Skip to content

build(deps): Bump react-dom from 18.3.1 to 19.2.5 in /frontend#9

Open
dependabot[bot] wants to merge 96 commits into
mainfrom
dependabot/npm_and_yarn/frontend/react-dom-19.2.5
Open

build(deps): Bump react-dom from 18.3.1 to 19.2.5 in /frontend#9
dependabot[bot] wants to merge 96 commits into
mainfrom
dependabot/npm_and_yarn/frontend/react-dom-19.2.5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 28, 2026

Copy link
Copy Markdown

Bumps react-dom from 18.3.1 to 19.2.5.

Release notes

Sourced from react-dom's releases.

19.2.5 (April 8th, 2026)

React Server Components

19.2.4 (January 26th, 2026)

React Server Components

19.2.3 (December 11th, 2025)

React Server Components

19.2.2 (December 11th, 2025)

React Server Components

19.2.1 (December 3rd, 2025)

React Server Components

19.2.0 (Oct 1, 2025)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.2 release post for more information.

New React Features

  • <Activity>: A new API to hide and restore the UI and internal state of its children.
  • useEffectEvent is a React Hook that lets you extract non-reactive logic into an Effect Event.
  • cacheSignal (for RSCs) lets your know when the cache() lifetime is over.
  • React Performance tracks appear on the Performance panel’s timeline in your browser developer tools

New React DOM Features

  • Added resume APIs for partial pre-rendering with Web Streams:
  • Added resume APIs for partial pre-rendering with Node Streams:
  • Updated prerender APIs to return a postponed state that can be passed to the resume APIs.

Notable changes

  • React DOM now batches suspense boundary reveals, matching the behavior of client side rendering. This change is especially noticeable when animating the reveal of Suspense boundaries e.g. with the upcoming <ViewTransition> Component. React will batch as much reveals as possible before the first paint while trying to hit popular first-contentful paint metrics.

... (truncated)

Changelog

Sourced from react-dom's changelog.

19.2.1 (Dec 3, 2025)

React Server Components

19.2.0 (October 1st, 2025)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.2 release post for more information.

New React Features

  • <Activity>: A new API to hide and restore the UI and internal state of its children.
  • useEffectEvent is a React Hook that lets you extract non-reactive logic into an Effect Event.
  • cacheSignal (for RSCs) lets your know when the cache() lifetime is over.
  • React Performance tracks appear on the Performance panel’s timeline in your browser developer tools

New React DOM Features

  • Added resume APIs for partial pre-rendering with Web Streams:
  • Added resume APIs for partial pre-rendering with Node Streams:
  • Updated prerender APIs to return a postponed state that can be passed to the resume APIs.

Notable changes

  • React DOM now batches suspense boundary reveals, matching the behavior of client side rendering. This change is especially noticeable when animating the reveal of Suspense boundaries e.g. with the upcoming <ViewTransition> Component. React will batch as much reveals as possible before the first paint while trying to hit popular first-contentful paint metrics.
  • Add Node Web Streams (prerender, renderToReadableStream) to server-side-rendering APIs for Node.js
  • Use underscore instead of : IDs generated by useId

All Changes

React

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

hermeschain-agent and others added 30 commits April 28, 2026 01:36
…06..335)

30 task specs covering migrations (indexes, new tables for slashes/contract
code+storage+metadata/state snapshots/peers), DB observability (pool
metrics, query histogram, slow-query log), read-replica routing, backup +
restore tooling, migration CLI helpers, Redis cache warming + pub/sub
bridge, SSE replica pinning, worker leader election, stuck-job recovery,
dead-letter queue, and a job retry dashboard endpoint.

First section of the spec-expansion plan; written before chain/vm/api
sections so later specs can cite migration filenames directly.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…K-001..060)

