chore: add github sponsors on supporters by bjohansebas · Pull Request #8531 · nodejs/nodejs.org

bjohansebas · 2026-01-09T17:08:43Z

Description

Note that there’s no REST API for GitHub Sponsors, only a GraphQL API. I’m still working on this.

Preview:

Validation

Related Issues

closes #8199

Check List

I have read the Contributing Guidelines and made commit messages that follow the guideline.
I have run pnpm format to ensure the code follows the style guide.
I have run pnpm test to check if all tests are passing.
I have run pnpm build to check if the website builds without errors.
I've covered new added functionality with unit tests if necessary.

vercel · 2026-01-09T17:08:47Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
nodejs-org	Ready	Preview	Apr 29, 2026 1:26am

github-actions · 2026-01-09T17:08:53Z

👋 Codeowner Review Request

The following codeowners have been identified for the changed files:

Team reviewers: @nodejs/nodejs-website

Please review the changes when you have a chance. Thank you! 🙏

github-actions · 2026-01-09T17:16:24Z

📦 Build Size Comparison

Summary

Metric	Value
Old Total Size	3.51 MB
New Total Size	3.51 MB
Delta	5.00 B (0.00%)

Changes

➕ Added Assets (2)

Name	Size
`.next/static/chunks/4ab402c4ccfd82ec.js`	41.55 KB
`.next/static/chunks/9683dd9e3611b206.js`	197.63 KB

➖ Removed Assets (2)

Name	Size
`.next/static/chunks/46deeb46308b8a8b.js`	41.54 KB
`.next/static/chunks/3a4ee3cc36de6c5f.js`	197.63 KB

Signed-off-by: Sebastian Beltran <bjohansebas@gmail.com>

bjohansebas · 2026-02-08T04:21:29Z

@nodejs/web-infra I think the new environment variable should also be set in Vercel, since that’s where the website is built, both for production and for previews

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Sebastian Beltran <bjohansebas@gmail.com>

bjohansebas · 2026-02-08T04:36:22Z

+        organization(login: "nodejs") {
+            sponsorshipsAsMaintainer (first: 100, includePrivate: false, after: "${cursor}", activeOnly: false) {


definitely, I’d prefer that we only show sponsors that are active, but why do we want to show everyone? see #8268.

wdyt @nodejs/nodejs-website @nodejs/marketing ?

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Sebastian Beltran <bjohansebas@gmail.com>

cursor

Cursor Bugbot has reviewed your changes and found 4 potential issues.

Autofix Details

Bugbot Autofix prepared fixes for all 4 issues found in the latest run.

✅ Fixed: GraphQL cursor interpolated as string "null" on first request
- The sponsorship query now serializes cursor with JSON.stringify(cursor), so the first request sends GraphQL null instead of the string "null".
✅ Fixed: Duplicate n.sponsorEntity fallback provides no additional coverage
- Sponsor extraction was consolidated to node.sponsor || node.sponsorEntity, removing the duplicated fallback in both mapping paths.
✅ Fixed: Component loses OpenCollective profile links by switching to url
- The supporters component now passes profile || url to Avatar, restoring OpenCollective profile links while keeping website URLs as fallback.
✅ Fixed: Missing deduplication between sponsorship and activity queries
- GitHub sponsors are now added through a deduplicating helper keyed by sponsor identity so overlaps between sponsorships and activity events no longer duplicate entries.

Or push these changes by commenting:

@cursor push 77dce1aa43

Preview (77dce1aa43)

diff --git a/apps/site/components/Common/Supporters/index.tsx b/apps/site/components/Common/Supporters/index.tsx
--- a/apps/site/components/Common/Supporters/index.tsx
+++ b/apps/site/components/Common/Supporters/index.tsx
@@ -11,13 +11,13 @@
 
 const SupportersList: FC<SupportersListProps> = ({ supporters }) => (
   <div className="flex max-w-full flex-wrap items-center justify-center gap-1">
-    {supporters.map(({ name, image, url }) => (
+    {supporters.map(({ name, image, profile, url }) => (
       <Avatar
         nickname={name}
         fallback={getAcronymFromString(name)}
         image={image}
         key={name}
-        url={url}
+        url={profile || url}
       />
     ))}
   </div>

diff --git a/apps/site/next-data/generators/supportersData.mjs b/apps/site/next-data/generators/supportersData.mjs
--- a/apps/site/next-data/generators/supportersData.mjs
+++ b/apps/site/next-data/generators/supportersData.mjs
@@ -46,7 +46,26 @@
   }
 
   const sponsors = [];
+  const seenSponsorKeys = new Set();
 
