feat: Add all-time contributions support with deduplicated repository count by banu4prasad · Pull Request #4644 · anuraghazra/github-readme-stats

banu4prasad · 2025-11-08T11:23:04Z

Summary

Adds support for displaying all-time contributions across all years on GitHub, with automatic deduplication of repositories to show accurate unique contribution counts.

Changes

Added all_time_contribs parameter to toggle between last year and all-time contributions
Deduplicated repository counting (counts each repo only once, even with multiple contribution types)
Increased cache duration for all-time stats.
Added ALL_TIME_CONTRIBS environment variable to enable/disable feature globally

Usage

Standard (last year only)
?username=YOUR_USERNAME

All-time contributions (deduplicated)
?username=YOUR_USERNAME&all_time_contribs=true

Environment Variables

ALL_TIME_CONTRIBS=true - Enable all-time contributions feature
PAT_1=<github_token> - GitHub Personal Access Token with read:user scope

fixes #2282

vercel · 2025-11-08T11:23:07Z

@banu4prasad is attempting to deploy a commit to the github readme stats Team on Vercel.

A member of the Team first needs to authorize it.

Copilot

Pull request overview

This PR adds support for displaying all-time contribution statistics across a user's entire GitHub history, with automatic deduplication to count unique repositories only once even when a user has multiple contribution types (commits, issues, PRs, reviews) to the same repository.

Key Changes:

Added all_time_contribs query parameter to enable fetching contributions across all years instead of just the last year
Implemented parallel fetching of contribution data using Promise.all() with a 9-second timeout and graceful fallback
Extended cache duration for all-time stats (6 hours default vs 4 hours for standard stats)

Reviewed changes

Copilot reviewed 6 out of 8 changed files in this pull request and generated 20 comments.

Show a summary per file

File	Description
`src/fetchers/all-time-contributions.js`	New module that fetches contribution years and yearly data in parallel, deduplicating repositories across all contribution types
`src/fetchers/stats.js`	Integrated all-time contributions feature with timeout protection and fallback logic; removed some logger statements
`api/index.js`	Added parameter handling for `all_time_contribs` and custom cache logic for longer TTL
`src/common/envs.js`	Added `ALL_TIME_CONTRIBS` environment variable to enable/disable the feature globally
`src/cards/stats.js`	Added conditional label rendering to show "all time" vs "last year" based on parameter
`src/cards/types.d.ts`	Added TypeScript type definition for the new `all_time_contribs` option
`src/translations.js`	Added `statcard.contribs-alltime` translation key in 48 languages
`.gitignore`	Added `.DS_Store` to ignore macOS system files

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 7 out of 9 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

…2617991897529006981 🔒 Fix Reflected XSS in API Status Endpoints

Replaced `curr.languages.edges.concat(acc)` with `acc.push(...curr.languages.edges)` to prevent recreating the accumulator array on each iteration. This reduces time complexity from O(N^2) to O(N). Co-authored-by: banu4prasad <113224132+banu4prasad@users.noreply.github.com>

…at-9829857916427544140 ⚡ perf: optimize O(N^2) array concatenation in top-languages fetcher

This commit escapes the `secondaryMessage` inside `renderError` using `encodeHTML()` to prevent XSS vulnerabilities when generating SVG output. Co-authored-by: banu4prasad <113224132+banu4prasad@users.noreply.github.com>

Updates `api/status/pat-info.js` and `api/status/up.js` to return proper structured JSON using `res.json()` rather than sending unescaped strings or stringified JSON via `res.send()`. This explicitly sets the correct Content-Type ensuring browsers won't execute malicious error messages as HTML. Updates tests accordingly. Co-authored-by: banu4prasad <113224132+banu4prasad@users.noreply.github.com>

Co-authored-by: banu4prasad <113224132+banu4prasad@users.noreply.github.com>

Changed the \`hide\` array filtering within \`renderStatsCard\` to use a \`Set\`. This changes the O(n) \`.includes()\` lookup to an O(1) \`.has()\` lookup. Applied to both stat items filtering and accessibility labels. Performance baseline measured using \`tests/bench/stats.bench.js\`: Before: avg ~32.5µs After: avg ~26.9µs Co-authored-by: banu4prasad <113224132+banu4prasad@users.noreply.github.com>

