Repository navigation
Resolve #982, #999, #1002, #1003: compressed body limits, SBOM, signed releases & event activity charts - #1069
Open
susanyusuf wants to merge 6 commits into
Conversation
Restore @stellar/stellar-sdk, node-cache and uuid to listener dependencies (clobbered by a bad merge) and regenerate the invalidated package-lock.json so npm ci succeeds again. Also repair merge-corruption left in security-headers, compatibility-check, webhook-sender, webhook-verifier and its test suite, and in the dashboard jest setup, where duplicated/partial declarations broke typecheck and tests.
) Add a decompression-limit middleware that bounds both the compressed and the inflated request body before any route handler reads it, guarding against decompression bombs. Unsupported encodings are rejected with 415, oversized payloads with 413 and malformed bodies with 400. Wire it into the events server behind maxCompressedBytes and maxDecompressedBytes options.
Add a workflow that produces SPDX and CycloneDX SBOMs for the listener, dashboard, frontend and contract packages on pushes to main, tags and manual runs. Artifacts are versioned with the build and the job fails visibly when no components are detected.
Add a release workflow that builds a versioned tarball, publishes a SHA256SUMS checksum file, attaches build provenance attestations and verifies both checksums and attestations after publishing. A validate-workflow job lints the workflow and rehearses the checksum logic on pull requests. Document the verification steps and reference them from the release checklist.
Add an event activity chart to the event explorer with selectable time ranges (1h/6h/24h/7d). Buckets use consistent, non-overlapping time boundaries so chart values reconcile with the underlying event data, and empty ranges render a dedicated empty state.
|
@susanyusuf Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #982
Closes #999
Closes #1002
Closes #1003
Summary
Resolves the four issues above.
#999 — Compressed request body limits
listener/src/middleware/decompression-limit.tsbounds both the compressed and the inflated request body before any route handler reads it, guarding against decompression bombs.gzip/x-gzip/deflate/br; unsupported encodings → 415, oversized payloads → 413, malformed bodies → 400.maxCompressedBytes/maxDecompressedBytesoptions.#1002 — SBOM generation
.github/workflows/sbom.ymlgenerates SPDX and CycloneDX SBOMs (via Syft) forlistener,dashboard,frontendandcontract.sbom-<version>-<sha>) and the job fails visibly when no components are detected or the files are missing.#1003 — Signed release artifacts & verification
.github/workflows/release.yml: builds a versioned tarball, publishesSHA256SUMS, attaches a build-provenance attestation, and verifies both the checksums and the attestation after publishing. Avalidate-workflowjob lints the workflow and rehearses the checksum logic on pull requests.docs/RELEASE_VERIFICATION.mdwith verification instructions;docs/RELEASE_CHECKLIST.mdupdated to reference it.#982 — Event activity charts
dashboard/src/utils/eventActivityData.tsanddashboard/src/components/EventActivityChart.tsxwith selectable1h/6h/24h/7dranges.EventExplorerPage.tsx.Included: repair of pre-existing
mainbreakageWhile implementing the above I found
mainin a broken merge state and fixed the parts that block CI and the code touched here:listener/package.jsonhad its production dependencies clobbered by a bad merge; restored@stellar/stellar-sdk,node-cacheanduuid.listener/package-lock.jsonwas invalid JSON → regenerated;npm cisucceeds again.security-headers.ts,compatibility-check.ts,webhook-sender.ts,webhook-verifier.ts(and its test suite) anddashboard/jest.setup.cjs.Test notes / known pre-existing issues
webhook-verifier(69),decompression-limit(38),security-headers+compatibility-check(12).npm run typecheckstill reports ~84 errors in files untouched by this PR, so theci.ymlmigrationsjob will remain red until that unrelated merge corruption is cleaned up. Happy to take that as a follow-up.npm cihits a pre-existing Storybook peer-dependency conflict (ERESOLVE); it requires--legacy-peer-depslocally.