chore(deps): bump lucide-react from 0.577.0 to 1.7.0 - #4
Closed
dependabot[bot] wants to merge 232 commits into
Closed
chore(deps): bump lucide-react from 0.577.0 to 1.7.0#4dependabot[bot] wants to merge 232 commits into
dependabot[bot] wants to merge 232 commits into
Conversation
Multi-chain creator fee tracker with Solana/Base support, real-time search, profile pages, cron-powered indexing, Supabase backend, security-hardened middleware, and mobile-optimized UI with Lottie animations. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Hobby plan only supports daily cron jobs. Changed: - refresh-prices: every 5min → every 6h - index-fees: every 15min → every 8h - cleanup: unchanged (daily at 3am) Upgrade to Pro for more frequent scheduling. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- refresh-prices: daily at midnight UTC - index-fees: daily at noon UTC - cleanup: daily at 3am UTC Pro plan needed for sub-daily frequency. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Platforms like Bags.fm allow designating social handles (Twitter, GitHub) as fee recipients without requiring a wallet connection. This restructures the resolve pipeline to query handle-based fees in parallel with wallet resolution, so fees are discovered even when no wallet is linked. - Add getFeesByHandle to PlatformAdapter interface - Implement handle-based fee lookup in Bags adapter with corrected API paths - Run fetchFeesByHandle + resolveWallets in parallel in freshResolve - Merge and dedup fees from both handle-based and wallet-based lookups - Create creator records even when wallet resolution returns empty - Fix canonical URL from claimscan.io to claimscan.com Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The Bags API v2 wraps all responses in { success, response: T } but the
adapter was reading from `data.walletAddress` and `data.fees`. Fixed:
- BagsWalletResponse now reads `response.wallet` (not `data.walletAddress`)
- BagsClaimablePosition uses `baseMint` + `totalClaimableLamportsUserShare`
- claim-stats requires tokenMint param (not wallet), so removed from
wallet-based queries — only claimable-positions is used per-wallet
- getHistoricalFees returns [] (no Bags endpoint for this)
- Removed unused sanitize imports
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Bridge social handles to EVM wallet addresses via public Farcaster APIs (Warpcast search + Farcaster Hub verifications). This enables multi-chain fee discovery — e.g. searching "VitalikButerin" now returns both SOL (via Bags.fm) and Base/ETH (via Farcaster verified addresses → Clanker). Uses dual search strategy (full handle + half-length prefix) with reputation-weighted scoring (follower count) to prefer real accounts over impersonators. No API keys required. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…r token discovery, sort fees descending - TokenFeeTable/ChainBreakdown/FeeSummaryCard: compute USD at display time using unclaimed amounts × SOL/ETH price when total_earned_usd is null - Pass solPrice/ethPrice through component tree (page → PlatformBreakdown/ ChainBreakdown → TokenFeeTable) - Sort TokenFeeTable by computed USD descending (largest fees first) - Fix Clanker getCreatorTokens: use /search-creator?q=WALLET instead of broken /tokens?deployer= which ignores the deployer parameter - Deduplicate and filter Clanker tokens by admin match Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- TokenFeeTable: add client-side pagination (15 tokens per page) with page navigation buttons, ellipsis for large page counts, and "X–Y of Z tokens" indicator - fetchAllFees: also call getLiveUnclaimedFees() from adapters that support it (pump, zora, heaven, bankr) so their fees appear in platform tabs, not just in the live summary card - Clanker getHistoricalFees: filter out tokens where availableFees=0 since we can't distinguish "claimed" from "not yet distributed" - Cleaned stale zero-amount Clanker records from DB Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add coinbarrel and raydium platform adapters for Solana fee discovery - Add eth.ts chain module for Zora multi-chain ProtocolRewards support - Add ScanStatusLog component showing per-platform scan results - Update PlatformBreakdown to show all platform tabs regardless of data - Expand platform_type to include coinbarrel and raydium - Update bankr, believe, revshare, zora adapters with improved fee logic Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Extract PROTOCOL_SOLANA addresses from Farcaster Hub alongside existing EVM addresses. This enables all Solana platform adapters (Heaven, Believe, Coinbarrel, Raydium, RevShare) to be queried for creators discovered via Farcaster identity resolution. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…gent The AI agent API (api.bankr.bot/agent) was unreliable and returned 0 results. Switched to the same structured API that bankr.bot frontend uses: - /token-launches/search for handle/wallet lookup - /public/doppler/token-fees for fee amounts (claimable/claimed WETH) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Clanker: /search-creator returns `searchedAddress` not `walletAddress`. Also extract verified addresses from `users[]` for better wallet coverage. Heaven: api.heaven.xyz DNS no longer resolves. Added warning comment. All calls fail silently (returns empty arrays). Kept adapter for if/when Heaven restores their API. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The /search endpoint caps at 5 results per group, causing missing tokens. Switch to /search/paginated with cursor-based pagination (up to 3 pages). Also handle "<0.000001" format from Bankr API in wethToWei. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Bags, Believe, and RevShare adapters returned null tokenSymbol causing the fee table to show truncated contract addresses instead of tickers. Now fetches name/symbol from Metaplex Token Metadata PDAs in a single batched RPC call (no new dependencies). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- solana-metadata: use Helius DAS getAssetBatch (1000 mints/call) as primary metadata source when HELIUS_API_KEY is set, with on-chain Metaplex fallback. Handles Token-2022 and tokens without Metaplex. - prices: add x-api-key header to Jupiter Price API calls when JUP_API_KEY is set. Jupiter now requires API key for all tiers. - believe: consolidate 3 separate getProgramAccounts GPA calls into 1 cached call shared across getCreatorTokens, getHistoricalFees, and getLiveUnclaimedFees. Add isMigrated filtering to skip graduated pools. 60s in-memory cache prevents redundant GPA queries within a scan cycle. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Fix all 22 audit issues across 10 platform adapters - Add silent failure logging to all empty catch blocks (C1-C3, H1-H7) - Add HTTP status logging to all fetch helpers (M2-M9, M12) - Log Promise.allSettled rejections in pump, zora, revshare, prices - Sync OrbitingLogos with PlatformIcon (add heaven, bankr, revshare) - Fix loading skeleton breakpoint mismatches with actual components - Add aria-expanded, aria-hidden for accessibility compliance - Remove unused PillNav component (491 lines) and gsap dependency - Add scan-line to prefers-reduced-motion media query - Add Coinbarrel and Raydium platform icons - Cross-chain Farcaster resolution (Solana + EVM) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Redesign Coinbarrel and Raydium SVG icons to use filled shapes instead of stroke-only paths so they remain visible at small sizes (h-3 w-3). Split homepage platform pills into two rows of 5 for balanced layout. Sync OrbitingLogos with the updated fill-based icon designs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Next.js requires inline scripts for client-side hydration. Without 'unsafe-inline' in the script-src CSP directive, all 'use client' components fail silently (TrueFocus, Grainient, motion animations). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…bels - Fix claim_status logic: don't mark as "claimed" when totalEarned is also 0 (no fee data ≠ claimed). Only mark "claimed" when earned > 0 and unclaimed = 0. - Filter out all-zero fee rows from Bankr adapter (API returned no data) - Add SOL/ETH currency indicator after token amounts in fee table Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Primary method: Bankr Agent API (POST /agent/prompt) with structured JSON prompts. Resolves Twitter handles directly and returns fee data without needing the legacy bearer-token search. - Agent API submits natural language prompt, polls for async job completion - Multi-strategy response parser: JSON extraction → pipe-delimited → regex - Legacy search + Doppler kept as fallback when BANKR_BEARER_TOKEN is set - Requires BANKR_API_KEY env var (bk_ key from bankr.bot/api) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Change poll interval from 3s to 2s per Bankr API docs - Increase max polls from 10 to 60 (30s → 2min timeout) - Add `data.success` check on submit response per API spec - Use lowercase `x-api-key` header per reference client - Support BANKR_API_URL env var with fallback to production URL - Log job.error field on failed/cancelled jobs for debugging Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The Bankr Agent API rewrite introduced 2-min polling windows per call, causing the entire resolve pipeline to exceed the 30s RESOLVE_TIMEOUT_MS. This blocked Base chain fees from appearing on first page loads. - Reduce AGENT_POLL_MAX from 60 to 5 (10s polling window) - Reduce submit timeout from 15s to 8s - Total per-call budget: ~18s (fits within 30s pipeline) - Background resolve still catches slow responses on next load Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Agent API jobs take 12s+ even with reduced polling, causing the entire resolve pipeline to exceed the 30s timeout. Legacy APIs (search + Doppler) complete in 2-5s. Swap all three adapter methods to use legacy APIs as primary path with Agent API as fallback only when legacy is unavailable or returns empty results. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Root cause: Promise.allSettled waits for ALL adapters. Without
BANKR_BEARER_TOKEN on Vercel, only the Agent API path runs — each call
burns 12-18s polling a job that never completes (jobs take 30s-2min).
Three calls across the 2-stage pipeline = ~36s, exceeding the 30s
RESOLVE_TIMEOUT_MS and returning creator=null ("No results found").
Fix: Single 5s AbortController wrapping the entire submit+poll cycle.
Agent API gets a fair shot but can't starve pump/bags/clanker/zora.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
getFeesByHandle runs in parallel with resolveWallets via Promise.all, NOT inside Promise.allSettled with other adapters. A 20s timeout won't block pump/bags/clanker results. The 5s cap stays for resolveIdentity and getHistoricalFees which DO run inside Promise.allSettled. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Bankr doesn't offer bearer tokens — only API keys (x-api-key header). Added bankrAuthHeaders() helper and HAS_BANKR_AUTH constant so the Search/Doppler pipeline works with the existing BANKR_API_KEY on Vercel. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Show $SYMBOL with $ prefix when token_symbol is available - Fallback to shortened contract address when symbol is missing - Replace pagination with "Show More" button (15 initial, +15 per click) - Extracted tokenDisplay() helper for consistent formatting Also added HELIUS_API_KEY to Vercel for reliable Solana token metadata resolution (tickers will populate on next fresh resolve). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- ProfileHeader: full wallet addresses with copy-to-clipboard, chain-colored badges (purple SOL, blue BASE), collapsible wallet list, platform source icons - PlatformBreakdown: compact 5x2 icon grid with badge counts, summary stats, filter tabs only for platforms with data, improved empty state Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add aria-label to copy button and aria-pressed to platform grid toggles - Fix setTimeout cleanup on unmount (useRef + useEffect) - Check execCommand return value before showing success - Limit keyboard tab navigation to only visible tabs Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Pump.fun adapter v2: cashback coin detection (BondingCurve.is_cashback_coin), fee sharing config (SharingConfig PDA), lock status (admin_revoked). BondingCurve byte offsets verified on mainnet (creator@49, cashback@82). Token discovery via Helius DAS with on-chain creator verification. Cron enrichment reads BondingCurve + SharingConfig for known mints, persists fee_type/fee_locked to fee_records. Zora Content Coins: queries Zora Coins REST API for auto-distributed earnings alongside legacy ProtocolRewards. Shows total USD earned with auto_distributed status. Leaderboard: /api/leaderboard endpoint with Redis cache (10min), computes USD on-the-fly from raw amounts * native prices (SOL/ETH). Anti-gaming filter (min 2 tokens, $1). /leaderboard page with SSR, filters, pagination. Footer link added. Telegram bot alerts: /alert @handle $500 threshold notifications. alert_rules table, poll worker checks every 15min with 24h cooldown. /alert list + remove. Frontend: CASHBACK badge (purple) + lock icon on TokenFeeTable. AUTO status for auto_distributed claim_status. Performance: proxy.ts fast-path skips rate limiting for static page GET requests (~200-400ms TTFB saving). HeroReveal overlay 800ms→200ms (~600ms perceived LCP). Turnstile script beforeInteractive→afterInteractive (unblock FCP). DB migrations 022 (fee_type, fee_locked, fee_recipients table) and 023 (alert_rules table) applied to production Supabase. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
react was at 19.2.3 while react-dom was at 19.2.4, causing npm install to fail on Vercel with ERESOLVE peer dependency conflict. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Response no longer exposes internal creator_id UUIDs, uses public handle instead (prevents enumeration of internal IDs) - Platform/chain filters validated against explicit enum sets instead of regex sanitization (rejects invalid values with 400) - Creators without a public handle are excluded from results Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…mismatch Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Redis was instantiated at module load time, causing Vercel page data collection to fail when UPSTASH_REDIS_REST_URL had trailing whitespace. Now uses lazy init with .trim() on env vars. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Adds handle_type field ('twitter' | 'github') to leaderboard response.
