Skip to content

feat: add open source governance documentation - #26

Merged
rogerSuperBuilderAlpha merged 2 commits into
mainfrom
claude/review-opensource-structure-3hTYk
Jan 29, 2026
Merged

feat: add open source governance documentation#26
rogerSuperBuilderAlpha merged 2 commits into
mainfrom
claude/review-opensource-structure-3hTYk

Conversation

@rogerSuperBuilderAlpha

@rogerSuperBuilderAlpha rogerSuperBuilderAlpha commented Jan 29, 2026

Copy link
Copy Markdown
Owner
  • Add GOVERNANCE.md with maintainer roles, decision-making process,
    and conflict resolution procedures
  • Add DCO.md (Developer Certificate of Origin) for contribution
    licensing clarity with sign-off instructions
  • Add TRADEMARK.md outlining brand usage policy for Cursor Boston
  • Add SUPPORT.md consolidating community resources and help channels
  • Update CONTRIBUTING.md to require DCO sign-off on commits
  • Update CHANGELOG.md to distinguish planned vs added features

https://claude.ai/code/session_0117KrZqL8YvmTkrsFCQSFqV

claude added 2 commits January 29, 2026 08:28
@claude
feat: add open source governance documentation
5254d27 
- Add GOVERNANCE.md with maintainer roles, decision-making process,
  and conflict resolution procedures
- Add DCO.md (Developer Certificate of Origin) for contribution
  licensing clarity with sign-off instructions
- Add TRADEMARK.md outlining brand usage policy for Cursor Boston
- Add SUPPORT.md consolidating community resources and help channels
- Update CONTRIBUTING.md to require DCO sign-off on commits
- Update CHANGELOG.md to distinguish planned vs added features

https://claude.ai/code/session_0117KrZqL8YvmTkrsFCQSFqV
@claude
refactor: organize Docker files into docker/ directory
a5103bf 
- Move Dockerfile and docker-compose.yml to docker/ folder
- Update docker-compose.yml to use parent context for builds
- Update CI workflow to reference new Dockerfile location
- Update CODEOWNERS for new docker/ directory path

Keeps .dockerignore in root as required by Docker.

https://claude.ai/code/session_0117KrZqL8YvmTkrsFCQSFqV
@vercel

vercel Bot commented Jan 29, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Review Updated (UTC)
cursor-boston Ready Ready Preview, Comment Jan 29, 2026 8:33am

@rogerSuperBuilderAlpha
rogerSuperBuilderAlpha merged commit 3bdca5b into main Jan 29, 2026
5 of 7 checks passed
@rogerSuperBuilderAlpha
rogerSuperBuilderAlpha deleted the claude/review-opensource-structure-3hTYk branch January 29, 2026 08:33
Pradyumna369 pushed a commit to Pradyumna369/cursor-boston that referenced this pull request Apr 12, 2026
@rogerSuperBuilderAlpha
Merge pull request rogerSuperBuilderAlpha#26 from rogerSuperBuilderAl…
ff18f3d 
…pha/claude/review-opensource-structure-3hTYk
rogerSuperBuilderAlpha added a commit that referenced this pull request May 2, 2026
@rogerSuperBuilderAlpha @claude
fix: address remaining CodeQL high-severity alerts + postcss bump
ba7a99f 
Closes the seven js/incomplete-url-substring-sanitization alerts in
scripts/* by extracting parseGithubLogin into scripts/_lib/. The new
helper does strict hostname validation (`github.com` / `www.github.com`
only) instead of substring-matching the URL, which previously could
have matched `evilgithub.com` or `something.com/github.com/foo`. Three
scripts had identical local copies of the function — now imported.

Closes js/incomplete-sanitization in WeekSubmissionsCollapsible by
replacing the manual `name.replace(/"/g, '\\"')` template with
JSON.stringify of the example object. The old code didn't escape
backslashes first, so a name like `abc\` produced broken JSON.

Closes Dependabot postcss alert (CVE-2026-41305) by adding a postcss
override pinning the resolved version ≥8.5.12. next.js 16.2.4 ships
a nested postcss@8.4.31 in its dependency tree; the override forces
all nested copies to dedupe to the patched version (now 8.5.13 across
the tree). Verified with `npm ls postcss`.

Closes:
- CodeQL #16, #17, #19, #20, #21, #22, #23 (script URL substring)
- CodeQL #26 (incomplete sanitization in summer-cohort component)
- Dependabot #58 (postcss XSS via unescaped </style>)

Not fixed (intentional, see follow-up):
- Dependabot #55 (uuid bounds check) — vuln only triggers when calling
  v3/v5/v6 with a custom buffer. Nothing in our tree does this. The
  patched v14 would force a firebase-admin major downgrade. Will
  dismiss the alert with this rationale separately.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@rogerSuperBuilderAlpha rogerSuperBuilderAlpha mentioned this pull request May 2, 2026
Merged
5 tasks
@rogerSuperBuilderAlpha rogerSuperBuilderAlpha mentioned this pull request May 18, 2026
Merged
2 tasks
rogerSuperBuilderAlpha added a commit that referenced this pull request May 18, 2026
@rogerSuperBuilderAlpha
test(lib/hiring-partners): constants + sanitizeEngineerExpectations (…
7b1ab90 
…coverage push #26) (#1025)

Drives lib/hiring-partners.ts (104 LOC, previously 0% covered) to
100% across statements / branches / functions / lines.

21 tests covering:
- constants surface (collection name, notify list, Calendly URL, return-to, length caps)
- PARTNER_ENGINEER_EXPECTATION_ITEMS shape (unique keys, non-empty labels)
- sanitizeEngineerExpectations:
  - null / undefined / string / number / array / empty object → {}
  - unknown keys dropped
  - non-number values dropped (string, boolean, null, object)
  - non-finite numbers dropped (NaN, Infinity, -Infinity)
  - out-of-range values dropped (0, 8, -3, 100)
  - non-integer values rounded into the 1..7 range
  - boundary values 1 and 7 accepted
  - values rounding to 0 (0.4) and 8 (7.6) dropped after rounding

Refs #54 (OpenSSF Silver test_statement_coverage80).

Signed-off-by: Ludwitt <ludwitt@ludwitt.com>
This was referenced May 18, 2026
Merged
Merged
rogerSuperBuilderAlpha added a commit that referenced this pull request May 19, 2026
@rogerSuperBuilderAlpha
test(openssf-gold): cover cursor idea-run GET/DELETE refresh paths (p…
133a688 
…ush #26) (#1148)

Adds 14 jest tests for the cursor idea-run [runId] GET/DELETE handlers
on top of the existing 1, lifting app/api/cursor/idea-runs/[runId]
/route.ts from 64.93% / 31.14% to 97.4% / 80.32% (statements/branches).

GET paths covered:
- Unauthenticated → 401
- Admin db missing → 500 'not_configured'
- Terminal status with no workflow stage → no refresh fired
- MissingCursorConnectionError → refreshSkipped='cursor_not_connected'
- Other api-key fetch error → 500 refresh_failed
- getCursorRunSnapshot throw → swallowed, cursorStatusDetail persisted
- activeRunId() routing: planning → planRunId, building → buildRunId,
  pr_open → prRunId (all three workflow-specific runId paths)

DELETE paths covered:
- Unauthenticated → 401
- Admin db missing → 500
- Missing run → 404
- deleteCursorAgent throw swallowed → local delete still runs (200)
- Firestore delete throw → 500 delete_failed

Branch coverage on this file lifted +49pp (31.14 → 80.32).

Part of the OpenSSF Best Practices Gold coverage push toward 90% / 80%.

Signed-off-by: Ludwitt <ludwitt@ludwitt.com>
@rogerSuperBuilderAlpha rogerSuperBuilderAlpha mentioned this pull request May 19, 2026
Merged
3 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@rogerSuperBuilderAlpha @claude