fix: undefined cancel-vote constant, deposit re-drain, dispute timelock bypass, and paused-claim exploit#1233
Open
Emeka000 wants to merge 150 commits into
Open
fix: undefined cancel-vote constant, deposit re-drain, dispute timelock bypass, and paused-claim exploit#1233Emeka000 wants to merge 150 commits into
Emeka000 wants to merge 150 commits into
Conversation
Bumps [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) from 19.2.6 to 19.2.7. - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react-dom) --- updated-dependencies: - dependency-name: react-dom dependency-version: 19.2.7 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [next](https://github.com/vercel/next.js) from 16.2.6 to 16.2.9. - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v16.2.6...v16.2.9) --- updated-dependencies: - dependency-name: next dependency-version: 16.2.9 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [axe-core](https://github.com/dequelabs/axe-core) from 4.11.4 to 4.12.1. - [Release notes](https://github.com/dequelabs/axe-core/releases) - [Changelog](https://github.com/dequelabs/axe-core/blob/develop/CHANGELOG.md) - [Commits](dequelabs/axe-core@v4.11.4...v4.12.1) --- updated-dependencies: - dependency-name: axe-core dependency-version: 4.12.1 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 25.9.1 to 26.0.1. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.0.1 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [@axe-core/react](https://github.com/dequelabs/axe-core-npm) from 4.11.3 to 4.12.1. - [Release notes](https://github.com/dequelabs/axe-core-npm/releases) - [Changelog](https://github.com/dequelabs/axe-core-npm/blob/develop/CHANGELOG.md) - [Commits](https://github.com/dequelabs/axe-core-npm/commits) --- updated-dependencies: - dependency-name: "@axe-core/react" dependency-version: 4.12.1 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [@playwright/test](https://github.com/microsoft/playwright) from 1.60.0 to 1.61.1. - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.60.0...v1.61.1) --- updated-dependencies: - dependency-name: "@playwright/test" dependency-version: 1.61.1 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
…utions-plug#1003) Adds docs/architecture.md with a Mermaid C4 level-1 system context diagram and a C4 level-2 container diagram showing all services (API, TTS, frontend), databases (PostgreSQL, Redis), external dependencies (Stellar RPC, SendGrid), and network boundaries (VPC public/private subnets). Includes an architecture-review checklist item for PRs that touch these boundaries. Closes solutions-plug#1003 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…utions-plug#1004) Adds docs/data-flow.md documenting the full lifecycle of every major data type (email addresses, subscription status, audit events, market data, on-chain bets, email tracking, analytics events, and transient Redis data). Each entry covers collection point, storage location, retention period, deletion mechanism, and access control. Includes a Mermaid data-flow diagram, a GDPR data-subject-rights implementation map, an access-control summary table, and outstanding action items for future compliance work. Closes solutions-plug#1004 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…olutions-plug#999) - Add proptest dev-dependency to predict-iq Cargo.toml - Add property_invariants_test.rs with 5 proptest properties covering stake conservation, state-machine irreversibility, and non-negative stakes - Create INVARIANTS.md documenting all financial and state-machine invariants with Certora/KEVM formal verification guidance Closes solutions-plug#999 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…ions-plug#1000) - Add fuzz/ directory with Cargo.toml and three libFuzzer targets: fuzz_place_bet, fuzz_resolve_market, fuzz_withdraw - Add contract-fuzz CI job to test.yml running each target for 60 s with crash artifact upload on failure - Document fuzzing setup, targets, corpus handling, and CI in README.md Closes solutions-plug#1000 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…utions-plug#1001) - api-outage.md: API completely unreachable — ECS checks, force redeploy, ALB triage - redis-failure.md: ElastiCache down — failover steps, memory/connection diagnostics - email-queue-backup.md: SQS queue depth spike — worker restart, DLQ inspection, replay - stellar-rpc-unavailable.md: RPC unavailable — fallback endpoint switch, ledger lag check - ecs-task-crash-loop.md: Task exits immediately — exit code guide, rollback steps - Add corresponding Prometheus alert rules with runbook_url annotations to alerts.yaml Closes solutions-plug#1001 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…NGELOG (solutions-plug#998) - Add 'Print unoptimized WASM size' step to build-optimized CI job so the size trend is visible on every push, not just when the limit is exceeded - Add WASM size tracking table to CHANGELOG.md [Unreleased] section with a note on budget rationale and measurement instructions The 65,536-byte (64 KB) budget and its rationale were already documented in contracts/predict-iq/README.md (WASM_SIZE_LIMIT_BYTES env var reference). Closes solutions-plug#998 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…lutions-plug#1005) Adds utoipa 4 as a dependency and wires up automatic OpenAPI spec generation from Axum route annotations: - services/api/src/handlers.rs: all 26 public handler functions annotated with #[utoipa::path(...)]; request/response types derive ToSchema / IntoParams - services/api/src/pagination.rs: adds the missing PaginationQuery struct (with limit() / cursor() helpers) that handlers.rs already imported; derives IntoParams for utoipa - services/api/src/openapi_spec.rs: new module housing the #[derive(OpenApi)] struct that lists every annotated path and component schema - services/api/src/bin/generate_openapi.rs: new binary that serialises ApiDoc to YAML on stdout; run with: cd services/api && cargo run --bin generate-openapi > openapi.yaml - .github/workflows/test.yml: new openapi-drift-check job builds the binary, generates the spec, and fails CI if the annotated path set diverges from the committed openapi.yaml; added to all-tests-passed gate - .github/pull_request_template.md: checklist items remind contributors to regenerate the spec and update docs/architecture.md when relevant Closes solutions-plug#1005 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds docs/deployment.md covering all steps a new team member needs to deploy PredictIQ from scratch: - Prerequisites (AWS CLI, Terraform, Docker, Rust, psql, gh) - First-time infrastructure provisioning via Terraform bootstrap script, plan, apply, and Secrets Manager setup - Environment variable reference table (required + optional/tuning) derived from config.rs - Normal deployment workflow: merge → GHCR image build → ECS rolling update → health validation - Database migration process: apply, check status, write new migrations (with rollback script requirement) - Rollback procedures for application, database, and infrastructure, with timeline targets - Validation checklist with six curl / AWS CLI commands to run after every production deployment Closes solutions-plug#1002 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add rust-version = '1.75' to services/api/Cargo.toml (determined by axum 0.7 / sqlx 0.8 / tower-http 0.6 requirements, matching the rust:1.75-slim image already pinned in the root Dockerfile) - Add .github/workflows/msrv.yml that reads the MSRV dynamically from Cargo.toml, installs the toolchain via dtolnay/rust-toolchain, and runs cargo check + cargo build --release - Document MSRV policy in CONTRIBUTING.md
- Replace single-stage Dockerfile with a two-stage build: builder (node:20-alpine) compiles TypeScript; runtime (node:20-alpine) installs production deps only and runs as non-root user ttsuser - Add engines field to package.json to pin Node.js 20 LTS - Add HEALTHCHECK calling /health/live with 30s interval - Add tts service to docker-compose.tracing.yml with OTEL Collector dependency, tts-output volume, resource limits, and healthcheck
