Ecosystem metrics
- New Repos
- 8
- New
- Commits
- 787
- up 8.1%
- Releases
- 7
- up 0.0%
- Contributors
- 55
- up 1.9%
- Merges
- 17
- down 5.6%
Activity Overview
Commits and releases over time
- Commits
- Releases
- Authors
Repository Explorer
No repositories match that filter.
8799 commits in all time
Jul 24, 2026 18:29 – Oct 22, 2026 18:29 UTC
fix: avoid spurious signer toasts on /signAll, coerce asset decimals, explicit delete failure
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
5385be75
fix/audit-2026-10-22
3/6 ++ 1 --
add Go Benchmark (go) benchmark result for 5301fb7fd0d25fc3d7dc1e03b4293a97049ca944
705071c1
gh-pages
1/445 ++ 1 --
dnssec: check embedded root anchor vs iana.org live in CI (#6785)
5301fb7f
master
3/69 ++ 27 --
fix: PBKDF2 minimum on import, tolerate malformed note, allow deleting unnamed account
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
c9746d5d
fix/audit-2026-10-22
4/12 ++ 4 --
fix: gate gateway links on full validation, harden SignAll signer lookup, delete navigation
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
b55af7f2
fix/audit-2026-10-22
3/28 ++ 10 --
fix: await asset validation before gateway links/polling; tighter PBKDF2 cap
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
0aea0b0d
fix/audit-2026-10-22
3/5 ++ 5 --
fix: gateway poll in-flight guard and countdown timer cleanup
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
d2f8e89a
fix/audit-2026-10-22
1/13 ++ 5 --
fix: gateway note join, asset failure, stricter backup validation
- join the generated note with ? when the URI has no query - make nothing payable when the asset cannot be validated - require a GCM-tag-sized ciphertext and a plausible legacy blob on import - deleteAccount no longer requires a name (address is the identifier) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
cf0e9a2c
fix/audit-2026-10-22
4/24 ++ 17 --
fix: harden gateway further after review (payee, network, polling)
- refuse gateway links without a valid payee address or with an unsupported network - stop polling once paid and keep a seen payment when a later poll fails - /signAll: ignore stale Falcon signer refreshes after a network switch Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
c3a80881
fix/audit-2026-10-22
13/63 ++ 16 --
fix: address code review findings on audit fixes
- validate PBKDF2 iteration cap and salt/iv sizes on wallet import - gateway: no doubled web+algorand scheme, hide waiting message on invalid link - /signAll: re-resolve Falcon signers when the network changes - importWallet: failing logout no longer makes a stored import look failed - restore original line endings, annotate unknown types Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
506e570c
fix/audit-2026-10-22
8/693 ++ 657 --
fix: address security audit 2026-10-22 (AW-2026-076..079)
- /gateway: accept only algorand payment URIs, validate cancel/success URLs
(https, loopback http), stop rewriting persisted node settings
- /signAll: block signing on genesis mismatch, warn on Falcon-1024 fee
shortfall; fix { txx } typo in ScheduledPaymentDetail
- importWallet: validate backup envelope and size, log out open wallet
- deleteAccount: match by address only, never splice(-1)
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
502e1558
fix/audit-2026-10-22
25/1,293 ++ 635 --
Add security audit report for commit a5217ae (2026-10-22)
- Conducted a comprehensive audit covering the commit range 0720e12..a5217ae. - Identified four new defense-in-depth findings: - AW-2026-076: Unvalidated URL-supplied hrefs and auto-submitted forms on /gateway page (Medium). - AW-2026-077: Missing network genesis verification and fee estimation in SignAll.vue (Medium). - AW-2026-078: ImportWallet accepts arbitrary strings into IndexedDB without validation (Low). - AW-2026-079: Incorrect account deletion logic in wallet store (Low). - Re-verified all open and mitigated findings from previous audits. - No changes to dependencies or significant code alterations since last audit.
ce8c5947
fix/audit-2026-10-22
2/852 ++ 679 --
Merge 61ac9e10612627c1a0d58142d94160745994bcbe into 1f9f2a498534caa90d19d2233ef47c1ba30327a8
24036d85
pull/6777/merge
4/85 ++ 2 --
Merge d51fddbbd45796692d4f3400871e49dd7bbae017 into 1f9f2a498534caa90d19d2233ef47c1ba30327a8
d05514b2
pull/6782/merge
2/4 ++ 5 --
Merge 43ace4d63120c117bfd2c6f37a79222fef7b3570 into 1f9f2a498534caa90d19d2233ef47c1ba30327a8
951a8064
pull/6781/merge
2/10 ++ 18 --
Merge babb69ae43679e4785c6d2e8d1aedd18fdca8e32 into 1f9f2a498534caa90d19d2233ef47c1ba30327a8
2779af73
pull/6785/merge
3/69 ++ 27 --
Merge 636fb5d8a4f16cce58802b3628840c769f5038e2 into 1f9f2a498534caa90d19d2233ef47c1ba30327a8
476163df
pull/6788/merge
11/1,261 ++ 287 --
Account for cost without being tricked by zero padding
636fb5d8
pull/6788/head
2/35 ++ 9 --
The maker publishes only at the top of the hour
4ab796ea
jm/stopgap-marketmaker
2/23 ++ 16 --
launch stopgap marketmaker 2026-2027 season
3e28a966
jm/stopgap-marketmaker
203/3,163 ++ 27,552 --
Merge 2704e76eef59eda8a02617a715b7b94a526b8a42 into 1f9f2a498534caa90d19d2233ef47c1ba30327a8
97f13180
pull/6778/merge
3/95 ++ 2 --