Ecosystem metrics
- New Repos
- 1,871
- New
- Commits
- 33
- up 37.5%
- Releases
- 1
- down 75.0%
- Contributors
- 21
- up 16.7%
- Merges
- 1
- up 0.0%
Activity Overview
Commits and releases over time
- Commits
- Releases
- Authors
Repository Explorer
No repositories match that filter.
320 commits in all time
May 20, 2026 01:33 – Aug 18, 2026 01:33 UTC
Merge b60d7a6bbad5c6756581271bd035e01034cbb4cc into 0b42a140b8b4e7209c648f9c8dd5f9f0043e42ac
028df353
pull/637/merge
1/0 ++ 1 --
Merge 59fd5c909fce3e0c675b8ca6b090f58157105095 into fd2b3698ab3576338916b442e7dc1078c851955e
de33fd5e
pull/632/merge
3/57 ++ 11 --
Merge b175262b6f5bbfd406604d978d217ec991cbf566 into 8602e0430cdc499f3bc1cecc5abe4aa31f4aee44
13f0968a
pull/172/merge
85/9,658 ++ 8,186 --
Merge f131b95a4cea7f1657ab8c703caa09836cdae81c into 8602e0430cdc499f3bc1cecc5abe4aa31f4aee44
5ef057f9
pull/162/merge
142/15,514 ++ 7,959 --
fix: keep sessions alive when only connected to WS
30a9d29c
develop
3/446 ++ 40 --
Refuse to sign a release whose tag and version disagree
sdk/pyproject.toml declared version = "0.1.0" while the repo carries tags v0.2.0 and v0.2.1 - and both of those tags ALSO carry "0.1.0". Two independent claims about which release this is, with nothing binding them. The first real run of this workflow would therefore have built trelyan_pq-0.1.0-*.whl, then SLSA-attested and Sigstore-signed those exact bytes under a v0.2.2 tag. The attestation would have been cryptographically valid and described the wrong release - which is worse than an unsigned artifact, because it carries an assurance nobody can act on. Nothing was published: release.yml was first committed 2026-06-18, AFTER both tags (it is absent at v0.2.0 and v0.2.1), it has never run, and both GitHub Releases have zero assets. The mislabelling was latent. Bumps the declared version to 0.2.2 - verified by building: the wheel is now trelyan_pq-0.2.2-py3-none-any.whl, previously it would have been 0.1.0 - and adds a gate in the build job, before anything is compiled or signed, that fails when the tag does not match. Simulated all three ways: v0.2.2 allowed, v0.2.1 and v9.9.9 blocked. Security impact: no crypto or protocol change. Closes a path where a signed, SLSA-attested artifact could name a different release than its tag.
6e76dd80
pull/25/head
2/23 ++ 1 --
fix: label data-signing failures as SIGN_DATA instead of SIGN_TRANSACTIONS
0b9b1f7b
pull/205/head
4/58 ++ 17 --
docs: refresh appendix block fields from review fixes
Regenerated from the go-algorand PR 6690 review changes: genesis blocks start their txn counter at 1000, and the block fields no longer describe the zero values returned for blocks that predate their enabling upgrade.
21a7f33f
pull/314/head
1/5 ++ 5 --
chore(release): react-native-keystore [skip ci]
# [react-native-keystore@1.0.0-canary.19](https://github.com/algorandfoundation/wallet-provider-extensions/compare/react-native-keystore@1.0.0-canary.18...react-native-keystore@1.0.0-canary.19) (2026-08-13) ### Features * extractable keys and seeds ([b78f0f8](https://github.com/algorandfoundation/wallet-provider-extensions/commit/b78f0f8a0acc0d3c895ae9155f56ddb4ca6f0a55))
7fdb2bcb
main
2/7 ++ 1 --
Merge 8af35133b70eeac806c01777969fd4314a7b2e33 into 75c72bf720cdf08705f25d121fcce3e3150f72e6
225e9f92
pull/1119/merge
1/3 ++ 3 --
Merge ee418c3a084cea2a2d4cb6be0ef37ee831d2cec5 into 75c72bf720cdf08705f25d121fcce3e3150f72e6
2b988ec9
pull/1059/merge
1/5 ++ 4 --
Merge efa49cef087a2360d02688c9f8f958d1aee3dc52 into f72f615ab65e8f7bf153b6165b9204e0f76c15ab
f3202119
pull/830/merge
6/21 ++ 0 --
test: add op tests for sha512, poseidon2, appBox family of ops, and `app_params_set` and new appParams fields
bfc12de3
main
60/9,674 ++ 1,003 --