60 task specs covering Block.fromJSON deserializer (unblocks gossip-apply),
peer head poller + auto-sync + reorg-on-sync, finality flag at depth-12 +
finality-violation rejection, VRF-style proposer rotation, equivocation
slashing, stake-weighted quorum, block timestamp drift + min-time checks,
difficulty retargeting, mempool persistence + RBF + size cap + TTL, log
indexing + filter endpoint + bloom helper, GHOST fork-choice with uncle
tracking, chain export/import, genesis parameterization + hash verify,
beacon randomness, state pruning + snapshots + fast-sync endpoint, fee
distribution (80/20 producer/burn) + coinbase receipt, account-history
rebuild + verify-chain CLI, state-root mismatch alarm, receipt-root
verify on sync, three SSE streams (logs/mempool/forks), per-block gas
stats, tps/block-times/uptime endpoints, mempool depth chart, tx
simulate/estimate-gas, account next-nonce + history, validator blocks,
reorg log.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
45 task specs extending the JSON-op interpreter into a usable contract VM:
arithmetic (MUL/DIV/MOD), comparisons (EQ/LT/GT), bitwise (AND/OR/NOT),
control flow (JUMP/JUMPI/JUMPDEST), storage (SLOAD/SSTORE persistence,
cold/warm pricing, zero-set refund), cross-contract CALL/STATICCALL/RETURN
+ returndata buffer, calldata + caller/origin/value/balance/block-context
opcodes, hashing precompiles (SHA256/KECCAK), ECRECOVER (Ed25519 variant),
contract deployment (CREATE + address derivation), code-loaded execution
path in BlockProducer, trace + gas-profile endpoints, SELFDESTRUCT, memory
model (MLOAD/MSTORE/MSTORE8 + expansion gas), stack + call depth limits,
REVERT with returndata, EVENT opcode + ABI registry, source verifier,
disasm + storage browser endpoints, 30-fixture VM unit test suite, /docs/vm
spec page, tiny DSL compiler stub, four worked sample contracts.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…41..180)

40 task specs: OpenAPI 3.1 generation + Swagger UI, /api/v1/* versioning
with deprecation headers, observability middleware (request-id, NDJSON
access log, slow-request log, rate-limit headers), CORS allowlist via env,
three-tier health checks (/live, /ready, /deep), build/flags/Prometheus
metrics endpoints, search endpoints (blocks, txs, top-by-balance/activity,
gas spenders, validator leaderboard), network dashboard bundle, block +
tx detail with receipts/decoded logs, contract events feed, address tag
system + suggestions, mempool snapshot/by-hash/cancel/bulk-submit/
idempotent-submit, WebSocket mirrors of every SSE channel, Socket.io
per-address rooms, SSE event replay, GraphQL gateway, tRPC mirror,
Ethereum JSON-RPC compat (eth_blockNumber/getBalance/call/sendRaw/
subscribe), Postman collection generator.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…K-106..140)

35 task specs: HD wallet derivation (BIP32-style), mnemonic export/import +
recovery flows, watch-only mode, multi-sig primitive (m-of-n contract),
ENS-like name registry + reverse lookup, wallet alias + contact book,
token balance aggregation + approve/transferFrom + allowance + transfer
history, faucet hardening (IP rate-limit, hCaptcha hook, dynamic drip,
auto-refill), batch send + scheduled send, hardware-key signing protocol
stub, session-key delegation, account-abstraction paymaster stub, social
recovery (3-of-5 guardians), per-account gas budget cap, password-encrypted
wallet export/import, address validity checker, vanity + bulk address
generator scripts, wallet metrics endpoint.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
35 task specs: CSRF + Helmet + body-size + per-endpoint rate limit overrides,
SQL-injection audit script, input length caps, API-key scoping (chain:read/
write etc) + 90d expiry + rotation + audit log, admin-token rotation flow,
failed-auth IP lockout (5/min → 15min block) + suspicious feed, tx replay
protection (chainId enforcement + nonce window tightening), wallet-export
rate limit + obscured mnemonic display, log redaction wrapper for
keys/sigs/mnemonics, CI hooks (gitleaks, npm audit, CodeQL, Snyk), CSP
nonces + SRI on CDN scripts, HTTPS-only redirect, SameSite=Strict cookies,
session-fixation defense, password-strength meter, encryption-at-rest
for mnemonics + KMS integration stub, Tor/VPN flag, ip2geo on auth log,
threat-feed (AbuseIPDB/Spamhaus) IP blocking, cert-pinning notes,
disclosure-response template.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…..215)

