Repository navigation
Fix/security audit followups - #989
Merged
IbrahimIjai merged 3 commits intoOct 17, 2026
Merged
Conversation
…dencies
The trade price feed used oracle.biscotti-proxy-worker.workers.dev as its
primary source. Nobody on the project owns that Cloudflare Worker, so
whoever controls it controlled the prices every user saw. Pyth Hermes is
now primary, with Binance and GMX as the existing fallbacks. A regression
test asserts the worker is never queried. Dead e2e route stubs and the
oracles docs page are updated to match.
Also:
- Remove 10 committed nano swap files that leaked a contributor's
username and hostname; ignore *.swp.
- cli-deploy.yml: pass workflow_dispatch inputs through env vars instead
of ${{ }} interpolation to prevent shell injection.
- Dependencies: bun audit fix, vitest 3 -> 4.1.12 (fixes critical
tinypool RCE and @vitest/mocker file read), and root overrides for
axios, protobufjs, simple-git, ws, uuid, toml, tmp, qs, got,
parse-duration, basic-ftp and @modelcontextprotocol/sdk.
bun audit: 165 -> 9 (remaining have no published fix or need breaking
major upgrades of their parents).
- h3 pinned to 2.0.1-rc.29 (main's version): audit fix moved it to 2.0.2,
whose router rejects the /**/*.woff2 rules in cache-headers.ts and broke
the web build. h3 had no advisory.
- vitest 4 migration: typed Mock<> instead of ReturnType<typeof vi.fn>,
test.server.deps.inline, and stubGlobal for matchMedia (jsdom has none;
vitest 3 silently allowed spying on the undefined property).
Verification (local + clean-room clone with --frozen-lockfile):
check:tokens, check:content, test, test:coverage, build, and all indexer
integration steps pass.
Committed at the user's explicit request with known gate failures, all
pre-existing on main and unchanged by this commit:
- bun lint: 9 errors in web (DepthLadder.tsx, ConfirmationDialog.tsx,
TVChartContainer.tsx, useSourceFreshness.test.ts)
- bun typecheck: 2 errors (DepthLadder.tsx midPrice, ConfirmationDialog.tsx
missing ENV import)
- changelog:validate fails on many existing entries; the new entry has
pr: TBD until a PR number exists.
Web vitest suite (not part of the gate): 145 failing vs 146 on main; no
new failures.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Typecheck/lint (issue 1):
- ConfirmationDialog used `ENV.NETWORK` without importing ENV (TS2304 at
333:23); opening the dialog threw `ReferenceError: ENV is not defined`.
Imported ENV and added a render test asserting the "Network: testnet"
row so the path stays covered.
- Removed the unused `midPrice` prop from DepthLadder's SpreadRow and
fixed the remaining import-order / unnecessary-condition lint errors.
Cache route rules (issue 2):
- `/**/*.woff2|png|svg|ico` are invalid rou3 patterns (a route may
contain only one wildcard token) and h3 2.x rejects them at build time.
Vite emits every hashed asset under /assets, so the directory rules
cover them; non-hashed public files deliberately fall through to the
revalidating document rule instead of being pinned immutable.
- Dropped the root `h3` override: h3 resolves to stable 2.0.2 and the
web build succeeds. Added rou3-router unit tests and a built-server
integration test (`test:cache-headers`) covering hashed .woff2/.png
(immutable) and /favicon.ico (revalidating).
Overrides smoke tests (issue 3):
- `subql publish` loads and validates its arguments (no IPFS upload was
performed); `subql deployment:deploy` does not exist in @subql/cli
6.6.3, so `onfinality`, `network` and `mcp` were smoke-tested instead.
- `lhci autorun` never matched nitro's ready line ("Listening on: ...")
and the 10s default timeout is too short for the docs dev server. With
both fixed, a full 15-run autorun completes and passes its assertions.
Audit follow-ups (issue 4):
- Bumped @tanstack/react-start 1.168.46 -> 1.168.61 (start-server-core
1.169.40), clearing both critical XSS advisories; held at ~1.168.x
because >=1.169.0 requires Vite 8.
- `bun audit` is down to 9 advisories (0 critical). extract-zip, braces
and sprintf-js have no patched releases; stream-json is only reachable
via @hot-wallet/sdk, which defaultModules() excludes and the built
bundle does not contain. The CI audit gate stays deferred until clean.
Verification: bun lint, typecheck, check:tokens, check:content, test,
test:coverage, build; indexer codegen/build/test + sync:contracts:local
+ manifest validation; apps/web typecheck/build. The web-only vitest
suite keeps pre-existing failures (routes.test.tsx mock shape, missing
matchMedia polyfill in the vitest setup) that this change does not touch.
|
@Mikey-222 is attempting to deploy a commit to the Ijai's projects Team on Vercel. A member of the Team first needs to authorize it. |
|
@Mikey-222 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
overridesforce major-version jumps; needs a periodic review #828cache-headers.tsare invalid for h3 2.x stable; h3 pinned to a release candidate #826ENV;mainfailsbun typecheck#825Issue 1 — typecheck / test failures
Issue 2 — rou3 route rules
Issue 3 — override smoke tests
Issue 4 — audit