…cess-11153830499985198609 ⚡ Optimize object property access in top languages fetcher

…s-410756806148804890 ⚡ Optimize hidden stats array lookups with Set

…ints Updates `api/status/pat-info.js` and `api/status/up.js` error handling to explicitly return a JSON object using `res.json({ error: ... })` instead of sending strings through `res.send()`. This enforces strict API consistency and mitigates any theoretical HTML rendering issues, resolving potential XSS concerns. Note this is a breaking change for existing clients directly parsing the raw string error response. Tests have been updated to cover the new outer catch payload structure. Co-authored-by: banu4prasad <113224132+banu4prasad@users.noreply.github.com>

…ints Updates `api/status/pat-info.js` and `api/status/up.js` error handling to explicitly return a JSON object using `res.json({ error: ... })` instead of sending strings through `res.send()`. This enforces strict API consistency and corrects the API behavior since the endpoint explicitly sets `Content-Type: application/json`. Tests have been updated to cover the new outer catch payload structure. Co-authored-by: banu4prasad <113224132+banu4prasad@users.noreply.github.com>

…410205025217312 🔒 Fix Reflected XSS Vulnerability in PAT Info and Uptime Endpoints

This commit escapes the `secondaryMessage` inside `renderError` using `encodeHTML()` to prevent XSS vulnerabilities when generating SVG output. Also avoids double-escaping regression. Co-authored-by: banu4prasad <113224132+banu4prasad@users.noreply.github.com>

This commit escapes the `secondaryMessage` inside `renderError` using `encodeHTML()` to prevent XSS vulnerabilities when generating SVG output. Also avoids double-escaping regression and adds robust tests. Co-authored-by: banu4prasad <113224132+banu4prasad@users.noreply.github.com>

…ry-message-14295917276723695873 🔒 Fix unescaped secondaryMessage XSS vulnerability in renderError

…utions.js` Co-authored-by: banu4prasad <113224132+banu4prasad@users.noreply.github.com>

…-219987405495775010 ⚡ perf: optimize batch processing in all-time contributions with worker pool

dargmuesli · 2026-05-18T08:59:22Z

@banu4prasad why was this closed? 👀

banu4prasad · 2026-05-18T15:20:02Z

@banu4prasad why was this closed? 👀

@dargmuesli cuz i have edited too many files which was not related to the PR

banu4prasad and others added 14 commits November 5, 2025 18:12

gitignore

2629b1c

[feat] all_time_contribs

72561d7

quick fix

d2418bc

[fix] allContrib

8c54693

[fix] timeout error

09ae38f

[fix] logger.log

87c9bd6

minor changes

fbd784d

changes 2

0f360d3

fixx

f0b65db

force=F

dcd8159

trying

89f64f7

changes

c1ce1f3

remove deduplicate

758310d

Merge branch 'anuraghazra:master' into master

2816400

github-actions Bot added stats-card Feature, Enhancement, Fixes related to stats the stats card. card-i18n Card text translations. labels Nov 8, 2025

Merge branch 'anuraghazra:master' into master

718263c

Copilot AI review requested due to automatic review settings December 18, 2025 06:44

Copilot started reviewing on behalf of banu4prasad December 18, 2025 06:44 View session

Copilot AI reviewed Dec 18, 2025

View reviewed changes

banu4prasad and others added 2 commits December 25, 2025 20:29

changes as per the review

ed9e12a

Merge branch 'anuraghazra:master' into master

e652efa

banu4prasad requested a review from Copilot December 25, 2025 15:04

Copilot started reviewing on behalf of banu4prasad December 25, 2025 15:05 View session

