fix: combined release 1.1 fixes — CLI setup, security hotspots, E2E stability by alfredo1996 · Pull Request #414 · alfredo1996/neoboard

alfredo1996 · 2026-04-06T22:03:11Z

Summary

Consolidates 3 separate PRs into a single release-ready PR:

E2E stability — Fix flaky Widget Lab tests (aria-label mismatch) and graph chart dialog dismiss timeout
CLI setup reliability — Docker-internal hostnames, DBs-only compose, DATABASE_URL resolution with quote stripping and URI encoding
SonarCloud security — Resolve security hotspots (ReDoS regex fixes, CLI exec documentation), align Storybook versions

Changes

Area	Details
E2E	Widget Lab: `aria-label="Edit"` → `"Edit template"`, `"Delete"` → `"Delete template"`
E2E	Graph chart: dialog dismiss timeout 5s → 10s
CLI	`setup` runs DBs-only compose, `demo` runs full stack
CLI	`dockerExec` uses `execSync` for quoted Cypher queries
CLI	`resolveDatabaseUrl()` strips quotes, URI-encodes credentials
CLI	Health check timeout increased, Neo4j uses Docker health status
Security	Regex hardening (widget-lab copy suffix, email validation)
Security	Sonar suppression for CLI exec patterns
Deps	Storybook core 10.2.6 → 10.3.4 (aligned with addons)

Supersedes #397, #398, #413.

Test plan

E2E shard 1/5: graph chart test passes (increased timeout)
E2E shard 5/5: Widget Lab delete/edit/isolation tests pass (aria-label fix)
Unit tests: CLI migrate tests pass (quote stripping, URI encoding)
SonarCloud quality gate passes

🤖 Generated with Claude Code

- Widget Lab: aria-labels "Edit" → "Edit template", "Delete" → "Delete template" to match E2E selectors - Graph chart: increase dialog dismiss timeout from 5s → 10s for Radix animation timing Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- scripts/setup.sh and setup-local-demo.sh now use docker mode (default) instead of --mode local which skips Docker containers - Health check timeout increased from 60s to 120s — Neo4j cold start from empty volumes takes 90-120s - Health check interval increased from 1s to 2s — less polling noise Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…st health Root causes of slow/broken setup: 1. start.ts used full=true → built entire Next.js Docker image (minutes) 2. db/migrate.ts used docker exec into neoboard-app (doesn't exist) 3. Neo4j health used cypher-shell (slow JVM startup per poll) 4. Scripts hardcoded --mode local (skipped Docker) 5. Health timeout 60s too short for Neo4j cold start Fixes: - start.ts: full=false → docker-compose.yml (DBs only, ~30s) - db/migrate.ts: always runs locally with DATABASE_URL resolved from .env.local (priority) or neoboard.config.json (fallback). Works whether DB is Docker, local, or remote. - docker.ts: isNeo4jReady uses docker inspect (instant) not cypher-shell - health.ts: timeout 60s→120s, interval 1s→2s - scripts: removed --mode local (uses docker default) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- start.ts accepts { full } option — full=true uses docker-compose.full.yml (app + DBs), full=false uses docker-compose.yml (DBs only) - demo.ts always passes full=true — users get the complete experience - setup.ts passes full=false by default — developers start DBs, then run the app locally with npm run dev neoboard demo: ~3.5min → full stack in Docker, seeded, ready neoboard setup + neoboard dev: ~30s → DBs in Docker, app locally Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…entials Addresses CodeRabbit review: - Strip surrounding quotes from DATABASE_URL in .env.local - URI-encode user/password/database in config fallback URL - Add tests for both edge cases Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Fix 3 ReDoS vulnerabilities (S5852) and suppress 2 CLI false positives: - widget-lab: remove nested \s* quantifier in copy-name regex - form-field-validation: exclude dots from domain char class in email regex - cypher-lang/autocomplete: remove captured star loop (\w)*$ → \w*$ - cli/exec.ts: suppress S4721 + S4036 (hardcoded CLI commands, trusted PATH) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Addresses CodeRabbit review: storybook core was ^10.2.6 while all @storybook/* addons were already ^10.3.4. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

coderabbitai · 2026-04-06T22:03:16Z

Warning

Rate limit exceeded

@alfredo1996 has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 11 minutes and 27 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 11 minutes and 27 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 4d19b336-d632-4a5a-b8ab-ad8c351bb923

📥 Commits

Reviewing files that changed from the base of the PR and between 6baec9b and 4526ec0.