- checkOutputDirectory: write + delete a probe file to confirm writability - checkElevenLabs: make a live GET /v1/user call (5 s timeout) to verify API key validity and network reachability; returns 503 on 401 or network errors - checkGoogle: validate key file exists, parses as JSON, and contains project_id + private_key; same for inline credentials object - checkJobQueueDepth: count pending+processing jobs against MAX_QUEUE_DEPTH (500); warns at 80 %, errors at 100 % — surfaced in /health/ready - readiness() now aggregates all four probes and returns 503 with a structured JSON body listing every failing check when any fail - /health/ready response body now includes a checks map alongside status, message, and timestamp
- Import opossum and add CircuitBreakerState/CircuitBreakerConfig types - Default config: 5-failure threshold (volumeThreshold), 30 s rolling window (rollingCountTimeout), 30 s half-open interval (resetTimeout), 10 s per-call timeout - TTSService._initCircuitBreakers builds one opossum CircuitBreaker per configured provider (elevenlabs, google) and wires open/halfOpen/close log events - TTSService._callProvider routes all provider calls through breaker.fire() so the open circuit fast-fails with HTTP 503 without making a network call - TTSService.getCircuitBreakerStates returns state snapshots exposed in /health/ready response body - HealthCheck.readiness includes circuit breaker states; open breakers produce an 'error' check entry causing a 503 readiness response - Add circuit-breaker.test.ts with 5 tests: initial closed state, trips open after threshold, fast-fail without network call, half-open transition, and empty state when no providers configured
- Added cache_circuit_breaker_state gauge metric with state labels (closed/open/half_open) - Updated CircuitBreaker to report state changes to metrics - Added optional metrics parameter to RedisCache constructor - Circuit breaker now logs and tracks state transitions (closed, open, half-open) - Added alert rules for circuit breaker open (>2min) and half-open states - Added Grafana dashboard panels: * Stat panel showing current circuit breaker state with color coding * Timeline graph showing state transitions over time - Metrics are updated atomically on state transitions Closes solutions-plug#963
- Added worker_status gauge metric with worker name labels - Each worker reports status: 1=running, 0=stopped - Implemented heartbeat mechanism (30s interval) for all workers: * email_queue - email processing worker * blockchain_sync - blockchain event sync worker * blockchain_tx_monitor - transaction monitoring worker * rate_limiter_cleanup - rate limit cleanup task * newsletter_cleanup - newsletter cleanup task - Workers set status to 1 on startup and 0 on shutdown - Added BackgroundWorkerDown alert rule (fires after 60s of status=0) - Added Grafana dashboard panel showing all worker statuses with color coding - Alert configuration includes noDataState=alerting for crash detection Closes solutions-plug#962
…ug#971 solutions-plug#968 — testing & observability hardening - solutions-plug#977: add proptest property-based tests for all validation functions (empty, over-max-len, all-whitespace, null bytes, control chars, Unicode, valid inputs); CI runs 1000 cases per property via PROPTEST_CASES=1000 - solutions-plug#972: add transaction-rollback DB fixture (with_test_transaction) so each integration test is isolated; CI verifies order-independence with two different nextest random seeds - solutions-plug#971: add docker-compose.test.yml (Postgres 15, Redis 7, Stellar RPC stub) with health checks; add Makefile targets (test-integration, test-integration-down); wire CI job api-integration-tests - solutions-plug#968: validate OTEL_EXPORTER_OTLP_ENDPOINT as a parseable URL at startup (fail-fast on bad config); TCP connectivity check with 2 s timeout logs WARN if unreachable; otel_export_errors_total Prometheus counter tracks failures; document OTLP config in TRACING.md Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
… ECS deploy strategy Closes solutions-plug#956 Closes solutions-plug#957 Closes solutions-plug#958 Closes solutions-plug#959
