds shadcn/ui config for CMS components.
apps/cms/.env.example Adds CMS env template (DB, secrets, OIDC, preview, etc.).
apps/cms/.gitignore Adds CMS-specific ignores (media, Next build, Playwright, etc.).
apps/cms/.npmrc Adds pnpm-related npm config for CMS workspace.
apps/cms/.prettierrc.json Adds Prettier config for CMS workspace.
apps/cms/.prettierignore Adds Prettier ignore rules for generated/build artifacts.
apps/cms/.editorconfig Adds EditorConfig settings for CMS workspace.
apps/cms/.vscode/settings.json Adds workspace editor settings (format/lint on save).
apps/cms/.vscode/launch.json Adds Next.js debugging launch configuration.
apps/cms/.vscode/extensions.json Recommends ESLint + Prettier extensions.
apps/cms/src/providers/Theme/index.tsx Adds theme context/provider (currently broken provider usage).
apps/cms/src/providers/HeaderTheme/index.tsx Adds header-theme context/provider (currently broken provider usage).
apps/cms/src/providers/index.tsx Adds shared Providers wrapper for CMS frontend.
apps/cms/src/providers/Theme/shared.ts Adds theme shared constants and implicit preference detection.
apps/cms/src/providers/Theme/types.ts Adds theme types + runtime validator.
apps/cms/src/providers/Theme/ThemeSelector/index.tsx Adds theme selector UI for CMS frontend.
apps/cms/src/providers/Theme/ThemeSelector/types.ts Adds theme selector constants/types.
apps/cms/src/providers/Theme/InitTheme/index.tsx Adds inline script to initialize theme before hydration.
apps/cms/src/utilities/deepMerge.ts Adds deep merge utility (currently null-handling bug).
apps/cms/src/utilities/ui.ts Adds shadcn cn() helper (clsx + tailwind-merge).
apps/cms/src/utilities/useDebounce.ts Adds debounce hook used by search UI.
apps/cms/src/heros/HighImpact/index.tsx Adds “high impact” hero component (effect dependency issue).
apps/cms/src/heros/MediumImpact/index.tsx Adds “medium impact” hero component.
apps/cms/src/heros/LowImpact/index.tsx Adds “low impact” hero component.
apps/cms/src/heros/RenderHero.tsx Adds hero renderer dispatching by hero type.
apps/cms/src/heros/config.ts Adds Payload field config for hero selection/content.
apps/cms/src/Header/config.ts Adds Payload global config for header nav.
apps/cms/src/Header/Component.tsx Adds header server component fetching cached global.
apps/cms/src/Header/Component.client.tsx Adds header client component (theme + navigation).
apps/cms/src/Header/Nav/index.tsx Adds header nav rendering + search link.
apps/cms/src/Header/RowLabel.tsx Adds custom row label for header nav array items.
apps/cms/src/Header/hooks/revalidateHeader.ts Adds revalidation hook for header global changes.
apps/cms/src/Footer/config.ts Adds Payload global config for footer nav.
apps/cms/src/Footer/Component.tsx Adds footer server component fetching cached global.
apps/cms/src/Footer/RowLabel.tsx Adds custom row label for footer nav array items.
apps/cms/src/Footer/hooks/revalidateFooter.ts Adds revalidation hook for footer global changes.
apps/cms/src/hooks/revalidateRedirects.ts Adds revalidation hook for redirects changes.
apps/cms/src/hooks/populatePublishedAt.ts Adds hook to populate publishedAt if missing.
apps/cms/src/search/Component.tsx Adds client-side search input that pushes query to router.
apps/cms/src/search/fieldOverrides.ts Adds plugin-search field overrides for searchable docs.
apps/cms/src/search/beforeSync.ts Adds beforeSync hook to populate search docs (categories/meta).
apps/cms/src/collections/Users/index.ts Adds Users collection with approval gating + OIDC fields.
apps/cms/src/collections/Users/hooks/approveFirstUser.ts Adds hook to auto-approve the first created user.
apps/cms/src/collections/Posts/hooks/revalidatePost.ts Adds ISR revalidation for posts on change/delete.
apps/cms/src/collections/Posts/hooks/populateAuthors.ts Adds authors population hook to protect user privacy.
apps/cms/src/collections/Pages/hooks/revalidatePage.ts Adds ISR revalidation for pages on change/delete.
apps/cms/src/collections/Media.ts Adds Media collection and upload/image sizing settings.
apps/cms/src/collections/Categories.ts Adds Categories collection with slug field.
apps/cms/src/components/ui/button.tsx Adds shadcn button component.
apps/cms/src/components/ui/card.tsx Adds shadcn card component.
apps/cms/src/components/ui/checkbox.tsx Adds shadcn checkbox component.
apps/cms/src/components/ui/input.tsx Adds shadcn input component.
apps/cms/src/components/ui/label.tsx Adds shadcn label component.
apps/cms/src/components/ui/textarea.tsx Adds shadcn textarea component.
apps/cms/src/components/AdminBar/index.tsx Adds Payload admin bar integration for preview/edit links.
apps/cms/src/components/AdminBar/index.scss Adds responsive CSS for admin bar display.
apps/cms/src/components/BeforeLogin/index.tsx Adds pre-login UI to enforce Hack Club OIDC-only login.
apps/cms/src/components/BeforeDashboard/index.tsx Adds “before dashboard” onboarding + seeding UI.
apps/cms/src/components/BeforeDashboard/index.scss Adds styles for dashboard onboarding component.
apps/cms/src/components/BeforeDashboard/SeedButton/index.tsx Adds DB seeding button with toast feedback.
apps/cms/src/components/BeforeDashboard/SeedButton/index.scss Adds styles for seed button.
apps/cms/src/components/CmsLogo.tsx Adds CMS logo component.
apps/cms/src/components/CmsIcon.tsx Adds CMS icon component.
apps/cms/src/components/CollectionArchive/index.tsx Adds archive grid rendering using Card component.
apps/cms/src/components/LivePreviewListener/index.tsx Adds Payload live preview listener wiring.
apps/cms/src/components/Link/index.tsx Adds CMSLink component (buttons/inline + refs/custom URLs).
apps/cms/src/components/Media/index.tsx Adds media rendering wrapper for image/video.
apps/cms/src/components/Media/types.ts Adds media component props/types.
apps/cms/src/components/Media/VideoMedia/index.tsx Adds video rendering for Payload media resources.
apps/cms/src/components/PageRange/index.tsx Adds search/page-range display component.
apps/cms/src/components/PayloadRedirects/index.tsx Adds server-side redirect handling using Payload redirects.
apps/cms/src/blocks/RenderBlocks.tsx Adds renderer mapping Payload layout blocks to components.
apps/cms/src/blocks/ArchiveBlock/config.ts Adds archive block schema for Payload pages.
apps/cms/src/blocks/ArchiveBlock/Component.tsx Adds archive block server component fetching posts.
apps/cms/src/blocks/Banner/config.ts Adds banner block schema.
apps/cms/src/blocks/Banner/Component.tsx Adds banner block rendering component.
apps/cms/src/blocks/CallToAction/config.ts Adds CTA block schema.
apps/cms/src/blocks/CallToAction/Component.tsx Adds CTA block rendering component.
apps/cms/src/blocks/Code/config.ts Adds code block schema.
apps/cms/src/blocks/Code/Component.tsx Adds code block server wrapper.
apps/cms/src/blocks/Code/Component.client.tsx Adds code block client renderer (Prism) + copy button.
apps/cms/src/blocks/Code/CopyButton.tsx Adds copy-to-clipboard UI for code blocks.
apps/cms/src/blocks/Content/config.ts Adds content block schema (columns + rich text + link).
apps/cms/src/blocks/Content/Component.tsx Adds content block rendering component.
apps/cms/src/blocks/Form/config.ts Adds form block schema (form builder integration).
apps/cms/src/blocks/Form/fields.tsx Adds field component registry for form rendering.
apps/cms/src/blocks/Form/Error/index.tsx Adds RHF error display component.
apps/cms/src/blocks/Form/Width/index.tsx Adds layout wrapper for form field widths.
apps/cms/src/blocks/Form/Text/index.tsx Adds text field renderer.
apps/cms/src/blocks/Form/Textarea/index.tsx Adds textarea field renderer.
apps/cms/src/blocks/Form/Email/index.tsx Adds email field renderer.
apps/cms/src/blocks/Form/Number/index.tsx Adds number field renderer.
apps/cms/src/blocks/Form/Select/index.tsx Adds select field renderer.
apps/cms/src/blocks/Form/State/index.tsx Adds US state selector field renderer.
apps/cms/src/blocks/Form/Country/index.tsx Adds country selector field renderer.
apps/cms/src/blocks/Form/Checkbox/index.tsx Adds checkbox field renderer.
apps/cms/src/blocks/Form/Message/index.tsx Adds message-only rich text renderer.
apps/cms/src/blocks/MediaBlock/config.ts Adds media block schema.
apps/cms/src/blocks/MediaBlock/Component.tsx Adds media block rendering component.
apps/cms/src/blocks/RelatedPosts/Component.tsx Adds related posts grid rendering block.
apps/cms/src/fields/defaultLexical.ts Adds default lexical editor config for rich text fields.
apps/cms/src/fields/linkGroup.ts Adds link group field generator using deepMerge utility.
apps/cms/src/endpoints/seed/home-static.ts Adds seed content for a non-empty homepage.
