Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@app/components/Button/CopyMd.vue`:
- Around line 15-36: Update prefetchMarkdown and the fetch condition inside
copyMarkdown so status === 'error' retries fetchMarkdown before copying,
preventing stale or empty markdown after transient failures. Preserve the
existing idle/pending behavior and ensure copying proceeds only with the
refreshed result or surfaces the fetch failure.

In `@app/components/Changelog/Releases.vue`:
- Around line 11-21: Pass the existing host value from Releases.vue into each
ChangelogCard, then update ChangelogCard’s raw release useLazyFetch query to
include host alongside the existing parameters. Ensure the raw endpoint receives
the self-hosted host instead of falling back to its default.

In `@server/api/changelog/md/`[provider]/[owner]/[repo]/[...path].get.ts:
- Around line 19-20: The changelog fetch path must not pass arbitrary host
values from the host query parameter into server-side requests. Update the
validation and fetch flow around the parsed host, including the logic at lines
32-46, to reuse a shared outbound-host validator that validates URL structure,
resolved addresses, and every redirect, or enforce the established host
allowlist before fetching and returning raw content.
- Around line 93-101: Add a `tangled` case to the `getRepoInfo()` provider
switch and dispatch to the existing `createTangledInfo` function with the
appropriate repository parameters, so Tangled repositories return their info
instead of falling through as undefined. Preserve the existing dispatch behavior
for GitHub, Forgejo/Codeberg, and GitLab.

In `@server/api/changelog/releases/`[provider]/[owner]/[repo].get.ts:
- Around line 37-41: Add a `tangled` branch to the provider switch alongside the
existing Forgejo and GitLab cases, routing through a dedicated
`getReleasesFromTangled` fetcher with the appropriate owner, repository, and
host values. Ensure the endpoint’s provider-specific release retrieval and
rendering path covers Tangled requests consistently with the advertised support.
- Around line 23-24: Validate the optional host from the query before it reaches
the Forgejo and GitLab $fetch URL construction, allowing only approved public
destinations or an explicit host allowlist. Apply the same protection to every
provider request and validate each redirect target to block private, loopback,
link-local, reserved, and DNS-rebinding addresses; reject invalid hosts before
fetching.

In `@server/api/changelog/releases/`[provider]/[owner]/[repo]/raw/[tag].get.ts:
- Line 75: URL-encode the decoded tag route parameter in the upstream API URL
construction for all three provider functions. Update each URL template using
tag to apply encodeURIComponent(tag), while leaving owner, repo, and the
surrounding request behavior unchanged.
- Around line 17-18: Validate the user-controlled host from rawQuery before
constructing any upstream URL. Add or reuse a validateHost(provider, host) guard
that permits only approved Git hosting providers (or otherwise enforces valid
public hostnames and rejects private, loopback, and link-local ranges), then
invoke it in the raw release flow before the provider-specific API calls; apply
the same protection to the corresponding releases endpoint and every listed host
usage.

In `@server/utils/changelog/detectChangelog.ts`:
- Around line 243-248: Update ROOT_ONLY_REGEX and both directory-filter
conditions in checkLatestForgejoRelease and checkLatestGitlabRelease so
extracted root-level paths such as changelog.md match without a leading slash,
while nested paths still require the configured directory prefix.

In `@server/utils/changelog/markdown.ts`:
- Line 239: Update accountRegex and the corresponding matching logic at the
referenced usage to exclude @ segments from email addresses and package-version
suffixes such as package@latest, while preserving valid standalone account
mentions. Ensure both account-matching paths use the same corrected boundary
behavior.
- Line 100: Update the textFilter configuration to prevent
createResolveGitTextToLinks from emitting unsafe raw anchor markup from
request-derived host, owner, or repo values; build links before sanitization or
HTML-escape both generated URLs and labels before insertion. Add a regression
test covering quote-containing repository components and verify the resulting
href and text cannot inject markup.

In `@shared/utils/constants.ts`:
- Line 48: Update the ERROR_CHANGELOG_NOT_FOUND constant’s user-facing message
to use “was found” instead of “had been found,” preserving the rest of the
wording.

---

Nitpick comments:
In `@app/components/Changelog/Markdown.vue`:
- Around line 24-26: Add a brief explanatory comment immediately above the
typeof data.value == 'string' guard in the watchEffect callback, clarifying that
the endpoint may return either a parsed object or raw string depending on the
raw query. Keep the existing guard and behavior unchanged.

In `@server/api/changelog/releases/`[provider]/[owner]/[repo]/raw/[tag].get.ts:
- Around line 116-127: Update getMarkdownFromForgejo and getMarkdownFromGitlab
so their $fetch API requests include the same User-Agent header as
getMarkdownFromGithub, using the value npmx.dev. Preserve the existing request
URLs and response parsing.

In `@server/utils/changelog/detectChangelog.ts`:
- Around line 106-114: Update the fetch call in checkFiles to enforce a finite
timeout, using AbortSignal.timeout or an equivalent AbortController signal,
while preserving the existing URL, headers, method selection, and false-on-error
behavior.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@shared/utils/git-providers.ts`:
- Around line 305-311: Update the provider parsing logic around the discarded
NEED_HOST.includes(provider.id) expression to retain its boolean result, then
use that result when assigning host in the returned object. Ensure host is
populated only for providers listed in NEED_HOST and remains undefined for all
others.

---

Nitpick comments:
In `@shared/utils/git-providers.ts`:
- Line 291: Type the NEED_HOST constant explicitly as ProviderId[] so its
provider entries are compile-time validated. Preserve the existing provider
values and locate the change at the NEED_HOST declaration.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/unit/server/utils/changelog/validateHost.spec.ts`:
- Line 52: Correct the describe block title in the host validation tests by
changing “know host” to “known host”; leave the test behavior unchanged.
- Line 46: Correct the typo in the test description for the “require radicle to
have a host” case by changing “shoud” to “should.”
- Around line 179-182: Correct the test description in the radicle host
validation test so it states that gitea.com should be rejected or disallowed.
Keep the existing createSchema('radicle') setup and toBeFalsy assertion
unchanged.
- Around line 19-27: Update the second test description in the changelog host
validation tests to say it allows tangled without a host, while leaving its
createSchema('tangled') setup and assertions unchanged.