Pull Request Explorer

Summary

Document patch releases for bundled Cube image

Clarifies which patch releases include the bundled Cube image, preventing confusion for users during migration.

Health Assessment

• • Quick review and approval with minimal changes; documentation update resolved confusion about patch releases.

Summary

Fix Helm migration job security context

Hardens migration job containers to meet restricted Pod Security, adding security context and mounts, and adds comprehensive tests.

Health Assessment

• • Quick review cycle with minimal rework, but introduces breaking changes to migration job security context, requiring users to update images or chart values.

Summary

Rebuild Cube image on updated distroless base

Removes security CVE exceptions and updates dependencies, ensuring the Cube image meets compliance without breaking functionality.

Health Assessment

• • Fast turnaround with minimal changes; no breaking changes reported; security fix delivered in a single commit.

Summary

Security: bump Next.js to patched version

Updates Next.js dependency to address a critical RCE vulnerability, ensuring secure image rendering.

Health Assessment

• • Quick security patch with minimal changes and fast review, indicating efficient process.

Summary

Bump Next to 16.3.6 for Security Fix

Upgrade Next.js to 16.3.6 to address a critical RCE vulnerability affecting the OG image route, ensuring secure rendering of brand colors.

Health Assessment

• • Quick turnaround with minimal changes; single review and commit indicates efficient process.

Summary

Ship slim Cube image without CVEs

Updates Docker and Helm to use a distroless Cube image, removing critical CVEs and ensuring numeric data handling.

Health Assessment

• • Rapid review and merge, minimal changes, low risk.

Summary

Fix Cube security settings in Helm chart

Helm chart now runs Cube with hardened security, reducing risk of privilege escalation and file system writes.

Health Assessment

• • Rapid approval with minimal changes indicates a straightforward security fix.

Summary

Ship slim Cube image without CVEs

Reduces security risk by replacing the vulnerable Cube image with a distroless version, ensuring secure deployments and compliance.

Health Assessment

• • Fast review and merge with minimal changes, indicating low complexity and risk.

Summary

Fix Cube security defaults in Helm chart

Helm chart now runs Cube with hardened security settings, reducing risk of privilege escalation and ensuring compliance for self-hosted deployments.

Health Assessment

• • Rapid review and merge with minimal changes indicates low complexity and high confidence in the fix.

Summary

Shrink Docker build context and cache install layer

Reduces CI build time and image size by limiting Docker context and caching dependencies, speeding up development and deployment.

Health Assessment

• • Merged in under 6 hours with a single commit and no review rework, indicating a smooth, low-risk change.

Summary

Add Embedded Data V2 field library and UI

Introduces a new embedded data system with a shared field library, typed fields, and a single UI card, replacing legacy JSON columns and enabling better data management.

Health Assessment

• • Fast review and merge (5 h cycle) despite a very large code change; the PR introduces breaking changes that require careful deployment and rollback planning.

Summary

Bump Next.js to 16.3.6 for security fix

Upgrades Next.js to patch a remote code execution vulnerability, ensuring secure OG image rendering. No functional changes, minimal risk.

Health Assessment

• • Quick review and merge, minimal changes, low risk.

Summary

Fix duplicate key promotion in embedded data

Prevents promotion of duplicate keys in embedded data, ensuring survey integrity and avoiding API errors.

Health Assessment

• • Rapid review and merge within 1.3 hours despite large code additions, indicating high confidence and minimal risk.

Summary

Add root test task to run repo-level scripts

Ensures all repository-level test scripts run during pnpm test, improving test coverage and reliability.

Health Assessment

• • Fast cycle time and single review round indicate smooth integration; minimal code churn and no breaking changes reduce risk.

Summary

Show feedback record taxonomy in API and drawer

Adds taxonomy visibility to feedback records, enabling users to see classification status directly in the API and UI, improving data insight and decision-making.

Health Assessment

• • Fast review cycle with minimal rework; moderate scope but no breaking changes; integration with Hub adds moderate risk.

Summary

Fix telemetry proxy usage updates

Ensures self‑hosted instances behind corporate proxies can successfully send usage updates, preventing silent license failures and improving monitoring visibility.

Health Assessment

• • The PR required a single commit after a long review period, indicating moderate review friction but a straightforward fix. The scope was small to medium, and no high‑risk changes were introduced.

Summary

Fix taxonomy max records and LLM URL validation

Ensures self‑hosted deployments enforce correct record limits and fail early on misconfigured LLM URLs, improving reliability and reducing runtime errors.

Health Assessment

• • The PR was merged within an hour of opening, with a single commit and no back‑and‑forth reviews, indicating a straightforward fix. The change is a breaking change that requires users to update their environment, but the impact is limited to self‑hosted deployments.

Summary

Exclude nested lockfiles from PR size check

Improves CI size check to ignore nested lockfiles and generated directories, reducing false positives and keeping PR size metrics accurate.

Health Assessment

• • Single commit with quick approval, minimal review friction, and a small code change.

Summary

Run Cube with read‑only root and no capabilities

Hardens the Cube container for self‑hosted deployments, reducing the attack surface by enforcing a read‑only filesystem, disabling privilege escalation, and dropping all capabilities. This change improves security compliance without requiring additional storage volumes.

Health Assessment

• • The PR was reviewed and merged within 12 hours, with a single commit and no back‑and‑forth, indicating a smooth process. The change is small in scope and introduces a breaking change only for a niche self‑hosted configuration, keeping overall risk low.

Summary

Add restricted surveys UI and lexicon

Enables survey visibility controls, adds restricted survey markers, and updates UI copy to reflect new visibility states, improving user control over survey access.

Health Assessment

• • Rapid review and multiple commits indicate active rework; large code changes across frontend and CI config suggest high complexity.

Summary

Security patch: bump markdown-it, engine.io, brace-expansion

Updates vulnerable dependencies to patched versions, eliminating multiple DoS and crash advisories and strengthening application security.

Health Assessment

• • Rapid security fix with minimal review, merged within 2.4 hours, indicating efficient process and low risk.

Summary

Fix survey editor logic destination error messages

Improves user-facing error messages by replacing block IDs with human-readable titles, enhancing clarity and localization.

Health Assessment

• • Quick review and single commit indicate a straightforward fix; AI assistance streamlined development and reduced iteration time.

Summary

Sync main into epic/embedded-data-v2

Synchronizes the main branch into the epic branch, resolving conflicts and keeping CI pipelines green, ensuring feature branch stays current and stable.

Health Assessment

• • Fast cycle time and minimal review comments indicate a smooth integration. The large number of file changes reflects significant branch drift but no functional impact.

Summary

Ship slim Cube image without CVEs

Deploy a secure, minimal Cube image, reducing vulnerabilities and improving deployment reliability.

Health Assessment

• • Rapid cycle time and minimal review iterations indicate an efficient process; the large code addition is largely due to lockfile updates, but overall risk remains moderate.

Summary

Remove merge conflict marker from migration guide

This change cleans up a stray merge conflict marker in the v6 migration guide, ensuring the documentation renders correctly for users.

Health Assessment

• • Quick fix with minimal review, indicating low complexity and high confidence in documentation quality.

Summary

Fix typecheck for Playwright specs

Ensures Playwright test type errors are caught during typecheck, preventing silent failures in CI and improving reliability of E2E tests.

Health Assessment

• • The PR had a long review time (over two days) but only a single commit and minimal changes, indicating a straightforward fix that was delayed in review.

Summary

Add dedicated ServiceAccount for taxonomy pod

Provides isolated IAM for the taxonomy pod, enhancing security and compliance by enabling fine‑grained workload identity.

Health Assessment

• • Rapid review and merge with minimal iterations, indicating a straightforward change with low risk.

Summary

Refactor AuthZed cutover to clear SonarQube findings

Improves code quality and test isolation for AuthZed integration, reducing technical debt and ensuring reliable user deletion behavior. This refactor removes SonarQube findings and clarifies CLI logic, enhancing maintainability.

Health Assessment

• • Fast cycle time and minimal review comments indicate a smooth, low-risk refactor.

Summary

Fix CI: stop maintenance releases rolling GHCR tags back

Ensures Docker image tags only move forward for stable releases, preventing older backports from overriding newer tags on GHCR.

Health Assessment

• • Fast review and merge with minimal rework, low risk to production.

Summary

Render container security context on web container

Ensures web container runs with hardened security settings, improving security posture for Helm deployments.

Health Assessment

• • Fast cycle time of 1 hour, minimal review friction, small scope, quick fix

Summary

Validate Helm chart timing invariants

Ensures self-hosted deployments enforce safe timing constraints for taxonomy pods, preventing runtime failures.

Health Assessment

• • Quick fix with minimal changes, fast review, no blockers.

Summary

Add performance testing guidance for agents

Provides agents with safe load test guidance and SigNoz analysis, improving reliability and compliance.

Health Assessment

• • The PR experienced a conflict that required a merge commit, leading to a long review cycle of over 63 hours.

Summary

Fix refund of failed invite rate limits

Ensures unused invite capacity is returned, preventing overcharging and improving billing accuracy for organizations.

Health Assessment

• • The PR had a long cycle time and review time, but only a single commit after approval, indicating a straightforward fix that required significant code changes.