apps/cms/src/endpoints/seed/contact-page.ts Adds seed content for a contact page + form block.
apps/cms/src/endpoints/seed/image-hero-1.ts Adds seed media metadata object.
apps/cms/src/endpoints/seed/image-1.ts Adds seed media metadata object.
apps/cms/src/endpoints/seed/image-2.ts Adds seed media metadata object.
apps/cms/src/app/(payload)/layout.tsx Adds generated Payload admin root layout wiring.
apps/cms/src/app/(payload)/api/[...slug]/route.ts Adds generated Payload REST route handlers.
apps/cms/src/app/(payload)/api/graphql/route.ts Adds generated GraphQL route handler.
apps/cms/src/app/(payload)/api/graphql-playground/route.ts Adds generated GraphQL playground route handler.
apps/cms/src/app/(payload)/admin/[[...segments]]/page.tsx Adds generated Payload admin page entrypoint.
apps/cms/src/app/(payload)/admin/[[...segments]]/not-found.tsx Adds generated Payload admin not-found handler.
apps/cms/src/app/(payload)/admin/auth/hackclub/start/route.ts Adds Hack Club OIDC auth start route (sets state/nonce cookies).
apps/cms/src/app/(frontend)/layout.tsx Adds CMS “frontend” app layout (Header/Footer/AdminBar/Providers).
apps/cms/src/app/(frontend)/page.tsx Adds frontend index route delegating to [slug] template.
apps/cms/src/app/(frontend)/not-found.tsx Adds frontend not-found page.
apps/cms/src/app/(frontend)/search/page.tsx Adds CMS search page backed by Payload search collection.
apps/cms/src/app/(frontend)/search/page.client.tsx Adds client hook to set header theme for search page.
apps/cms/src/app/(frontend)/posts/page.tsx Adds posts index page listing published posts with pagination.
apps/cms/src/app/(frontend)/posts/page.client.tsx Adds client hook to set header theme for posts page.
apps/cms/src/app/(frontend)/posts/page/[pageNumber]/page.tsx Adds paginated posts route with validation + pagination controls.
apps/cms/src/app/(frontend)/posts/page/[pageNumber]/page.client.tsx Adds client hook to set header theme for paginated posts page.
apps/cms/src/app/(frontend)/posts/[slug]/page.client.tsx Adds client hook to set header theme for post detail page.
apps/cms/src/app/(frontend)/next/seed/route.ts Adds authenticated seed endpoint to populate database.
apps/cms/src/app/(frontend)/next/preview/route.ts Adds preview endpoint enforcing PREVIEW_SECRET + auth.
apps/cms/src/app/(frontend)/next/exit-preview/route.ts Adds endpoint to disable draft mode.
apps/cms/src/app/(frontend)/(sitemaps)/pages-sitemap.xml/route.ts Adds server-side sitemap route for pages.
apps/cms/src/app/(frontend)/(sitemaps)/posts-sitemap.xml/route.ts Adds server-side sitemap route for posts.
apps/cms/src/access/anyone.ts Adds open read access helper.
apps/cms/src/access/authenticated.ts Adds authenticated access helper.
apps/cms/src/access/authenticatedOrPublished.ts Adds access helper for published-or-authenticated reads.
apps/cms/src/environment.d.ts Adds env var typings for CMS runtime configuration.
apps/cms/scripts/seed-categories.mjs Adds script to seed default categories in CMS DB.
apps/cms/test.env Adds Node options for tests.
apps/cms/dev-entry.sh Adds dev helper to auto-confirm schema push prompt.
apps/cms/src/utilities/getURL.ts Adds server/client URL helpers.
apps/cms/src/utilities/getRedirects.ts Adds redirect fetching + cached redirect accessor.
apps/cms/src/utilities/getGlobals.ts Adds globals fetching + cached global accessor.
apps/cms/src/utilities/getDocument.ts Adds document lookup + cached document accessor.
apps/cms/src/utilities/getMediaUrl.ts Adds media URL normalization helper.
apps/cms/src/utilities/getMeUser.ts Adds current-user fetch helper based on payload-token cookie.
apps/cms/src/utilities/generatePreviewPath.ts Adds helper to generate preview URLs with secret param.
apps/cms/src/utilities/generateMeta.ts Adds helper to build Next metadata from Payload docs.
apps/cms/src/utilities/mergeOpenGraph.ts Adds helper to merge OpenGraph defaults with overrides.
apps/cms/src/utilities/formatDateTime.ts Adds date formatting helper.
apps/cms/src/utilities/formatAuthors.ts Adds helper to format authors array into human-readable string.
apps/cms/src/utilities/toKebabCase.ts Adds kebab-case utility.
apps/cms/src/utilities/canUseDOM.ts Adds DOM presence checker used by client/server utilities.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread apps/cms/src/providers/Theme/index.tsx Outdated
setThemeState(themeToSet)
}, [])

return <HeaderThemeContext value={{ headerTheme, setHeaderTheme }}>{children}</HeaderThemeContext>
Comment on lines +9 to +11
export function isObject(item: unknown): item is object {
return typeof item === 'object' && !Array.isArray(item)
}
Comment thread apps/cms/next.config.ts
Comment on lines +16 to +18
typescript: {
ignoreBuildErrors: true,
},
Comment thread docker-compose.yml Outdated
environment:
DATABASE_URL: postgres://sn_cms:sn_cms@postgres:5432/sn_cms
NEXT_PUBLIC_SERVER_URL: ${NEXT_PUBLIC_SERVER_URL:-https://newsroom.matmanna.dev}
PAYLOAD_SECRET: ${PAYLOAD_SECRET:-6995edc626d1895603aaa92c}
Comment on lines +36 to +40
webServer: {
command: 'pnpm dev',
reuseExistingServer: true,
url: 'http://localhost:3000',
},
Comment on lines +4 to +9
let page: Page

test.beforeAll(async ({ browser }, testInfo) => {
const context = await browser.newContext()
page = await context.newPage()
})
const { setTheme } = useTheme()
const [value, setValue] = useState('')

const onThemeChange = (themeToSet: Theme & 'auto') => {
Comment thread apps/cms/src/heros/HighImpact/index.tsx Outdated
Comment on lines +14 to +16
useEffect(() => {
setHeaderTheme('dark')
})
@matmanna matmanna removed a link to an issue Jun 9, 2026
20 tasks
@matmanna matmanna linked an issue Jun 14, 2026 that may be closed by this pull request
@socket-security

socket-security Bot commented Jun 17, 2026

Copy link
Copy Markdown

@socket-security

socket-security Bot commented Jun 17, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn Critical
Critical CVE: When Vitest UI server is listening, arbitrary file can be read and executed

