Pull Request Explorer

Summary

Fix inverted monthDays digest validation

Corrects logic that incorrectly rejected valid monthly digest days, ensuring proper validation and preventing errors in scheduled digests.

Health Assessment

• • Quick fix with minimal changes, automated tests added, no major risk.

Summary

Release Novu Cloud daily production

Automated daily production Novu Cloud release.

Health Assessment

• • Release was automated and merged quickly with minimal changes, indicating a smooth process.

Summary

Remove SMTP TLS requirement assertion

Allows non‑TLS SMTP configurations, improving integration flexibility.

Health Assessment

• • Fast merge with minimal changes and a single review, indicating low complexity and risk.

Summary

Release Novu Cloud production update

Automated daily production Novu Cloud release

Health Assessment

• • Release merged within minutes with automated CI, minimal manual review, indicating a well‑established release pipeline.

Summary

Document Slack Block Kit for Dashboard Workflows

Adds comprehensive Slack Block Kit documentation, trigger override examples, and cross-links to improve integration guidance.

Health Assessment

• • Rapid merge with minimal review, documentation-only changes, no code or security impact.

Summary

Clarify region keys, Mailtrap scope, FCM tokens

Improves documentation clarity on API region binding, Mailtrap usage, and FCM token management, reducing user confusion and support tickets. Ensures developers correctly configure endpoints and token handling, improving onboarding and reliability.

Health Assessment

Summary

Add SDK decorator for mobile link creation

Exposes the mobile‑link endpoint in the SDK and Postman collection, enabling developers to create mobile links via the SDK.

Health Assessment

• • Fast 9.5‑hour cycle with a single review round and no functional code changes; high confidence summary indicates minimal risk despite large code generation scope.

Summary

Add contexts concept and update multi‑tenancy docs

Updates documentation to reflect the recommended multi‑tenancy flow using contexts, replacing legacy subscriber ID prefixing and clarifying tenant isolation.

Health Assessment

• • Merged within 1 hour of opening, single review, no rework; documentation-only changes with minimal code impact.

Summary

Fix prototype pollution in path setter

Centralizes path-setting logic into a new safeSetPath utility, replacing lodash/set and local ad-hoc implementations to prevent prototype pollution.

Health Assessment

• • The PR fixes a critical security issue by introducing a safeSetPath utility to prevent prototype pollution.
• • The code changes are well-structured and follow best practices.

Summary

Remove legacy managed agent onFinish content fallback

Eliminates deprecated response.content handling, ensuring managed agent replies are delivered exclusively via the onMessage webhook, simplifying reply flow and reducing legacy code.

Health Assessment

• • Quick single-file change, merged within 18 minutes, indicating smooth review and low risk.

Summary

Refactor framework exports to handler surface

Clean up public SDK surface to expose only handler‑facing agent APIs, improving developer experience and reducing unnecessary types.

Health Assessment

• • Fast cycle time of 0.7h, single commit, minimal review, low risk of breaking changes.

Summary

Align agent name length to 60 characters

Standardizes agent name length across API, dashboard, and shared constants, improving consistency and preventing validation errors.

Health Assessment

• • Merged within 1.6 hours with no review back‑and‑forth, indicating a straightforward, low‑risk change.

Summary

Add email agent onboarding guide and simplified setup

Introduces a two‑phase onboarding flow for email agents, gating production‑ready steps behind a feature flag and centralizing inbound‑connection logic to improve reliability and user experience.

Health Assessment

• • Long cycle time with many commits and extensive changes indicates significant rework and potential blockers.

Summary

Fix Slack watermark link formatting

Corrects rendering of the Powered by Novu watermark on Slack by using Slack mrkdwn link syntax while preserving markdown links on other platforms, improving message clarity and click‑through.

Health Assessment

• • Rapid, single‑commit fix with quick review and minimal code changes, indicating low complexity and low risk to production.

Summary

Add self-hosted Slack tool approval cards

Enables self-hosted agents to post lightweight tool approval cards with native Slack blocks, improving user experience and reducing payload size.

Health Assessment

• • Merged in just 1.1 hours with a single commit and no review comments, indicating a straightforward, low-risk change.

Summary

Fix email-webhook payload content for v2 workflows

Ensures email-webhook integrations receive correct content in v2 workflows while preserving legacy behavior, improving email rendering accuracy.

Health Assessment

• • The PR had a long cycle time (138h) but only two files were changed, indicating a small technical scope but a slow review process. The single review round and moderate review time suggest moderate friction, but the extended overall duration points to process inefficiencies.

Summary

Apply SEO and metadata best practices to docs

Improves search visibility and consistency across documentation, ensuring each page has unique, concise metadata.

Health Assessment

• • Quick turnaround with minimal changes, indicating straightforward documentation updates.

Summary

Add Clerk OAuth support for selected API endpoints

Enables Clerk OAuth access tokens on opted‑in API endpoints, enhancing security and integration with Clerk authentication for users.

Health Assessment

• • The PR was merged within 1.1 hours with only a single quick review, indicating high confidence in the changes despite the large code churn.

Summary

Fix environment-scoped API key access for workflows

Ensures environment-scoped API keys cannot read or diff workflows across environments, tightening security.

Health Assessment

• • Merged within 10 minutes with no review, indicating a straightforward security fix with minimal risk.

Summary

Validate Infobip SMS baseUrl against SSRF

Adds SSRF-safe validation for Infobip SMS base URLs to prevent security vulnerabilities.

Health Assessment

• • The PR has a relatively fast cycle time of 5.5 hours and a fast time to first review of 0.2 hours, indicating efficient review and merge processes.
• • The PR has a moderate scope with 11 files changed, which may require careful review and testing to ensure correctness and prevent regressions.

Summary

Improve tool approval card cleanup

Enhances user experience by automatically deleting approval cards, reducing clutter and ensuring timely responses in tool approval flows.

Health Assessment

• • Fast review and merge with minimal iterations indicates high confidence and low risk.

Summary

Expose delete message on agent reply contract

Adds the ability for self-hosted agents to delete platform messages, improving cleanup and consistency across conversations.

Health Assessment

• • The PR was merged within 0.8 hours with minimal review friction, indicating a straightforward, low-risk change. AI assistance was used to generate code and documentation.

Summary

Block SSRF via SMTP and Sinch region fixes

Adds robust outbound validation for SMTP and Sinch integrations, preventing SSRF attacks and ensuring region compliance. This enhances security and reliability for tenant-controlled integrations.

Health Assessment

• • Rapid review and merge within 1.3 hours indicates high confidence and minimal friction.

Summary

Remove eval from workflow schema conversion

Eliminates runtime code execution in workflow payload schema conversion, replacing unsafe eval with a safe, programmatic Zod converter to enhance security.

Health Assessment

• • Rapid review and merge within 1.6 hours indicates minimal friction and high confidence. The PR addresses a critical security vulnerability by removing unsafe eval usage, with comprehensive testing via Greptile.

Summary

Block prototype pollution in verify-payload service

Hardens payload verification against prototype pollution, preventing a critical security vulnerability that could affect all tenants.

Health Assessment

• • Rapid resolution of a critical security issue with minimal changes and quick review turnaround.

Summary

Sync Vitest devDependency ranges to ^4.1.0

Aligns declared Vitest versions with the pnpm override to close open advisories, ensuring no runtime impact.

Health Assessment

• • Fast merge with no review or comments; minimal scope and risk.

Summary

Fix environment variable scoping for API keys

Prevents IDOR by ensuring API key and keyless callers can only modify or delete their own environment, enhancing security.

Health Assessment

• • Fast cycle and minimal review iterations indicate efficient resolution of a critical security fix.

