Ecosystem metrics
- New Repos
- 18
- down 28.0%
- Commits
- 874
- up 25.2%
- Releases
- 11
- up 175.0%
- Contributors
- 58
- up 20.8%
- Merges
- 15
- down 34.8%
Activity Overview
Commits and releases over time
- Commits
- Releases
- Authors
Repository Explorer
No repositories match that filter.
10597 commits in all time
May 14, 2026 19:39 – Aug 12, 2026 19:39 UTC
Merge 3ce7d70965caeae51bef5a9ec692437e32f74845 into f8a1376be4bde38b83eac7c40df89a3a7a0127fa
417c7028
pull/91/merge
9/1,582 ++ 1,024 --
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?v=4&s=80)
Merge 92420b294b832280110daa3eaef9ff0fcc4ecc6a into b0a3e71a91adfd1dfb97b5060d054618c2a147aa
a81a01c1
pull/66/merge
10/1,149 ++ 1,264 --
chore(deps): Update all non-major dependencies
92420b29
renovate/all-non-major-dependencies
10/1,149 ++ 1,264 --
feat: "ussemble" layer changes to support multi-byte ops (`sub_code` field)
a7442eea
main
2/14 ++ 10 --
test: add op tests for sha512, poseidon2, appBox family of ops, and `app_params_set` and new appParams fields
bfc12de3
main
60/9,674 ++ 1,003 --
chore: get augmented langspec from go-algorand
bb0cadd5
main
1/4,388 ++ 2,847 --
script changes to accomodate new `app_box_*` ops and `app_params_set`, `sub_code` for opcodes more than one byte long, and new augmented langspec in go-algorand
ea8c6bb3
main
5/162 ++ 56 --
Merge c21bd5d0f8afa62b9e1af546e91d532d82f0d094 into 0baa5b4c004ae3b9307b09a22e113c95549787cb
e055db12
pull/262/merge
14/2,843 ++ 3,275 --
Merge f8d5b5d0721434145cd1998fc916ec218eeb3fd0 into 2bb186e0a27bcf0b321e530f202ed6b7ecc5d1f0
2354aaa0
pull/14/merge
1/67 ++ 3 --
Fetch the pinned Falcon tarball fail-fast, with retries
The windows leg of run 31626290777 failed with:
tar: Error is not recoverable: exiting now
The archive was fine; the download was not. `curl -sL ... | tar xz` has
three defects that combine to produce exactly that misleading message:
-s without -f curl exits 0 on an HTTP error and pipes the error PAGE
into tar, so a failed download presents as a corrupt
archive
no pipefail the pipeline's exit status is tar's regardless
no retry a transient network blip fails the whole build
Split download and extract into separate commands, add -f so an HTTP error
is an error, --retry 3 --retry-delay 2 --retry-all-errors for transient
failures, and set -o pipefail. A future failure now names the component
that actually failed.
Applied to both occurrences (signature-kat and testnet-e2e).
Not a security fix: the pin, the digest gate and the FPEMU assertion that
follow are unchanged, and they remain what actually proves the fetched tree
is the audited one. This only stops a network blip from being reported as a
corrupt archive.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
f8d5b5d0
fix/lib-gated-security-tests-never-run
1/18 ++ 2 --
feat: keystore migrations
c2174679
feat/keystore-migrations
17/697 ++ 20 --
Merge 39fe70f0db3ef898de0ac5253680ae377f3ff178 into 2bb186e0a27bcf0b321e530f202ed6b7ecc5d1f0
f2c3fd93
pull/16/merge
1/19 ++ 2 --
Let the secret scan actually scan history
ci.yml claimed "Full history is scanned, not just the diff, so a secret
introduced earlier is still caught". It was scanned on no automatic
trigger.
From gitleaks-action v2 at the pinned SHA, src/gitleaks.js:103-115, only
two event types get a commit range:
push --log-opts=--no-merges --first-parent <base>^..<head>
pull_request --log-opts=--no-merges --first-parent <base>^..<head>
Every other supported event (src/index.js:176 - schedule,
workflow_dispatch) runs with no --log-opts, which is what makes gitleaks
walk the whole history.
Observed on this repo's own runner, scanning two commits:
gitleaks detect --redact -v --exit-code=2 ... \
--log-opts=--no-merges --first-parent 6d7d771^..8aea860
And the job carried `if: github.event_name != 'schedule'`, excluding the
one automatic trigger that would have scanned everything. Verified against
scheduled run 31368848691: `Secret scan (gitleaks)` does not appear in it
at all. So push and PR each covered a handful of commits, the weekly run
covered none, and a secret committed before the pushed range was caught by
nothing. fetch-depth: 0 was already correct - the checkout was never the
problem, the trigger was.
This matters here specifically because the deployment path uses
DEPLOYER_MNEMONIC, an Algorand mnemonic that controls its account outright:
a leak in history is irrevocable, and history is exactly what was unscanned.
Removing the condition lets the Monday schedule perform the full-history
scan the comment already promised.
Independently checked before enabling, so the first scheduled run is not a
surprise: 35 commits, the only .env-shaped file ever added is .env.example,
and no private-key blocks or mnemonic assignments appear anywhere in
history. That check covers the highest-risk categories for this repo, not
gitleaks' full ruleset - if the first full run does flag something, most
likely an allow-list gap around the deliberate public test vector in
sdk/tests/vectors/, that is information rather than breakage.
Found by an adversarial claim-vs-enforcement sweep (TCE-10).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
39fe70f0
fix/gitleaks-full-history-never-scanned
1/19 ++ 2 --
Merge bdd835ad7944dd017383b5ed02c5e7dc22a3c249 into c16958b8238c18f3d0762c3772e296e9b7976a02
2b156ca2
pull/31/merge
49/4,038 ++ 103 --
feat(react-native-keystore): adopt legacy flat records as tracked migration
bdd835ad
pull/31/head
17/697 ++ 20 --
Merge 05826aba5827d68791bd0d9395289e9842a14434 into c16958b8238c18f3d0762c3772e296e9b7976a02
9a01f0b2
pull/31/merge
49/4,038 ++ 103 --
chore: bump react-native-autofill submodule to formatting fix
Co-authored-by: Junie <junie@jetbrains.com>
05826aba
feat/keystore-migrations
1/1 ++ 1 --
feat(react-native-keystore): adopt legacy flat records as tracked migration
a65f6bf0
feat/keystore-migrations
17/697 ++ 20 --