From 060762a71f6ea0c8fe3910316db7ea2ed5240097 Mon Sep 17 00:00:00 2001
From: onmax <maximogarciamtnez@gmail.com>
Date: Sun, 31 May 2026 11:16:32 +0200
Subject: [PATCH 1/7] fix: prevent chat suggestions from submitting forms

A form-associated <button> defaults to type="submit", not type="button". The suggestion tiles trigger a chat action, so declaring type="button" keeps them inert if this prompt area is ever wrapped by a form.

Docs: https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/button#type
---
 app/components/chat/ChatPanel.vue | 1 +
 1 file changed, 1 insertion(+)

diff --git a/app/components/chat/ChatPanel.vue b/app/components/chat/ChatPanel.vue
index d1742f33a..51f231646 100644
--- a/app/components/chat/ChatPanel.vue
+++ b/app/components/chat/ChatPanel.vue
@@ -126,6 +126,7 @@ const suggestions = [
             <button
               v-for="suggestion in suggestions"
               :key="suggestion.title"
+              type="button"
               class="flex sm:flex-col gap-3 p-4 rounded-lg border border-default bg-default hover:bg-elevated/50 text-left transition-colors cursor-pointer"
               @click="askQuestion(suggestion.question)"
             >

From 58070fe2ec91aa4b10daceb9811d0fe84755d861 Mon Sep 17 00:00:00 2001
From: onmax <maximogarciamtnez@gmail.com>
Date: Sun, 31 May 2026 11:16:42 +0200
Subject: [PATCH 2/7] fix: serialize feedback date ranges in state

Nuxt useState is serialized through the payload, so the state value should stay JSON-safe. Store ISO strings there and expose Date objects through a computed wrapper so consumers keep the same API without relying on Date instances surviving hydration.

The default range also uses the same startOfDay/endOfDay normalization as setDateRange. That keeps the first "Last 30 days" window aligned with picker and preset updates instead of using raw timestamps.

Docs: https://nuxt.com/docs/4.x/getting-started/state-management

Docs: https://nuxt.com/docs/api/composables/use-state
---
 app/composables/useDateRange.ts | 25 +++++++++++++++++++------
 1 file changed, 19 insertions(+), 6 deletions(-)

diff --git a/app/composables/useDateRange.ts b/app/composables/useDateRange.ts
index 08d9b8a42..ec57660b4 100644
--- a/app/composables/useDateRange.ts
+++ b/app/composables/useDateRange.ts
@@ -5,16 +5,29 @@ export interface DateRange {
   end: Date
 }
 
+interface SerializedDateRange {
+  start: string
+  end: string
+}
+
 export function useDateRange() {
-  const dateRange = useState<DateRange>('feedback-date-range', () => ({
-    start: subDays(new Date(), 30),
-    end: new Date()
+  const serializedDateRange = useState<SerializedDateRange>('feedback-date-range', () => {
+    const end = endOfDay(new Date())
+    return {
+      start: startOfDay(subDays(end, 30)).toISOString(),
+      end: end.toISOString()
+    }
+  })
+
+  const dateRange = computed<DateRange>(() => ({
+    start: new Date(serializedDateRange.value.start),
+    end: new Date(serializedDateRange.value.end)
   }))
 
   const setDateRange = (range: DateRange) => {
-    dateRange.value = {
-      start: startOfDay(range.start),
-      end: endOfDay(range.end)
+    serializedDateRange.value = {
+      start: startOfDay(range.start).toISOString(),
+      end: endOfDay(range.end).toISOString()
     }
   }
 

From 1cf268e0205f539b1eee850d8631ceb935b33a71 Mon Sep 17 00:00:00 2001
From: onmax <maximogarciamtnez@gmail.com>
Date: Sun, 31 May 2026 11:16:48 +0200
Subject: [PATCH 3/7] fix: keep sponsor data composables in Nuxt context

Nuxt documents useFetch as a composable that should be called directly in setup, plugins, or route middleware so it can register payload state for hydration. Calling useFetch and useAsyncData directly in this composable keeps the Nuxt data primitives visible instead of hiding them behind a generic Promise.all boundary.

