Publish valid RSS and sitemap feeds with public event URLs

[esthor]

Problem

Post-deployment validation found that the event RSS endpoint returns HTTP 200 with invalid XML: titles such as “All Things Web Show & Tell” and descriptions are interpolated without escaping. RSS and sitemap links also use protected deployment URLs, and the sitemap declares an incorrect namespace.

Change

• Generate well-formed XML for event titles, descriptions and links, retaining Unicode and filtering invalid XML control characters.
• Use canonical allthingsweb.dev URLs for these public publishing feeds, independently of ephemeral deployment origins; encode event path segments.
• Declare the sitemap protocol namespace and retain event modification dates. Omit unknown modification dates for static pages instead of inventing a new date on every request.
• Extract pure feed generators and exercise them with an XML parser in tests. No runtime dependency or database migration is added.

This is a separate feed-correctness follow-up based on merged main after #24. Runtime/authentication origin configuration is unchanged.

Validation

• CodeRabbit CLI reviewed committed head 353facd957c0c74942b620225f0f3e48069328c8 against merged main and reported 0 issues. The GitHub bot was quota-limited and did not perform a PR review; its green status is not treated as approval.
• CI and Vercel preview build passed for that same head.
• 19 tests pass with 87 assertions; TypeScript, formatting and diff checks pass.
• Parser-based tests cover ampersands, markup, injected item elements, Unicode, invalid controls, encoded URLs, namespace, dates and empty feeds.
• Independently parsed generated feeds against the current production snapshot using Python XML: all 35 RSS items and 38 sitemap URLs are valid and point to the public site.
• Merged as aec7a34fe8433606f6d56d5ba8d25855e571fc9a; main CI and production deployment passed. Live verification at 02:29 UTC parsed 35 RSS items and 38 sitemap URLs, reconciled every event link and title with the published-event API, and confirmed the /rss.xml redirect resolves to the public /rss endpoint.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
allthingsweb	Ready	Preview	Sep 16, 2026 2:26am UTC

[coderabbitai]

Warning

Review limit reached

Next included review available in 48 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

This review ran on the open-source allowance, not this organization's plan, because the pull request author doesn't have an assigned seat. Waiting won't change this — ask an organization admin to assign them a seat, or add seats in Billing if every seat is already assigned, then retry.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 466edefa-2582-4f5c-94e9-5613bcf3425f

📥 Commits

Reviewing files that changed from the base of the PR and between 343a86e and 353facd.

⛔ Files ignored due to path filters (1)

• app/bun.lock is excluded by !**/*.lock

📒 Files selected for processing (5)

• app/package.json
• app/src/app/rss/route.ts
• app/src/app/sitemap.xml/route.ts
• app/src/lib/event-feeds.ts
• app/tests/event-feeds.test.ts

---

_{Comment @coderabbitai help to get the list of available commands.}