[Review] Daily Deep Review — 2026-05-04: Repo stale 22 days, CI still broken, db.rs size issue filed

[evan-zhang11]

Summary

Last commit: 2026-04-12 (22 days stale)
CI Status (main): ❌ Broken (verify failing — cargo fmt + frontend_unit)
Open PRs: 8 (all blocked by CI failures)
Open Issues: 45+

CI Status Detail

Main branch (commit 9f95d3d)

• ❌ verify: failure (cargo fmt on icon_handlers.rs:413 + font_handlers.rs:182)
• ✅ meta: success
• ⏭️ Docker/release jobs: skipped (not tagged)

Dependabot PRs

• chore(deps): bump resvg from 0.44.0 to 0.47.0 #234 (resvg 0.44→0.47): ✅ backend, ❌ fmt+frontend_unit
• chore(deps): bump sha2 from 0.10.9 to 0.11.0 #233 (sha2 0.10→0.11): ✅ backend, ❌ fmt+frontend_unit
• chore(deps): bump the cargo-minor-patch group with 9 updates #232 (cargo minor-patch x9): ❌ multiple failures
• chore(deps): bump the npm-minor-patch group across 1 directory with 10 updates #216 (npm minor-patch x10): ✅ backend, ❌ fmt+frontend_unit
• chore(deps): bump rust from 1.94-slim-bookworm to 1.95-slim-bookworm #215 (Rust 1.94→1.95 Docker): ✅ backend, ❌ fmt+frontend_unit
• chore(deps): bump softprops/action-gh-release from 2 to 3 #214 (action-gh-release v2→v3): ✅ backend, ❌ fmt+frontend_unit
• feat: 从服务器导入文件（引用模式） #173 (File import, Lucas): ❌ merge conflicts + failures
• chore(deps): bump tower-sessions from 0.14.0 to 0.15.0 #65 (tower-sessions 0.15): ❌ 5 failing checks

New Issues Filed

• code-quality: db.rs grown to 1763 lines — connection management, migrations, and utilities should be split into modules #244: db.rs grown to 1763 lines — needs module split (connection, migrations, spatial, utils)

Previously Filed (Still Open, Unresolved)

CI Blockers

• fix: main branch CI broken — cargo fmt and biome check failures since 2026-04-12 #223: Main CI broken (cargo fmt + biome)
• ci: cargo fmt fails on font_handlers.rs and icon_handlers.rs (rustfmt line-length enforcement) #238: cargo fmt fails on font_handlers.rs + icon_handlers.rs
• ci: cargo audit fails — Cargo.lock has unresolvable num-rational dependency #239: cargo audit can't parse Cargo.lock

Security

• [安全] Critical SQL Injection Vulnerability in Feature Properties Query #194: SQL injection in feature properties query
• [安全] SVG 上传潜在的 XXE (XML External Entity) 攻击向量 #218: SVG XXE attack vector
• [安全] DefaultBodyLimit::disable() 全局禁用请求体大小限制 #219: DefaultBodyLimit disabled globally
• security: SVG icon served inline enables stored XSS #237: SVG served inline enables XSS
• security: 4 npm vulnerabilities — Vite path traversal, picomatch ReDoS, postcss XSS, proto pollution #240: 4 npm vulnerabilities

Code Quality

• code-quality: handlers.rs grown to 1626 lines (was 882) — needs splitting #227: handlers.rs 1626 lines
• code-quality: workspace_handlers.rs at 1259 lines — needs module split #229: workspace_handlers.rs 1259 lines
• code-quality: App.jsx grown to 2111 lines (was 612) — needs splitting #230: App.jsx 2111 lines
• code-quality: import.rs grown to 1584 lines — OGC_FID workaround logic should be extracted #241: import.rs 1584 lines
• code-quality: db.rs grown to 1763 lines — connection management, migrations, and utilities should be split into modules #244: db.rs 1763 lines (NEW)

Documentation

• docs: Major documentation gaps in behaviors.md — workspace, PostGIS, settings, and file-level APIs undocumented #212: Major gaps in behaviors.md
• docs: behaviors.md missing icon management API and font delete endpoint #224/228/243: Missing icon/font/workspace API docs

Key Observations

1. 22 days without commits — longest stale period in recent history. All development appears blocked by CI.
2. CI is the critical path — fixing ci: cargo fmt fails on font_handlers.rs and icon_handlers.rs (rustfmt line-length enforcement) #238 (cargo fmt) would unblock 6 dependabot PRs immediately.
3. No new security findings — previously identified issues remain unfixed.
4. File size growth continues — db.rs now joins the list of files needing modularization.
5. PR chore(deps): bump the cargo-minor-patch group with 9 updates #232 (9 cargo deps) has additional failures beyond fmt — likely needs investigation.

Recommended Priority

1. 🔴 Fix CI (ci: cargo fmt fails on font_handlers.rs and icon_handlers.rs (rustfmt line-length enforcement) #238) — run cargo fmt, commit. This alone unblocks most PRs.
2. 🔴 Fix cargo audit (ci: cargo audit fails — Cargo.lock has unresolvable num-rational dependency #239) — regenerate Cargo.lock
3. 🟡 Fix frontend_unit — investigate the workflow failure
4. 🟢 Merge approved PRs once CI is green
5. 🟢 Modularize large files (code-quality: handlers.rs grown to 1626 lines (was 882) — needs splitting #227, code-quality: workspace_handlers.rs at 1259 lines — needs module split #229, code-quality: import.rs grown to 1584 lines — OGC_FID workaround logic should be extracted #241, code-quality: db.rs grown to 1763 lines — connection management, migrations, and utilities should be split into modules #244)