The call sites can still include useSponsors() in their existing Promise.all arrays; Promise.all accepts plain values, and the composable keeps returning the same sponsors helpers.

Docs: https://nuxt.com/docs/4.x/api/composables/use-fetch
---
 app/composables/useSponsors.ts | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/app/composables/useSponsors.ts b/app/composables/useSponsors.ts
index d5d23e5fc..77b35c5b4 100644
--- a/app/composables/useSponsors.ts
+++ b/app/composables/useSponsors.ts
@@ -1,10 +1,8 @@
 import type { Sponsor } from '#shared/types'
 
-export const useSponsors = async () => {
-  const [{ data: apiSponsors }, { data: manualSponsors }] = await Promise.all([
-    useFetch('/api/sponsors', { key: 'sponsors' }),
-    useAsyncData('manual-sponsors', () => queryCollection('manualSponsors').first())
-  ])
+export const useSponsors = () => {
+  const { data: apiSponsors } = useFetch('/api/sponsors', { key: 'sponsors' })
+  const { data: manualSponsors } = useAsyncData('manual-sponsors', () => queryCollection('manualSponsors').first())
 
   const sponsors = computed(() => {
     const manual = manualSponsors.value?.sponsors || []

From abfe02b8174e51aef34b47ea9d07af07658d1b9d Mon Sep 17 00:00:00 2001
From: onmax <maximogarciamtnez@gmail.com>
Date: Sun, 31 May 2026 11:17:03 +0200
Subject: [PATCH 4/7] fix: preserve request context in team auth fetches

Nuxt server-route docs say request headers and request context are not forwarded by default for server-side fetches, and event.$fetch should be used when that context should follow the internal request. The same server docs recommend passing event to useRuntimeConfig in server routes so runtime environment overrides are resolved against the active request.

This keeps the admin/team helpers on request-aware server primitives instead of ambient global fetch/config access.

Docs: https://nuxt.com/docs/4.x/directory-structure/server#forwarding-context-headers

Docs: https://nuxt.com/docs/4.x/directory-structure/server#runtime-config
---
 server/api/admin/mcp-install.get.ts |  2 +-
 server/api/auth/github.get.ts       |  2 +-
 server/api/v1/teams/index.get.ts    |  6 +++---
 server/utils/team.ts                | 17 +++++++++--------
 4 files changed, 14 insertions(+), 13 deletions(-)

diff --git a/server/api/admin/mcp-install.get.ts b/server/api/admin/mcp-install.get.ts
index 5c54fa7fd..14542a06b 100644
--- a/server/api/admin/mcp-install.get.ts
+++ b/server/api/admin/mcp-install.get.ts
@@ -1,7 +1,7 @@
 export default defineEventHandler(async (event) => {
   const { user } = await requireUserSession(event)
 
-  if (!user?.login || !(await isAuthorizedAdmin(user.login))) {
+  if (!user?.login || !(await isAuthorizedAdmin(event, user.login))) {
     throw createError({ statusCode: 403, statusMessage: 'Admin access required' })
   }
 
diff --git a/server/api/auth/github.get.ts b/server/api/auth/github.get.ts
index ff6125fbe..c6c162f66 100644
--- a/server/api/auth/github.get.ts
+++ b/server/api/auth/github.get.ts
@@ -1,6 +1,6 @@
 export default defineOAuthGitHubEventHandler({
   async onSuccess(event, { user }) {
-    const allowed = await isAuthorizedAdmin(user.login)
+    const allowed = await isAuthorizedAdmin(event, user.login)
 
     if (!allowed) {
       return sendRedirect(event, '/admin/login?error=access-denied')
diff --git a/server/api/v1/teams/index.get.ts b/server/api/v1/teams/index.get.ts
index 5a7b87572..5643f8d33 100644
--- a/server/api/v1/teams/index.get.ts
+++ b/server/api/v1/teams/index.get.ts
@@ -1,9 +1,9 @@
 import type { GitHubTeamMember } from '../../../types/github'
 
