GitLab fixes 500 errors from oversized comments across nine vulnerability GraphQL mutations

·5 views

A GitLab merge request, gitlab-org/gitlab!269616, adds a length check to the comment argument of nine GraphQL mutations in its vulnerability management features. The bug stemmed from a 50,000-character limit that the model enforced but the API did not, so oversized input produced a generic internal server error. Bulk dismiss was worse, failing only at the database constraint because it skipped model validations. The change went through several rounds of CI fixes, including regenerating public GraphQL docs and introspection schemas, and was refined after reviewer feedback. The author's write-up highlights how easily such validation gaps ship unnoticed.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Excel Freelancer Dashboard Tracks Income, Expenses and Hours in One View

Freelancers often scatter invoices, expenses, hours and bank balances across separate files, making it hard to judge whether they can take on new work. The article proposes a single-page Excel dashboard that can be updated in about 15 minutes a week. It recommends showing four key figures at the top: monthly income, expenses, billable hours and unpaid invoice total. All other figures are drawn from one master table of jobs, so a single status change updates the whole sheet. A month-by-month summary and a list of outstanding invoices round out the layout.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

myOS Portfolio Platform Adds Reddit Posting and Unified Logo in v2.37 to v2.40

The myOS Portfolio Platform has released updates from version 2.37.0 through 2.40.0 as documented in a developer log. The latest version introduces Reddit posting via the free API using a user's own account. Social posting now runs only automatically, with networks connected through a picker, and Bluesky sign-in receives its own card. Secret fields are also now protected from browser autofill. Earlier releases in the series added a unified logo and admin style, README research with an approval step, a phone tab bar, and an AI provider setup guide with cost forecasting.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Validating URL Search Params in TanStack Start With Zod

Treating URL query parameters as trusted data causes pages to crash, show empty results, or send bad values to the API. TanStack Start addresses this by letting each route declare a validateSearch function that the router runs whenever the URL changes. Using a Zod schema with .catch() instead of .default() replaces invalid values such as a non-numeric page with safe defaults rather than raising errors. Components then read strongly typed search values through Route.useSearch(), without manual parsing or casting. Filters stored in the URL also survive page refreshes, can be shared as links, and respond to the back button.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Notifio's 38-page product site loads a single 550-byte image and has no screenshots

The developer of Notifio, a desktop app, found that its marketing website contains no screenshots despite the usual convention for selling such software. A count across 38 pages showed the only image loaded on each is a 550-byte SVG bell icon in the header, which the browser caches after the first visit. Instead of screenshots, the site uses inline SVG icons and animated product demos built from HTML elements, which avoids separate image assets and their associated loading and high-density display costs. The developer notes the demos carry trade-offs, including about 997 lines of hand-rolled timer code and an accessibility gap that was addressed. The 214 KB og-image.png used for social previews is never downloaded by ordinary visitors, but is fetched by platforms such as Slack and WhatsApp when links are shared.

0 comments Read more at DEV Community