[ErisDS]

Follow up the review on #1081 with version 4 deep-import guidance, a removal TODO for the temporary @tryghost/string type shim, and a comment explaining why coverage measures compiled JavaScript. Replace the stale string parameter JSDoc with the existing null/omitted-input behavior.

Runtime behavior, types and exports are unchanged. Keep the nullable slug contract and both build hooks: package preparation and local testing each need compiled output.

Validation:

• corepack pnpm --filter @tryghost/security test — 42 tests pass, including build, declaration checks and CommonJS compatibility.
• corepack pnpm lint
• corepack pnpm format:check
• Manual check: string.safe() and string.safe(null) both return an empty string.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 8dd4312e-7c8f-40af-a849-38310bb49cc6

📥 Commits

Reviewing files that changed from the base of the PR and between f6f8dd0 and f3cec5d.

📒 Files selected for processing: 4

• packages/security/README.md
• packages/security/lib/string.ts
• packages/security/types/tryghost-string.d.ts
• packages/security/vitest.config.ts

Included review availability: This review used your included allowance. 2 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

Walkthrough

The README adds guidance on CommonJS root and deep imports, named exports, and version 4 default-import behavior. Comments clarify how safe handles null or omitted slug values, when the declaration shim can be removed, and what the coverage configuration measures.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~4 minutes

Change: Other

Suggested reviewers: vikaspotluri123

Merge Risk: ⚪ Minimal · up to f3cec

No actionable merge-blocking risk remains; the PR is limited to clarifying package documentation and code comments.

Pre-merge checks: 5

Check name	Status	Explanation
Description check		The description directly covers the documentation, TODO comment, coverage comment, JSDoc correction, preserved behavior, and validation results in the changeset.
Title check		The title clearly and concisely identifies the main change: clarifying compatibility notes for the security package.
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 3 files. (1 skipped: 1 …
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 3 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}