Reviewing files that changed from the base of the PR and between 9f6ad82 and d6fba25.

• apps/cyberstorm-remix/app/p/packageListing.tsx (1 hunks)
• apps/cyberstorm-remix/app/p/packageVersion.tsx (1 hunks)
• apps/cyberstorm-remix/app/p/packageVersionWithoutCommunity.tsx (1 hunks)
• apps/cyberstorm-remix/app/p/tabs/Readme/PackageVersionReadme.tsx (1 hunks)
• apps/cyberstorm-remix/app/p/tabs/Readme/PackageVersionWithoutCommunityReadme.tsx (1 hunks)
• apps/cyberstorm-remix/app/p/tabs/Required/PackageVersionRequired.tsx (1 hunks)
• apps/cyberstorm-remix/app/p/tabs/Required/PackageVersionWithoutCommunityRequired.tsx (1 hunks)
• apps/cyberstorm-remix/app/p/tabs/Versions/PackageVersionVersions.tsx (1 hunks)
• apps/cyberstorm-remix/app/p/tabs/Versions/PackageVersionWithoutCommunityVersions.tsx (1 hunks)
• apps/cyberstorm-remix/app/p/tabs/Versions/Versions.tsx (5 hunks)
• apps/cyberstorm-remix/app/p/tabs/Versions/common.tsx (1 hunks)
• apps/cyberstorm-remix/app/root.tsx (2 hunks)
• apps/cyberstorm-remix/app/routes.ts (1 hunks)
• apps/cyberstorm-remix/cyberstorm/utils/LinkLibrary.tsx (1 hunks)
• apps/cyberstorm-remix/cyberstorm/utils/typeChecks.ts (1 hunks)
• apps/cyberstorm-storybook/LinkLibrary.tsx (1 hunks)
• packages/cyberstorm/src/components/Links/LinkingProvider.tsx (2 hunks)
• packages/cyberstorm/src/components/Links/Links.tsx (1 hunks)
• packages/cyberstorm/src/utils/utils.ts (1 hunks)
• packages/dapper-fake/src/fakers/package.ts (1 hunks)
• packages/dapper-fake/src/index.ts (2 hunks)
• packages/dapper-ts/src/index.ts (3 hunks)
• packages/dapper-ts/src/methods/packageVersion.ts (1 hunks)
• packages/thunderstore-api/src/get/packageVersionDetails.ts (1 hunks)
• packages/thunderstore-api/src/index.ts (1 hunks)
• packages/thunderstore-api/src/schemas/objectSchemas.ts (1 hunks)
• packages/thunderstore-api/src/schemas/requestSchemas.ts (1 hunks)
• packages/thunderstore-api/src/schemas/responseSchemas.ts (2 hunks)
• tools/ts-dev-proxy/nginx.conf (1 hunks)

• packages/thunderstore-api/src/index.ts
• apps/cyberstorm-remix/cyberstorm/utils/LinkLibrary.tsx
• packages/cyberstorm/src/components/Links/Links.tsx
• apps/cyberstorm-storybook/LinkLibrary.tsx
• apps/cyberstorm-remix/app/p/tabs/Required/PackageVersionRequired.tsx
• packages/thunderstore-api/src/schemas/requestSchemas.ts
• packages/thunderstore-api/src/schemas/responseSchemas.ts
• tools/ts-dev-proxy/nginx.conf

• GitHub Check: Generate visual diffs
• GitHub Check: Test
• GitHub Check: CodeQL

packages/dapper-fake/src/fakers/package.ts (1)

175-223: Align fake package version payload with API schema

The fake payload still returns a dependencies array while omitting the required install_url and version_number fields that the real PackageVersionDetailsResponseData schema exposes. Consumers typed against the schema (and the new UI) will end up with missing CTA URLs / version labels, and the extra field can break strict typing. Please mirror the schema exactly.

-  // Fake dependencies (reuse logic but need extra flags)
-  const dependencyCount = faker.number.int({ min: 0, max: 6 });
-  const dependencies = await Promise.all(
-    range(dependencyCount).map(async () => {
-      const depSeed = `${seed}-dep-${faker.string.alpha(8)}`;
-      setSeed(depSeed);
-      const isActive = faker.datatype.boolean(0.8);
-      const removed = faker.datatype.boolean(0.1);
-      const unavailable = !removed && faker.datatype.boolean(0.05);
-      return {
-        description: isActive
-          ? faker.company.buzzPhrase()
-          : "This package has been removed.",
-        icon_url: isActive
-          ? faker.helpers.maybe(() => getFakeImg(256, 256), {
-              probability: 0.85,
-            }) ?? null
-          : null,
-        is_active: isActive,
-        name: faker.word.words(3).split(" ").join("_"),
-        namespace: faker.word.sample(),
-        version_number: getVersionNumber(),
-        is_removed: removed,
-        is_unavailable: unavailable,
-      };
-    })
-  );
+  const dependency_count = faker.number.int({ min: 0, max: 6 });
@@
-    dependencies,
-    dependency_count: dependencies.length,
+    dependency_count,
+    install_url: `ror2mm://v1/install/thunderstore.io/${namespace}/${name}/${version}/`,
@@
-  };
+    version_number: version,
+  };

packages/dapper-fake/src/index.ts (1)

36-36: Fake package version payload misses contract fields

Wiring getPackageVersionDetails to the fake source still returns a shape without version_number and install_url, while the real API and consuming UI expect them. Local dev/testing will trip over the mismatch (the new pages read those keys), so please update the faker to keep parity.

--- a/packages/dapper-fake/src/fakers/package.ts
+++ b/packages/dapper-fake/src/fakers/package.ts
@@
   return {
     description: faker.company.buzzPhrase(),
     download_count: faker.number.int({ min: 0, max: 5_000_000 }),
     icon_url: iconUrl,
     name,
     namespace,
+    version_number: version,
     size: faker.number.int({ min: 20_000, max: 4_000_000_000 }),
@@
     download_url: `https://thunderstore.io/package/download/${namespace}/${name}/${version}/`,
+    install_url:
+      faker.helpers.maybe(
+        () => `https://thunderstore.io/package/install/${namespace}/${name}/${version}/`,
+        { probability: 0.9 }
+      ) ?? null,
     full_version_name: `${namespace}-${name}-${version}`,

apps/cyberstorm-remix/app/p/tabs/Readme/PackageVersionWithoutCommunityReadme.tsx (1)

1-58: Reiterating blocker: sanitize README HTML before rendering

This surfaces raw README HTML from the API straight into the DOM. A malicious README (or a compromised upstream) can ship arbitrary <script> content, giving us an immediate XSS vector. Please sanitize the HTML in both loaders and at render time before calling dangerouslySetInnerHTML.

-import { Suspense } from "react";
+import { Suspense } from "react";
+import DOMPurify from "isomorphic-dompurify";
@@
-    return {
-      readme: await dapper.getPackageReadme(
-        params.namespaceId,
-        params.packageId,
-        params.packageVersion
-      ),
-    };
+    const readme = await dapper.getPackageReadme(
+      params.namespaceId,
+      params.packageId,
+      params.packageVersion
+    );
+    return {
+      readme: { ...readme, html: DOMPurify.sanitize(readme.html) },
+    };
@@
-      readme: dapper.getPackageReadme(
-        params.namespaceId,
-        params.packageId,
-        params.packageVersion
-      ),
+      readme: dapper
+        .getPackageReadme(
+          params.namespaceId,
+          params.packageId,
+          params.packageVersion
+        )
+        .then((value) => ({
+          ...value,
+          html: DOMPurify.sanitize(value.html),
+        })),
@@
-                dangerouslySetInnerHTML={{ __html: resolvedValue.html }}
+                dangerouslySetInnerHTML={{
+                  __html: DOMPurify.sanitize(resolvedValue.html),
+                }}

Also applies to: 74-77

apps/cyberstorm-remix/app/p/packageVersion.tsx (4)

153-172: Effect misses deps and lacks error handling.

Add version to deps and handle rejected promises.

-  useEffect(() => {
+  useEffect(() => {
     if (!startsHydrated.current && isHydrated) return;
     if (isPromise(version)) {
-      version.then((versionData) => {
+      version
+        .then((versionData) => {
           setFirstUploaded(
             <RelativeTime
               time={versionData.datetime_created}
               suppressHydrationWarning
             />
           );
-      });
+        })
+        .catch((err) => {
+          console.error("Failed to load version data", err);
+        });
     } else {
       setFirstUploaded(
         <RelativeTime
           time={version.datetime_created}
           suppressHydrationWarning
         />
       );
     }
-  }, []);
+  }, [version]);

---

177-181: Memo uses stale inputs.

Include version and community in deps.

-  const versionAndCommunityPromise = useMemo(
-    () => Promise.all([version, community]),
-    []
-  );
+  const versionAndCommunityPromise = useMemo(
+    () => Promise.all([version, community]),
+    [version, community]
+  );

---

198-203: Guard missing base URL in og:url.

Add a fallback to avoid “undefined/pathname” when env is absent.

-              <meta
-                property="og:url"
-                content={`${
-                  getPublicEnvVariables(["VITE_BETA_SITE_URL"])
-                    .VITE_BETA_SITE_URL
-                }${location.pathname}`}
-              />
+              <meta
+                property="og:url"
+                content={`${getPublicEnvVariables(["VITE_BETA_SITE_URL"]).VITE_BETA_SITE_URL ?? ""}${location.pathname}`}
+              />

---

190-194: Use <title>, not meta title.

<title> sets the document title; is ignored.

-              <meta
-                title={`${formatToDisplayName(
-                  resolvedValue[0].full_version_name
-                )} | Thunderstore - The ${resolvedValue[1].name} Mod Database`}
-              />
+              <title>{`${formatToDisplayName(
+                resolvedValue[0].full_version_name
+              )} | Thunderstore - The ${resolvedValue[1].name} Mod Database`}</title>

packages/cyberstorm/src/components/Links/LinkingProvider.tsx (1)

112-128: New link types wiring looks correct.

Interface and noop defaults added consistently.

Also applies to: 182-187

apps/cyberstorm-remix/app/p/packageVersionWithoutCommunity.tsx (5)

104-116: Revalidation path segments look correct.

Namespace (2), package (3), version (5).

---

138-157: Effect misses deps and lacks error handling.

Add version to deps and handle rejected promises.

-  useEffect(() => {
+  useEffect(() => {
     if (!startsHydrated.current && isHydrated) return;
     if (isPromise(version)) {
-      version.then((versionData) => {
+      version
+        .then((versionData) => {
           setFirstUploaded(
             <RelativeTime
               time={versionData.datetime_created}
               suppressHydrationWarning
             />
           );
-      });
+        })
+        .catch((err) => {
+          console.error("Failed to load version data", err);
+        });
     } else {
       setFirstUploaded(
         <RelativeTime
           time={version.datetime_created}
           suppressHydrationWarning
         />
       );
     }
-  }, []);
+  }, [version]);

---

178-183: Guard missing base URL in og:url.

Add a fallback to avoid “undefined/pathname” when env is absent.

-              <meta
-                property="og:url"
-                content={`${
-                  getPublicEnvVariables(["VITE_BETA_SITE_URL"])
-                    .VITE_BETA_SITE_URL
-                }${location.pathname}`}
-              />
+              <meta
+                property="og:url"
+                content={`${getPublicEnvVariables(["VITE_BETA_SITE_URL"]).VITE_BETA_SITE_URL ?? ""}${location.pathname}`}
+              />

---

170-174: Use <title>, not meta title.

<title> sets the document title; is ignored.

-              <meta
-                title={`${formatToDisplayName(
-                  resolvedValue[0].full_version_name
-                )} | ${resolvedValue[1].name}`}
-              />
+              <title>{`${formatToDisplayName(
+                resolvedValue[0].full_version_name
+              )} | ${resolvedValue[1].name}`}</title>

---

256-265: Fix HTML Popover attributes (camelCase won’t work).