…g bench Issue 1 - Crash reporting: - Add worker_crash_total IntCounterVec to Metrics - Wrap email worker spawn in monitored restart loop (max 5 restarts, exponential backoff 1s/2s/4s/8s/16s), log FATAL on exhaustion - Add EmailWorkerDown and EmailWorkerCrashLooping Prometheus alerts Issue 2 - Template caching: - Templates already compiled once at EmailTemplateEngine::new() startup - Add benches/email_templates.rs: cached vs per-request at 1000 renders - Register bench in Cargo.toml; document restart-to-update policy Issue 3 - Context size limit: - Reject contexts > 64 KB (serialised JSON) in render() before Handlebars - Return structured anyhow error with byte count and template name Issue 4 - Template schema validation: - Add templates/schema.json documenting required vars per template - validate_all_templates() uses realistic per-template fixture data - Add 16 boundary-value tests: empty strings, special chars, long strings, XSS escaping, and startup validation sanity check Misc: tighten .gitignore (test snapshots, bench output, temp files)
…s counter
- Add sendgrid_retries_total{reason} counter to Metrics
- Retry on 429 and 5xx responses (max 3 attempts)
- Exponential backoff with jitter (2^attempt * 100ms + rand[0,100)ms)
- Respect Retry-After header on 429 responses
- Add wiremock to dev-dependencies for HTTP mock testing
- Add test: two 429s followed by 202 verifies email sent and counter=2
Closes #reliability #email
…ed body) - Add DEFAULT_REQUEST_BODY_MAX_BYTES = 1 MiB constant - Add request_size_validation_middleware to validation.rs - Fast path: reject on Content-Length header > limit - Slow path: buffer chunked body via axum::body::to_bytes with cap - Returns 413 Payload Too Large with JSON error body - Add content_type_validation_middleware (415 for non-JSON POST/PUT/PATCH) - Add request_validation_middleware (400 for SQLi/path-traversal patterns) - Add parse_request_body_max_bytes() for env-var override - Add two_mb_body_returns_413 integration test Closes #security #reliability #api
…-plug#936, solutions-plug#938 solutions-plug#935 — Add full jitter to RPC retry backoff - Introduce RPC_BACKOFF_JITTER_FACTOR env var (default 1.0 = full jitter) - Replace deterministic exponential backoff with random(0, min(cap, base*2^n)) - Add rpc_backoff_jitter_factor field to Config and BlockchainClient - Add unit tests verifying unique delays and zero-jitter determinism solutions-plug#938 — Handle ledger gaps/forks in blockchain sync worker - Persist last processed ledger as a checkpoint key in Redis (7d TTL) - On restart, detect and log gaps between checkpoint and current ledger - During normal sync, detect sequence skips and emit log.warn with gap size - Emit log.error alert when gap exceeds 10 ledgers - Add observe_ledger_gap metric (blockchain_ledger_gaps_total) solutions-plug#936 — Supervised sync worker with Prometheus metrics and health endpoint - Extract inner run_sync_loop (no coordinator) from run_sync_worker - Wrap in supervised restart loop in start_background_tasks: catches panics, increments blockchain_sync_worker_restarts_total, restarts after 1s - Add blockchain_sync_worker_last_heartbeat_ts gauge updated each poll cycle - Add GET /health/ready endpoint: returns 503 if heartbeat older than 60s solutions-plug#932 — HMAC-SHA256 email idempotency key - Replace SHA-256(recipient||template||data) with HMAC-SHA256(secret, recipient||template||hour_bucket) - Add EMAIL_IDEMPOTENCY_SECRET env var (falls back to HMAC_KEY) - Add hour-boundary timestamp bucket to bound pre-computation window - Update idempotency_key signature; propagate secret through EmailService and queue - Add test verifying key changes when secret changes
- Add auth_failures_total Prometheus counter with 'reason' label to
Metrics struct; observe_auth_failure(reason) increments it.
Valid reason labels: invalid_api_key, expired_token, missing_credentials.
- Add AuthFailureReason enum with from_headers() classifier:
* x-api-key header present → InvalidApiKey
* Authorization header present → ExpiredToken
* neither present → MissingCredentials
- In audit_logging_middleware, detect 401 responses and emit a dedicated
'auth_failure' audit log entry that includes:
* masked key prefix (first 4 chars + ****) for API-key attempts
* client IP address from the TCP socket
* user-agent string
* failure reason, path, and HTTP method in the details JSON blob
The entry is written asynchronously so it never blocks the response.
- Emit a WARN-level tracing event on every auth failure with reason,
masked actor, client IP, and user-agent for log-based alerting.