Summary

Add 'Other' option to ranking questions

Allows survey creators to include a free‑text 'Other' choice in ranking questions, ensuring responses are captured and summarized correctly.

Health Assessment

• • The PR was reviewed quickly but required multiple commits to address feedback, indicating moderate iteration intensity.

Summary

Fix embedded data screen‑reader and export loop

Improves accessibility by correctly rendering screen‑reader text, optimizes export performance, and enhances test reliability, reducing potential user confusion and deployment delays.

Health Assessment

• • Fast cycle time and single review round indicate a straightforward bug fix with minimal friction and low risk.

Summary

Refuse hidden field clash in v1 API

Prevents API errors and data integrity issues by rejecting hidden fields that conflict with question IDs, ensuring reliable survey data ingestion for integrators.

Health Assessment

• • The PR was reviewed and merged within 20 hours, with a single review comment and no back‑and‑forth, indicating a smooth, low‑friction process. The change is a focused bugfix that adds a guard against a specific data conflict, mitigating risk to existing surveys.

Summary

Security: Bump dependencies to fix advisories

Updates critical email and networking libraries to address multiple security advisories, ensuring safer operation and compliance.

Health Assessment

• • Quick security patch with minimal changes and fast review, indicating efficient process.

Summary

Retire orphaned Formbricks Cloud helmfile deploy workflow

Removes obsolete CI workflow that referenced a deleted Helmfile, cleaning up the pipeline and preventing failed dispatches.

Health Assessment

• • Quick removal of obsolete workflow with minimal rework; fast cycle time indicates low friction.

Summary

Fix CI: Scan release image by digest

Ensures container images are scanned immediately after release, improving security visibility and preventing missed scans.

Health Assessment

• • Quick fix with minimal changes, resolved in under 12 hours, indicating efficient review and low complexity.

Summary

Remove legacy survey variable columns

Eliminates duplicate storage of embedded data, simplifying schema and improving performance.

Health Assessment

Summary

Require Manage Access for Survey Head Scripts

Ensures only users with manage permissions can modify survey head scripts, tightening security and preventing unauthorized changes.

Health Assessment

• • Quick turnaround with minimal rework; single commit resolved permission issue promptly.

Summary

Require Manage access for survey custom head scripts

Ensures only users with Manage access can modify survey custom head scripts, tightening security and preventing unauthorized changes.

Health Assessment

• • Fast turnaround with immediate review and minimal rework indicates a straightforward security fix.

Summary

Replace MinIO client with RustFS CLI

Unblocks E2E tests and self‑hosted installs by switching to a supported RustFS CLI image, ensuring reliable storage setup.

Health Assessment

• • Quick, single‑commit fix with no breaking changes; minimal scope and fast review cycle.

Summary

Replace MinIO client with RustFS CLI

Fixes E2E workflow failures by switching to RustFS CLI image, ensuring self-hosted installs and tests run successfully.

Health Assessment

• • Quick fix with minimal changes, resolved E2E failures promptly.

Summary

Fix array limits and invalid_params caps

Prevents oversized payloads from exhausting memory and protects the API from abuse, ensuring stability and security for all users.

Health Assessment

• • The PR was merged quickly after a single review, but the changes are large and introduce breaking limits on request payloads, raising risk despite the fast cycle time.

Summary

Fix survey close button touch area

Improves accessibility by expanding the close button hit area to 44px and ensuring it stays within the card corner, preventing clipping on large radii.

Health Assessment

• • The PR was reviewed and merged within 0.9 hours, with a single comment and no rework, indicating a smooth, low-risk change.

Summary

Require Manage access for survey head scripts

Ensures only workspace managers can modify survey custom head scripts, tightening security and preventing unauthorized changes.

Health Assessment

• • Rapid cycle with multiple review rounds and significant code changes; high risk due to breaking change and large scope.

Summary

Fix chart gutter scaling for flipped bar charts

Ensures chart labels are fully visible by scaling the gutter to chart width, improving readability in both editor and widget views.

Health Assessment

• • Quick turnaround with a single review and minimal rework, focusing on chart rendering logic to improve label visibility.

Summary

Delete respondent uploads on survey deletion

Ensures all uploaded files tied to a survey are removed when the survey is deleted, preventing orphaned storage and reducing storage costs.

Health Assessment

• • Fast review and merge cycle with minimal rework; straightforward bugfix supported by comprehensive tests.

Summary

Add matrix chart type for Likert matrix questions

Enables users to visualize matrix questions as a grid of statements × scale points, simplifying analytics and reducing manual query work.

Health Assessment

• • Fast cycle time (22.4h) but required multiple review rounds and significant rework, indicating a complex feature addition with high scope. The PR’s large code changes and several changes‑requested reviews suggest moderate friction and a higher risk of downstream impact.