We wrote in January about a handful of fixes we sent upstream to open source projects we depend on. Since then we’ve made several more contributions.
ClarityBoss is assembled from many open source pieces. We owe a lot to the people maintaining them, and when we find something broken or wrong while building our product, taking the time to fix it upstream is the least we can do.
reka-ui
reka-ui (the successor to Radix Vue) is our headless component library. It provides the unstyled but accessible primitives, including dialogs, dropdowns, tabs, tooltips, calendars, and drawers, that we layer our own Tailwind styling on top of. Having accessible behavior handled by the library means we can focus on what ClarityBoss actually looks like rather than reimplementing keyboard navigation and focus trapping for every modal.
One of the components we use is AvatarImage, which shows user avatars throughout the app on person profiles and cards. We noticed that the referrerpolicy and crossorigin props were accepted by the component but silently dropped. They never made it down to the underlying <img> element. This matters when displaying avatars loaded from external sources where you want to control referrer leakage or handle CORS correctly. The fix was straightforward once we identified it, and PR #2391 was merged in mid-January.
resend-go
resend-go is the official Go SDK for Resend, the email API we use for outbound mail such as magic links, reminders, and sharing notifications. We also use Resend’s inbound email receiving feature, which allows users to forward emails into ClarityBoss to have them processed and turned into entries automatically.
Resend had added new fields to the inbound email receiving API, but the Go SDK structs hadn’t been updated to reflect them. Without those fields, we couldn’t access the additional parsed data that Resend was already providing in API responses. We sent PR #98 to add the missing fields, which was merged the next day. A short turnaround, which we appreciated.
Plausible
Plausible is the privacy-first analytics platform we use to understand how people are using ClarityBoss without tracking individual users or sending data to third parties.
When we were working to utilize server-side rendering at build time to pre-render HTML pages, we we hit a snag: the tracker script accessed window.location at module import time rather than deferring it to when the tracking actually runs. In server-side rendering or module environments, location is not available at import time. The access would throw, which breaks the entire module load.
PR #6039 defers that location access until execution time. It’s still open in the Plausible repository as of this writing, but hopefully it will get looked at, as there was already an upstream issue related to server-side usage.
z-schema
z-schema is a JSON Schema validator that can be used by RxDB. We use it instead of the more popular Ajv, as we didn’t want to add unsafe-eval to our Content-Security-Policy (upstream docs), and trying to compile the schemas at build time was hard with RxDB involved.
We discovered an issue in our Vite build when we were moving to Vite 8: z-schema’s package.json had "sideEffects": false set at the package level, which tells bundlers that every file in the package is safe to tree-shake. That is almost always fine, but z-schema has one file that calls registerRemoteReference() as a side effect at import time. With sideEffects: false, Vite 8’s rolldown bundler was correctly (per the spec) eliminating that initialization call entirely.
The result was a runtime failure that was hard to trace back to its source. Here is this fix, along with several others we made:
- PR #319: Removed some pieces of the legacy Grunt build toolchain that were left behind, which had become dead weight in the project.
- PR #320: Scoped validator imports to only the functions actually used, setting up proper tree-shaking support to shrink the library footprint when bundled.
- PR #322: Fixed test failures that the import refactoring surfaced.
- Issue #380 and PR #381: Identified and fixed the
sideEffectsmetadata to correctly mark the one file that can’t be tree-shaken.
All four PRs were merged within about a day and a half of being opened. The maintainer was quick to accept our fixes, which was awesome.
This kind of work rarely makes it into a changelog or a product announcement. But it’s part of how the ecosystem stays healthy, and we find it genuinely satisfying to leave a project in a better state than we found it.