35 task specs: priority queue (urgent/normal/chore) + dependency graph +
estimated/actual effort tracking, transient-vs-permanent retry classification,
30min timeout, per-task + cumulative daily token budgets + cost estimate +
SSE token-usage stream, task rejection logging, skill registry persistence
+ versioning + hot-reload + per-skill rate-limit + source viewer + tools log
dump, verification gates (typecheck + tests + prettier) with auto-rollback,
PR-mode + branch-per-task + auto-rebase + commitlint + co-author/DCO +
PR template generator + auto-link + squash-merge + LLM conflict resolution,
per-area agent identity rotation + expertise routing, cross-task memory
recall, per-task post-mortem + vector-indexed learning corpus.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
40 task specs: 20 unit tests covering every blockchain primitive (validator
rotation+quorum, interpreter happy/out-of-gas/revert, gas meter, peer
registry eviction, parseVmProgram edges, mempool nonce window + RBF,
StateManager apply + revert, createReceipt + bloom, Chain.handleReorg,
ForkManager fork-choice, Block.isValid, sig verify, faucet cooldown,
api-key gating, migration ordering); 9 integration tests (boot smoke,
receipt persistence across restart, reorg state convergence, VM tx
end-to-end, peer announce/list, faucet→send→balance, api-key gating,
SSE event coverage, socket.io rooms); 3 load tests (1k tx/s, 100 SSE
clients, peer announce flood); 3 fuzz tests (VM, tx fields, API JSON);
2 property tests (state-root invariance, gas accounting); 2 snapshot
tests (API shapes, HUD components); 1 CI workflow tying everything to
PR + push.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…16..265)

50 task specs: tx detail modal + block detail drawer + account panel +
mempool live tail + reorg widget + validator board with rotating producer
indicator + quorum vote ticker + VM trace viewer + contract storage browser
+ event log viewer, gas-price + block-time charts + TPS sparkline + reusable
chart component, network peer map (force-directed) + peer latency table,
wallet HD address tree + send-tx form with gas estimator + token balance
grid + approve/transfer modal + faucet button with cooldown + address book
+ name registry browse, theme variants (high-contrast, amber CRT) + theme
picker dropdown + compact mode, agent reasoning panel + per-task progress
bar + cost ticker, SSE reconnect with exponential backoff + channel
selector, keyboard shortcuts overlay + cmd-k command palette + block/
address search + tx-hash paste auto-route + URL deep-link state restore
+ shareable view URLs, local + server-synced HUD prefs, toast + browser
push notifications, embed mode + mobile-responsive collapse + PWA manifest
+ service worker, a11y pass (aria-labels, keyboard-trap, focus-visible).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…..445)

35 task specs: ESLint + Prettier + Husky + lint-staged + Commitlint hooks,
Renovate + Dependabot dep updates, tsconfig strict + noUncheckedIndexedAccess
+ path aliases, build-time env validation (zod) + .env.example refresh,
docker-compose + devcontainer + Makefile + justfile + nvmrc + Volta pin,
README badges + Mermaid architecture/sequence diagrams (block production,
reorg, agent task), logo + favicon + og:image generator, sitemap + robots,
Lighthouse ≥ 90 + bundle-size budget enforcement + tree-shake audit +
dynamic imports for heavy panels, frontend + backend Sentry integration,
Logflare/Axiom log forwarding.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
….305)

40 task specs: landing tagline rewrite, /docs/architecture + consensus +
api + sdk pages, SDK packages (TS npm, Python PyPI, Rust crate) with
chain client + wallet helper + VM op builder + signed-tx builder, hermes
CLI tool with balance/send/call/deploy/node-start commands, four worked
example walkthroughs (counter, erc20-like, multisig, oracle), four
tutorials (first contract, run validator, query chain, submit tx),
v0.1 whitepaper draft, glossary + FAQ + roadmap + contributing + style
guide + code of conduct, threat model, security.txt, bug bounty page,
status page stub, press kit.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…5) and 13 final polish (TASK-476..490)

Section 12 (30 task specs): standalone block explorer + validator dashboard
+ embeddable chain stats widget, Telegram + Discord bots, Slack/email/SMS
notifiers, /api/webhooks subscription endpoint, Zapier connector + n8n node,
Grafana + Datadog + Prometheus alert + PagerDuty mappings, five operator
runbooks (db down, agent stuck, chain halted, peer partition, disk full),
chaos tests (kill worker, drop db, clock skew), disaster-recovery dry run,
multi-region notes, CDN caching + asset versioning, npm publish workflows
for SDK + CLI, Homebrew tap formula.

Section 13 (15 task specs): auto-generated CHANGELOG from conventional
commits, v0.3 release tag + blog post, demo screencast + onboarding video,
public roadmap board + issue/PR templates + Discussion categories, RSS feed,
newsletter signup endpoint, Discord invite on landing, Twitter card meta
refresh, live commit counter on landing, tagline A/B rotation test.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Replaces the 490-bullet flat list with a status table linking into the
detailed spec files (queue/01..13). Each section row shows task range,
specs ready, implemented count, and file link.

Spec-expansion phase complete: 490/490 detailed task specs across 13
section files (01 chain-consensus 60, 02 vm 45, 03 wallet 35, 04 api 40,
05 agent 35, 06 hud 50, 07 docs 40, 08 db 30, 09 security 35, 10 testing
40, 11 dx 35, 12 ecosystem 30, 13 polish 15).

Quality gate: 10 random TASK IDs spot-checked, every cited file path
resolves on disk, every spec carries the required template fields. Pass.

Next phase: implementation pass authors one commit per task on the
tier-3-backlog branch; backend/scripts/paced-push.ts (to be authored)
advances origin/main at 60 commits/day.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…led cadence

Reads data/push_pointer.txt and pushes the next N commits from
tier-3-backlog to refs/heads/main one at a time. Cadence configured
externally (cron/worker interval). Env-tunable: PUSH_BATCH (default 1),
PUSH_BRANCH/TARGET/REMOTE.

Idempotent: if remote already at branch tip, no-ops. On push failure,
aborts batch without bumping pointer so next fire retries.

Local smoke-test confirms enumeration + correct abort on missing creds.
Production deploy needs GITHUB_TOKEN in env for the worker.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Block-detail endpoints scan tx table without an index on block_height;
add a btree so block-tx lookups stay O(log n) as the chain grows.
First migration in the section-08 implementation pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…n-agent)

The header GitHub icon at App.tsx:1732 pointed at the non-existent
hermeschain-dev org instead of the real hermeschain-agent org. The
command palette and CommitMarquee links were already correct; this
was the lone outlier producing a 404 on web.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…DESC)

Mempool admission and next-nonce computation both want max(nonce) per
sender; compound index makes that an index-only lookup instead of a
full table scan.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…balances

balance is TEXT (decimal-as-string) so a plain btree sorts
lexicographically and ranks accounts wrong. Cast to numeric in the
index expression so 'top accounts' (TASK-155) is a true index-range scan.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Failure-rate queries and 'latest reverts' both filter on status and
order by block; a compound index serves both with a single range scan.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
/api/logs filters by topic/address inside logs_json; without a GIN over
parsed JSON, every query is a full receipts scan. Generated column keeps
existing TEXT writes through storeReceipt() unchanged while PG materializes
the JSONB form for indexed containment queries (logs_jsonb @> '...').

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds stake column for weighted producer selection (TASK-013) and
stake-weighted quorum (TASK-014). Default 1 keeps current head-count
quorum behavior intact until stakes are explicitly assigned.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Per-offense row with offending validator, height, evidence pointer, and
stake decrement applied. Indexed by validator and by height for both
the per-validator history endpoint (TASK-011) and chain-wide recent feed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Persistent contract bytecode keyed by deterministically-derived contract
address; needed by CREATE opcode (TASK-079), code-loaded execution path
in BlockProducer (TASK-082), and disasm endpoint (TASK-099). Bytecode
stored as JSON-op TEXT matching the 'vm:' prefix format. Indexed by
code_hash (dedup detection) and deployer.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Composite (contract_address, storage_key) PK makes SLOAD an index-only
lookup. updated_at_block enables state-snapshot logic (TASK-035). SSTORE
writes upsert via ON CONFLICT.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…ier)

Per-contract metadata: human name, JSON ABI for log decoding (TASK-160),
source URL + verification flag (TASK-098). Partial index on
source_verified=TRUE keeps 'list verified' queries cheap.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Periodic full-state checkpoints every 10k blocks (TASK-035). BYTEA blob
holds gzipped JSON of accounts + contract_storage at that height. Used by
peer fast-sync endpoint /api/mesh/snapshot/:height (TASK-036).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
For multi-replica deploys, the file-backed peer registry is local-only.
Mirror to PG so all replicas share the peer set; the JSON file stays as
a write-through cache for fast cold boot. PeerRegistry.registerPeer
follow-up (separate task) wires the UPSERT.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Naming consistency with agent_memory, agent_completed_tasks, etc. The
table stores agent conversations, not generic chat. Backwards-compat
view at the old name keeps any forgotten callsite reading; future
cleanup task drops the view.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…metrics

PG_POOL_MAX, PG_POOL_IDLE_MS, PG_POOL_CONNECT_MS env vars override the
hardcoded defaults (was max=20). New db.poolStats() exposes
{total, idle, waiting, max} for /api/metrics (TASK-152) and /health/ready
(TASK-149) consumers. In-memory mode returns zeros; no caller breakage.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
queryMetrics module exposes recordQuery(ms), recordQueryError(), and
getHistogram() (cumulative-bucket Prometheus form). db.exec/db.query
now record every call into the histogram and log [PG SLOW] when over
PG_SLOW_QUERY_MS (default 1000). Slow log includes truncated SQL +
param COUNT (never values, to avoid PII leak).

Histogram buckets: 1, 5, 10, 50, 100, 500, 1000, 5000 ms — chosen to
distinguish cache hits from queries that warrant operator attention.
Consumed by /api/metrics (TASK-152) and /health/deep (TASK-149).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
hermeschain-agent and others added 27 commits April 28, 2026 04:47
Documents every env var introduced across tier-1 + tier-2 + tier-3
implementation: LLM, DB pool tuning, Redis bridge, auth, mesh,
SSE pinning, block reward, observability, backups, build info.

Each var labeled with the TASK-NNN that introduced it for traceability.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
`docker compose up` boots a working local Hermeschain stack: PG 16
+ Redis 7 + backend on :4000. Healthchecks gate backend boot until
data services ready. Source mounts in for live-reload via ts-node-dev.

Reads ANTHROPIC_API_KEY + ADMIN_TOKEN from host env to avoid baking
secrets into the file.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Smallest possible VM program (PUSH+PUSH+ADD+LOG+STOP) demonstrating VM
dispatch + dynamic gas + real log emission end-to-end. README walks
through submission via curl + expected receipt shape.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…ery chain)

first-contract.md  — 4-step walkthrough from blank → deployed counter
                     with verification step
query.md           — REST cookbook: blocks, accounts, history, tx, logs,
                     SSE, mempool, stats, mesh, health

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Nine new opcodes covering arithmetic completion (mul/div/mod), boolean
comparisons (eq/lt/gt), bitwise (and/or/not). Gas costs: 5n for mul/div/mod,
3n for the rest.

Divide-by-zero and modulo-by-zero return status:'revert' (not crash) per
EVM convention. Smoke-tested locally end-to-end.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…ints

GET /api/wallet/validate/:input  — returns {valid, reason} for an
                                   address (base58 + length check)
GET /api/blocks/search?from=&to=&producer=  — filter blocks in a range,
                                   optionally by producer

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…tor scripts

vanity-address.js  — brute-force keypairs until publicKey starts with
                     a given prefix. Args: --prefix, --max, --starts-with.
                     Logs every 50k attempts. Exits 1 if no match.

bulk-keys.js       — generate N keypairs as JSON for test fixtures.

Both wired as npm run vanity / npm run bulk-keys. Smoke-tested locally.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Importable schema-v38 dashboard with 6 panels:
  - chain height stat
  - mempool size stat (yellow >5k, red >8k)
  - active peers stat
  - block production rate timeseries
  - PG pool total/idle/waiting timeseries
  - PG query latency heatmap

Reads from /api/metrics (TASK-152). Drop into Grafana via Import → JSON.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Walks docs/blog/*.md, extracts H1 + first paragraph, generates RSS 2.0
XML keyed off file mtime. Output at frontend/public/feed.xml. Run via
`npm run rss` (or wire into build).

Currently empty (no blog posts yet); posts dropped into docs/blog/
appear automatically.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Runs gitleaks on every PR, every push to main, and weekly on Mondays.
Failing scan blocks the PR. Catches accidentally-committed API keys,
private keys, mnemonics.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Matrix runs against backend and frontend, fails on high+ severity
vulnerabilities. Catches deps with known CVEs before merge.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
GitHub-native static analysis with security-extended query suite.
Builds backend + analyzes; results post to Security tab.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Three jobs:
  - build-backend: Node 20+22 matrix, with PG 16 + Redis 7 services
                   for integration tests; runs build + test
  - build-frontend: Node 20, vite build
  - lint: prettier --check

Triggers on PR and push to main. PR-required for merge once branch
protection is enabled.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Production-only 301 redirect when X-Forwarded-Proto != https. Railway
sets the header. No-op in dev. Mounted before observability middleware
so redirected requests don't pollute access log.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Lazy-loads @sentry/node only when SENTRY_DSN is set so the dep is
genuinely optional. Without DSN, all helpers no-op silently. Exports:
  attachSentryRequestHandler(app)  — mount before routes
  attachSentryErrorHandler(app)    — mount last
  captureException(err, ctx)       — manual capture for caught errors

Reads SENTRY_TRACES_SAMPLE_RATE (default 0.1) and tags release with
HERMES_BUILD_COMMIT (TASK-150) for source-map attribution.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
POST /api/newsletter            — subscribe (idempotent on email)
POST /api/newsletter/unsubscribe — soft-unsubscribe via timestamp

Migration 0015 adds newsletter_subscribers table with email PK + source
(where they signed up from) + confirmed flag + unsubscribed_at.

Storage only — no email send. Forward to Mailchimp / Buttondown via
out-of-band cron or webhook.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@hermeschain/sdk npm package skeleton with:
  - HermesClient class (status, getBalance, getNextNonce, getReceipt, submitTx)
  - vmProgram() fluent builder (.push().add().log().stop().toTxData())
  - Typed VmOp / Receipt / ChainStatus interfaces
  - Standalone tsconfig + package.json (publishable)
  - README with quickstart

Signing helpers (TASK-275, TASK-277) ship in a follow-up commit; this
skeleton lets clients read state + submit pre-signed txs immediately.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Keep-a-Changelog format covering tier-1 + tier-2 + tier-3 sweep so far.
~50 TASK-NNN entries cross-linked to backlog specs. Sets up the
[Unreleased] section for the rest of the implementation pass to land
into; each commit can append its TASK ID rather than reinventing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Hand-curated rather than auto-generated from express _router.stack
(too fragile across versions). 22 endpoints documented covering chain,
mempool, mesh, accounts, txs, build/health/metrics. Swagger UI mount
(TASK-142) consumes this spec from /docs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
GET /api/chain/export?from=&to=  streams one JSON-line per block
(content-type application/x-ndjson). No buffering — write+flush per
line so multi-thousand-block exports don't OOM.

Each line: { type: 'block', ...Block.toJSON() }. Pairs with the future
chain:import script (TASK-029).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
GET /api/contract/:addr/disasm   — parsed JSON-op program + deploy info
GET /api/contract/:addr/storage  — paginated key/value with prefix filter

Both depend on contract_code (TASK-313) and contract_storage (TASK-314)
tables already shipped. Returns 404 for unknown addresses; safe to call
on accounts that aren't contracts.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
5 methods implemented:
  eth_blockNumber           — chain height in hex
  eth_chainId               — HERMES_CHAIN_ID env (default 0x1f407)
  net_version               — decimal of chain id
  eth_getBalance(addr)      — balance in hex wei
  eth_getTransactionCount   — nonce in hex

Anything else returns -32601 (method not found). MetaMask + eth-tools
can connect for read-only. eth_call (TASK-177), eth_sendRawTransaction
(TASK-178), and subscriptions (TASK-179) ship later.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
… tier-3-backlog

PacedPusher class wired into worker.ts startup. On every PUSH_INTERVAL_MS
(default 24min = 60/day), fetches origin and advances refs/heads/main
by one commit drawn from origin/tier-3-backlog. Pointer stored in
data/push_pointer.txt for telemetry; idempotent across restarts.

To activate on Railway worker:
  PACED_PUSH_ENABLED=true
  GITHUB_TOKEN=<token with repo write>

Off by default, no-ops without both. Replaces the manual paced-push.js
script as the production path.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…r.js)

worker.ts is dead code — railway.json startCommand is 'cd backend && npm
start' which runs node dist/api/server.js. The AGENT_ROLE=worker branch
inside server.ts handles agent mode. Move PacedPusher.start() into the
server.listen callback's worker branch so it actually fires on Railway.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…nch)

Worker container is cloned --single-branch by Railway, so origin/tier-3-backlog
remote-tracking ref doesn't exist by default. Fetch with explicit
+refs/heads/*:refs/remotes/origin/* refspec to force-create the ref.

Symptom: '[PACER] enumerate failed: Command failed: git rev-list ...
origin/main..origin/tier-3-backlog' on every tick.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Worker is cloned --depth 50 by GitIntegration. The fetch-all-branches
refspec brings the branch tip refs but the intermediate commits aren't
available in the shallow object store, so 'git push <sha>:refs/heads/main'
fails with the SHA missing. Run 'git fetch --unshallow' first (no-op
when already deep).

Also wraps execSync errors to include stderr — the prior 'Command failed'
message swallowed the actual git error reason, making debugging harder.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Bumps [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) from 18.3.1 to 19.2.5.
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.5/packages/react-dom)

---
updated-dependencies:
- dependency-name: react-dom
  dependency-version: 19.2.5
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Apr 28, 2026

Copy link
Copy Markdown
Author

Labels

The following labels could not be found: dependencies, frontend. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot @github

dependabot Bot commented on behalf of github May 11, 2026

Copy link
Copy Markdown
Author

A newer version of react-dom exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant