Skip to content

feat(ui): link trust downgrade warnings to version diffs - #3358

Open
drawliin wants to merge 1 commit into
npmx-dev:mainfrom
drawliin:feat/trust-downgrade-diff
Open

drawliin wants to merge 1 commit into
npmx-dev:mainfrom
drawliin:feat/trust-downgrade-diff

Conversation

@drawliin

@drawliin drawliin commented Oct 24, 2026 •

Copy link
Copy Markdown

linked issue

fixes #2345

context

the trust downgrade warning explains the publishing change.. but has no direct link to inspect the files changed between releases.

description

adds a “file changes” link from the trusted version to the downgraded version.. using the existing diff route and translation.

the link is hidden when no trusted version is available.

extends the existing component tests to cover scoped and unscoped packages.. version order.. and warnings without a trusted version. the link tests fail against the original component and pass with this change.

validation:

  • full suite: 3,146 passed.. 5 skipped
  • lint, type checks and css checks passed
  • accessibility checks passed for the updated warning

@agentscanapp

agentscanapp Bot commented Oct 24, 2026

Copy link
Copy Markdown

Thanks for opening this pull request! 🎉

We really appreciate you taking the time to contribute, @drawliin.

A maintainer will take a look as soon as they can. In the meantime, please make sure that:

  • the description explains what changed and why
  • any related issues are linked
  • existing tests still pass

If anything needs adjusting we'll leave comments here. Thanks again!

@vercel

vercel Bot commented Oct 24, 2026 •

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
npmx.dev Ready Ready Preview Oct 24, 2026 7:10pm UTC
2 Skipped Deployments
Project Deployment Actions Updated
docs.npmx.dev Ignored Ignored Preview Oct 24, 2026 7:10pm UTC
npmx-lunaria Ignored Ignored Oct 24, 2026 7:10pm UTC

Request Review

@coderabbitai

coderabbitai Bot commented Oct 24, 2026 •

Copy link
Copy Markdown
Contributor

Review in Change Stack →

No actionable comments were generated in the recent review.

Recent review info
Run configuration
Commits

Reviewing files that changed from the base of the PR and between f5da8f1 and 3be2bb0.

Files selected for processing: 3
  • app/components/Package/Install/Dropdown.vue
  • app/components/Package/SecurityDowngradeAlert.vue
  • test/nuxt/a11y.spec.ts

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

📝 Summary

Summary by CodeRabbit

  • New Features
    • Security downgrade alerts now include a “File Changes” link when a trusted version is available, letting you compare it with the downgraded version.
  • Tests
    • Expanded accessibility checks for the alert across additional packages and verified when the comparison link and alert are shown.

The downgrade alert now shows a “File Changes” link when a trusted version is available. The link uses the package name and trusted and downgraded versions. Tests cover two packages and alert states with and without a trusted version.

Changes: Package downgrade diff link

Layer / File(s) Summary
Pass package details and render the diff link
app/components/Package/Install/Dropdown.vue, app/components/Package/SecurityDowngradeAlert.vue
The install dropdown passes the package name to the alert. When a trusted version exists, the alert renders a link to compare the trusted and downgraded versions.
Validate the link and alert states
test/nuxt/a11y.spec.ts
Tests check the diff link for vue and @nuxt/kit. They also check that the link is absent without a trusted version and that the alert disappears when downgrade is null.

Suggested reviewers: alexdln

Priority: Normal

Merge Risk: Minimal · up to 3be2b

The downgrade warning’s diff link has no identified issue that needs resolution before merging.

Pre-merge checks: Passed 4
Check name Status Explanation
Title check Passed The title clearly summarises the main change: adding links from trust downgrade warnings to version diffs.
Linked Issues check Passed Issue #2345 asks for a quick link on the trust downgrade box, such as a "files changed" button, that shows what changed in the package. The diff of app/components/Package/SecurityDowngradeAlert.vue ad…
Out of Scope Changes check Passed All changed areas support the objective in #2345. SecurityDowngradeAlert.vue gains the diff link. Dropdown.vue passes packageName to that component, which the new prop requires. test/nuxt/a11y.spec.ts…
Description check Passed The pull request description directly matches the changes. It explains the new “File Changes” link, its visibility condition, and the related test coverage.
Full details: Linked Issues check

Explanation

Issue #2345 asks for a quick link on the trust downgrade box, such as a "files changed" button, that shows what changed in the package. The diff of app/components/Package/SecurityDowngradeAlert.vue adds a LinkBase, rendered with v-if="downgrade.trustedVersion". Its target is diffRoute(packageName, downgrade.trustedVersion, downgrade.downgradedVersion), and its label is $t('compare.file_changes'). This matches the requested behaviour. The link is hidden when no trusted version exists. The component now takes the required packageName prop. The file read of app/components/Package/Install/Dropdown.vue at the reviewed head shows that the component passes :package-name="packageName", so the new prop has a caller. The change set's summary reports component tests for scoped and unscoped packages, version order, and the no-trusted-version case in test/nuxt/a11y.spec.ts. Those tests were not read directly. The diff of Dropdown.vue was unavailable, so the change to that file rests on the head file read. The diffRoute helper and the compare.file_changes key were not read directly. Both are referenced by the PR and the summary, and this assessment relies on those references.

Full details: Out of Scope Changes check

Explanation

All changed areas support the objective in #2345. SecurityDowngradeAlert.vue gains the diff link. Dropdown.vue passes packageName to that component, which the new prop requires. test/nuxt/a11y.spec.ts covers the new link, its target versions, and the hidden state without a trusted version. The PR summary reports no unrelated files. The change set's listed files show no unrelated changes. Not verified: the Dropdown.vue diff could not be read, and other callers of PackageSecurityDowngradeAlert, if any, were not checked for the new required prop.

Finishing Touches
🧪 Generate unit tests (beta)
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@codecov

codecov Bot commented Oct 24, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

This branch was successfully deployed

1 active deployment
Preview – npmx.dev — 3be2bb0f Deployed Oct 24, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Show quick link to diff page on trust downgrade box

1 participant