- Add unit tests:
* AuthFailureReason correctly classified from header combinations
* key_prefix masks all but the first four characters
* as_str() labels are stable and match Prometheus convention
* parse_admin_action correctly maps known and unknown paths
Previously DATABASE_URL and REDIS_URL were already in Secrets Manager,
but HMAC_KEY, SENDGRID_API_KEY, and API_SIGNING_KEY were missing.
No plaintext sensitive values are passed through ECS environment blocks.
infrastructure/terraform/modules/ecs/main.tf:
- Add aws_secretsmanager_secret + aws_secretsmanager_secret_version for:
* predictiq/<env>/hmac-key (rotation: 90 days)
* predictiq/<env>/sendgrid-api-key (rotation: 180 days)
* predictiq/<env>/api-signing-key (rotation: 90 days)
- Add all five secret ARNs to the ECS task definition 'secrets' block
so ECS agent injects them as env vars at task startup.
- Expand aws_iam_role_policy.ecs_task_execution_secrets Resource list
to include the three new secret ARNs (least-privilege; no wildcards).
- Add 'secret_arns' output map so CI/CD pipelines can reference ARNs.
- Tag each secret with RotationEnabled and RotationSchedule for auditability.
infrastructure/terraform/variables.tf:
- Add hmac_key, sendgrid_api_key, api_signing_key variable declarations
(all sensitive=true, with validation rules).
infrastructure/terraform/main.tf:
- Pass the three new variables through to the ECS module.
scripts/rotate-secret.sh:
- New helper: rotates a named secret and triggers ECS rolling redeployment.
- Validates secret name against known inventory; prompts for confirmation
in production; reads value from stdin when '-' is passed as value arg.
docs/secrets.md:
- Full secrets inventory with paths, env var names, types, and rotation
schedule.
- Architecture diagram showing Terraform → Secrets Manager → ECS flow.
- Manual and automated rotation procedures.
- Instructions for adding new secrets, auditing access, and emergency
revocation.
…t metric, load_watched_transactions, cap check in watch_transaction, DB persistence for tx watch/resolve, fix duplicate health_live Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 26.0.1 to 26.1.0. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.1.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
…/npm_and_yarn/services/tts/types/node-26.1.0 chore(deps-dev): bump @types/node from 26.0.1 to 26.1.0 in /services/tts
Bumps [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) from 7.5.1 to 8.5.2. - [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases) - [Commits](express-rate-limit/express-rate-limit@v7.5.1...v8.5.2) --- updated-dependencies: - dependency-name: express-rate-limit dependency-version: 8.5.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [opossum](https://github.com/nodeshift/opossum) from 8.5.0 to 10.0.0. - [Release notes](https://github.com/nodeshift/opossum/releases) - [Changelog](https://github.com/nodeshift/opossum/blob/main/CHANGELOG.md) - [Commits](nodeshift/opossum@v8.5.0...v10.0.0) --- updated-dependencies: - dependency-name: opossum dependency-version: 10.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Updates the requirements on [soroban-sdk](https://github.com/stellar/rs-soroban-sdk) to permit the latest version. - [Release notes](https://github.com/stellar/rs-soroban-sdk/releases) - [Commits](stellar/rs-soroban-sdk@v26.0.1...v27.0.0) --- updated-dependencies: - dependency-name: soroban-sdk dependency-version: 27.0.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
--- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.1.1 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [typescript](https://github.com/microsoft/TypeScript) from 6.0.3 to 7.0.2. - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](https://github.com/microsoft/TypeScript/commits) --- updated-dependencies: - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