Use lowercase popovertarget/popovertargetaction on native button.

-                <button
-                  popoverTarget="packageDetailDrawer"
-                  popoverTargetAction="show"
+                <button
+                  popovertarget="packageDetailDrawer"
+                  popovertargetaction="show"
                   className="button button--variant--secondary button--size--medium package-listing__drawer-button"
                 >

Likely an incorrect or invalid review comment.

Reviewing files that changed from the base of the PR and between d6fba25 and 2c332c4.

• apps/cyberstorm-remix/app/p/packageListing.tsx (1 hunks)
• apps/cyberstorm-remix/app/p/packageVersion.tsx (1 hunks)
• apps/cyberstorm-remix/app/p/packageVersionWithoutCommunity.tsx (1 hunks)
• apps/cyberstorm-remix/app/p/tabs/Readme/PackageVersionReadme.tsx (1 hunks)
• apps/cyberstorm-remix/app/p/tabs/Readme/PackageVersionWithoutCommunityReadme.tsx (1 hunks)
• apps/cyberstorm-remix/app/p/tabs/Required/PackageVersionRequired.tsx (1 hunks)
• apps/cyberstorm-remix/app/p/tabs/Required/PackageVersionWithoutCommunityRequired.tsx (1 hunks)
• apps/cyberstorm-remix/app/p/tabs/Versions/PackageVersionVersions.tsx (1 hunks)
• apps/cyberstorm-remix/app/p/tabs/Versions/PackageVersionWithoutCommunityVersions.tsx (1 hunks)
• apps/cyberstorm-remix/app/p/tabs/Versions/Versions.tsx (5 hunks)
• apps/cyberstorm-remix/app/p/tabs/Versions/common.tsx (1 hunks)
• apps/cyberstorm-remix/app/root.tsx (2 hunks)
• apps/cyberstorm-remix/app/routes.ts (1 hunks)
• apps/cyberstorm-remix/cyberstorm/utils/LinkLibrary.tsx (1 hunks)
• apps/cyberstorm-remix/cyberstorm/utils/semverCompare.ts (1 hunks)
• apps/cyberstorm-remix/cyberstorm/utils/typeChecks.ts (1 hunks)
• apps/storybook/LinkLibrary.tsx (1 hunks)
• packages/cyberstorm/src/components/Links/LinkingProvider.tsx (2 hunks)
• packages/cyberstorm/src/components/Links/Links.tsx (1 hunks)
• packages/cyberstorm/src/utils/utils.ts (1 hunks)
• packages/dapper-fake/src/fakers/package.ts (1 hunks)
• packages/dapper-fake/src/index.ts (2 hunks)
• packages/dapper-ts/src/index.ts (3 hunks)
• packages/dapper-ts/src/methods/packageVersion.ts (1 hunks)
• packages/thunderstore-api/src/get/packageVersionDetails.ts (1 hunks)
• packages/thunderstore-api/src/index.ts (1 hunks)
• packages/thunderstore-api/src/schemas/objectSchemas.ts (1 hunks)
• packages/thunderstore-api/src/schemas/requestSchemas.ts (1 hunks)
• packages/thunderstore-api/src/schemas/responseSchemas.ts (2 hunks)
• tools/ts-dev-proxy/nginx.conf (1 hunks)

• apps/cyberstorm-remix/app/p/tabs/Required/PackageVersionWithoutCommunityRequired.tsx
• apps/cyberstorm-remix/cyberstorm/utils/typeChecks.ts
• apps/cyberstorm-remix/app/routes.ts
• packages/thunderstore-api/src/schemas/responseSchemas.ts
• packages/cyberstorm/src/utils/utils.ts
• packages/thunderstore-api/src/schemas/objectSchemas.ts
• apps/cyberstorm-remix/app/p/packageListing.tsx
• packages/dapper-ts/src/index.ts
• apps/cyberstorm-remix/app/p/tabs/Versions/common.tsx

• GitHub Check: Generate visual diffs
• GitHub Check: Test

apps/cyberstorm-remix/app/p/tabs/Required/PackageVersionRequired.tsx (1)

69-74: Active implementation is clean.

The placeholder component is straightforward and clearly communicates the blocked status. No issues with the active code.

packages/thunderstore-api/src/index.ts (1)

37-37: LGTM!

The export follows the established pattern and is correctly positioned alphabetically.

packages/cyberstorm/src/components/Links/Links.tsx (1)

43-47: LGTM!

The new link identifiers follow the established naming conventions and cleanly extend the API surface.

apps/cyberstorm-remix/cyberstorm/utils/semverCompare.ts (1)

6-19: LGTM with a note on edge case behavior.

The logic correctly compares valid semver strings and respects the sort direction. Returning 0 for invalid semver values means those rows maintain their original order (stable sort). This is acceptable if all version columns are expected to contain valid semver strings.

packages/thunderstore-api/src/schemas/requestSchemas.ts (1)

170-179: LGTM!

The schema definition is well-formed and follows the established pattern for request parameter schemas.

apps/cyberstorm-remix/app/root.tsx (2)

274-277: LGTM!

The new page matches follow the established pattern.

---

450-459: LGTM!

The community breadcrumb logic correctly includes the new packageVersionPage in the conditions.

apps/storybook/LinkLibrary.tsx (1)

167-201: LGTM!

The new link mappings follow the established pattern and correctly implement the URL patterns for community-scoped and non-community package version routes.

packages/dapper-ts/src/methods/packageVersion.ts (1)

5-23: LGTM!

Clean delegation to the API layer with proper parameter mapping.

packages/thunderstore-api/src/get/packageVersionDetails.ts (1)

9-24: LGTM!

Proper API endpoint implementation with schema validation.

apps/cyberstorm-remix/cyberstorm/utils/LinkLibrary.tsx (1)

162-196: LGTM!

New link mappings follow the established pattern and correctly construct version-specific routes.

apps/cyberstorm-remix/app/p/packageVersion.tsx (2)

60-116: LGTM!

Loaders correctly fetch version, community, and team data with proper 404 handling.

---

118-131: LGTM!

shouldRevalidate logic correctly prevents unnecessary revalidation when staying on the same package version.

apps/cyberstorm-remix/app/p/tabs/Versions/Versions.tsx (5)

8-8: LGTM!

Import additions for NewLink, shared components from common module, and rowSemverCompare are correct and align with the updated UI requirements.

Also applies to: 18-19

---

21-42: LGTM!

Loader correctly requires communityId and returns it alongside namespaceId/packageId for downstream NewLink usage.

---

44-65: LGTM!

ClientLoader mirrors the server-side loader structure and returns consistent data shape.

---

67-134: LGTM!

Component correctly destructures communityId and uses it in NewLink components to generate package version routes. Semver-aware sorting via rowSemverCompare on column 0 is appropriate for the Version column.

---

136-153: LGTM!

Exporting columns enables reuse across related components.

packages/cyberstorm/src/components/Links/LinkingProvider.tsx (2)

113-128: LGTM!

New link methods follow existing patterns and correctly define community and non-community variants with appropriate prop types.

---

182-186: LGTM!

Noop implementations for the new link methods are consistent with the default library pattern.

apps/cyberstorm-remix/app/p/packageVersionWithoutCommunity.tsx (6)

60-80: LGTM!

Loader correctly fetches version and team details and throws 404 on missing params.

---

82-102: LGTM!

ClientLoader mirrors the server-side loader and returns consistent promise-based data.

---

104-116: LGTM!

shouldRevalidate correctly compares namespace (index 2), package (index 3), and version (index 5) segments. Past review comment is outdated—the code already uses the correct indices.

---

205-417: LGTM!

Component body correctly implements responsive layout with drawer, tabs navigation, and sidebar. NewLink components use appropriate linkIds for non-community routes.

---

419-452: LGTM!

Actions component is correctly memoized and conditionally renders donation button based on team data.

---

454-492: LGTM!

packageMeta function correctly renders metadata with appropriate formatting and includes copy-to-clipboard for dependency string.