Pull Request Explorer

Summary

Update SDK to version 0.2.3

Bumps the MCP Typescript SDK to 0.2.3, adding a 409 Conflict response for email conflicts, enabling clients to handle conflicts gracefully.

Health Assessment

• • Fast merge with minimal changes, automated generation, no review needed.

Summary

Deploy production release v3.103.1

Deploys the latest release to production, ensuring new features and bug fixes are live.

Health Assessment

• • Rapid automated merge of the release branch with minimal review; high line count but no new code changes in this PR.

Summary

Fix SOA remote-applicable ISO 27001 §7 controls editability

Allows remote organizations to edit specific ISO 27001 §7 controls that are applicable to remote setups, improving audit accuracy and user experience.

Health Assessment

• • Fast cycle time and minimal rework; AI review helped identify and resolve issues quickly.

Summary

Add out‑of‑scope controls for evidence checks

Enables customers to mark intentional resources as out of scope, unblocking audits and improving workflow.

Health Assessment

• • Rapid approval with minimal review indicates high confidence; large scope but no blockers or regressions were detected.

Summary

Fix unclickable role picker in Add User dialog

Users can now select roles in the Add User dialog without pointer event issues, improving onboarding experience.

Health Assessment

• • Fast merge with minimal changes, automated deployment, quick fix to UI bug.

Summary

Fix role picker in invite dialog

Restores role selection in People → Add User by making the role picker clickable again.

Health Assessment

• • Fast review and merge, low cycle time, and small scope indicate a healthy and efficient PR process.

Summary

Deploy MCP Server v0.2.2 to Production

Deploys updated MCP Server with new 2FA tools, member access aggregation, ISMS version history, and trust portal questionnaire controls, enhancing security and user management.

Health Assessment

• • Rapid automated merge with minimal review; large code generation changes; high risk due to size but automated tooling mitigates manual errors.

Summary

Update SDK to version 0.2.2

Bumps the mcp-typescript SDK and server package to 0.2.2, adding 2FA controls, member access insights, ISMS history, and trust portal questionnaire updates.

Health Assessment

• • Rapid merge after automated SDK regeneration; minimal review iterations; large code churn indicates automated generation and a significant feature release.

Summary

Deploy candidate branch to production

Deploys updated authentication, role selection, Excel parsing fixes, and auditor prompt improvements to production, ensuring a stable user experience.

Health Assessment

• • Rapid cycle time and minimal review indicate high confidence, but the large scope of changes suggests moderate risk for production stability.

Summary

Remove brackets and placeholders from vendor prompts

Fixes vendor prompt formatting, ensuring accurate use case display for auditors and improving clarity for end users.

Health Assessment

• • Fast cycle time and minimal review rounds indicate a straightforward bug fix with low risk.

Summary

Add self-serve and admin login email change

Enables users and admins to change login email safely with double opt‑in, reducing lockout tickets and support overhead.

Health Assessment

• • Fast cycle time and review, AI‑assisted review helped resolve issues quickly despite large scope.

Summary

Fix questionnaire Excel parsing hang

Prevents server outages by stripping large data validations from uploaded Excel files, ensuring fast and safe parsing.

Health Assessment

• • Fast turnaround with minimal review; quick fix to critical outage.

Summary

Restore role selection in invite dialog

Users can now select roles via mouse or keyboard in the People invite dialog, fixing selection issues.

Health Assessment

• • Fast review and merge with minimal changes, low risk to production.

Summary

Deploy production release v3.102.0

Deploys the latest release to production, regenerating the OpenAPI spec to keep API documentation current.

Health Assessment

• • Rapid automated merge with minimal review; large line change but limited scope of files and no back‑and‑forth discussion.

Summary

Regenerate public OpenAPI spec to unblock workflows

Updates the OpenAPI spec to reflect current API, enabling nightly generation and Gram sync, and fixes generator tests. This ensures SDK updates and accurate documentation.

Health Assessment

• • The PR was merged within 18 minutes with a single automated review, indicating a straightforward fix to regenerate the OpenAPI spec and resolve test failures.

Summary

Deploy production release v3.101.2

Automated release of candidate branch to production, triggering database migrations, SBOM generation, and dependency hardening.

Health Assessment

• • Rapid review and multiple iterations indicate active rework, but overall cycle time remains within normal range.

Summary

Raise requirement description limit to 100k chars

Increases API validation limit to unblock HITRUST framework imports, preventing rejection of large requirement descriptions.

Health Assessment

• • Rapid review and merge with minimal changes; AI review confirmed no issues.

Summary

Fix security: resolve CodeQL alerts

Removes XSS vulnerabilities, sanitizes codegen strings, and restricts GitHub Actions permissions, improving application security.

Health Assessment

• • Rapid AI-assisted fix with minimal review, high confidence, and no significant rework.

Summary

Health Assessment

Summary

Pin Syft to v1.46.0 in SBOM workflow

Fix SBOM generation by pinning Syft to a version that can parse bun.lock, ensuring accurate dependency snapshots.

Health Assessment

• • Quick, single-file change with no rework; minimal risk and fast turnaround.

Summary

Fix CI SBOM workflow to scan bun.lock via file input

Ensures accurate dependency graph for Bun packages, improving SBOM completeness and Dependabot coverage.

Health Assessment

• • Quick, single-file change that resolved an SBOM completeness issue with minimal review friction.

Summary

Submit resolved bun tree to GitHub dependency graph

Ensures accurate SBOM and Dependabot alerts for bun dependencies, improving security visibility.

Health Assessment

• • Fast cycle time of 12 minutes and a single review round indicate a smooth integration. Minimal code changes (53 lines) reduce risk.

Summary

Patch tmp and js-yaml dependencies in mcp-server

Clears three Dependabot alerts by overriding vulnerable dependencies, ensuring secure builds without runtime changes.

Health Assessment

• • Quick fix with minimal changes, resolved security alerts promptly.

Summary

Prevent SSRF in task-automation API calls

Fixes a critical server‑side request forgery vulnerability by encoding user input and enforcing an origin allowlist, ensuring enterprise API calls cannot be redirected or manipulated.

Health Assessment

• • Rapid response to a critical security alert with a single, small change and a quick review, indicating efficient triage and high confidence in the fix.

Summary

Bump semantic-release to v25, clear sigstore advisory

Updates dev‑only release tooling to newer versions, removing a security advisory and ensuring CI builds run with updated dependencies.

Health Assessment

• • Fast cycle time and minimal rework; AI-generated description streamlined communication.

Summary

Remediate dependency security vulnerabilities

Reduces security findings from 165 to 16, ensuring safer runtime and improved build stability.

Health Assessment

• • Rapid security remediation with minimal review, high line count but single commit indicates efficient process.

Summary

Remediate dependency security vulnerabilities

Reduces security findings by upgrading dependencies and adding safe root overrides across the monorepo.

Health Assessment

• • The PR has a low review friction due to its clear and concise description.
• • The scope of the PR is medium, as it involves upgrading multiple dependencies.

Summary

Fix org chart image stale data after changes

Ensures org chart view updates instantly after uploads, deletes, or edits, improving user experience by eliminating stale data.

Health Assessment

• • PR was auto‑generated and reviewed by cubic with quick feedback and minimal rework, but the long cycle time reflects merge timing rather than code complexity.

Summary

Fix device-agent sign-in screen after reinstall

Ensures the device-agent displays the sign-in screen after reinstall by cleaning stale data, improving user onboarding and device linking.

Health Assessment

• • Merged after a single quick review, but the long cycle time was due to a delayed merge rather than code complexity.

Summary

Health Assessment

Summary

Revert deterministic retry billing id to prevent free scans

Fixes a billing idempotency bug that caused free scans on webhook redelivery after a refunded failure, restoring correct debiting behavior.

Health Assessment

• • Quick, single-commit fix with minimal code changes; AI-assisted review provided confidence and rapid approval.

Summary

Fix pentest retry deduplication and billing

Ensures idempotent pentest retries, prevents duplicate scans and double billing, and preserves check selections, improving reliability and cost control.

Health Assessment

• • Rapid review and minimal rework indicate high confidence; AI-assisted review helped catch issues quickly.

Summary

Auto-retry failed pentest scans and clean messages

Automatically retries failed penetration test scans up to two times, hiding transient failures and replacing raw error messages with user-friendly text, improving customer experience and reducing support tickets.

Health Assessment

• • Fast review and merge cycle with minimal rework; large code changes but well-tested and reviewed by an AI tool, indicating high confidence in quality.

Summary

Deploy production release v3.101.0

Deploys the latest production release, applying new SoA features and database migrations to ensure accurate compliance reporting for customers.

Health Assessment

• • Rapid deployment with minimal review; only one issue was identified and resolved quickly, indicating a smooth release process.

Summary

Apply fully-remote physical-control rule consistently

Ensures remote organizations see consistent Not Applicable status for physical-security controls across UI and PDF, preventing stale or mismatched data.

Health Assessment

• • Quick, single-commit fix with high confidence review; minimal rework and low risk.

Summary

Persist applicability and justification on SoA answers

Adds per-document records for control applicability and justification, improving compliance accuracy and user experience across the platform.

Health Assessment

• • Fast cycle time and minimal review rounds indicate a smooth, low-risk change. AI-assisted review helped catch issues early.

Summary

Deploy production release of internal org features

Deploys new internal organization participation logic and ISMS roles, enabling platform admin handling and compliance features.

Health Assessment

• • Rapid merge after automated PR with AI-generated review summary; minimal review time but large code changes indicate high risk but fast deployment.

Summary

Add regression tests for automation-failure participant filter

Adds regression tests to ensure internal-org participant filter correctly excludes platform admins for customer orgs and includes them for internal orgs, preventing misrouted notifications.

Health Assessment

• • Quick turnaround with no rework; automated review found no issues; PR merged within minutes.

Summary

Fix Trigger.dev deploy failure due to auth import

Removes broken import of @trycompai/auth/participation from bundled task notifiers, restoring deploy stability. Adds a local, dependency‑free participation rule and drift guard to ensure consistency.

Health Assessment

• • Resolved in under 10 minutes with a single review, indicating low complexity and high confidence in the fix.

Summary

Add ISMS Roles & Responsibilities Document

Provides ISO 27001 Clause 5.3 governance roles, member assignments, and automated PDF/DOCX export, improving audit readiness and reducing manual compliance effort.

Health Assessment

• • Rapid AI‑assisted development and review enabled a 4.5‑hour cycle time, but the 4,376‑line addition indicates a substantial feature scope with moderate risk.

Summary

Treat platform admins as members in internal organizations

Adds an internal flag to treat platform admins as real members in platform‑operated orgs, unifying participation logic and improving compliance and notifications.

Health Assessment

• • The PR introduced a new internal flag to unify participation logic across many services, with extensive testing and AI‑generated code, resulting in a large change but minimal rework after review.

Summary

Deploy production release v3.100.0

Releases the latest production‑ready version, fixing policy serialization and device compliance logic to ensure accurate policy bodies and consistent device verdicts.

Health Assessment

• • Fast cycle time and immediate review indicate a streamlined release process. The PR includes a critical bug fix for policy serialization and device compliance logic, ensuring accurate data handling in production.

Summary

Fix device compliance to canonical four‑check standard

Ensures imported devices display accurate compliance status, preventing false positives and improving security visibility for customers.

Health Assessment

• • Rapid review and merge (under an hour) with minimal rework indicates high confidence and low friction in the process.

Summary

Restore content serialization for policy writes

Fixes policy content corruption when creating or updating policies via MCP, ensuring policy bodies retain their intended structure and preventing blank drafts.

Health Assessment

• • Quick, single‑commit fix with no significant rework; minimal scope and low risk to production.

Summary

Deploy production release v3.99.3

Deploys the latest release to production, enabling new device sync features and compliance updates.

Health Assessment

• • Rapid cycle with quick review, but multiple commits indicate iterative refinement; large scope suggests high impact deployment.

Summary

Fix device sync N+1 queries and controlled select

Improves device sync performance by batching provider lookups and ensures UI correctly reflects saved provider selection, reducing errors and improving user experience.

Health Assessment

• • Quick fix with minimal changes, no blockers, AI-assisted review summary.

Summary

Refactor device sync UI: remove redundant text

Improves UI clarity by removing duplicate sync info and simplifying the re-sync button, enhancing user experience.

Health Assessment

• • PR merged immediately with no review comments, indicating a straightforward refactor with minimal risk.

Summary

Refactor device sync UI for better alignment

Improves the device sync interface by right-aligning controls and replacing the text button with an icon-only re-sync button, enhancing layout consistency and accessibility.

Health Assessment

• • Fast turnaround with minimal changes and no review issues, indicating a straightforward refactor.