Fork sync - #36
Open
mateumiralles wants to merge 1027 commits into
Open
Conversation
…match-2.3.2 chore(deps): bump picomatch from 2.3.1 to 2.3.2
…et.io-parser-4.2.6 chore(deps): bump socket.io-parser from 4.2.5 to 4.2.6
…ted-3.4.2 chore(deps): bump flatted from 3.3.1 to 3.4.2
…-3.3.3 chore(deps): bump svgo from 3.3.2 to 3.3.3
fix: improve csp
Merge develop into main
Bumps [follow-redirects](https://github.com/follow-redirects/follow-redirects) from 1.15.9 to 1.16.0. - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.9...v1.16.0) --- updated-dependencies: - dependency-name: follow-redirects dependency-version: 1.16.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [hono](https://github.com/honojs/hono) from 4.12.3 to 4.12.14. - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.3...v4.12.14) --- updated-dependencies: - dependency-name: hono dependency-version: 4.12.14 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
- remove invalid keys from depositable - rounding up potential keys count - active keys stake if group was removed
- @lidofinance/* family 0.59.0 -> 0.61.0 - reef-knot 8.1.1 -> 8.2.0
# Conflicts: # config/feature-flags/types.ts # config/feature-flags/utils.ts # features/qa-config/qa-feature-flags.tsx # package.json # providers/modify-provider.tsx # yarn.lock
chore: bump matomo/analytics and reef-knot packages
Mirror the per-module manifest pattern for favicons: track explicit favicon-csm.* and favicon-cm.* source sets, generate the canonical favicon.* files at build time in build-dynamics.mjs based on MODULE, and gitignore the generated outputs.
* feat: add flag to skip deposit data signature validation Add a dedicated DISABLE_DEPOSIT_DATA_SIGNATURE_VALIDATION feature flag (URL param disable-deposit-signature-validation) that skips only BLS signature verification via the skipSignature option added in lido-csm-sdk alpha-73, while keeping structure, withdrawal-credentials, duplicate and keys-limit checks. The existing DISABLE_DEPOSIT_DATA_VALIDATION flag is unchanged and still skips the entire validation. Bumps @lidofinance/lido-csm-sdk 2.0.0-alpha.70 -> 2.0.0-alpha.73. * fix: update help text for 'Keys limit' parameter in headerBadge.spec.ts * fix: update duplicatedKeys tests to disable deposit data signature validation --------- Co-authored-by: exromany <exromany@lido.fi>
# Conflicts: # package.json
Key limit reached message compared targetLimit with uploaded keys (totalAddedKeys - totalWithdrawnKeys) instead of deposited validators, producing false positives while depositable slots remained.
enabled did not check isActive, so stale cached filled data kept the banner visible after the window closed. In that state isDismissed (isBefore(now, end)) is always false, so the close button could never hide it. Gate enabled on isActive to align with the filled query and dismiss window.
buildDynamics() runs at next.config.mjs module-load, so it reruns at next start (as user node) and rewrites public/favicon.* and manifest.json. Only manifest.json was chowned to node; the CM favicons stayed root-owned, so next start crashed with EACCES on copyFileSync. Chown all of public/.
(cherry picked from commit 9739c75)
fix: last fixes
DKG upload and members auto-init failures render custom failed tx-stages that bypass getErrorCode, so they were never tracked. Add trackMatomoRawError at those catch sites (tags dkg_upload_page/_create/_add_keys, members_init) and a trackMatomoSurveySigninDenied event fired on DENIED_SIG during create-IDVTC / claim-IDVTC sign-in.
feat(idvtc): DKG + members/rotation on generated SDK
feat: track IDVTC survey-API failures and sign-in denials in Matomo
- raise KEYS_UPLOAD_TX_LIMIT from 25 to 75 - validate only the first 75 keys via SDK; keys beyond the limit get a per-row error and the form error is tooManyKeys - update @lidofinance/lido-csm-sdk to 2.0.0-alpha.75
…ation-validate
fix: update key limits in tests and improve error messages
* feat: raise DKG file upload limit to 5 MB csm-surveys-api raised the per-file upload cap from 64 KB to 5 MiB and added a per-operator quota (100 MiB / 1000 files). Sync the client side: - bump MAX_CONTENT_BYTES to 5 MiB and update the rejection copy - add copy for the new FILES_QUOTA_EXCEEDED / FILES_COUNT_EXCEEDED codes, which otherwise fall back to the server message and show raw byte counts - re-pull the OpenAPI spec (0.7.0 -> 0.7.2) and regenerate Total size and file count stay backend-enforced; the client validates only each file's own size. * fix: handle failed DKG uploads and cap files at 4 MB Follow-up to the 5 MiB sync, from testing large uploads against hoodi. - Transit the tx modal to a failed stage when an in-flow DKG upload throws. uploadStaged set a non-terminal pending stage but left the terminal state to its callers, and the add-keys flow's catch only called handleTxError — a predicate that transits nothing — so a failed upload left the modal spinning forever. - Lower the per-file cap to 4 MB, deliberately stricter than the API's own 5 MiB, so an oversized file never reaches the server. - Detect an oversized batch. The server's 413 for exceeding its 6 MiB body limit carries no Access-Control-Allow-Origin header, so the browser blocks it and no HTTP status ever reaches us; recognise the opaque transport failure and surface operator-facing copy instead. Also pins survey-client's documented status-0 contract for a rejected fetch with a test, since the detection above depends on it. * feat: cap total DKG batch size at the server's body limit Staging accepted any number of files, so a batch could pass the per-file check and still blow the API's 4,300,000-byte BODY_LIMIT — and since the in-flow upload runs after the tx, that meant keys submitted and files lost. Validate the whole batch against MAX_TOTAL_BYTES on the dkgFiles field of both flows, and on the standalone page's drop handler. The form error disables submit through the existing hasErrors path. Also corrects two wrong figures: SERVER_BODY_LIMIT_BYTES was 6 MiB, and the per-file cap claimed to be stricter than the API's, which is the same 4 MiB.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
7 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fork sync