Ecosystem metrics
- New Repos
- 2
- New
- Commits
- 362
- down 31.2%
- Releases
- 1
- down 50.0%
- Contributors
- 36
- down 2.7%
- Merges
- 8
- down 42.9%
Activity Overview
Commits and releases over time
- Commits
- Releases
- Authors
Repository Explorer
No repositories match that filter.
8525 commits in all time
Aug 14, 2026 19:40 – Nov 12, 2026 19:40 UTC
fix: validate derivation indexes, decouple build from test tooling
Follow-up to the previous commit, from review.
Derivation:
- harden() rejects levels outside [0, 2^31) with a RangeError, and
deriveChildNodePrivate/deriveChildNodePublic reject indexes outside
[0, 2^32) with a clear message instead of a RangeError from
Buffer.writeUInt32LE deep inside the derivation. Tests cover both.
Build and test:
- tsconfig.json is build-only ("types": ["node"]); the jest types moved to
a new tsconfig.spec.json, which the test scripts and ts-jest now use. The
published build no longer needs @types/jest.
- "prepack" runs the build, so packing right after a test run can't ship
the specs and src/test-utils that tests leave in dist.
- CI drops its redundant "Compile TypeScript" step; pnpm test already
compiles (and type-checks) as its first step.
Docs and test helpers:
- README breaking changes now say that non-TX protocol payloads (MX,
Program, ProgData, ...) must be signed with signData, that index misuse
throws a RangeError, and which deep import path the exports map blocks.
- Comment why @parcel/watcher builds are denied, and why the test helper
clamps the X25519 scalar (libsodium parity, not needed by noble).
- Keep the original failure as the cause of secretbox's "decryption failed".
No pnpm-lock.yaml change: a from-scratch resolve with pnpm 12.3.4 (what
pnpm/action-setup installs) is identical to the committed lockfile, and
pnpm install --frozen-lockfile leaves it untouched.
8b46887c
pull/36/head
12/77 ++ 16 --
fix: address code review round 7 (restore every duplicate on rollback, wait for the wrong-password result in delete specs)
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
479b9345
master
3/11 ++ 5 --
fix: address code review round 6 (in-flight QR guard, delete double-click guard, native token label on SignAll)
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
09dff654
fix/audit-2026-11-12-round2
3/38 ++ 20 --
fix: address code review round 5 (stop scanner before awaiting, saveWallet success contract, clipboard generation guard, gateway anchor survives reload)
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
355a6b66
fix/audit-2026-11-12-round2
6/97 ++ 20 --
fix: address code review round 4 (guard rollback of an unknown account, clean note on QR scan)
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
d9716758
fix/audit-2026-11-12-round2
2/4 ++ 1 --
fix: address code review round 3 (restore original line endings, delete dialog stays open on failure, precise delete rollback, zero-address access entries)
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
42b2337f
fix/audit-2026-11-12-round2
11/1,307 ++ 1,280 --
fix: address code review round 2 (Ledger slot after read, genesis verdict parity, clipboard retry cap, localized mnemonic toast, QR outside flag)
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
4335545b
fix/audit-2026-11-12-round2
17/52 ++ 7 --
fix: address code review round 1 (Folks env check, delete rollback on throw, pay outside-recipient flag, Ledger slot, SignAll asset column)
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
4f5ac821
fix/audit-2026-11-12-round2
7/833 ++ 824 --
fix: remediate audit 2026-11-12 findings (AW-2026-101..124)
- /sign review reads amount, asset, receiver, app and keyreg details from the real transaction (shared TxReviewDetails) - dApp fee ceiling/type allow-list apply to signers:[] entries; signatures forgotten on every request end path - deleting an account needs the wallet password; last-account deletion is persisted - payment QR uses link parsing and network confirmation; gateway time floor and host display - node-parameter checks for library-built transactions; clipboard retry; locale guard hardening - AW-2026-114 accepted by product owner Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
557f1593
fix/audit-2026-11-12-round2
54/2,681 ++ 1,495 --
Add security audit report for commit 2073168
- Executive summary highlights findings from the audit covering the range f8a74a0..2073168. - Identified 0 Critical, 1 High, 2 Medium, 9 Low, and 1 Informational new findings. - Key findings include issues with multisig transaction visibility, incorrect labeling of key registrations, and security concerns with the ARC-56 registry container. - Detailed recommendations provided for each finding to enhance security and user experience. - Verification of unit tests, linting, and production build confirmed clean. - Dependency review indicates an increase in advisories, with a total of 13 advisories noted.
51aea496
fix/audit-2026-11-12-round2
2/324 ++ 72 --
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?v=4&s=80)
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?v=4&s=80)
Merge 07b7e1b9bd09c0d2ae555b7f206b2e4fd4baf64f into b3d4e46aabdff5f6ac7276177c541518eca758e9
4ee62fbf
pull/216/merge
3/4 ++ 4 --
Merge eb3af77471415a9086163864730a5f64a25d62aa into b3d4e46aabdff5f6ac7276177c541518eca758e9
0e2f9c52
pull/215/merge
1/1 ++ 1 --
Merge 1ee648d32bcaee3c866f112676ba685d69e76e40 into b3d4e46aabdff5f6ac7276177c541518eca758e9
ffda1d89
pull/214/merge
3/4 ++ 4 --
Merge 5aa2de2b7a2f9b99615337fa0c294af2a9d6f513 into b3d4e46aabdff5f6ac7276177c541518eca758e9
8d7e8a9c
pull/213/merge
1/1 ++ 1 --
Merge 2ffb02493eef4c92b7441a7b7a001828088cd59c into b3d4e46aabdff5f6ac7276177c541518eca758e9
79ce1f65
pull/212/merge
2/4 ++ 4 --
fix: address code review round 10 (remember recipient only from Pay and the Sign form, not makePayment callers)
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2fbcb7f0
fix/audit-2026-11-12
2/5 ++ 9 --