-export default defineCachedEventHandler(async () => {
+export default defineCachedEventHandler(async (event) => {
   const [core, _ecosystem] = await Promise.all([
-    $fetch<GitHubTeamMember[]>('/api/v1/teams/core'),
-    $fetch<GitHubTeamMember[]>('/api/v1/teams/ecosystem')
+    event.$fetch<GitHubTeamMember[]>('/api/v1/teams/core'),
+    event.$fetch<GitHubTeamMember[]>('/api/v1/teams/ecosystem')
   ])
 
   const filteredEcosystem = [] as GitHubTeamMember[]
diff --git a/server/utils/team.ts b/server/utils/team.ts
index 76ce8252f..d4190c648 100644
--- a/server/utils/team.ts
+++ b/server/utils/team.ts
@@ -1,12 +1,13 @@
 import type { GitHubTeamMember } from '../types/github'
+import type { H3Event } from 'h3'
 
-const getCoreMembers = cachedFunction((): Promise<GitHubTeamMember[]> => $fetch<GitHubTeamMember[]>('/api/v1/teams/core'), {
+const getCoreMembers = cachedFunction((event: H3Event): Promise<GitHubTeamMember[]> => event.$fetch<GitHubTeamMember[]>('/api/v1/teams/core'), {
   maxAge: 60 * 60 * 24 * 7, // 1 week
   getKey: () => 'core-members'
 })
 
-export async function isCoreTeamMember(login: string): Promise<boolean> {
-  const coreMembers = await getCoreMembers()
+export async function isCoreTeamMember(event: H3Event, login: string): Promise<boolean> {
+  const coreMembers = await getCoreMembers(event)
   if (!coreMembers || !Array.isArray(coreMembers)) {
     throw createError({
       statusCode: 500,
@@ -16,8 +17,8 @@ export async function isCoreTeamMember(login: string): Promise<boolean> {
   return coreMembers.some(member => member.login.toLowerCase() === login)
 }
 
-function getExtraAdminLogins(): string[] {
-  const raw = useRuntimeConfig().adminGithubLogins
+function getExtraAdminLogins(event: H3Event): string[] {
+  const raw = useRuntimeConfig(event).adminGithubLogins
   if (!raw) return []
   return raw
     .split(',')
@@ -25,10 +26,10 @@ function getExtraAdminLogins(): string[] {
     .filter(Boolean)
 }
 
-export async function isAuthorizedAdmin(login: string): Promise<boolean> {
+export async function isAuthorizedAdmin(event: H3Event, login: string): Promise<boolean> {
   const normalized = login.toLowerCase()
-  if (getExtraAdminLogins().includes(normalized)) {
+  if (getExtraAdminLogins(event).includes(normalized)) {
     return true
   }
-  return isCoreTeamMember(normalized)
+  return isCoreTeamMember(event, normalized)
 }

From 66a8d84f06ceb33f19483be76533294d06be965a Mon Sep 17 00:00:00 2001
From: onmax <maximogarciamtnez@gmail.com>
Date: Sun, 31 May 2026 11:17:08 +0200
Subject: [PATCH 5/7] fix: constrain canonical head links to safe attributes

Nuxt recommends useHeadSafe when head data is derived from input because it restricts rendered head fields to a safe attribute whitelist. The canonical composable builds links from route and optional content-derived markdown paths, and useHeadSafe still allows the rel, href, type, and related link attributes this helper emits.

Docs: https://nuxt.com/docs/4.x/api/composables/use-head-safe
---
 app/composables/useCanonical.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/composables/useCanonical.ts b/app/composables/useCanonical.ts
index a6bf1be7b..445a01a65 100644
--- a/app/composables/useCanonical.ts
+++ b/app/composables/useCanonical.ts
@@ -10,7 +10,7 @@ export function useCanonical(markdownAlternate?: MaybeRefOrGetter<string | null
   const route = useRoute()
   const site = useSiteConfig()
 
-  useHead({
+  useHeadSafe({
     link: computed(() => {
       const links: Link[] = [
         { rel: 'canonical', href: joinURL(site.url, route.path) }

From 148cc2e9d462f5f284700e6f19459ac33c3d0c31 Mon Sep 17 00:00:00 2001
From: onmax <maximogarciamtnez@gmail.com>
Date: Sun, 31 May 2026 11:17:14 +0200
Subject: [PATCH 6/7] fix: run DOM-dependent watchers after render

Vue runs normal watcher callbacks before the owner component DOM has updated. These watchers read or mutate DOM state after reactive values change, so flush="post" schedules them after Vue applies the render update.

Docs: https://vuejs.org/guide/essentials/watchers.html#callback-flush-timing
---
 app/components/AdminDashboard.vue | 2 +-
 app/pages/modules/index.vue       | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/components/AdminDashboard.vue b/app/components/AdminDashboard.vue
index 412d9c7ce..1f4a693ab 100644
--- a/app/components/AdminDashboard.vue
+++ b/app/components/AdminDashboard.vue
@@ -320,7 +320,7 @@ watch(currentPage, () => {
   if (feedbackContainer.value) {
     feedbackContainer.value.scrollTop = 0
   }
-})
+}, { flush: 'post' })
 </script>
 
 <template>
diff --git a/app/pages/modules/index.vue b/app/pages/modules/index.vue
index a5ae23151..3e5b5fac3 100644
--- a/app/pages/modules/index.vue
+++ b/app/pages/modules/index.vue
@@ -91,7 +91,7 @@ watch(scrollY, (y) => {
   if (window.innerHeight + y >= document.documentElement.scrollHeight - SCROLL_THRESHOLD) {
     debouncedLoadMore()
   }
-})
+}, { flush: 'post' })
 
 watch(filteredModules, () => {
   isLoading.value = false

From 75a4e85a04fe7d0ba8670dd97732a4710652723b Mon Sep 17 00:00:00 2001
From: onmax <maximogarciamtnez@gmail.com>
Date: Sun, 31 May 2026 11:17:21 +0200
Subject: [PATCH 7/7] fix: describe optimized images explicitly

Nuxt Image renders native img attributes and documents that alt should always be provided. Deployment logos carry information, so the logo image gets an explicit label.

Nuxt Image also generates responsive candidates from the sizes option. The video-course logos are fixed-size images, so the sizes value now matches the actual sponsor/non-sponsor rendered width instead of forcing a wider candidate for every course.

Docs: https://image.nuxt.com/usage/nuxt-img#alt

Docs: https://image.nuxt.com/usage/nuxt-img#sizes
---
 app/pages/deploy/index.vue  | 9 ++++++++-
 app/pages/video-courses.vue | 1 +
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/app/pages/deploy/index.vue b/app/pages/deploy/index.vue
index ddd4724cb..96eebed27 100644
--- a/app/pages/deploy/index.vue
+++ b/app/pages/deploy/index.vue
@@ -62,7 +62,14 @@ await fetchList()
             }"
           >
             <template #leading>
-              <NuxtImg v-if="deployment.logoSrc" :src="deployment.logoSrc" width="40" height="40" class="w-10 h-10" />
+              <NuxtImg
+                v-if="deployment.logoSrc"
+                :src="deployment.logoSrc"
+                :alt="`${deployment.title} logo`"
+                width="40"
+                height="40"
+                class="w-10 h-10"
+              />
               <UIcon v-else :name="deployment.logoIcon" class="size-10 text-black dark:text-white" />
             </template>
             <UBadge
diff --git a/app/pages/video-courses.vue b/app/pages/video-courses.vue
index 0e8e22aa5..c5aded5c2 100644
--- a/app/pages/video-courses.vue
+++ b/app/pages/video-courses.vue
@@ -45,6 +45,7 @@ defineOgImage('Docs.takumi', {
               :alt="course.name"
               :width="'sponsor' in course && course.sponsor ? 94 : 56"
               :height="'sponsor' in course && course.sponsor ? 47 : 28"
+              :sizes="'sponsor' in course && course.sponsor ? '94px' : '56px'"
               format="webp"
               :modifiers="{ position: 'top' }"
               :loading="index > 3 ? 'lazy' : undefined"