Pull Request Explorer

Summary

Move database recommendation in self-hosting docs

Updated self-hosting documentation to clarify database recommendation placement, improving clarity for self-hosting users.

Health Assessment

• • PR merged immediately with no review required, indicating a straightforward documentation change with minimal impact.

Summary

Recommend Neon in self-hosting docs

Adds Neon as the recommended Postgres provider in self-hosting documentation, clarifying a non-affiliate stance.

Health Assessment

• • Quick docs update with minimal changes and immediate approval.

Summary

Health Assessment

Summary

Add WhatsApp chatbot articles

Adds two blog posts guiding users on building WhatsApp chatbots, expanding content library.

Health Assessment

• • Long cycle time indicates potential bottlenecks in review or approval process.

Summary

Copy skills during Conductor setup

Copies .agents/skills and .claude/skills directories into the Conductor workspace, ensuring directories exist before copying ignored skill files.

Health Assessment

• • Quick merge with minimal changes and no review required.

Summary

Fix missing result columns in CSV export

Ensures CSV exports include all result columns, preventing missing data in reports and improving data integrity for users.

Health Assessment

• • Quick fix with minimal rework, fast review and merge, low risk.

Summary

Fix landing page Discord URL

Update Discord redirect URL to typebot.io and ignore local directories.

Health Assessment

• • Quick fix with minimal changes and no review iterations.

Summary

Block IPv6 Unspecified SSRF Targets

This change prevents potential SSRF attacks by blocking IPv6 unspecified addresses, enhancing security for the application.

Health Assessment

• • Rapid review and merge indicate low complexity and high confidence in the fix.

Summary

Prepare v3.17.1 release

This PR bumps the root package version to 3.17.1 and adds the corresponding changelog entry, ensuring the release workflow and documentation reflect the latest changes.

Health Assessment

• • Rapid merge with minimal changes indicates a straightforward release preparation with no significant friction.

Summary

Fix upload proxy public URL

This fix ensures that upload proxy URLs are correctly resolved in self-hosted reverse‑proxy environments, preventing broken uploads and potential security issues.

Health Assessment

• • Quick review and merge with no rework indicates a straightforward bug fix.

Summary

Update Nx deploy docs for self-hosting

This update ensures that self-hosting users have accurate, up-to-date instructions for deploying the application using Nx and Bun, improving deployment reliability and reducing support overhead.

Health Assessment

• • PR was merged immediately with no review, indicating a straightforward documentation update.

Summary

Prepare v3.17.0 release

Bump root package version to 3.17.0 and add changelog section for the release workflow.

Health Assessment

• • Rapid merge with minimal changes; no review required; low risk.

Summary

Fix unsafe upload URL generation

Ensures secure file uploads by replacing unsafe presigned URLs with server‑generated proxy URLs, protecting against potential security vulnerabilities and improving reliability for end users.

Health Assessment

• • The PR was merged within 30 minutes of opening, with a single automated review and one follow‑up commit, indicating a smooth, low‑friction process despite a large code change.

Summary

Secure Google Sheets OAuth integration and cleanup

This PR hardens the Google Sheets OAuth flow by adding signed state, enforcing proper authorization, and cleaning up after callbacks, reducing security risks and ensuring reliable data sync for users.

Health Assessment

• • Fast turnaround with a single commit and no review rounds indicates high confidence in the changes; however, the large code addition warrants careful monitoring for potential downstream impacts.

Summary

Fix PartyKit deploy workflow gate

Deployments now trigger only on changes to PartyKit packages, preventing unnecessary builds and reducing deployment errors.

Health Assessment

• • Quick fix merged within minutes with minimal changes, indicating low complexity and high confidence.

Summary

Fix WhatsApp preview webhook authorization

Prevents unauthorized access to WhatsApp preview webhooks, ensuring only the correct typebot can resume sessions, improving security and reliability.

Health Assessment

• • Quick fix with minimal changes, no review needed, merged within minutes.

Summary

Fix WhatsApp webhook verification

Ensures reliable Meta WhatsApp webhook handling by adding optional secret validation, auto‑subscribing the Meta app, and cleaning up integration state, improving stability for users.

Health Assessment

• • Fast review and merge with minimal rework; large code changes were quickly validated, indicating strong confidence in the fix.

Summary

Fix WhatsApp status forwarding SSRF protection

This change ensures that WhatsApp status forwarding URLs are protected against SSRF attacks, improving security for workspace-configured integrations.

Health Assessment

• • Quick fix with minimal changes and no review friction.

Summary

Add WhatsApp status forward URL update script

Adds a script to update the WhatsApp status webhook forward URL for typebot settings, enabling automated configuration updates.

Health Assessment

• • The PR was reviewed by an AI tool and merged within minutes, indicating a straightforward change.
• • Minimal review comments and a single commit suggest low complexity and high confidence.

Summary

Add auth failure troubleshooting section to self-hosting docs

Adds a troubleshooting guide for authentication failures in self-hosted deployments, helping users diagnose and resolve common issues.

Health Assessment

• • Quick turnaround with minimal changes and a single review, indicating a straightforward documentation update.

Summary

Add Ask Model file search controls

Adds chunk count and score threshold options to the Ask Model, enabling finer control over OpenAI file_search tool usage and ensuring score thresholds stay within the 0‑1 range.

Health Assessment

• • The PR had a long cycle time and review period, but only a few commits and comments, indicating limited rework and low technical risk.

Summary

Sanitize CSV exports against formula injection

Prevents spreadsheet formula injection by escaping dangerous leading characters in CSV exports, protecting users from malicious data.

Health Assessment

• • Quick, single‑commit fix with AI‑assisted review, minimal scope and no major blockers.

Summary

Prevent cross-tenant webhook resume IDOR

This fix stops unauthorized users from resuming webhook sessions of other typebots, safeguarding tenant isolation and data security.

Health Assessment

• • Rapid review and merge indicate low complexity and high confidence in the change.

Summary

Hash API tokens for security

Store API tokens as SHA‑256 hashes, authenticate against both hashed and legacy tokens, and seed Playwright tokens as hashes, preventing replay attacks and improving security.

Health Assessment

• • Rapid review with AI assistance led to a single commit and minimal back‑and‑forth, indicating a straightforward, low‑risk change.

Summary

Upgrade vulnerable dependencies to latest versions

This PR updates critical dependencies, including the AI SDK, nodemailer, and OpenTelemetry, to address security vulnerabilities and improve compatibility, ensuring safer and more reliable operation.

Health Assessment

• • Rapid cycle with a single review, indicating straightforward dependency updates; minimal friction and quick resolution.

Summary

Health Assessment

Summary

Health Assessment

Summary

Revert Google Sheets picker fixes

Reverts recent changes that broke the Google Sheets picker in production, restoring stable functionality for users.

Health Assessment

• • Quick revert with minimal code changes and no additional commits, indicating low complexity and low risk to the codebase.

Summary

Add trigger_onepick OAuth param for Google Sheets picker

Adds required OAuth parameter to Google Sheets consent URL to comply with Google’s 2026 enforcement, preventing 401 errors in the picker iframe.

Health Assessment

• • Rapid approval with minimal changes; AI-assisted code generation ensured compliance with Google’s new requirement.

Summary

Fix Google Sheets picker 401 error

Ensures Google Sheets integration works by setting the Cloud Project AppId, preventing 401 errors and improving user experience.

Health Assessment

• • Quick AI-assisted fix with minimal changes, fast review and merge, low risk to production

Summary

Health Assessment