CVE: GHSA-5xrq-8626-4rwp When Vitest UI server is listening, arbitrary file can be read and executed (CRITICAL)

Affected versions: >= 4.0.0 < 4.1.0; < 3.2.6

Patched version: 4.1.0

From: apps/cms/package.jsonnpm/vitest@4.0.18

ℹ Read more on: This package | This alert | What is a critical CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/vitest@4.0.18. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm @astrojs/compiler is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/@astrojs/check@0.9.9npm/@astrojs/compiler@2.13.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@astrojs/compiler@2.13.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm @emnapi/runtime is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/eslint-config-next@16.2.6npm/next@16.2.6npm/astro@6.4.6npm/@tailwindcss/postcss@4.3.1npm/sharp@0.34.2npm/@emnapi/runtime@1.11.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/runtime@1.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm @payloadcms/drizzle is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/@payloadcms/db-postgres@3.84.1npm/@payloadcms/drizzle@3.84.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@payloadcms/drizzle@3.84.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm @typescript-eslint/eslint-plugin is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/eslint-config-next@16.2.6npm/@typescript-eslint/eslint-plugin@8.61.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript-eslint/eslint-plugin@8.61.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm astro is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: apps/web/package.jsonnpm/astro@6.4.6

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/astro@6.4.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm damerau-levenshtein is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/eslint-config-next@16.2.6npm/damerau-levenshtein@1.0.8

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/damerau-levenshtein@1.0.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm data-urls is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/jsdom@28.0.0npm/data-urls@7.0.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/data-urls@7.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm date-fns is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/@payloadcms/ui@3.84.1npm/date-fns@3.6.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/date-fns@3.6.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm date-fns is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/@payloadcms/ui@3.84.1npm/date-fns@3.6.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/date-fns@3.6.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm drizzle-orm is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/@payloadcms/db-postgres@3.84.1npm/drizzle-orm@0.45.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/drizzle-orm@0.45.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm es-abstract is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/eslint-config-next@16.2.6npm/es-abstract@1.24.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/es-abstract@1.24.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm eslint-plugin-react is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/eslint-config-next@16.2.6npm/eslint-plugin-react@7.37.5

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/eslint-plugin-react@7.37.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm happy-dom is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/vitest@4.0.18npm/@payloadcms/richtext-lexical@3.84.1npm/happy-dom@20.10.3

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/happy-dom@20.10.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm js-yaml is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/@eslint/eslintrc@3.3.5npm/payload@3.84.1npm/@astrojs/mdx@5.0.6npm/@astrojs/node@10.1.4npm/astro@6.4.6npm/js-yaml@4.2.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/js-yaml@4.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm jsdom is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: apps/cms/package.jsonnpm/jsdom@28.0.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/jsdom@28.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm jsdom is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: apps/cms/package.jsonnpm/jsdom@28.0.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/jsdom@28.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm marked is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/@payloadcms/ui@3.84.1npm/marked@14.0.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/marked@14.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm monaco-editor is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/@payloadcms/ui@3.84.1npm/monaco-editor@0.55.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/monaco-editor@0.55.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm monaco-editor is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/@payloadcms/ui@3.84.1npm/monaco-editor@0.55.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/monaco-editor@0.55.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm next is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: apps/cms/package.jsonnpm/next@16.2.6

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/next@16.2.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm payload is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: apps/cms/package.jsonnpm/payload@3.84.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/payload@3.84.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm playwright-core is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/@playwright/test@1.58.2npm/playwright-core@1.58.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/playwright-core@1.58.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm scheduler is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/@payloadcms/ui@3.84.1npm/scheduler@0.25.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/scheduler@0.25.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm strtok3 is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/payload@3.84.1npm/@payloadcms/next@3.84.1npm/strtok3@10.3.5

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/strtok3@10.3.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[cms] stage one

2 participants