Sidebranch - #400
Open
Osuochasam wants to merge 9 commits into
Open
Conversation
The .github/workflows directory (plus .gitleaks.toml and .trivyignore) was accidentally wiped across two earlier cleanup commits, which is why GitHub's code-scanning status showed "Actions workflow file not found" for CodeQL and Gitleaks. Restores the workflows, adapted to drop the Docker/native-addon scanning steps that no longer apply since that code was removed separately. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- Delete 7 one-off AI-generated task-completion reports and 2 stale point-in-time snapshots (PROJECT_STATUS.md, STATUS_MONITORING_GUIDE.md) that duplicated commit history and linked to already-deleted docs. - Strip Docker/PM2/WASM-sandbox/native-addon instructions from README, QUICK_REFERENCE, DEPLOYMENT_CHECKLIST, and CONTRIBUTING now that those features have been removed from the repo — the docs were instructing readers to run commands that no longer exist. - Remove the now-dead captive-core env var block from .env.example and untrack .env.test.tmp (a leftover local file, now gitignored). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- Regenerate package-lock.json: three pure-JS packages had bogus OS restrictions injected (verified against the real npm registry), which blocked npm install entirely on non-Linux platforms. - Remove ~10 package.json scripts pointing at files that no longer exist (native/soroban-xdr-decode, docker-compose.microservices.yml, ecosystem.config.js, lib/wasm-sandbox, src/worker/evm-bridge-indexer.ts) and a duplicate `ws` devDependency. - Bump next 16.2.10 -> 16.2.12 (same minor line, patch only) to resolve a chain of high-severity CVEs; add @types/react-syntax-highlighter. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The production build did not compile at all prior to this commit. Root causes: - lib/stellar/indexer.ts and server.ts still imported lib/dag/ and lib/stellar/captive-core.ts, both deleted in an earlier "non-core cleanup" commit; a later revert of a fix for this (PR #386) reintroduced the dead imports plus several undefined identifiers. Strips the DAG/captive-core code paths cleanly, matching the intentional removal. - app/api/ingest-historical/route.ts, RawDataDialog's InclusionProofPanel import, and app/api/status/route.ts's resilient-client usage were all orphaned by earlier feature removals (ClickHouse ingestion, Merkle inclusion proofs). Removes the dead route/import and fixes status route to use the resilient client's actual exports. - lib/metrics.ts imported the prom-client package root, which unconditionally pulls in Node-only built-ins (fs, v8, cluster) via its defaultMetrics/cluster submodules. Since this module is reachable from Edge middleware (rateLimit -> redisCache -> metrics) and a client component (the sandbox page's isomorphic translateEvent call), this broke both the Edge and browser bundles. Imports Counter/Gauge/Registry from their submodule paths instead (no Node-only deps), with a small ambient .d.ts to keep types. - tsconfig.json's target was still ES2017 despite an earlier commit claiming to bump it to ES2020, causing BigInt-literal errors; bumped for real. - Assorted real type errors: Next.js 15+ async `params` in the three webhook routes, an untyped healthStatus object, a redundant status comparison, a Prisma.EventFindManyArgs mismatch, dead duplicate logic in DashboardClient.tsx referencing undefined names, a duplicate `Network` identifier in Header.tsx, missing icon imports, an ErrorCode[] vs string[] mismatch, an index-signature mismatch, a closure-mutation narrowing limitation in the circuit breaker, a stellar-sdk response shape mismatch, and propagating the DecodedScVal -> DecodedValue union through the translator so Map/Vec-returning decoders type-check. Verified with a full `next build` (Turbopack + typecheck) passing clean. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The Trivy release the security-scan workflow pinned to (v0.61.0) has been pruned from GitHub releases (404 on the releases API), which is why the "Install Trivy" step failed on every run. Bump to the current latest stable, v0.74.0. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The "Comment on PR (on failure)" step calls github.rest.issues.createComment, which needs pull-requests: write. Without an explicit permissions block the default GITHUB_TOKEN is read-only, so this step failed with "Resource not accessible by integration" on every run where validation failed. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