GitHub handles display as "user (GitHub)" instead of "@user" to avoid
confusion with Twitter handles. Prioritizes twitter_handle over github.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Clanker adapter returns inflated total_earned values for some tokens (e.g. 157M ETH worth), producing $566B USD in the leaderboard. Skip records exceeding $50M per token until the adapter is fixed. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
availableFees(owner, token) returns fees in the token's own units, not WETH. This caused 157M ETH worth of phantom fees for creators with high-volume meme tokens. Now queries availableFees(owner, WETH) on Base and availableFees(owner, WBNB) on BSC to get correct ETH/BNB-denominated fees. Reset all 6 inflated Clanker records in DB. Root cause: the 2nd param of availableFees is the FEE CURRENCY (what you receive), not the Clanker token you deployed. Passing the token address returned fees in that token's units (e.g. 2.4M CSKILLS) which were then treated as 2.4M ETH ($5B+). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…rer links - Remove Heaven from help text (platform removed in migration 015) - Add BSC/ETH chain support: VALID_CHAINS, CHAIN_CONFIG-based native token/decimals/prices, Clanker API chain_id detection, chain-agnostic EVM address lookup - Fix getCreatorUnclaimedUsd: was summing total_earned_usd instead of computing USD from total_unclaimed — alerts fired at wrong thresholds - Show Pump.fun v2 metadata (cashback, fee locked, recipient count) - Show Zora auto-distributed fees instead of misleading $0 unclaimed - Accept wallet addresses in /scan (Solana + EVM) - Add Explorer buttons (Solscan/Basescan/Etherscan/Bscscan) to CA scan and claim notifications Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Fix BigInt precision loss for EVM 18 decimals (10**18 → 10n**18n) - Fix PostgREST filter injection in /alert set path (unquoted handle) - Consolidate channel membership gate in middleware (remove copy-paste from 3 handlers) - Add logging to all empty catch blocks (bot.ts, poll.ts, lookup.ts, require-channel.ts) - Guard snapshot updates behind successful notifications (prevent lost claim alerts) - Fix deleteAlertRule always returning true (now checks affected rows) - Fix getGroupsForToken returning [] on DB error (now throws to prevent snapshot advance) - Fix getCreatorUnclaimedUsd returning 0 on DB error (now returns null, skips rule) - Fix stopPolling race condition during startup (use pollHandle pattern) - Add error checking to parallel Supabase queries in lookupTokenByAddress - Move Supabase client to module-level in poll worker - Remove dead nativeAmount* fields from LookupResult - Add safeBigInt parse failure logging - Use price map instead of nested ternaries in format.ts - Log full stack trace in poll cycle errors Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Integrate three technologies for the OWS Hackathon (Track 05: The Observatory): - x402 pay-per-query endpoints: /api/v2/fees ($0.01), /api/v2/export ($0.05), /api/v2/intelligence ($0.02) — USDC payments on Base via x402 protocol - Allium enrichment: cross-chain transaction history and PnL data layered on top of ClaimScan fee intelligence - OWS wallet resolution: /api/v2/resolve maps OWS wallet names to multi-chain addresses via CLI - Updated docs page with V2 API section and agent access examples Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- x402 server: fail loud on missing X402_WALLET_ADDRESS instead of empty default - Allium client: guard against empty API key inside fetch function - OWS resolver: distinguish ENOENT from real errors, cache isOWSAvailable - All v2 routes: add maxDuration=60, handle Supabase .single() errors properly (PGRST116 = 404, everything else = 500), add console.error logging - Export route: validate format param against allowlist - Intelligence route: collect Allium errors as array instead of overwriting, surface fee query availability in response - Resolve route: add server-only import, catch OWS errors as 500 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…nite guard - OWS resolve: remove prefix matches for base/bsc that collided with testnets (eip155:84532 was mis-classified as mainnet base) - Intelligence route: only include 'allium' in dataSources when data was actually fetched successfully - Fees route: add missing Number.isFinite guard on totalUnclaimedUsd Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- /terms: updated service description to 10 platforms on 4 chains, added V2 API pricing section (x402 per-request USDC payments), added V2 API data collection entry in privacy section, added Allium as sub-processor, updated fee changes clause - /docs: updated counts to 10 launchpads and 4 chains, updated meta descriptions Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Vercel build collects page data by evaluating route modules, but env vars are not available during that phase. Changed from throw-on-load to log-on-request so the build completes and the check runs at runtime when env vars are available. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
PlatformBreakdown called useWallet() during SSR when crawlers hit /og-docs.png (which fell through to [handle] catch-all). Two fixes: - Add ssr: false to PlatformBreakdown dynamic import - Add static og-docs.png to public/ so the URL resolves directly Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Fixes from full security audit (0 critical, 3 high, 6 medium, 3 low): - H-1: SSRF prevention in /api/flex — host allowlist blocks env var injection - H-3: HMAC replay — require Redis in prod, reject if unavailable - M-1: Anti-enumeration now covers anonymous IPs (40 handle limit) - M-3: CORS no longer reflects non-allowed origins - M-4: x-real-ip only trusted when running on Vercel - M-8: x402 fails closed when wallet address missing in prod - L-1: Upstash limiter retries import on failure instead of caching miss - L-2: Turnstile IP uses trusted Vercel IP, not spoofable x-forwarded-for Reverts ssr:false on PlatformBreakdown (not allowed in Server Components in Next.js 16 — the og-docs.png static file fix from previous commit resolves the WalletContext SSR crash). No exploitation detected in 7-day log audit. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…removal M-9: Remove NEXT_PUBLIC_SOLANA_RPC_URL from client bundle. Wallet adapter uses free public RPC (no client components call RPC directly). Paid keys stay server-side only. M-5: Cap tarpit delay to 500ms on handle routes (user-facing pages). Full 5s tarpit reserved for API routes only. Saves serverless budget. M-7: Replace 50k-row JS aggregation with Postgres function get_leaderboard(). Joins fee_records + creators + token_prices in DB, returns pre-ranked paginated results. Migration 024 adds the function. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Postgres enum chain_type needs explicit ::TEXT cast for JOIN and CASE comparisons with text literals. Fixes migration 024 apply failure. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…sions, lifecycle hooks - Fix accepts format: single object → array (protocol spec conformance) - Fix CSV injection in /api/v2/export: prefix dangerous chars with single quote - Add dev warning when X402_WALLET_ADDRESS is unset - Add network/facilitator compatibility validation at boot - Add lifecycle hooks (onAfterVerify, onAfterSettle, onSettleFailure) with structured logging - Add bazaar extension for AI agent discoverability on all v2 routes - Add payment-identifier extension for idempotency support - Pin x402 packages to exact 2.8.0 (protocol still young, avoid surprise breaks) - Add @x402/extensions as direct dependency Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Bumps [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) from 0.577.0 to 1.7.0. - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.7.0/packages/lucide-react) --- updated-dependencies: - dependency-name: lucide-react dependency-version: 1.7.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Contributor
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
LW-ARTS
pushed a commit
that referenced
this pull request
May 12, 2026
…etup-node-6 chore(deps): bump actions/setup-node from 4 to 6
LW-ARTS
pushed a commit
that referenced
this pull request
May 12, 2026
…il logging (#44) Helius webhooks authenticate via a static bearer secret only — they don't support HMAC body signing natively, so the audit's recommended "HMAC body + timestamp" fix isn't directly implementable without changing providers or inserting a proxy. This adds layered defense that doesn't require any upstream change: 1. **IP allowlist scaffold** (lib/constants.ts) — empty initially so production stays fail-open until live IPs are observed. Once populated from `vercel logs`, requests with valid bearer but unknown source IP get 403'd. Caps blast radius if HELIUS_WEBHOOK_SECRET ever leaks. 2. **Structural validation** (isValidHeliusEvent) — every event must have a base58 Solana signature, a string `type`, and a numeric `timestamp`. Forged events from a leaked-secret attacker won't pass. Cheaper than onchain signature verification but raises the bar significantly. 3. **Auth-fail logging** — `[webhook] auth failed` with sourceIp + ua + hasAuthHeader so Sentry/Vercel logs surface brute-force attempts. Previously the 401 returned silently with no forensic signal. Closes HIGH #4 from security audit 2026-04-15. The full HMAC-body fix remains an architectural TODO (would require switching webhook provider or adding a signing proxy in front of Helius). Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps lucide-react from 0.577.0 to 1.7.0.
Release notes
Sourced from lucide-react's releases.
... (truncated)
Commits
dada0a8fix(lucide-react): Fix dynamic imports (#4210)a6e648afix(lucide-react): correct client directives in RSC files (#4189)1f010a3fix(lucide-react): Fixes provider export and RSC render issues (#4175)484f2c9docs(version-1): Version 1 website (#4142)a0e202dfeat(packages/angular): add new@lucide/angularpackage (#3897)c5b155eMerge branch 'main' of https://github.com/lucide-icons/lucide into next628d4f9Merge branch 'main' of https://github.com/lucide-icons/lucide into next0c6dfebfeat(context-providers): Adding Context providers (#3315)7327637Merge branch 'main' of https://github.com/lucide-icons/lucide into next08bd4b3Merge branch 'main' of https://github.com/lucide-icons/lucide into nextDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)