fix: use pnpm, add prisma generate to build, fix cache headers#107
Merged
Conversation
- vercel.json: Change installCommand from npm to pnpm install --frozen-lockfile - vercel.json: Change buildCommand to include prisma generate before next build - vercel.json: Change devCommand from npm to pnpm - vercel.json: Remove conflicting API cache headers (was public caching auth endpoints) - vercel.json: Remove duplicate security headers (consolidated in next.config.js) - next.config.js: Remove Cache-Control immutable on all routes (was caching HTML 1yr) - next.config.js: Add security headers consolidated from vercel.json - next.config.js: Set API routes to no-store (auth endpoints must never be cached)
Contributor
|
Deployment failed with the following error: Learn More: https://vercel.com/docs/concepts/projects/project-configuration |
Reviewer's guide (collapsed on small PRs)Reviewer's GuideUpdates deployment and runtime configuration to use pnpm, ensure Prisma generation runs before builds, and fix dangerous caching by removing overly aggressive public cache headers and consolidating security headers in next.config.js, with API routes now explicitly marked as no-store. Sequence diagram for API request with updated no-store cachingsequenceDiagram
actor User
participant Browser
participant VercelServer
participant NextApiRoute as NextAPI_Route
participant Database as PostgreSQL_DB
User->>Browser: Navigate to /api/auth/login
Browser->>VercelServer: HTTP request /api/auth/login
VercelServer->>NextApiRoute: Invoke handler for /api/auth/login
NextApiRoute->>Database: Query user/session data
Database-->>NextApiRoute: Result or error
NextApiRoute-->>VercelServer: Response body
VercelServer-->>Browser: Response with Cache-Control: no-store
Browser->>Browser: Do not cache response
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 1 issue, and left some high level feedback:
- Consider applying more granular cache-control headers instead of removing the global long-term cache entirely, so that truly static assets (e.g. /_next/static, images) can still be cached aggressively while HTML and dynamic content remain uncached.
- You’ve set
Cache-Control: no-storeon all/api/:path*routes; if there are non-sensitive, read-only endpoints that would benefit from caching, consider scopingno-storeto only auth/session-related routes and applying more permissive policies elsewhere. - Review whether
X-Frame-Options: SAMEORIGINmatches the intended embedding behavior for this app; if the UI is never meant to be framed,DENYwould be stricter, and if some routes must be embeddable, you may need route-specific header overrides.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- Consider applying more granular cache-control headers instead of removing the global long-term cache entirely, so that truly static assets (e.g. /_next/static, images) can still be cached aggressively while HTML and dynamic content remain uncached.
- You’ve set `Cache-Control: no-store` on all `/api/:path*` routes; if there are non-sensitive, read-only endpoints that would benefit from caching, consider scoping `no-store` to only auth/session-related routes and applying more permissive policies elsewhere.
- Review whether `X-Frame-Options: SAMEORIGIN` matches the intended embedding behavior for this app; if the UI is never meant to be framed, `DENY` would be stricter, and if some routes must be embeddable, you may need route-specific header overrides.
## Individual Comments
### Comment 1
<location path="next.config.js" line_range="57-62" />
<code_context>
+ // Headers for performance and security
async headers() {
return [
{
source: '/:path*',
headers: [
- {
- key: 'Cache-Control',
- value: 'public, max-age=31536000, immutable',
- },
{
</code_context>
<issue_to_address>
**suggestion (performance):** Consider reintroducing long-lived caching for static assets instead of removing the global Cache-Control header entirely.
Removing `Cache-Control` for `/:path*` will reduce browser/CDN caching of JS, CSS, and images, likely hurting performance and increasing bandwidth. If the goal is to relax caching for HTML or certain dynamic routes, consider narrowing the scope instead (e.g., keep long-lived caching on `/static/:path*`, `/_next/static/:path*`, etc.) while using less aggressive headers for dynamic content.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Comment on lines
57
to
-62
| { | ||
| source: '/:path*', | ||
| headers: [ | ||
| { | ||
| key: 'Cache-Control', | ||
| value: 'public, max-age=31536000, immutable', |
There was a problem hiding this comment.
suggestion (performance): Consider reintroducing long-lived caching for static assets instead of removing the global Cache-Control header entirely.
Removing Cache-Control for /:path* will reduce browser/CDN caching of JS, CSS, and images, likely hurting performance and increasing bandwidth. If the goal is to relax caching for HTML or certain dynamic routes, consider narrowing the scope instead (e.g., keep long-lived caching on /static/:path*, /_next/static/:path*, etc.) while using less aggressive headers for dynamic content.
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ❌ Deployment failed View logs |
gem-enterprise | b88e61f | May 10 2026, 05:37 AM |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b88e61fe12
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Comment on lines
82
to
+83
| key: 'Cache-Control', | ||
| value: 'public, max-age=60, s-maxage=120', | ||
| value: 'no-store', |
There was a problem hiding this comment.
Setting Cache-Control: no-store on /api/:path* applies to every API handler, including the public news feed at src/app/api/intel/news/route.ts that explicitly uses export const revalidate = 60 for minute-level caching. This effectively disables caching for that endpoint, increasing repeated database reads and response latency under traffic; the no-store policy should be limited to sensitive endpoints (auth/session/etc.) or exclude cacheable public APIs.
Useful? React with 👍 / 👎.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes deployment configuration and dangerous caching behavior that prevented the site from being fully operational.
Changes
vercel.json
npm installtopnpm install --frozen-lockfile(per project rules — pnpm is the required package manager)npm run buildtopnpm run db:generate && pnpm run build(ensures Prisma client is generated before build)npm run devtopnpm devCache-Control: public, max-age=60, s-maxage=120on/api/*)next.config.js
Cache-Control: public, max-age=31536000, immutableon ALL routes — this was caching HTML pages for 1 year in browsers, preventing users from seeing deployment updatesCache-Control: no-store— auth and session endpoints must never be cachedRoot Cause of Errors
The primary reason the site is not fully operational is the PostgreSQL database is not connected. The
/api/healthendpoint returns{"status":"degraded","services":{"database":"error"}}. This breaks:/api/auth/login→ 500)Required action: Set
POSTGRES_PRISMA_URLandPOSTGRES_URL_NON_POOLINGenvironment variables in Vercel project settings. Provision a PostgreSQL database (Neon, Supabase, or Vercel Postgres) and runpnpm run db:pushto initialize the schema.Verification
pnpm install --frozen-lockfile✓pnpm run db:generate✓pnpm build✓ (158 routes, 0 errors)pnpm test✓ (100/100 tests pass)Files Changed
vercel.jsonnext.config.jsSummary by Sourcery
Update deployment and runtime configuration to use pnpm, fix Prisma generation in the build, and correct HTTP caching and security headers for the app and API routes.
Enhancements:
Build: