fix: correct bot data sources so posts carry accurate information - #10
Merged
Conversation
Two defects caused bots to publish inaccurate information. BaseUpdateWatcher took data[0] from the GitHub releases API without looking at the draft/prerelease flags, so RC, beta and canary builds were announced as if they were stable releases (Next.js v16.4.0-canary.8, Vue v3.6.0-rc.5, Angular v22.2.0-next.3, and 11 others at the time of writing). Releases are now filtered; `allowPrerelease` opts back in. An optional `tagPattern` was added alongside it: monorepos publish releases for sibling packages under the same repository, which let a bot announce a version that was not its own product. buildNewsPost/buildUpdatePost passed the title through unchanged while only the description was sanitised, so feeds that wrap titles in markup were published verbatim, e.g. <p><em>'Star Wars</em> Zero Company': ...</p> cleanHtml now decodes entities before stripping tags (feeds routinely double-encode), and both builders route the title through cleanTitle(). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D1hjCgmu3CDm1NqN4fy713
Audited every watcher against its live source. These were fetching
nothing, or fetching the wrong project's data.
Dead RSS feeds (all returned 404 or served HTML, so the bots had been
silent). Replacements verified to parse and return current articles:
appwrite -> appwrite.io/blog/rss.xml
defold -> defold.com/feed.xml
elixir -> elixir-lang.org/atom.xml
firebase -> firebase.blog/rss.xml
php -> php.net/feed.atom
playcanvas -> blog.playcanvas.com/rss
stability -> stability.ai/news-updates?format=rss
supabase -> supabase.com/rss.xml
unity -> blog.unity.com/feed
Renamed repositories, previously reached only through GitHub's redirect:
react, reactnative, prisma (prisma/orm), comfyui (Comfy-Org), nativewind.
Wrong source entirely:
cocos cocos-creator/cocos-engine 404s; the engine lives at cocos/cocos-engine
xai grok-1 has had no release since 2024 -> xai-org/xai-sdk-python
gemini the JS SDK repo is archived as deprecated-generative-ai-js ->
googleapis/js-genai, and the news feed (blog.google/technology/ai)
serves general consumer content — a Google Search home-decor post
went out tagged #gemini — so it now reads blog.google/products/gemini
django and mongodb publish no GitHub releases at all (their tags are branch
pointers and alphas), so both move to their official blog feeds as news bots.
kotlinmultiplatform shared a feed with the kotlin bot, meaning both posted
the same article; it now reads the Kotlin Multiplatform tag feed.
nativewind and stride apply the new tagPattern: the first was announcing
react-native-css-interop releases, the second the CLI tool rather than the
engine.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01D1hjCgmu3CDm1NqN4fy713
Each of these had no reachable source, so they were either silent or would have published something misleading. Feed retired upstream, technology still covered by its update bot: bevy, groq, cohere, nativescript news bots. None of them offer RSS any more and none advertise feed autodiscovery. semantickernel news: the blog now redirects to the Microsoft Agent Framework blog, so posts would have carried a #semantickernel tag for a different product. Its update bot is active (dotnet-1.80.0) and stays. swiftui: read the exact same swift.org feed as the swift bot, so every article went out twice under two tags. Upstream publishes no usable GitHub releases; the news bot already covers the technology: expo, go, java, python, flutter (Flutter's last release was a .pre from 2024). No usable source at all, bot removed entirely: spine, watermelondb, and flipper (archived by Meta). Also derives the technology count in the startup log from the registry — it had drifted to 116 against 174 actual watchers — and corrects README. Slow-moving sources were deliberately left alone: bulletphysics, love2d, pygame, box2d, deepseek and stability publish rarely, but their latest release is still the correct latest release. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D1hjCgmu3CDm1NqN4fy713
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Audited all 131 GitHub release watchers and 58 RSS watchers against their live sources. A number of bots were publishing inaccurate information or had gone silent without anyone noticing.
Core fixes
Prereleases were announced as stable releases.
BaseUpdateWatchertookdata[0]straight from the GitHub releases API without checking thedraft/prereleaseflags. At the time of the audit 14 bots were sitting on an RC, beta or canary as their "latest version" — Next.jsv16.4.0-canary.8, Vuev3.6.0-rc.5, Angularv22.2.0-next.3, Kotlinv2.4.20-RC2among them. Releases are now filtered, withallowPrereleaseto opt back in. Verified every affected repo has a recent stable release, so no bot goes silent as a result.Markup in post titles. Only the description was sanitised, so feeds that wrap titles in HTML published it verbatim:
cleanHtmlnow decodes entities before stripping tags (feeds routinely double-encode) and both post builders route the title throughcleanTitle().tagPatternwas added for monorepos that release sibling packages under one repository —nativewindwas announcingreact-native-css-interop@0.2.6,stridethe CLI tool instead of the engine.Source corrections
Nine RSS feeds returned 404 or served HTML, so those bots had never posted. Replacements verified to parse and return current articles:
appwrite,defold,elixir,firebase,php,playcanvas,stability,supabase,unity.Five repositories were reachable only via GitHub's redirect and now point at their real location:
react,reactnative,prisma(→prisma/orm),comfyui(→Comfy-Org),nativewind.Wrong source entirely:
cocoscocos-creator/cocos-engine404scocos/cocos-enginexaigrok-1has had no release since 2024xai-org/xai-sdk-pythongeminideprecated-generative-ai-js; news feed served general consumer content — a Google Search home-decor post went out tagged#geminigoogleapis/js-genai+blog.google/products/geminidjangoandmongodbpublish no GitHub releases at all (their tags are branch pointers and alphas), so both became news bots on their official blog feeds.kotlinmultiplatformshared a feed with thekotlinbot — both posted the same article — and now reads the KMP tag feed.Retired watchers
14 watchers whose upstream source no longer exists.
bevy,groq,cohereandnativescriptno longer publish RSS at all;semantickernel's blog now redirects to the Microsoft Agent Framework blog, so posts would have carried the wrong product's tag;swiftuiread the identical swift.org feed as theswiftbot.expo,go,java,pythonandflutterupdate bots are gone as those projects publish no usable releases, but their news bots still cover them.spine,watermelondbandflipper(archived by Meta) had no usable source and were removed entirely.Slow-moving sources were deliberately left alone —
bulletphysics,love2d,pygame,box2d,deepseekandstabilitypublish rarely, but their latest release is still the correct latest release.Notes
config.json, and their platform accounts are untouched — that removal is a separate call.Verification
Each commit was checked out into its own worktree:
index.jsimport count matches registry count, every imported file exists, no empty bot directories.prettier --check .,node --checkacross all files, and the CI core-module import test all pass.🤖 Generated with Claude Code
https://claude.ai/code/session_01D1hjCgmu3CDm1NqN4fy713