Copilot AI reviewed Dec 25, 2025

View reviewed changes

Comment thread src/fetchers/all-time-contributions.js Outdated

Comment thread src/common/cache.js Outdated

Comment thread src/cards/stats.js Outdated

Comment thread api/index.js Outdated

banu4prasad added 4 commits December 25, 2025 20:46

removed unnecessary import

20ed7b7

minor fix

86e6a8e

cache duration

1455495

add envs

78f49cc

banu4prasad and others added 4 commits May 16, 2026 17:33

Merge pull request #1 from banu4prasad/fix-reflected-xss-api-status-1…

6a5bc0f

…2617991897529006981 🔒 Fix Reflected XSS in API Status Endpoints

Merge branch 'anuraghazra:master' into master

0529026

url.parse() fix

2a3673a

github-actions Bot added repo-card Issues related to the pin/repo card. lang-card Issues related to the language card. wakatime-card Issues related to the wakatime card. gist-card labels May 16, 2026

banu4prasad and others added 19 commits May 16, 2026 18:37

Merge pull request #2 from banu4prasad/perf/top-languages-reduce-conc…

449cef5

…at-9829857916427544140 ⚡ perf: optimize O(N^2) array concatenation in top-languages fetcher

Fix unescaped secondaryMessage XSS vulnerability

ca94291

This commit escapes the `secondaryMessage` inside `renderError` using `encodeHTML()` to prevent XSS vulnerabilities when generating SVG output. Co-authored-by: banu4prasad <113224132+banu4prasad@users.noreply.github.com>

⚡ Optimize object property access in top languages fetcher

6b614ac

Co-authored-by: banu4prasad <113224132+banu4prasad@users.noreply.github.com>

Merge pull request #5 from banu4prasad/optimize-top-langs-property-ac…

8678ec7

…cess-11153830499985198609 ⚡ Optimize object property access in top languages fetcher

Merge pull request #6 from banu4prasad/perf-optimization-hide-include…

3ff07de

…s-410756806148804890 ⚡ Optimize hidden stats array lookups with Set

Merge pull request #4 from banu4prasad/fix/security-xss-pat-info-6799…

68b9af8

…410205025217312 🔒 Fix Reflected XSS Vulnerability in PAT Info and Uptime Endpoints

Merge pull request #3 from banu4prasad/security-fix-unescaped-seconda…

d52be2e

…ry-message-14295917276723695873 🔒 Fix unescaped secondaryMessage XSS vulnerability in renderError

perf: optimize batch processing with worker pool in `all-time-contrib…

a154f49

…utions.js` Co-authored-by: banu4prasad <113224132+banu4prasad@users.noreply.github.com>

perf: optimize batch processing with worker pool in `all-time-contrib…

7faf835

…utions.js` Co-authored-by: banu4prasad <113224132+banu4prasad@users.noreply.github.com>

perf: optimize batch processing with worker pool in `all-time-contrib…

f002691

…utions.js` Co-authored-by: banu4prasad <113224132+banu4prasad@users.noreply.github.com>

perf: optimize batch processing with worker pool in `all-time-contrib…

54900e6

…utions.js` Co-authored-by: banu4prasad <113224132+banu4prasad@users.noreply.github.com>

perf: optimize batch processing with worker pool in `all-time-contrib…

a150c89

…utions.js` Co-authored-by: banu4prasad <113224132+banu4prasad@users.noreply.github.com>

Merge pull request #7 from banu4prasad/jules-optimize-process-batched…

df65590

…-219987405495775010 ⚡ perf: optimize batch processing in all-time contributions with worker pool

banu4prasad closed this May 17, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: Add all-time contributions support with deduplicated repository count#4644

feat: Add all-time contributions support with deduplicated repository count#4644
banu4prasad wants to merge 55 commits into
anuraghazra:masterfrom
banu4prasad:master

banu4prasad commented Nov 8, 2025 •

edited

Loading

Uh oh!

vercel Bot commented Nov 8, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dargmuesli commented May 18, 2026

Uh oh!

banu4prasad commented May 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

banu4prasad commented Nov 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Usage

Environment Variables

Uh oh!

vercel Bot commented Nov 8, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dargmuesli commented May 18, 2026

Uh oh!

banu4prasad commented May 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

banu4prasad commented Nov 8, 2025 •

edited

Loading