…uite Get the Next.js 16 frontend building and running, give it a real design system, and bring the full test/CI gate to green. Build fixes - Resolve dependency conflicts (typescript ^5.9.3, bundlewatch ^0.4.2, @next/bundle-analyzer aligned to Next 16.2.9) - Fix Zod v4 breakage (ZodError.errors -> .issues) in next.config.js and src/lib/env.ts - Migrate config to Next 16 / Turbopack (drop swcMinify + custom webpack splitChunks; Turbopack handles chunking/minification) - Rename middleware.ts -> proxy.ts (function middleware -> proxy) - Add .env.local (NEXT_PUBLIC_API_URL) Redesign (UI/UX: Modern Dark, gold + purple on deep navy) - New design token system (tokens.css) with dark-primary + light variant - Full visual layer (landing.css): glass sticky nav, hero with ambient glow and gradient display type (Orbitron/Exo 2, self-hosted via next/font), glass email capture, bento feature cards, numbered step cards, footer - Token-driven Statistics band - Create previously-404 brand assets (mark.svg, feature icons, favicon) - Trim accessibility.css to pure a11y utilities Functional fix - CSP connect-src blocked the statistics API; proxy.ts now allowlists the configured API origin from NEXT_PUBLIC_API_URL Tests / CI (0 failing, coverage gate met) - Fix jest env loading (default NEXT_PUBLIC_API_URL in jest.config.js) - Exclude Playwright e2e specs from Jest - Fix broken relative imports (LoadingSpinner/Skeleton suites) - Stub api.getStatistics so Statistics mount doesn't consume form fetch mocks; fix mock shapes, tab-order assumptions, and stale copy expectations - Convert nav menubar/menuitem roles to semantic links; add required attr - Add API endpoint-wrapper + env validation tests; exclude framework entry files from coverage collection
…/npm_and_yarn/services/tts/express-rate-limit-8.5.2 chore(deps): bump express-rate-limit from 7.5.1 to 8.5.2 in /services/tts
…/npm_and_yarn/services/tts/opossum-10.0.0 chore(deps): bump opossum from 8.5.0 to 10.0.0 in /services/tts
Bumps [@opentelemetry/sdk-node](https://github.com/open-telemetry/opentelemetry-js) from 0.219.0 to 0.220.0. - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.219.0...experimental/v0.220.0) --- updated-dependencies: - dependency-name: "@opentelemetry/sdk-node" dependency-version: 0.220.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
…/cargo/soroban-sdk-27.0.0 chore(deps): update soroban-sdk requirement from 26.0.1 to 27.0.0
…/npm_and_yarn/services/tts/opentelemetry/sdk-node-0.220.0 chore(deps): bump @opentelemetry/sdk-node from 0.219.0 to 0.220.0 in /services/tts
Bumps [@opentelemetry/core](https://github.com/open-telemetry/opentelemetry-js) from 2.8.0 to 2.9.0. - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v2.8.0...v2.9.0) --- updated-dependencies: - dependency-name: "@opentelemetry/core" dependency-version: 2.9.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [@opentelemetry/instrumentation-http](https://github.com/open-telemetry/opentelemetry-js) from 0.219.0 to 0.220.0. - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.219.0...experimental/v0.220.0) --- updated-dependencies: - dependency-name: "@opentelemetry/instrumentation-http" dependency-version: 0.220.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
…/npm_and_yarn/services/tts/opentelemetry/core-2.9.0 chore(deps): bump @opentelemetry/core from 2.8.0 to 2.9.0 in /services/tts
Bumps [@opentelemetry/semantic-conventions](https://github.com/open-telemetry/opentelemetry-js) from 1.41.1 to 1.43.0. - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@semconv/v1.41.1...semconv/v1.43.0) --- updated-dependencies: - dependency-name: "@opentelemetry/semantic-conventions" dependency-version: 1.42.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
…emetry/instrumentation-http-0.220.0
Bumps [@opentelemetry/exporter-trace-otlp-grpc](https://github.com/open-telemetry/opentelemetry-js) from 0.219.0 to 0.220.0. - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.219.0...experimental/v0.220.0) --- updated-dependencies: - dependency-name: "@opentelemetry/exporter-trace-otlp-grpc" dependency-version: 0.220.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
