Merge branch 'main' into improve/CM-968-foundation

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: skwowet

.claude/skills/packages-worker-add-entrypoint/SKILL.md

@@ -19,7 +19,6 @@ each worker in its own `src/{worker}/` directory with its own entry point.
 services/apps/packages_worker/
   src/
     bin/
-      packages-worker.ts        ← parent stub
       github-repos-enricher.ts  ← existing worker
       <name>.ts                 ← entry point you will create
     github/                     ← existing worker logic

.github/workflows/frontend-lint.yml

@@ -5,6 +5,9 @@ on:
     paths:
       - 'frontend/**'
 
+permissions:
+  contents: read
+
 jobs:
   lint-frontend:
     runs-on: ubuntu-latest

.nvmrc

@@ -0,0 +1 @@
+20

AGENTS.md

@@ -32,7 +32,7 @@ We currently support all our integrations for self-hosting. For each one of them
 
 #### <a name="requirements">Requirements</a>
 
-- [Node](https://nodejs.org/en) v16.16.0
+- [Node](https://nodejs.org/en) v20+
 - [Docker](https://docs.docker.com/get-docker/) and [docker-compose](https://docs.docker.com/compose/install/)
 
 #### <a name="getting_started">Getting started</a>

README.md

@@ -35,3 +35,6 @@ CROWD_PACKAGES_DB_PORT=5432
 CROWD_PACKAGES_DB_USERNAME=postgres
 CROWD_PACKAGES_DB_PASSWORD=example
 CROWD_PACKAGES_DB_DATABASE=packages-db
+
+# security-contacts-worker
+SECURITY_CONTACTS_USER_AGENT="lfx-security-contacts-worker"

backend/.env.dist.composed

@@ -22,7 +22,7 @@ CROWD_REDIS_PORT=6379
 
 # S3 settings
 CROWD_S3_HOST=localhost
-CROWD_S3_PORT=9000
+CROWD_S3_PORT=9100
 CROWD_S3_INTEGRATION_ASSETS_BUCKET=crowd-integrations-assets
 CROWD_S3_MICROSERVICES_ASSETS_BUCKET=crowd-microservices-assets
 CROWD_S3_AWS_ACCOUNT_ID=000000000000
@@ -170,6 +170,7 @@ CROWD_TINYBIRD_BASE_URL=http://localhost:7181/
 # Auth0
 CROWD_AUTH0_ISSUER_BASE_URLS=
 CROWD_AUTH0_AUDIENCE=
+
 # packages DB (osspckgs)
 CROWD_PACKAGES_DB_READ_HOST=localhost
 CROWD_PACKAGES_DB_WRITE_HOST=localhost
@@ -184,13 +185,38 @@ ENRICHER_BATCH_SIZE=100
 ENRICHER_REPO_UPDATE_INTERVAL_HOURS=24
 ENRICHER_IDLE_SLEEP_SEC=60
 
+# security-contacts-worker
+SECURITY_CONTACTS_USER_AGENT="lfx-security-contacts-worker"
+
+OSSPCKGS_GCP_PROJECT=local-dev
+OSSPCKGS_GCS_BUCKET=local-dev
+OSSPCKGS_GCP_CREDENTIALS_B64=e30=
+
 # osv-sync (Temporal-scheduled; see services/apps/packages_worker/src/osv/schedule.ts)
 # OSV_ECOSYSTEMS uses OSV's canonical bucket case (npm lowercase, Maven titlecase) because
 # the bucket URL <BASE>/<ecosystem>/all.zip is case-sensitive (Maven/all.zip exists,
 # maven/all.zip 404s). The allowlist check and DB storage normalize to lowercase
 # internally per ADR-0001 §OSV "Ecosystem normalization", so downstream stays lowercase.
 OSV_BULK_BASE_URL=https://osv-vulnerabilities.storage.googleapis.com
-OSV_ECOSYSTEMS=npm,Maven
+OSV_ECOSYSTEMS=npm,Maven,cargo,NuGet
 OSV_TMP_DIR=/tmp/osv
 OSV_BATCH_SIZE=500
 OSV_DERIVE_BATCH_SIZE=1000
+
+# maven enricher
+
+MAVEN_FETCHER_BATCH_SIZE=2000
+MAVEN_FETCHER_CONCURRENCY=10
+MAVEN_FETCHER_NON_CRITICAL_BATCH_SIZE=500
+MAVEN_FETCHER_NON_CRITICAL_CONCURRENCY=20
+MAVEN_FETCHER_REFRESH_DAYS=1
+MAVEN_FETCHER_GROUP_DELAY_MS=100
+MAVEN_FETCHER_BASE_URL_BACKFILL=https://maven-central.storage-download.googleapis.com/maven2
+MAVEN_FETCHER_BASE_URL_INCREMENTAL=https://repo1.maven.org/maven2
+
+# dockerhub-sync (see services/apps/packages_worker/src/dockerhub/)
+DOCKERHUB_API_BASE_URL=https://hub.docker.com/v2
+DOCKERHUB_BATCH_SIZE=100
+DOCKERHUB_REFRESH_INTERVAL_HOURS=24
+DOCKERHUB_DISCOVERY_INTERVAL_DAYS=14
+DOCKERHUB_IDLE_SLEEP_SEC=60

backend/.env.dist.local

@@ -2,4 +2,5 @@ dist
 node_modules
 admin
 venv-*
-.serverless
+.serverless
+.claude

backend/.prettierignore

@@ -49,6 +49,13 @@
     "password": "PRODUCT_DB_PASSWORD",
     "database": "PRODUCT_DB_DATABASE"
   },
+  "packagesDb": {
+    "host": "CROWD_PACKAGES_DB_WRITE_HOST",
+    "port": "CROWD_PACKAGES_DB_PORT",
+    "user": "CROWD_PACKAGES_DB_USERNAME",
+    "password": "CROWD_PACKAGES_DB_PASSWORD",
+    "database": "CROWD_PACKAGES_DB_DATABASE"
+  },
   "segment": {
     "writeKey": "CROWD_SEGMENT_WRITE_KEY"
   },

backend/config/custom-environment-variables.json

@@ -19,6 +19,7 @@
     "script:continue-run": "SERVICE=script TS_NODE_TRANSPILE_ONLY=true tsx src/bin/scripts/continue-run.ts",
     "script:trigger-webhook": "SERVICE=script TS_NODE_TRANSPILE_ONLY=true tsx src/bin/scripts/trigger-webhook.ts",
     "script:send-weekly-analytics-email": "SERVICE=script TS_NODE_TRANSPILE_ONLY=true tsx src/bin/scripts/send-weekly-analytics-email.ts",
+    "script:merge-members": "SERVICE=script TS_NODE_TRANSPILE_ONLY=true tsx src/bin/scripts/merge-members.ts",
     "script:merge-organizations": "SERVICE=script TS_NODE_TRANSPILE_ONLY=true tsx src/bin/scripts/merge-organizations.ts",
     "script:refresh-materialized-views": "SERVICE=script TS_NODE_TRANSPILE_ONLY=true tsx src/bin/scripts/refresh-materialized-views.ts",
     "script:unmerge-members": "SERVICE=script TS_NODE_TRANSPILE_ONLY=true tsx src/bin/scripts/unmerge-members.ts",
@@ -142,7 +143,7 @@
     "@types/cron": "^2.0.0",
     "@types/express": "^4.17.17",
     "@types/html-to-text": "^8.1.1",
-    "@types/node": "~18.0.4",
+    "@types/node": "^20.8.2",
     "@types/sanitize-html": "^2.6.2",
     "@types/superagent": "^4.1.15",
     "@types/uuid": "^9.0.2",