Summary

Disable Vercel partner integrations for Better Auth

Prevents cross‑tenant IDOR by gating Vercel integration to Enterprise Cloud only, ensuring Better Auth deployments cannot access Vercel partner endpoints.

Health Assessment

• • Rapid, single‑commit fix with AI‑generated code; minimal scope and low review friction; security issue resolved quickly.

Summary

Harden Pusher Beams instanceId against SSRF

Prevents potential SSRF attacks by validating instance IDs and ensuring safe URL construction for Pusher Beams integration.

Health Assessment

• • Rapid review and merge indicate low complexity and high confidence in the security fix.

Summary

chore(root): update Sentry packages to v10.63.0

Upgrades all Sentry SDK packages across the monorepo to the latest v10.63.0, removing legacy packages and ensuring compatibility, reducing potential runtime errors and improving monitoring stability.

Health Assessment

• • Fast merge with minimal review; large dependency update but no blockers reported.

Summary

Add feature-flagged rolling secret key rotation

Enables customers to rotate API secret keys without downtime, gated by a feature flag, improving security and operational flexibility.

Health Assessment

• • Multiple commits over 40 hours with feature flag gating indicate careful rollout; however, large code changes and concurrency logic increase risk.

Summary

Resolve OpenTelemetry core vulnerability

Updates pnpm overrides to upgrade vulnerable OpenTelemetry packages, eliminating a moderate DoS risk for the Novu monorepo.

Health Assessment

• • Fast review and single commit led to a quick merge; the change is a security fix with moderate risk but minimal code churn beyond dependency updates.

Summary

Fix German timestamp localization

Corrects German inbox timestamps by normalizing locale codes, ensuring accurate relative time display for German users.

Health Assessment

• • Review took 42 hours, but no rework was required; PR merged within 44 hours.

Summary

Release Novu Cloud daily production

Automated daily production Novu Cloud release.

Health Assessment

• • Fast, automated release with minimal changes, no review needed.

Summary

Release Novu 2026-07-05

Automated daily production Novu Cloud release.

Health Assessment

• • Release PR merged quickly with minimal review, but included extensive code changes across backend and CI configurations, indicating a large scope but streamlined process.

Summary

Scope inbox snooze lookups to subscriber

Ensures inbox snooze and unsnooze actions correctly resolve the authenticated subscriber before querying messages, improving security and preventing unauthorized access.

Health Assessment

• • F
• • a
• • s
• • t
• •
• • c
• • y
• • c
• • l
• • e
• •
• • t
• • i
• • m
• • e
• •
• • a
• • n
• • d
• •
• • m
• • i
• • n
• • i
• • m
• • a
• • l
• •
• • r
• • e
• • v
• • i
• • e
• • w
• •
• • r
• • o
• • u
• • n
• • d
• • s
• •
• • i
• • n
• • d
• • i
• • c
• • a
• • t
• • e
• •
• • a
• •
• • s
• • t
• • r
• • a
• • i
• • g
• • h
• • t
• • f
• • o
• • r
• • w
• • a
• • r
• • d
• •
• • f
• • i
• • x
• •
• • w
• • i
• • t
• • h
• •
• • c
• • o
• • m
• • p
• • r
• • e
• • h
• • e
• • n
• • s
• • i
• • v
• • e
• •
• • t
• • e
• • s
• • t
• • s
• • .

Summary

Align conversation timeline for managed and self-hosted agents

Simplifies the dashboard conversation timeline by removing noisy tool‑use entries and deduplicating ledger writes, delivering a clearer, unified audit trail for all agents and improving user experience.

Health Assessment

• • The PR was reviewed and merged within 13 hours, indicating a smooth review process. The single commit and AI assistance suggest rapid development, but the 398‑line change across both backend and frontend introduces moderate risk that warrants careful regression testing.

Summary

Fix worker filter evaluation crashes

Adds defensive checks and fail‑closed logic to legacy step filters, preventing worker crashes and infinite retry storms, thereby improving system reliability.

Health Assessment

• • Fast 2.4‑hour cycle with no review required; minimal code changes focused on stability; low risk of regressions.

Summary

Validate environment ownership for env variable values

Ensures environment variable values belong to the authenticated organization before persistence, preventing cross‑organization data leaks.

Health Assessment

• • Fast fix with single commit and comprehensive tests, minimal scope and risk.

Summary

Self-hosted tool approval consistency and plan card removal

Aligns self-hosted agent approvals with managed behavior, removes plan cards, and ensures consistent tool approval flow, improving reliability and user experience.

Health Assessment

• • The PR was merged within 20 minutes of opening, indicating a fast review cycle, but the large number of lines changed and multiple commits after the first review suggest significant rework and complexity.
• • This high volume of changes in a short time increases risk of regressions.

Summary

Add organization scoping to Vercel integration

Ensures Vercel partner integration updates are limited to the caller’s organization, preventing cross‑org configuration leaks.

Health Assessment

• • Merged within 6 minutes with no review comments, indicating a straightforward, low‑risk change.

Summary

Add subscriber credentials tab to dashboard

Introduces a new credentials tab in the dashboard sidebar, allowing users to view and manage push, chat, and email/SMS credentials with full CRUD UI and API support.

Health Assessment

• • The PR was reviewed quickly (0.3h) and merged within 24h, indicating efficient review. However, the addition of over 2,500 lines across 20 files represents a substantial code change, raising moderate risk for downstream impact.

Summary

Refactor inbound handler, add system-generated flag

Improves engagement counting accuracy and bypasses free‑tier limits for system messages, reducing billing errors and ensuring correct analytics.

Health Assessment

• • Merged in under 30 minutes with a single review, indicating a straightforward, low‑risk refactor with minimal impact on the codebase.

Summary

Add self-hosted tool approval for AI SDK agents

Enables gated tool calls to pause, present approval cards, and resume statelessly, mirroring managed runtime behavior without server‑side session state.

Health Assessment

• • Large‑scale feature added with minimal review time, indicating efficient collaboration but high complexity and potential for subtle bugs.

Summary

Fix React hooks to prevent undefined state on remount

Ensures preference and schedule hooks correctly set state from fetch responses, eliminating stale undefined state after component remounts and improving reliability for users.

Health Assessment

• • Quick review and merge, minimal changes, low risk

Summary

Fix actor variable compilation in notifications

Ensures actor variables are rendered in actual notifications and excludes actor from fan‑out, improving notification accuracy for end users.

Health Assessment

• • Quick review and merge within a day, minimal rework, small scope.

Summary

Fix v0 notification payload mapping in inbox API

Ensures v0 workflow notifications expose trigger payload via the data field, aligning with v2 behavior and enabling smooth migration to @novu/js.

Health Assessment

• • Quick, single‑file change with minimal review, indicating low complexity and risk.

Summary

Document idempotency and transactionId billing

Adds documentation for idempotency keys and transactionId billing on trigger API, addressing customer feedback in DOC-399.

Health Assessment

• • The PR was reviewed and approved quickly, with minimal changes required.
• • The documentation changes are clear and concise, making it easier for users to understand idempotency and transactionId billing.

Summary

Document framework bridge URL retry behavior

Adds comprehensive documentation for retry logic, SMS webhook integration, inbox updates, and Slack OAuth, enhancing developer clarity and reducing support queries.

Health Assessment

• • Multiple small commits were made to refine documentation, but the review was rapid and the merge was straightforward, indicating a low-risk, high-value documentation update.

Summary

Fix API service: normalize null subscriber channels

Corrects Zod validation errors by ensuring subscriber responses always return an empty array for missing channels, improving SDK reliability and user experience.

Health Assessment

• • The PR was reviewed and merged within 5 hours, with a single commit and minimal changes, indicating a straightforward, low-risk fix.