main advanced independently while this branch was in progress (a revert PR, a rate-limit memory-leak fix, a stats-503 fix, re-adding lib/dag/, and Soroswap/Blend blueprint corrections). Since GitHub tests a PR's synthetic merge commit rather than the raw branch head, the unresolved divergence (especially in package-lock.json, a generated file that should never be trusted to line-merge) is what was actually causing the Registry Linter job's `npm ci` step to fail in ~1s with a package.json/lockfile mismatch. Conflict resolution notes: - package.json / package-lock.json: kept this branch's fixes (Next.js patch bump, dead-script removal, corrected lockfile), added main's new `validate:blueprints` script, then regenerated the lockfile from scratch rather than trusting git's line merge on a generated file. - app/api/health/route.ts, app/api/status/route.ts: kept this branch's type fixes, adopted main's improved database-error handling. - lib/translator/blueprints/blend-pool.ts: this branch's side referenced an undefined `amountField` and used the wrong formatter (formatStroops on a fill percentage). main's side was semantically correct per the file's own doc comment but skipped the null-safe accessor. Combined the two: correct field + formatter, with the type-safe accessor. - lib/auth/rateLimit.ts and its test file: these auto-merged with NO conflict markers reported by git, but the result silently interleaved two independent implementations from two prior main PRs (#396 and #398, both fixing the same rate-limit memory leak) into invalid, duplicate-declaration code — already broken on main itself before this merge, not something this branch introduced. Reconstructed a single implementation matching the test suite's actual expectations (tier-based public API, non-pipelined Redis calls to match the test fixture, warn-once fallback logging), and deduplicated the test file's own interleaved suites the same way. - lib/translator/registry.ts: same silent-duplication pattern — two `createTranslateFromMapping` definitions. Kept the more complete one (matches the file's actual imported helpers) and removed the other along with its now-unused `interpolate` helper. Verified with a full `next build` (Turbopack + typecheck) passing clean, and a real `npm ci` from a clean node_modules succeeding. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
GitHub's Trivy code-scanning check (separate from the workflow job's own exit code, which was already passing due to continue-on-error) was still flagging 6 alerts including 5 high-severity findings from the dependency tree: @opentelemetry/propagator-jaeger, brace-expansion, fast-uri, js-yaml, and nanoid. - npm audit fix resolved brace-expansion, dompurify, fast-uri, js-yaml, nanoid, and swagger-ui-react with no breaking changes. - Bumped the @opentelemetry/* packages to 0.221.0 in lockstep (pre-1.0, so npm reports it as a semver-major bump, but it resolves the propagator-jaeger DoS with no code changes needed) and verified with a full build. - Tried bumping next to 16.3.1 to also clear postcss/sharp for real (they were already suppressed via .trivyignore, but a genuine fix is better than a suppression) — reverted it: 16.3.1 changed next build's typecheck scope to include test files, which surfaced a large pre-existing backlog of unrelated test-file type errors and broke the build. Not worth the regression risk for two CVEs that were already safely suppressed. - Added .trivyignore entries for the one new postcss advisory (GHSA-fxqj-rqcc-2cmp, an incomplete-fix follow-up to one already suppressed) and for uuid (GHSA-w5hq-g745-h8pq) — verified bull's actual call sites invoke uuid.v4() with no arguments, so the vulnerable buffer-argument code path is never exercised. bull, node-cron, and @opencensus/core have no non-breaking fix available upstream. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The prior commit suppressed postcss/sharp CVEs in .trivyignore because they come from next@16.2.12's own private nested copies (node_modules/next/node_modules/postcss, node_modules/sharp), which a top-level npm override can't reach — or so I assumed. Trivy's code-scanning check kept surfacing more postcss CVEs beyond what npm audit tracked (CVE-2026-45623, CVE-2026-73646), making it clear suppression alone wasn't going to keep up. Turns out npm's nested override syntax (overrides.next.postcss, overrides.next.sharp) *can* reach into a dependency's own private copies — verified node_modules/next/node_modules/postcss is now 8.5.26 (was 8.4.31) and node_modules/sharp is 0.35.3 (was 0.34.5), both fully patched, with a clean `next build`. Removed the now-unnecessary postcss/sharp suppressions from .trivyignore, leaving only the documented uuid one. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.