Skip to content

fix(studio): show a toast when saving index page conversion fails - #3404

Merged
adriangohjw merged 3 commits into
opengovsg:mainfrom
soroush5:fix/index-conversion-save-error-toast
Oct 5, 2026
Merged

adriangohjw merged 3 commits into
opengovsg:mainfrom
soroush5:fix/index-conversion-save-error-toast

Conversation

@soroush5

@soroush5 soroush5 commented Sep 13, 2026 •

Copy link
Copy Markdown
Contributor

📊 PR diff breakdown

Bucket Files +Lines -Lines
⚙️ App 1 +8 -0
🧪 Test 1 +55 -4
📄 Doc 0 +0 -0
🚫 Ignore 0 +0 -0

Hey! Found that if converting the index page fails (bad network, server
error), the drawer just closes silently — the user thinks the save went
through but nothing was saved. Silent data-loss-shaped UX.

What I changed

  • RootStateDrawer.tsx — wired the existing onError path of the
    save mutation to the app's toast, so failures surface immediately

How I verified

Added a browser test that mocks a failed save and asserts the error
toast appears — red before (no toast), green after. Full studio suite
still green (3/3 browser tests pass).

Relates to #3405

@soroush5
soroush5 requested a review from a team as a code owner September 13, 2026 15:58
Copilot AI lite review requested due to automatic review settings September 13, 2026 15:58
@vercel

vercel Bot commented Sep 13, 2026

Copy link
Copy Markdown

@soroush5 is attempting to deploy a commit to the Isomer Team on Vercel.

A member of the Team first needs to authorize it.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

One or more issues must be addressed before approval.

Pull request overview

Adds user-visible error feedback when index-page conversion saves fail.

Changes:

  • Displays an error toast from the save mutation’s onError handler.
  • Adds browser coverage for failed conversion saves.
File summaries
File Description
apps/studio/src/features/editing-experience/components/Drawer/RootStateDrawer.tsx Updated as part of this pull request.
apps/studio/src/features/editing-experience/components/Drawer/tests/RootStateDrawer.browser.test.tsx Updated as part of this pull request.
Review details

Suppressed comments (1)

apps/studio/src/features/editing-experience/components/Drawer/tests/RootStateDrawer.browser.test.tsx:136

  • This test never exercises the index-page conversion flow: renderDrawer hard-codes ResourceType.Page, and CONTENT_PAGE has the content layout, so the conversion infobox/modal and handleSaveConversionToIndexPage are never reached. It directly invokes the mutation option instead, so a regression in wiring the actual conversion save could still pass. Use an IndexPage custom-layout fixture and drive the preview/accept path (or otherwise invoke the conversion save) while simulating the mutation failure.
    renderDrawer({
      pageState: CONTENT_PAGE,
      permalink: "about-us",
      title: "About us",
  • Files reviewed: 2/2 changed files
  • Comments generated: 0
  • Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@claude
claude Bot requested a review from dcshzj September 22, 2026 05:56
@endor-labs-pro

endor-labs-pro Bot commented Oct 5, 2026

Copy link
Copy Markdown

Warning

Endor Labs detected 1 policy violations associated with this pull request.

Please review the findings that caused the policy violations.

📋 Policy: PR Warn (38 findings)

📥 Package npm://[email protected]

⤵️ Dependency: npm://[email protected]
🚩 GHSA-55q2-fjhq-7xh7: DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS

Details

⤵️ Dependency: npm://[email protected]
🚩 GHSA-2v37-7h3g-55p8: nanoid: custom generators can loop indefinitely when size is zero

Details

  • Severity: Medium
  • Tags: Transitive Normal Reachable Dependency Reachable Function Fix Available Warning
  • Categories: SCA Vulnerability Security
  • Remediation: No newer versions of @opengovsg/design-system-react (current: 1.34.0, latest: 1.35.0) require nanoid 3.3.17 or higher. Consider other options to upgrade nanoid to 3.3.17 (current: 3.3.16, latest: 6.0.1).
⤵️ Dependency: npm://[email protected]
🚩 CVE-2026-94485: Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass

Details

  • Severity: Medium
  • Tags: Direct Normal Reachable Dependency Reachable Function Fix Available Warning
  • Categories: SCA Vulnerability Security
  • Remediation: Upgrade next to version 16.3.8 (current: 16.2.11, latest: 16.4.0-canary.54).
🚩 GHSA-p293-qw3h-jr36: Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

Details

  • Severity: Critical
  • Tags: Direct Normal Reachable Dependency Reachable Function Fix Available Warning
  • Categories: SCA Vulnerability Security
  • Remediation: Upgrade next to version 16.3.3 (current: 16.2.11, latest: 16.4.0-canary.54).
🚩 GHSA-2xp9-vwfh-vxw4: Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

Details

  • Severity: Critical
  • Tags: Direct Normal Reachable Dependency Reachable Function Fix Available Warning
  • Categories: SCA Vulnerability Security
  • Remediation: Upgrade next to version 16.3.3 (current: 16.2.11, latest: 16.4.0-canary.54).
⤵️ Dependency: npm://[email protected]
🚩 GHSA-vp8m-p9jh-q5pm: undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

Details

  • Severity: High
  • Tags: Transitive Normal Reachable Dependency Reachable Function Fix Available Warning
  • Categories: SCA Vulnerability Security
  • Remediation: Upgrade undici to version 8.10.2 (current: 8.10.0, latest: 8.11.2).

📥 Package npm://@isomer/[email protected]

⤵️ Dependency: npm://[email protected]
🚩 CVE-2023-54404: Zod 4.6.5 Uncontrolled Resource Consumption via Array Validation

Details

  • Severity: Medium
  • Tags: Direct Normal Reachable Dependency Reachable Function Unfixable Warning
  • Categories: SCA Vulnerability Security
  • Remediation: No patch upgrades available to fix the issue. Check the security advisory for alternative controls or actions.

📥 Package npm://[email protected]

⤵️ Dependency: npm://[email protected]
🚩 GHSA-vfj7-8cjw-p6xm: braces vulnerable to stack-exhaustion denial of service through deeply nested patterns

Details

  • Severity: High
  • Tags: Transitive Normal Reachable Dependency Reachable Function Unfixable Warning
  • Categories: SCA Vulnerability Security
  • Remediation: No patch upgrades available to fix the issue. Check the security advisory for alternative controls or actions.
⤵️ Dependency: npm://[email protected]
🚩 GHSA-55q2-fjhq-7xh7: DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS

Details

⤵️ Dependency: npm://[email protected]
🚩 GHSA-p293-qw3h-jr36: Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

Details

  • Severity: Critical
  • Tags: Direct Normal Reachable Dependency Reachable Function Fix Available Warning
  • Categories: SCA Vulnerability Security
  • Remediation: Update [email protected] to use next version 16.3.3 (current: 16.2.11, latest: 16.4.0-canary.54).
🚩 CVE-2026-94485: Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass

Details

  • Severity: Medium
  • Tags: Direct Normal Reachable Dependency Reachable Function Fix Available Warning
  • Categories: SCA Vulnerability Security
  • Remediation: Update [email protected] to use next version 16.3.8 (current: 16.2.11, latest: 16.4.0-canary.54).
🚩 GHSA-2xp9-vwfh-vxw4: Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

Details

  • Severity: Critical
  • Tags: Direct Normal Reachable Dependency Reachable Function Fix Available Warning
  • Categories: SCA Vulnerability Security
  • Remediation: Update [email protected] to use next version 16.3.3 (current: 16.2.11, latest: 16.4.0-canary.54).
⤵️ Dependency: npm://[email protected]
🚩 GHSA-r28c-9q8g-f849: PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

Details

🚩 GHSA-6g55-p6wh-862q: PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

Details

🚩 GHSA-qx2v-qp2m-jg93: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

Details

🚩 GHSA-fxqj-rqcc-2cmp: PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

Details

⤵️ Dependency: npm://[email protected]
🚩 GHSA-vp8m-p9jh-q5pm: undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

Details

📥 Package npm://@isomer/[email protected]

⤵️ Dependency: npm://[email protected]
🚩 GHSA-vp8m-p9jh-q5pm: undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

Details

  • Severity: High
  • Tags: Transitive Normal Reachable Dependency Reachable Function Fix Available Warning
  • Categories: SCA Vulnerability Security
  • Remediation: Check if you can use a newer version of vitest (current: 5.0.0, latest: 5.0.3) that requires undici 8.10.2 or higher (current: 8.10.0, latest: 8.11.2). See for example [email protected] ([email protected]).
⤵️ Dependency: npm://[email protected]
🚩 CVE-2023-54404: Zod 4.6.5 Uncontrolled Resource Consumption via Array Validation

Details

  • Severity: Medium
  • Tags: Direct Normal Reachable Dependency Reachable Function Unfixable Warning
  • Categories: SCA Vulnerability Security
  • Remediation: No patch upgrades available to fix the issue. Check the security advisory for alternative controls or actions.

📥 Package npm://@isomer/[email protected]

⤵️ Dependency: npm://[email protected]
🚩 GHSA-vp8m-p9jh-q5pm: undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

Details

  • Severity: High
  • Tags: Transitive Normal Reachable Dependency Reachable Function Fix Available Warning
  • Categories: SCA Vulnerability Security
  • Remediation: Check if you can use a newer version of vitest (current: 5.0.0, latest: 5.0.3) that requires undici 8.10.2 or higher (current: 8.10.0, latest: 8.11.2). See for example [email protected] ([email protected]).

📥 Package npm://@isomer/site-launch@pr/3404

⤵️ Dependency: npm://[email protected]
🚩 GHSA-r4gj-5m52-g5wh: Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF

Details

  • Severity: High
  • Tags: Direct Normal Reachable Dependency Reachable Function Fix Available Warning
  • Categories: SCA Vulnerability Security
  • Remediation: Update @isomer/site-launch@pr/3404 to use axios version 1.20.0 (current: 1.19.0, latest: 1.20.0).
🚩 GHSA-x97p-jq2g-jp4f: Axios: Prototype Pollution Gadget in axios toFormData Options

Details

  • Severity: High
  • Tags: Direct Normal Reachable Dependency Reachable Function Fix Available Warning
  • Categories: SCA Vulnerability Security
  • Remediation: Update @isomer/site-launch@pr/3404 to use axios version 1.20.0 (current: 1.19.0, latest: 1.20.0).
🚩 GHSA-m8m8-qj5v-23w3: Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection

Details

  • Severity: High
  • Tags: Direct Normal Reachable Dependency Reachable Function Fix Available Warning
  • Categories: SCA Vulnerability Security
  • Remediation: Update @isomer/site-launch@pr/3404 to use axios version 1.20.0 (current: 1.19.0, latest: 1.20.0).
🚩 GHSA-c29m-xwm3-cm6r: Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)

Details

  • Severity: High
  • Tags: Direct Normal Reachable Dependency Reachable Function Fix Available Warning
  • Categories: SCA Vulnerability Security
  • Remediation: Update @isomer/site-launch@pr/3404 to use axios version 1.20.0 (current: 1.19.0, latest: 1.20.0).
🚩 GHSA-542g-h47m-68v8: Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization

Details

  • Severity: High
  • Tags: Direct Normal Reachable Dependency Reachable Function Fix Available Warning
  • Categories: SCA Vulnerability Security
  • Remediation: Update @isomer/site-launch@pr/3404 to use axios version 1.20.0 (current: 1.19.0, latest: 1.20.0).
🚩 GHSA-mghh-pgcx-3jjj: Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location

Details

  • Severity: High
  • Tags: Direct Normal Reachable Dependency Reachable Function Fix Available Warning
  • Categories: SCA Vulnerability Security
  • Remediation: Update @isomer/site-launch@pr/3404 to use axios version 1.20.0 (current: 1.19.0, latest: 1.20.0).
🚩 GHSA-3pq3-5fj3-cg6v: Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls

Details

  • Severity: High
  • Tags: Direct Normal Reachable Dependency Reachable Function Fix Available Warning
  • Categories: SCA Vulnerability Security
  • Remediation: Update @isomer/site-launch@pr/3404 to use axios version 1.20.0 (current: 1.19.0, latest: 1.20.0).
⤵️ Dependency: npm://[email protected]
🚩 CVE-2023-54404: Zod 4.6.5 Uncontrolled Resource Consumption via Array Validation

Details

  • Severity: Medium
  • Tags: Direct Normal Reachable Dependency Reachable Function Unfixable Warning
  • Categories: SCA Vulnerability Security
  • Remediation: No patch upgrades available to fix the issue. Check the security advisory for alternative controls or actions.

📥 Package npm://@opengovsg/[email protected]

⤵️ Dependency: npm://[email protected]
🚩 GHSA-vfj7-8cjw-p6xm: braces vulnerable to stack-exhaustion denial of service through deeply nested patterns

Details

  • Severity: High
  • Tags: Transitive Normal Reachable Dependency Reachable Function Unfixable Warning
  • Categories: SCA Vulnerability Security
  • Remediation: No patch upgrades available to fix the issue. Check the security advisory for alternative controls or actions.
⤵️ Dependency: npm://[email protected]
🚩 GHSA-55q2-fjhq-7xh7: DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS

Details

⤵️ Dependency: npm://[email protected]
🚩 CVE-2023-54404: Zod 4.6.5 Uncontrolled Resource Consumption via Array Validation

Details

  • Severity: Medium
  • Tags: Direct Normal Reachable Dependency Reachable Function Unfixable Warning
  • Categories: SCA Vulnerability Security
  • Remediation: No patch upgrades available to fix the issue. Check the security advisory for alternative controls or actions.

📥 Package npm://@isomer/migrate-tags@pr/3404

⤵️ Dependency: npm://[email protected]
🚩 GHSA-mghh-pgcx-3jjj: Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location

Details

  • Severity: High
  • Tags: Direct Normal Reachable Dependency Reachable Function Fix Available Warning
  • Categories: SCA Vulnerability Security
  • Remediation: Update @isomer/migrate-tags@pr/3404 to use axios version 1.20.0 (current: 1.19.0, latest: 1.20.0).
🚩 GHSA-x97p-jq2g-jp4f: Axios: Prototype Pollution Gadget in axios toFormData Options

Details

  • Severity: High
  • Tags: Direct Normal Reachable Dependency Reachable Function Fix Available Warning
  • Categories: SCA Vulnerability Security
  • Remediation: Update @isomer/migrate-tags@pr/3404 to use axios version 1.20.0 (current: 1.19.0, latest: 1.20.0).
🚩 GHSA-542g-h47m-68v8: Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization

Details

  • Severity: High
  • Tags: Direct Normal Reachable Dependency Reachable Function Fix Available Warning
  • Categories: SCA Vulnerability Security
  • Remediation: Update @isomer/migrate-tags@pr/3404 to use axios version 1.20.0 (current: 1.19.0, latest: 1.20.0).
🚩 GHSA-r4gj-5m52-g5wh: Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF

Details

  • Severity: High
  • Tags: Direct Normal Reachable Dependency Reachable Function Fix Available Warning
  • Categories: SCA Vulnerability Security
  • Remediation: Update @isomer/migrate-tags@pr/3404 to use axios version 1.20.0 (current: 1.19.0, latest: 1.20.0).
🚩 GHSA-m8m8-qj5v-23w3: Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection

Details

  • Severity: High
  • Tags: Direct Normal Reachable Dependency Reachable Function Fix Available Warning
  • Categories: SCA Vulnerability Security
  • Remediation: Update @isomer/migrate-tags@pr/3404 to use axios version 1.20.0 (current: 1.19.0, latest: 1.20.0).
🚩 GHSA-c29m-xwm3-cm6r: Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)

Details

  • Severity: High
  • Tags: Direct Normal Reachable Dependency Reachable Function Fix Available Warning
  • Categories: SCA Vulnerability Security
  • Remediation: Update @isomer/migrate-tags@pr/3404 to use axios version 1.20.0 (current: 1.19.0, latest: 1.20.0).
🚩 GHSA-3pq3-5fj3-cg6v: Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls

Details

  • Severity: High
  • Tags: Direct Normal Reachable Dependency Reachable Function Fix Available Warning
  • Categories: SCA Vulnerability Security
  • Remediation: Update @isomer/migrate-tags@pr/3404 to use axios version 1.20.0 (current: 1.19.0, latest: 1.20.0).

This comment was automatically generated by Endor Labs.
Scanned @ 10-05-2026 05:42:19 UTC

@adriangohjw
adriangohjw merged commit 231cbd6 into opengovsg:main Oct 5, 2026
27 of 29 checks passed
@soroush5

soroush5 commented Oct 5, 2026

Copy link
Copy Markdown
Contributor Author

Thanks for tightening the test and merging this.

This branch had an error being deployed

1 failed deployment
staging — 4ea8712c Deployed Oct 5, 2026 by adriangohjw via studio #16412
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants