Repository navigation
fix(analytics): keep frontend metadata separate from optional arguments - #2649
Conversation
✅ Deploy Preview for creative-fairy-df92c4 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the
 |
| Layer / File(s) | Summary |
|---|---|
Message shape and dispatch packages/analytics/modules/analytics/client.ts |
AnalyticsMessage now includes a separate meta field. The frontend forwarder sends metadata separately from args. The background port handler explicitly dispatches identify, page, track, captureException, and setEnabled. |
Estimated code review effort: 2 (Simple) | ~10 minutes
Change: Bug fix
Merge Risk: 
a0f7d
-
The metadata forwarding change is ready to merge after normal checks.
Security Architecture Review
-
Security architecture risk: 🔵 Low · up to
a0f7dThe change corrects metadata placement while preserving the observed opt-out controls and narrowing method dispatch. Compatibility between clients running different versions remains unverified, so the assessment is low risk rather than risk-free.
Retained concerns
No architecture-level concerns identified.Security review details
-
Security Blast Radius
- inferred — A caller able to open the matching internal analytics port can affect the background’s shared analytics identity and enabled flag, and submit events to configured providers when enabled. The inspected path does not establish reachability from arbitrary websites, other extensions, tenants, or services.
Trust Boundaries and Controls
- observed — The listener remains browser.runtime.onConnect and routes by port name; no new external connection listener is introduced. Additional sender authorization and runtime payload validation are absent in both inspected versions. Explicit method dispatch narrows the former dynamic lookup, while provider enabled checks remain intact. These existing boundary limitations were not shown to gain new exposure or authority through this PR.
-
🚥 Pre-merge checks | ✅ 5
-
✅ Passed checks (5 passed)
-
Check name Status Explanation Title check ✅ Passed The title clearly and concisely describes the main change: keeping frontend metadata separate from optional analytics arguments. Description check ✅ Passed The description includes an overview and concrete manual testing steps with expected results. The template’s Related Issue section is omitted, but it is conditional and does not prevent the descriptio… Docstring Coverage ✅ Passed Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 1 files. Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request. Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
-
Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Create a new PR
-
- Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
github-actions
Bot
added
the
pkg/analytics
|
@coderabbitai review |
✅ Action performedReview finished.
|
PatrykKuniczak
left a comment
PatrykKuniczak
left a comment
There was a problem hiding this comment.
I think it can be simplified.
But again, so sorry, but i don't understand, and don't see difference:
Before:
After:
After all, it seems it's breaking change and it's not fix it's feat/chore.
Let's send me more details please.
…end-metadata # Conflicts: # packages/analytics/modules/analytics/client.ts
@wxt-dev/analytics
@wxt-dev/auto-icons
@wxt-dev/browser
@wxt-dev/i18n
@wxt-dev/is-background
@wxt-dev/module-react
@wxt-dev/module-solid
@wxt-dev/module-svelte
@wxt-dev/module-vue
@wxt-dev/runner
@wxt-dev/storage
@wxt-dev/unocss
@wxt-dev/webextension-polyfill
wxt
commit: |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #2649 +/- ##
==========================================
+ Coverage 80.32% 80.41% +0.09%
==========================================
Files 139 139
Lines 4162 4162
Branches 961 961
==========================================
+ Hits 3343 3347 +4
+ Misses 720 717 -3
+ Partials 99 98 -1 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
Thanks for helping make WXT better! |
Overview
Calls from the popup, options pages or content scripts that left out an optional argument, like
track('some-event')oridentify('some-user-id')from the README, received the page metadata in that argument's place. The metadata is now sent as its own field.Manual Testing
packages/analytics/entrypoints/popup/main.ts), addvoid analytics.track('no-props');.bun run dev:buildinpackages/analyticsand load.output/chrome-mv3in Chrome.trackevent should have no properties, andmetashould have the popup's URL and a session ID. Before this change, the metadata showed up inevent.propertiesandmeta.urlwasbackground.js.