+  const addSponsor = node => {
+    const s = node.sponsor || node.sponsorEntity; // support different field names
+    const key = s?.id ?? s?.login ?? s?.url ?? s?.name ?? s?.avatarUrl;
+    if (key && seenSponsorKeys.has(key)) {
+      return;
+    }
+    if (key) {
+      seenSponsorKeys.add(key);
+    }
+
+    sponsors.push({
+      name: s?.name || s?.login || null,
+      image: s?.avatarUrl || null,
+      url: s?.url || null,
+      source: 'github',
+    });
+  };
+
   // Fetch sponsorship pages
   let cursor = null;
 
@@ -64,18 +83,8 @@
     }
 
     const { nodes, pageInfo } = nodeRes;
-    const mapped = nodes.map(n => {
-      const s = n.sponsor || n.sponsorEntity || n.sponsorEntity; // support different field names
-      return {
-        name: s?.name || s?.login || null,
-        image: s?.avatarUrl || null,
-        url: s?.url || null,
-        source: 'github',
-      };
-    });
+    nodes.forEach(addSponsor);
 
-    sponsors.push(...mapped);
-
     if (!pageInfo.hasNextPage) {
       break;
     }
@@ -96,18 +105,8 @@
   }
 
   const { nodes } = nodeRes;
-  const mapped = nodes.map(n => {
-    const s = n.sponsor || n.sponsorEntity || n.sponsorEntity; // support different field names
-    return {
-      name: s?.name || s?.login || null,
-      image: s?.avatarUrl || null,
-      url: s?.url || null,
-      source: 'github',
-    };
-  });
+  nodes.forEach(addSponsor);
 
-  sponsors.push(...mapped);
-
   return sponsors;
 }
 
@@ -115,7 +114,7 @@
   return `
     query {
         organization(login: "nodejs") {
-            sponsorshipsAsMaintainer (first: 100, includePrivate: false, after: "${cursor}", activeOnly: false) {
+            sponsorshipsAsMaintainer (first: 100, includePrivate: false, after: ${JSON.stringify(cursor)}, activeOnly: false) {
                 nodes {
                     sponsor: sponsorEntity {
                         ...on User {

_{This Bugbot Autofix run was free. To enable autofix for future PRs, go to the Cursor dashboard.}

…handling

…in supportersData.mjs

…ships and donations queries

… in GraphQL queries

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 492c9ed. Configure here.}

cursor · 2026-04-12T19:31:32Z

+
+    const { nodes, pageInfo } = nodeRes;
+    const mapped = nodes.map(n => {
+      const s = n.sponsor || n.sponsorEntity; // support different field names


GraphQL alias makes n.sponsorEntity fallback unreachable dead code

Low Severity

The || n.sponsorEntity fallback in both fetchSponsorshipsQuery and fetchDonationsQuery is unreachable. In SPONSORSHIPS_QUERY, the GraphQL alias sponsor: sponsorEntity ensures the response field is always sponsor — sponsorEntity never appears in the JSON response. In DONATIONS_QUERY, the field is natively named sponsor. So n.sponsorEntity is always undefined, making the fallback dead code with a misleading comment.

Additional Locations (1)

apps/site/next-data/generators/supportersData.mjs#L184-L186

^{Reviewed by Cursor Bugbot for commit 492c9ed. Configure here.}

… key handling

MattIPv4 · 2026-04-12T22:08:54Z

X-posting from Slack... the fine-grained token I generated did not work:

[{"type":"FORBIDDEN","path":["organization"],"extensions":{"saml_failure":false},"locations":[{"line":3,"column":5}],"message":"The 'Node.js' enterprise forbids access via a fine-grained personal access tokens if the token's lifetime is greater than 366 days. Please adjust your token's lifetime at the following URL: https://github.com/settings/personal-access-tokens/13409736"}]

I attempted switching the preview to a classic token with no permissions set, which also did not work:

[{"type":"INSUFFICIENT_SCOPES","locations":[{"line":6,"column":11}],"message":"Your token has not been granted the required scopes to execute this query. The 'id' field requires one of the following scopes: ['read:user', 'read:org'], but your token has only been granted the: [''] scopes. Please modify your token's scopes at: https://github.com/settings/tokens."},{"type":"INSUFFICIENT_SCOPES","locations":[{"line":17,"column":15}],"message":"Your token has not been granted the required scopes to execute this query. The 'databaseId' field requires one of the following scopes: ['read:org'], but your token has only been granted the: [''] scopes. Please modify your token's scopes at: https://github.com/settings/tokens."},{"type":"INSUFFICIENT_SCOPES","locations":[{"line":18,"column":15}],"message":"Your token has not been granted the required scopes to execute this query. The 'name' field requires one of the following scopes: ['read:org'], but your token has only been granted the: [''] scopes. Please modify your token's scopes at: https://github.com/settings/tokens."},{"type":"INSUFFICIENT_SCOPES","locations":[{"line":19,"column":15}],"message":"Your token has not been granted the required scopes to execute this query. The 'login' field requires one of the following scopes: ['read:org'], but your token has only been granted the: [''] scopes. Please modify your token's scopes at: https://github.com/settings/tokens."},{"type":"INSUFFICIENT_SCOPES","locations":[{"line":20,"column":15}],"message":"Your token has not been granted the required scopes to execute this query. The 'avatarUrl' field requires one of the following scopes: ['read:org'], but your token has only been granted the: [''] scopes. Please modify your token's scopes at: https://github.com/settings/tokens."},{"type":"INSUFFICIENT_SCOPES","locations":[{"line":21,"column":15}],"message":"Your token has not been granted the required scopes to execute this query. The 'url' field requires one of the following scopes: ['read:org'], but your token has only been granted the: [''] scopes. Please modify your token's scopes at: https://github.com/settings/tokens."},{"type":"INSUFFICIENT_SCOPES","locations":[{"line":22,"column":15}],"message":"Your token has not been granted the required scopes to execute this query. The 'websiteUrl' field requires one of the following scopes: ['read:org'], but your token has only been granted the: [''] scopes. Please modify your token's scopes at: https://github.com/settings/tokens."},{"type":"INSUFFICIENT_SCOPES","locations":[{"line":25,"column":11}],"message":"Your token has not been granted the required scopes to execute this query. The 'timestamp' field requires one of the following scopes: ['read:user', 'read:org'], but your token has only been granted the: [''] scopes. Please modify your token's scopes at: https://github.com/settings/tokens."},{"type":"INSUFFICIENT_SCOPES","locations":[{"line":27,"column":13}],"message":"Your token has not been granted the required scopes to execute this query. The 'monthlyPriceInDollars' field requires one of the following scopes: ['read:user', 'read:org'], but your token has only been granted the: [''] scopes. Please modify your token's scopes at: https://github.com/settings/tokens."},{"type":"INSUFFICIENT_SCOPES","locations":[{"line":28,"column":13}],"message":"Your token has not been granted the required scopes to execute this query. The 'isOneTime' field requires one of the following scopes: ['read:user', 'read:org'], but your token has only been granted the: [''] scopes. Please modify your token's scopes at: https://github.com/settings/tokens."}]

Given our security posture for this project is that anyone can submit a PR that will immediately be built on Vercel, anyone could extract this token, so I do not believe it is safe to grant read:user or read:org to this token, as this can access non-public information.

We could attempt using a fine-grained token that has an expiration date, to comply with the org requirement (even though the fine-grained token resource owner is not the org), but that then becomes a yearly maintenance burden for us to ensure it is regenerated before it expires and breaks this feature.

I feel like we may be at an impasse here, unless we want to try a classic token with those permissions, but production only, so that this feature will not work in preview deployments?

MattIPv4 · 2026-04-12T22:33:10Z

I have generated a new classic token for @openjs-vercel with just the read:org permission (this does include potential access to private information). As this contains more than just public access, this token is now only set in the Vercel production environment, and specifically for preview deployments of this branch only -- however, importantly, other preview deployments will not have access to the token and this feature will not work for them.

With that scope applied to the token, https://nodejs-org-git-githubsponsors-openjs.vercel.app/en/about/partners is showing sponsors 🎉

bjohansebas · 2026-04-12T22:35:47Z

Cool, so @nodejs/nodejs-website and @nodejs/web-infra, could you please review it?

Signed-off-by: Brian Muenzenmeyer <brian.muenzenmeyer@gmail.com>

bmuenzenmeyer

one clarifying point between a comment and a query
otherwise looks great!

bmuenzenmeyer · 2026-04-30T01:37:51Z

+        first: 100
+        includePrivate: false
+        after: $cursor
+        activeOnly: false


activeOnly sounds contrary to the comment in the calling function, where we filter out active members. just something to confirm one way or the other

This comment was marked as off-topic.

Sign in to view

bjohansebas commented Jan 9, 2026

View reviewed changes

Comment thread apps/site/next-data/generators/supportersData.mjs Outdated

feat: implement fetch for github sponsors sponsorhip

46d49e7

bjohansebas force-pushed the github_sponsors branch from 06c283f to 46d49e7 Compare January 25, 2026 15:07

vercel Bot deployed to Preview January 25, 2026 15:08 View deployment

fixup

00e81c5

vercel Bot deployed to Preview February 8, 2026 03:21 View deployment

feat: implement donations queary and fix links

309a8bb

Signed-off-by: Sebastian Beltran <bjohansebas@gmail.com>

vercel Bot deployed to Preview February 8, 2026 03:53 View deployment

feat: update text of supporters

70c5076

vercel Bot deployed to Preview February 8, 2026 04:01 View deployment

bjohansebas added 2 commits February 8, 2026 04:10

feat: include past sponsors

21655fa

Signed-off-by: Sebastian Beltran <bjohansebas@gmail.com>

feat: sort supporters

448e37e

Signed-off-by: Sebastian Beltran <bjohansebas@gmail.com>

bjohansebas marked this pull request as ready for review February 8, 2026 04:22

bjohansebas requested a review from a team as a code owner February 8, 2026 04:22

Copilot AI review requested due to automatic review settings February 8, 2026 04:22

Copilot started reviewing on behalf of bjohansebas February 8, 2026 04:22 View session

vercel Bot deployed to Preview February 8, 2026 04:23 View deployment

sentry Bot reviewed Feb 8, 2026

View reviewed changes

Comment thread apps/site/next-data/generators/supportersData.mjs Outdated

Comment thread apps/site/next-data/generators/supportersData.mjs Outdated

Comment thread apps/site/next-data/generators/supportersData.mjs

This comment was marked as resolved.

Sign in to view

Update apps/site/next-data/generators/supportersData.mjs

0ad4e41

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Sebastian Beltran <bjohansebas@gmail.com>

vercel Bot deployed to Preview February 8, 2026 04:29 View deployment

sentry Bot reviewed Feb 8, 2026

View reviewed changes

Comment thread apps/site/next-data/generators/supportersData.mjs Outdated

bjohansebas commented Feb 8, 2026

View reviewed changes

Apply suggestion from @Copilot

6da91ff

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Sebastian Beltran <bjohansebas@gmail.com>

vercel Bot deployed to Preview February 8, 2026 04:41 View deployment

vercel Bot deployed to Preview April 12, 2026 18:45 View deployment

cursor Bot reviewed Apr 12, 2026

View reviewed changes

Comment thread apps/site/next-data/generators/supportersData.mjs Outdated

Comment thread apps/site/next-data/generators/supportersData.mjs Outdated

Comment thread apps/site/components/Common/Supporters/index.tsx

Comment thread apps/site/next-data/generators/supportersData.mjs Outdated

fix: update supporters data mapping to include source and adjust URL …

f419e15

…handling

vercel Bot deployed to Preview April 12, 2026 19:02 View deployment

cursor Bot reviewed Apr 12, 2026

View reviewed changes

Comment thread apps/site/next-data/generators/supportersData.mjs

bjohansebas added 2 commits April 12, 2026 19:07

refactor: consolidate GraphQL queries for sponsorships and donations …

c493a8d

…in supportersData.mjs

refactor: streamline fetching of GitHub sponsors by combining sponsor…

6f5435b

…ships and donations queries

vercel Bot deployed to Preview April 12, 2026 19:11 View deployment

bjohansebas added 2 commits April 12, 2026 19:13

test: add end-to-end test for partners page to verify no 500 error

536b553

refactor: simplify cursor handling and clean up sponsor field mapping…

7cb53c4

… in GraphQL queries

vercel Bot deployed to Preview April 12, 2026 19:19 View deployment

fix: correct wording in supporters section for clarity

492c9ed

vercel Bot deployed to Preview April 12, 2026 19:23 View deployment

cursor Bot reviewed Apr 12, 2026

View reviewed changes

chore: standardize naming for GitHub sponsor supporter and update API…

512ba91

… key handling

bjohansebas requested a review from a team as a code owner April 12, 2026 19:42

github-advanced-security AI found potential problems Apr 12, 2026

View reviewed changes

Comment thread .github/workflows/playwright-cloudflare-open-next.yml Fixed

vercel Bot deployed to Preview April 12, 2026 19:43 View deployment

remove test

dfdf2ab

vercel Bot deployed to Preview April 12, 2026 19:50 View deployment

MattIPv4 mentioned this pull request Apr 12, 2026

Add NEXT_GITHUB_READ_API_TOKEN to PERMISSIONS.md nodejs/web-team#127

Merged

bjohansebas requested review from araujogui, avivkeller and ovflowd April 18, 2026 15:18

Merge branch 'main' into github_sponsors

4d0c924

Signed-off-by: Brian Muenzenmeyer <brian.muenzenmeyer@gmail.com>

vercel Bot deployed to Preview April 29, 2026 01:26 View deployment

bmuenzenmeyer approved these changes Apr 30, 2026

View reviewed changes

		organization(login: "nodejs") {
		sponsorshipsAsMaintainer (first: 100, includePrivate: false, after: "${cursor}", activeOnly: false) {

Conversation

bjohansebas commented Jan 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Validation

Related Issues

Check List

Uh oh!

vercel Bot commented Jan 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jan 9, 2026

👋 Codeowner Review Request

Uh oh!

This comment was marked as off-topic.

github-actions Bot commented Jan 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📦 Build Size Comparison

Summary

Changes

Uh oh!

Uh oh!

bjohansebas commented Feb 8, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment was marked as resolved.

Uh oh!

Uh oh!

bjohansebas Feb 8, 2026

Choose a reason for hiding this comment

Uh oh!

bjohansebas Feb 8, 2026

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Apr 12, 2026

Choose a reason for hiding this comment

GraphQL alias makes n.sponsorEntity fallback unreachable dead code

Uh oh!

Uh oh!

MattIPv4 commented Apr 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

MattIPv4 commented Apr 12, 2026

Uh oh!

bjohansebas commented Apr 12, 2026

Uh oh!

bmuenzenmeyer left a comment

Choose a reason for hiding this comment

Uh oh!

bmuenzenmeyer Apr 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

bjohansebas commented Jan 9, 2026 •

edited

Loading

vercel Bot commented Jan 9, 2026 •

edited

Loading

github-actions Bot commented Jan 9, 2026 •

edited

Loading

cursor Bot left a comment •

edited

Loading

GraphQL alias makes `n.sponsorEntity` fallback unreachable dead code

MattIPv4 commented Apr 12, 2026 •

edited

Loading

bmuenzenmeyer Apr 30, 2026 •

edited

Loading