[comp] Production Deploy

[github-actions]

This is an automated pull request to release the candidate branch into production, which will trigger a deployment.
It was created by the [Production PR] action.

[cursor]

PR Summary

Medium Risk
Moderate risk: refactors the vendor risk-assessment Trigger.dev task (parallel Firecrawl calls, metadata-driven UI refresh, DB updates) and replaces Trust Portal Vercel/DNS integration plumbing, which could impact long-running jobs and domain verification edge cases.

Overview
Vendor risk assessment now runs with parallel core+news research and realtime progress reporting. The Trigger.dev task splits Firecrawl work into firecrawlResearchCore and firecrawlResearchNews, streams progress via run metadata (phase/messages), writes core results first (risk level, links, certifications, badges, logo), then merges news into GlobalVendors when available, with improved error handling/reset behavior.

Risk assessment outputs are broadened and surfaced more consistently. Compliance badge extraction now passes through all verified certs (normalizing known types), frontend certification filtering no longer whitelists a few types, vendor list/detail pages show an explicit Researching state and a new VendorResearchFeed, and Trust Portal vendor enrichment can backfill badges from GlobalVendors data.

Audit + Trust Portal plumbing improvements. Audit logging gains action-specific descriptions for POST sub-endpoints like vendors/:id/trigger-assessment, and Trust Portal domain management replaces Axios + external DNS lookup with a fetch wrapper for Vercel API calls and Node dns-based verification.

^{Reviewed by Cursor Bugbot for commit 540b2fc. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
comp-framework-editor	Ready	Preview, Comment	Apr 6, 2026 8:12pm

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
app (staging)	Skipped		Apr 6, 2026 8:12pm
portal (staging)	Skipped		Apr 6, 2026 8:12pm

[claudfuen]

🎉 This PR is included in version 3.16.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 540b2fc. Configure here.}

[cursor]

Failed assessment incorrectly marks vendor as "assessed"

High Severity

The catch block sets the vendor status to VendorStatus.assessed when the risk assessment fails. The VendorStatus enum has three values: not_assessed, in_progress, and assessed. On failure, the vendor appears successfully assessed in the UI despite having no (or incomplete) risk assessment data. The error message at the throw site even says "vendor will not be marked as assessed," directly contradicting what the catch block does. The status needs to be reset to not_assessed instead of assessed.

Additional Locations (1)

• apps/api/src/trigger/vendor/vendor-risk-assessment-task.ts#L1134-L1137

 

^{Reviewed by Cursor Bugbot for commit 540b2fc. Configure here.}