[comp] Production Deploy #1949

github-actions · 2025-12-23T20:18:26Z

This is an automated pull request to release the candidate branch into production, which will trigger a deployment.
It was created by the [Production PR] action.

* feat: task assignment for vendor and records * refactor(auth): simplify role validation and update entity types * refactor(task): clean and fix bug * feat(task): add GetTaskItemStatsQueryDto for task item stats retrieval * chore: added focus mode for task, improved logic and cleaning up * feat(task): add task item attachment upload and activity logging * feat: add comments to task, notifications in email and in-appm clean code * feat: risk assesstment for vendors, fix some bugs * refactor(notifications): clean up NovuService fetch logic and error handling * feat(api): add INTERNAL_API_TOKEN to environment example * feat(env): add INTERNAL_API_TOKEN to environment configuration * chore(api): fix bugs * fix(api): update default framework ID from iso42001 to iso27001 * fix(api): correct entity route path for risk in comment notifier --------- Co-authored-by: Tofik Hasanov <annexcies@gmail.com>

vercel · 2025-12-23T20:18:31Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
app (staging)	Ready	Preview, Comment	Dec 31, 2025 5:55pm
portal (staging)	Ready	Preview, Comment	Dec 31, 2025 5:55pm

cursor · 2025-12-23T20:18:31Z

PR Summary

Introduces task/evidence management with role-based access, notifications, and vendor automation; increases upload limits and adds trust portal FAQs.

New Task Management: Adds module with CRUD APIs, pagination/stats, attachments (special S3 paths), activity logs, and role guard; exposed in task-management/* endpoints.
Notifications: Email + Novu in‑app for task assignments and mentions; comment mention notifications; Novu service + envs (NOVU_API_KEY, NEXT_PUBLIC_NOVU_APPLICATION_IDENTIFIER).
Auth/Guards: Propagate userRoles; new InternalTokenGuard; role validator (RequireRoles) across endpoints.
Vendor Risk Assessment Automation: Trigger.dev tasks to create "Risk Assessment" task items (with optional Firecrawl research); batch internal endpoint and backfill task.
Trust Portal: New GET /trust/:friendlyUrl/faqs and ability to manage FAQs; organization primary color error handling tweak.
File handling limits: Max upload increased to 100MB (API and app); request body limits raised (150MB); knowledge base/questionnaire/task attachments updated accordingly.
Comments: Mention notifier service; improved entity validation and better errors; minor controller cleanup.
Build/runtime: Dockerfile includes packages/email; api/app package updates.
App UI: “Tasks” renamed to “Evidence”, task items added to Risk page with deep links; new email preferences (task mentions/assignments); copy updates.

^{Written by Cursor Bugbot for commit 77b6c21. This will update automatically on new commits. Configure here.}

CLAassistant · 2025-12-23T20:18:33Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

graphite-app · 2025-12-23T20:20:11Z

Graphite Automations

"Auto-assign PRs to Author" took an action on this PR • (12/23/25)

1 reviewer was added to this PR based on Mariano Fuentes's automation.

cursor · 2025-12-23T20:24:06Z

apps/api/src/task-management/task-management.service.ts

+        } else {
+          this.logger.log(`[MENTION DEBUG] No mentions found in description`);
+        }
+      }


Task update notifies all mentioned users repeatedly

The updateTaskItem function sends mention notifications to ALL mentioned users on every description update, rather than only newly mentioned users. The comments service correctly compares previous and current mentions using extractMentionedUserIds(existingComment.content) and filters with currentMentioned.filter((id) => !previousMentioned.has(id)). The task management service has access to existingTaskItem.description but doesn't use it for this comparison. This causes users to receive duplicate notifications every time a task description is edited, even for minor typo fixes.

cursor · 2025-12-23T20:24:06Z

apps/app/src/app/(app)/[orgId]/vendors/actions/create-vendor-action.ts

          assigneeId: input.parsedInput.assigneeId,
-          organizationId: session.session.activeOrganizationId,
+          website: input.parsedInput.website,
+          organizationId: input.parsedInput.organizationId,


Web UI vendor creation misses risk assessment task

The vendors.service.ts was updated to trigger vendor-risk-assessment-task when creating vendors (which creates a TaskItem), but the web UI's create-vendor-action.ts server action creates vendors directly in the database without triggering this task. The researchVendorAction called by the form only takes a website URL without vendor context, so it cannot create the TaskItem. This means vendors created through the web UI won't receive automatic risk assessment TaskItems, while vendors created through the API will. The existence of backfill-vendor-risk-assessment-tasks.ts confirms the intent is for all vendors to have these tasks.

Additional Locations (1)

apps/api/src/vendors/vendors.service.ts#L74-L94

…1950) Co-authored-by: Tofik Hasanov <annexcies@gmail.com>

cursor · 2025-12-23T21:20:19Z

apps/api/src/comments/comment-mention-notifier.service.ts

+      const parentRoutePath = taskItem?.entityType === 'vendor' ? 'vendors' : 'risk';
+      const commentUrl = taskItem
+        ? `${appUrl}/${organizationId}/${parentRoutePath}/${taskItem.entityId}?taskItemId=${entityId}#task-items`
+        : '';


Comment mention notifications broken for legacy Task entities

The comment mention notifier only handles CommentEntityType.task comments, but assumes entityId is always a TaskItem ID. However, comments.service.ts explicitly supports both TaskItem and legacy Task entities under this type (with backward compatibility comments). When a comment is made on a legacy Task (not TaskItem), db.taskItem.findUnique returns null, causing entityName to default to "Unknown Task" and commentUrl to be an empty string. The notification email will then display a broken "View Comment" button linking to nothing and show "copy and paste this URL:" with an empty link.

…ons (#1951) Co-authored-by: Tofik Hasanov <annexcies@gmail.com>

Co-authored-by: Tofik Hasanov <annexcies@gmail.com>

cursor · 2025-12-23T21:46:18Z

apps/app/src/app/(app)/[orgId]/vendors/[vendorId]/page.tsx

    where: {
      id: vendorId,
-      organizationId: session.session.activeOrganizationId,
+      organizationId,


Vendor page removed organization access validation from session

The getVendor and getAssignees functions were changed from validating session.session.activeOrganizationId to accepting organizationId directly from URL params without verifying the authenticated user has access to that organization. Previously the code checked if (!session || !session.session.activeOrganizationId), ensuring the user had an active org context. Now it only checks if (!session?.user?.id) and trusts the orgId URL param. This is inconsistent with the risk page which still uses session-based org validation. An authenticated user could potentially access vendor data from other organizations by manipulating the URL, unless there's middleware protection not visible in this diff.

Additional Locations (1)

apps/app/src/app/(app)/[orgId]/vendors/[vendorId]/page.tsx#L114-L127

…1954) Co-authored-by: Tofik Hasanov <annexcies@gmail.com>

* feat(api): update firecrawl integration and enhance risk assessment task * feat(api): enhance news item processing in firecrawl agent --------- Co-authored-by: Tofik Hasanov <annexcies@gmail.com>

…nd skeleton UI (#1956) Co-authored-by: Tofik Hasanov <annexcies@gmail.com>

…#1957) Co-authored-by: Tofik Hasanov <annexcies@gmail.com>

* feat: faq trust portal logic in trust setting * fix: change field name for faq, update UI * chore: update db package to canory version to check logic in stage * feat(trust): normalize FAQ order on save and update handling * feat(trust): create collision-safe temporary FAQ IDs and optimize dirty state handling * fix(trust): update FAQ prompt text for clarity --------- Co-authored-by: Tofik Hasanov <annexcies@gmail.com>

Co-authored-by: Tofik Hasanov <annexcies@gmail.com>

* chore: update @trycompai/db package version to 1.3.20 * chore: update @trycompai/db package version to 1.3.20 --------- Co-authored-by: Tofik Hasanov <annexcies@gmail.com>

claudfuen · 2026-01-01T22:09:00Z

🎉 This PR is included in version 1.72.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

github-actions bot added prod-deploy automated-pr labels Dec 23, 2025

graphite-app bot requested a review from Marfuen December 23, 2025 20:18

vercel bot deployed to staging – portal December 23, 2025 20:19 View deployment

vercel bot deployed to staging – app December 23, 2025 20:20 View deployment

cursor bot reviewed Dec 23, 2025

View reviewed changes

fix(email): update import paths for unsubscribe URL to new package (#…

a133735

…1950) Co-authored-by: Tofik Hasanov <annexcies@gmail.com>

vercel bot temporarily deployed to staging – portal December 23, 2025 21:15 Inactive

vercel bot temporarily deployed to staging – app December 23, 2025 21:15 Inactive

cursor bot reviewed Dec 23, 2025

View reviewed changes

feat(email): add email package and update import paths for notificati…

79407cf

…ons (#1951) Co-authored-by: Tofik Hasanov <annexcies@gmail.com>

vercel bot deployed to staging – app December 23, 2025 21:29 View deployment

vercel bot deployed to staging – portal December 23, 2025 21:29 View deployment

chore(email): remove unused dependency on @trycompai/ui (#1952)

c65ff2f

Co-authored-by: Tofik Hasanov <annexcies@gmail.com>

vercel bot deployed to staging – app December 23, 2025 21:42 View deployment

vercel bot deployed to staging – portal December 23, 2025 21:42 View deployment

cursor bot reviewed Dec 23, 2025

View reviewed changes

chore(docker): update Dockerfile to include email package in build (#…

72e4a47

…1954) Co-authored-by: Tofik Hasanov <annexcies@gmail.com>

vercel bot temporarily deployed to staging – portal December 23, 2025 23:37 Inactive

vercel bot temporarily deployed to staging – app December 23, 2025 23:37 Inactive