…/npm_and_yarn/services/tts/opentelemetry/instrumentation-http-0.220.0 chore(deps): bump @opentelemetry/instrumentation-http from 0.219.0 to 0.220.0 in /services/tts
…emetry/exporter-trace-otlp-grpc-0.220.0
…/npm_and_yarn/services/tts/opentelemetry/exporter-trace-otlp-grpc-0.220.0 chore(deps): bump @opentelemetry/exporter-trace-otlp-grpc from 0.219.0 to 0.220.0 in /services/tts
…/npm_and_yarn/services/tts/types/node-26.1.1 chore(deps-dev): bump @types/node from 26.1.0 to 26.1.1 in /services/tts
…/npm_and_yarn/services/tts/opentelemetry/semantic-conventions-1.42.0 chore(deps): bump @opentelemetry/semantic-conventions from 1.41.1 to 1.43.0 in /services/tts
…/npm_and_yarn/services/tts/typescript-7.0.2 chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 in /services/tts
…end-build-redesign-tests feat: fix frontend build, redesign landing page, and green the test suite
|
@Emeka000 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR Body
Summary
CANCEL_OUTCOME_INDEXand letcast_voteaccept it as a special sentinel outcome, so community "cancel market" votes can actually be cast instead of failing to compile / always reverting ([Bug] Community 'cancel market' vote path references an undefined CANCEL_OUTCOME_INDEX constant #1184).market.creation_depositbefore transferring inrelease_creation_deposit, closing an unbounded repeat-drain of contract funds ([Bug] release_creation_deposit never clears the deposit, allowing unbounded repeat-drain of contract funds #1185).market.dispute_timestamp(not the stalepending_resolution_timestamp) as the base for the 72h voting window infinalize_resolution'sDisputedarm, and returnTimelockActiveinstead ofVotingNotStarted, so the dispute voting window can no longer be bypassed ([Bug] finalize_resolution's Disputed branch uses the wrong timestamp, allowing the 72h dispute voting window to be bypassed #1187).claim_winningsso payouts can't be claimed while the contract is paused, matchingplace_bet/withdraw_refund([Bug] claim_winnings never checks the circuit breaker, so funds can leave the contract during an emergency pause #1188).Known blocker (pre-existing, not introduced by this PR)
maincurrently fails to build independent of these changes — confirmed viagit stashbefore touching any files. ~28 compile errors exist incontracts/predict-iq, including calls tomarkets::get_outcome_stake/set_outcome_stake/increment_outcome_bet_count/validate_parent_marketthat don't exist inmarkets.rs, missingErrorCode/ConfigKeyvariants, and aMarketinitializer missing fields. This PR's changes reduce the error count from 28 to 26 (fixing the undefined-constant compile error from #1184) but do not touch the remaining unrelated breakage.Because of this,
cargo build/cargo test/cargo clippycould not be run to completion in this environment, so the tests required by each issue's "Testing Requirements" are not included here — they need to be added once the baseline build is fixed. Flagging this rather than silently skipping it.Test plan
cd contracts/predict-iq && cargo build --releasepasses with zero warningscd contracts/predict-iq && cargo clippy --all-targets --all-features -- -D warningspassesCancelled([Bug] Community 'cancel market' vote path references an undefined CANCEL_OUTCOME_INDEX constant #1184)release_creation_deposittwice and asserting the second call transfers 0 ([Bug] release_creation_deposit never clears the deposit, allowing unbounded repeat-drain of contract funds #1185)finalize_resolutionrejects withTimelockActivebefore 72h fromdispute_timestamp([Bug] finalize_resolution's Disputed branch uses the wrong timestamp, allowing the 72h dispute voting window to be bypassed #1187)claim_winningsis rejected ([Bug] claim_winnings never checks the circuit breaker, so funds can leave the contract during an emergency pause #1188)Closes #1184,
closes #1185,
closes #1187
closes #1188