[Review] Daily Deep Review — 2026-07-03: 30-day stagnation, 6 PRs pending, CI regressions

[evan-zhang11]

Summary

Comprehensive repository review for 2026-07-03. The repository has been stagnant for 30 days with no code commits since 2026-06-04.

Repository Activity

• Last code commit: 2026-06-04 (30 days ago)
• Last 8 commits: All Dependabot dependency bumps (merged by sharkAndshark)
• Last feature work: PostGIS modal fix PR feat: PostGIS import UX improvements and tile_source routing refactor #260 merged 2026-05-25
• Open PRs: 6 (4 Dependabot, 1 feature, 1 stale dependency upgrade)

Open PR Status

PR	Type	CI Status	Notes
#296	cargo deps (17 updates)	❌ Failing	duckdb version mismatch (#298)
#295	npm deps (9 updates)	✅ All green	Ready to merge
#294	actions/cache 5→6	✅ All green	Ready to merge
#291	actions/checkout 6→7	✅ All green	Ready to merge
#173	File import feature	❌ Failing	Merge conflicts, 5 failing checks
#65	tower-sessions 0.15	❌ Failing	Tracked in #68

Ready to merge: #295, #294, #291

CI Status (Nightly)

Job	Status	Details
verify	✅ Pass	Main branch compiles & tests pass
docker_smoke	❌ Fail	Missing zlib1g-dev (#273)
windows binaries	❌ Fail	Build backend binaries fails (#267)
npm-audit	❌ Fail	2 HIGH + 1 MODERATE vulns (#297)
rust-audit	❌ Fail	Exits with error
linux/mac binaries	✅ Pass	All platforms build successfully

New Issues Filed Today

• security: npm audit — 2 HIGH severity vulnerabilities (undici + vite) #297: npm audit — 2 HIGH severity vulnerabilities (undici + vite)
• fix(ci): PR #296 blocked — duckdb crate version mismatch between Cargo.lock and Cargo.toml #298: PR chore(deps): bump the cargo-minor-patch group across 1 directory with 17 updates #296 blocked — duckdb crate version mismatch

Previously Filed (Still Open)

• docs: behaviors.md missing documentation for 14+ implemented API endpoints #285: behaviors.md missing 14+ API endpoint docs
• code-quality: postgis.rs grown to 1589 lines — PostGIS tile serving and admin logic should be split #284: postgis.rs at 1589 lines — needs module split
• test: no test coverage for map editor CRUD handlers (map_handlers.rs) #277: No test coverage for map editor CRUD handlers
• code-quality: map_handlers.rs field values — LIMIT injected as string interpolation, not parameterized #275: map_handlers.rs LIMIT injected as string interpolation
• security: map_handlers.rs get_field_values — field name injection risk via DuckDB identifier interpolation #274: map_handlers.rs field name injection risk
• fix(ci): Docker build broken — missing zlib1g-dev for freetype-sys (updates #269) #273: Docker build missing zlib1g-dev

Code Quality Snapshot (Backend)

File	Lines	Trend	Issue
api_tests.rs	9792	→	Test file, acceptable
db.rs	1798	↑ (+35)	#244 (was 1763)
handlers.rs	1632	→	#270
postgis.rs	1589	→	#284
import.rs	1584	→	#241
workspace_handlers.rs	1259	→	#229

Code Quality Snapshot (Frontend)

File	Lines	Issue
App.jsx	2186	#271
LayerStylePanel.jsx	1644	#276
Settings.jsx	945	—
MapEditor.jsx	701	—

Recommendations

1. Merge green PRs (chore(deps): bump the npm-minor-patch group across 1 directory with 9 updates #295, chore(deps): bump actions/cache from 5 to 6 #294, chore(deps): bump actions/checkout from 6 to 7 #291) to reduce PR backlog
2. Fix npm audit (security: npm audit — 2 HIGH severity vulnerabilities (undici + vite) #297) — 2 HIGH severity vulnerabilities
3. Fix Docker build (fix(ci): Docker build broken — missing zlib1g-dev for freetype-sys (updates #269) #273) — add zlib1g-dev to Dockerfile
4. Consider duckdb Dependabot strategy (fix(ci): PR #296 blocked — duckdb crate version mismatch between Cargo.lock and Cargo.toml #298) to prevent recurring CI blocks
5. Triage stale PRs — feat: 从服务器导入文件（引用模式） #173 (file import) and chore(deps): bump tower-sessions from 0.14.0 to 0.15.0 #65 (tower-sessions) have been open for months