[raymondjacobson]

Facebook's crawler receives HTTP 500 for /legal/privacy-policy even after passing the Cloudflare WAF. The SSR router interprets it as a track with handle legal and slug privacy-policy; the renderer then destructures an undefined track. Production Worker logs confirmed this failure.

Reserve the legal namespace from music routes and add explicit SSR handling for all five existing legal pages. Each response includes page-specific metadata, a heading, a direct link to the existing PDF, and an embedded PDF without requiring JavaScript. Client rendering uses the existing public site. The policy documents themselves remain the source of truth; this change does not transcribe or alter their contents.

Validation:

• npm run test:ssr -w @audius/web: 7 regression tests pass, covering legal routes with trailing slashes, namespace exclusions, document rendering/assets, and ordinary music routes.
• A temporary Vike integration fixture using the actual legal renderer returned HTTP 200 for all five URLs with facebookexternalhit/1.1 and ?fbclid=test; verified titles, PDF links, and embeds.
• Targeted ESLint, Prettier, and git diff --check pass.
• Web CI/CD run #2388 passes on commit 6057909f8d: full web tests, typecheck, lint/stylelint, production build, and SSR production build.
• Reproduced and fixed test compatibility with the repository's older Node types and happy-dom/Vite asset URL handling; the seven regression tests pass in both Node and happy-dom.

After deployment, re-scrape the privacy-policy URL in Meta's Sharing Debugger and retry the required-action submission. Production and Meta settings have not been changed by this PR.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 6057909

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[socket-security]

Dependency limit exceeded — report not shown.

This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report.

Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard.

Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account.