Uh oh!
There was an error while loading. Please reload this page.
Update AngularJS to 1.8 - #631
Conversation
…r security Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…ersions Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Pull request overview
Updates the site’s frontend dependency (AngularJS) to a modern 1.8.x release to mitigate known vulnerabilities, and strengthens repository validation around hackathon data.
Changes:
- Upgrade AngularJS CDN reference from 1.2.23 to 1.8.3.
- Add URL scheme validation in
test.jsto reject non-HTTP(S) URLs in hackathon link fields. - Remove the embedded Google Analytics snippet from
index.htmland404.html.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
test.js | Adds validation for unsafe URL schemes and adjusts date-parse validity checks. |
index.html | Removes Google Analytics snippet and bumps AngularJS script to 1.8.3. |
404.html | Removes Google Analytics snippet. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| let startDate = Date.parse(hackathon.startDate); | ||
| if (startDate !== undefined) { | ||
| if (!isNaN(startDate)) { | ||
| if (lastStartDate > startDate) { | ||
| bail(`${hackathon.title} should be before ${lastHackathon.title}`); | ||
| } |
There was a problem hiding this comment.
Date.parse() returns NaN for invalid/missing dates, and lastStartDate is still updated later even when startDate is NaN. If a single entry has an unparseable startDate, subsequent chronological validation will silently stop working because lastStartDate becomes NaN and comparisons always fail. Consider only updating lastStartDate/lastHackathon when startDate is a valid number (or handle invalid dates explicitly).
| <meta charset="UTF-8"> | ||
| <meta name="viewport" content="width=device-width, initial-scale=1"> | ||
| <meta name="description" content="An archive of hackathons from around the world (2014-2025)."> | ||
| <meta name="keywords" content="hackathon, hackathons, list, directory"> | ||
| <!-- Start Google Javascript --> | ||
| <script> | ||
| (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){ | ||
| (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o), | ||
| m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m) | ||
| })(window,document,'script','https://www.google-analytics.com/analytics.js','ga'); | ||
| ga('create', 'UA-51284668-3', 'auto'); | ||
| ga('require', 'displayfeatures'); | ||
| ga('send', 'pageview'); | ||
| </script> | ||
| <link rel="shortcut icon" href="images/favicon.ico" /> | ||
| <link rel="stylesheet" type="text/css" href="css/skeleton.css"> | ||
| <link rel="stylesheet" type="text/css" href="css/style.css"> |
There was a problem hiding this comment.
This change removes the Google Analytics snippet entirely. The PR description/title focus on updating AngularJS for CVEs; if the analytics removal is intentional, it should be called out in the PR description (or split into a separate PR) so reviewers understand the behavioral/ops impact.
| <meta charset="UTF-8"> | ||
| <meta name="description" content="An archive of hackathons from around the world (2014-2025)."> | ||
| <meta name="keywords" content="hackathon, hackathons, list"> | ||
| <link rel="shortcut icon" href="/images/favicon.ico" /> | ||
| <!-- Start Google Javascript --> | ||
| <script> | ||
| (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){ | ||
| (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o), | ||
| m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m) | ||
| })(window,document,'script','//www.google-analytics.com/analytics.js','ga'); | ||
| ga('create', 'UA-51284668-3', 'auto'); | ||
| ga('require', 'displayfeatures'); | ||
| ga('send', 'pageview'); | ||
| </script> | ||
| <link rel="stylesheet" type="text/css" href="css/skeleton.css"> | ||
| <link rel="stylesheet" href="css/style.css"> |
There was a problem hiding this comment.
This change removes the Google Analytics snippet entirely. The PR description/title focus on updating AngularJS for CVEs; if the analytics removal is intentional, it should be called out in the PR description (or split into a separate PR) so reviewers understand the behavioral/ops impact.
This PR updates AngularJS to 1.8 to address multiple CVEs and update test code. It also removes the legacy Google Analytics code.