[dev] [tofikwest] tofik/update-ui-task-comments-sidebar (#1955)

154ca39

* feat(api): update firecrawl integration and enhance risk assessment task * feat(api): enhance news item processing in firecrawl agent --------- Co-authored-by: Tofik Hasanov <annexcies@gmail.com>

vercel bot deployed to staging – app December 24, 2025 06:20 View deployment

vercel bot deployed to staging – portal December 24, 2025 06:20 View deployment

feat(api): enhance vendor risk assessment task with status handling a…

012cba9

…nd skeleton UI (#1956) Co-authored-by: Tofik Hasanov <annexcies@gmail.com>

vercel bot temporarily deployed to staging – portal December 24, 2025 15:06 Inactive

vercel bot deployed to staging – app December 24, 2025 15:08 View deployment

feat(api): increase concurrency limit for vendor risk assessment task (…

0a2bd7a

…#1957) Co-authored-by: Tofik Hasanov <annexcies@gmail.com>

vercel bot temporarily deployed to staging – app December 24, 2025 15:48 Inactive

vercel bot temporarily deployed to staging – portal December 24, 2025 15:48 Inactive

mintlify bot deployed to staging - packages/docs December 27, 2025 00:05 View deployment

mintlify bot deployed to staging - packages/docs December 27, 2025 00:06 View deployment

vercel bot deployed to staging – app December 27, 2025 00:07 View deployment

vercel bot deployed to staging – portal December 27, 2025 00:07 View deployment

feat(api): increase file upload size limits to 100MB (#1959)

31da681

Co-authored-by: Tofik Hasanov <annexcies@gmail.com>

vercel bot temporarily deployed to staging – portal December 27, 2025 01:44 Inactive

vercel bot deployed to staging – app December 27, 2025 01:46 View deployment

[dev] [tofikwest] tofik/update-db-version (#1960)

77b6c21

* chore: update @trycompai/db package version to 1.3.20 * chore: update @trycompai/db package version to 1.3.20 --------- Co-authored-by: Tofik Hasanov <annexcies@gmail.com>

vercel bot deployed to staging – app December 31, 2025 17:55 View deployment

vercel bot deployed to staging – portal December 31, 2025 17:55 View deployment

Marfuen merged commit aac5172 into release Jan 1, 2026
16 of 17 checks passed

claudfuen added the released label Jan 1, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[comp] Production Deploy #1949

[comp] Production Deploy #1949

Uh oh!

github-actions bot commented Dec 23, 2025

Uh oh!

vercel bot commented Dec 23, 2025 •

edited

Loading

Uh oh!

cursor bot commented Dec 23, 2025 •

edited

Loading

Uh oh!

CLAassistant commented Dec 23, 2025

Uh oh!

graphite-app bot commented Dec 23, 2025

Uh oh!

cursor bot Dec 23, 2025

Uh oh!

cursor bot Dec 23, 2025

Uh oh!

cursor bot Dec 23, 2025

Uh oh!

cursor bot Dec 23, 2025

Uh oh!

Uh oh!

claudfuen commented Jan 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

[comp] Production Deploy #1949

[comp] Production Deploy #1949

Uh oh!

Conversation

github-actions bot commented Dec 23, 2025

Uh oh!

vercel bot commented Dec 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor bot commented Dec 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

CLAassistant commented Dec 23, 2025

Uh oh!

graphite-app bot commented Dec 23, 2025

Graphite Automations

Uh oh!

cursor bot Dec 23, 2025

Choose a reason for hiding this comment

Task update notifies all mentioned users repeatedly

Uh oh!

cursor bot Dec 23, 2025

Choose a reason for hiding this comment

Web UI vendor creation misses risk assessment task

Uh oh!

cursor bot Dec 23, 2025

Choose a reason for hiding this comment

Comment mention notifications broken for legacy Task entities

Uh oh!

cursor bot Dec 23, 2025

Choose a reason for hiding this comment

Vendor page removed organization access validation from session

Uh oh!

Uh oh!

claudfuen commented Jan 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

vercel bot commented Dec 23, 2025 •

edited

Loading

cursor bot commented Dec 23, 2025 •

edited

Loading