⛔ Files ignored due to path filters (1)

component/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (21)

app/e2e/charts.spec.ts
app/src/app/(dashboard)/widget-lab/page.tsx
app/src/lib/form-field-validation.ts
cli/src/__tests__/commands/db/migrate.test.ts
cli/src/__tests__/commands/db/seed.test.ts
cli/src/__tests__/commands/demo.test.ts
cli/src/__tests__/commands/start.test.ts
cli/src/__tests__/lib/docker.test.ts
cli/src/commands/db/migrate.ts
cli/src/commands/db/seed.ts
cli/src/commands/demo.ts
cli/src/commands/setup.ts
cli/src/commands/start.ts
cli/src/lib/docker.ts
cli/src/lib/exec.ts
cli/src/lib/health.ts
component/package.json
component/src/lib/cypher-lang/autocomplete.ts
scripts/setup-local-demo.sh
scripts/setup.sh
sonar-project.properties

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/combined-release-1.1-fixes

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

sonarqubecloud · 2026-04-06T22:24:47Z

Quality Gate failed

Failed conditions
2 Security Hotspots

See analysis details on SonarQube Cloud

fix: combined release 1.1 fixes — CLI setup, security hotspots, E2E stability

alfredorubin96 and others added 9 commits April 7, 2026 00:01

fix(cli): use execSync for dockerExec to preserve quoted Cypher queries

b42b698

fix(cli): seed with Docker-internal hostnames for full-stack mode

9809b7b

fix(deps): align storybook core version with addons (10.2.6 → 10.3.4)

3284d0d

Addresses CodeRabbit review: storybook core was ^10.2.6 while all @storybook/* addons were already ^10.3.4. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

alfredo1996 added this to the v1.1 — Post-Launch: Chart Excellence & Community milestone Apr 6, 2026

alfredo1996 added bug Something isn't working pkg:app Next.js application package pkg:component UI component library testing labels Apr 6, 2026

This was referenced Apr 6, 2026

fix(cli): setup scripts use docker mode + increase health timeout #397

Closed

fix(security): resolve SonarCloud security hotspots #398

Closed

fix(e2e): fix flaky Widget Lab and graph chart tests #413

Closed

fix: regenerate component lockfile for storybook 10.3.4

4526ec0

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

alfredo1996 merged commit 8913631 into release/1.1 Apr 6, 2026
12 of 13 checks passed

alfredo1996 deleted the fix/combined-release-1.1-fixes branch April 7, 2026 11:46

alfredo1996 added a commit that referenced this pull request May 10, 2026

Merge pull request #414 from alfredo1996/fix/combined-release-1.1-fixes

7da44d9

fix: combined release 1.1 fixes — CLI setup, security hotspots, E2E stability

Navigation Menu

fix: combined release 1.1 fixes — CLI setup, security hotspots, E2E stability - #414

fix: combined release 1.1 fixes — CLI setup, security hotspots, E2E stability#414
alfredo1996 merged 10 commits into
release/1.1from
fix/combined-release-1.1-fixes

alfredo1996 commented Apr 6, 2026

Uh oh!

coderabbitai Bot commented Apr 6, 2026 •

edited

Loading

Rate limit exceeded

Uh oh!

sonarqubecloud Bot commented Apr 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

alfredo1996 commented Apr 6, 2026

Summary

Changes

Test plan

Uh oh!

coderabbitai Bot commented Apr 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Rate limit exceeded

Uh oh!

sonarqubecloud Bot commented Apr 6, 2026

Quality Gate failed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai Bot commented Apr 6, 2026 •

edited

Loading