You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
High Risk
Large new DeFi borrow path with wallet signing, transaction submission, and LTV validation touches money-moving flows; earn routing/state refactor could regress staking if mis-wired.
Overview
Adds a feature-flagged borrow experience in the dashboard (form → review → steps → complete, plus borrow position management), backed by a new borrow module: Effect Schema domain models, OpenAPI-generated BorrowApi client, and @effect/atom-react atoms for markets/positions, form state, action execution (sign/submit/confirm), and post-tx cache refresh.
Earn flow cleanup: drops EarnPageStateUsageBoundaryProvider / @xstate/store, removes common/get-token-balances.ts and getInitialToken from stake types, and tightens validator handling via a composite Validator.key (address + optional subnet) used in select-validator and position balance keys.
Tooling/config: OpenAPI generator gains BorrowApi (full httpclient + spec prep), optional CLI spec selection, VITE_BORROW_API_URL / VITE_FORCE_BORROW, and root pnpm.patchedDependencies removed; adds skeleton line/circle loaders for borrow UI loading states.
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: f2d2a83c-e736-49e8-b48f-3041b4042c82
You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.
Use the checkbox below for a quick retry:
🔍 Trigger review
✨ Finishing Touches🧪 Generate unit tests (beta)
Create PR with unit tests
Commit unit tests in branch feat/earn-effect-atom-poc
Comment @coderabbitai help to get the list of available commands.
Key validators by address and subnet so selection keeps distinct validator options.
Scope balance and init token options to the selected dashboard category.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, Cursor Security Agent left an unresolved medium-severity finding, and required checks did not finish on the latest commit (Bugbot cancelled; Security Agent still running). Assigned jdomingos and dnehl for human review.
Sent by Cursor Approval Agent: Pull Request Router and Approver
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent has an unresolved medium-severity tabnabbing finding on complete.tsx. jdomingos and dnehl are already assigned for human review.
Sent by Cursor Approval Agent: Pull Request Router and Approver
Split earn intent and view atoms so route and wallet state changes update the resolved view.
Keep dispatch separate from view reads and add wallet resolution handling.
Cover dashboard tab selection and patch Effect parent tracking.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent has an unresolved medium-severity tabnabbing finding on complete.tsx. jdomingos and dnehl are already assigned for human review.
Sent by Cursor Approval Agent: Pull Request Router and Approver
Replace legacy context, query, and state-machine integrations with Effect services and
atom-backed wallet, API, and workflow state.
Split Vitest projects and add AST rules to validate the new architecture.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent still has unresolved findings (medium tabnabbing and high canary-publish/supply-chain issues in release.yml). jdomingos and dnehl are already assigned for human review.
Sent by Cursor Approval Agent: Pull Request Router and Approver
Actions with empty, address-like, or missing token symbols no longer
fall back to "Unknown token". Filter them from the activity list so
users only see items with a usable token label.
The reason will be displayed to describe this comment to others. Learn more.
🔒 Agentic Security Review
Severity: MEDIUM
window.open(url, "_blank") is called on a transaction URL without opener isolation or URL validation. If this URL is attacker-controlled (directly or via compromised upstream metadata), the opened page can retain window.opener access and redirect the original trusted tab.
Impact: This enables reverse-tabnabbing/phishing flow hijack during a wallet-sensitive user journey.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent still has unresolved findings (medium tabnabbing and high canary-publish/supply-chain issues in release.yml). jdomingos and dnehl are already assigned for human review.
Sent by Cursor Approval Agent: Pull Request Router and Approver
The legacy price API serializes native tokens with an undefined address
key, while local token identity uses an empty one. Fall back to the
legacy key so USD amounts format correctly for native tokens.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent still has unresolved findings (medium tabnabbing and high canary-publish/supply-chain issues in release.yml). jdomingos and dnehl are already assigned for human review.
Sent by Cursor Approval Agent: Pull Request Router and Approver
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent still has unresolved findings (medium tabnabbing and high canary-publish/supply-chain issues in release.yml). jdomingos and dnehl are already assigned for human review.
Sent by Cursor Approval Agent: Pull Request Router and Approver
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent still has unresolved findings (medium tabnabbing and high canary-publish/supply-chain issues in release.yml). No new reviewers assigned; two reviewers are already requested for human review.
Sent by Cursor Approval Agent: Pull Request Router and Approver
Align classic and dashboard unstake on one shared section with a footer
CTA, and select the receive token from the amount accessory like
enter/stake instead of a separate dropdown.
Pending actions can require validator selection while the position has
nothing to unstake, so rendering the modal inside the unstake section
hid it. Render it alongside the whole surface on both classic and
dashboard instead.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Not approving: Cursor Security Agent did not reach a terminal state within the polling window, and this large earn/borrow refactor exceeds the low-risk approval threshold. No new reviewers assigned; two reviewers are already requested for human review.
Sent by Cursor Approval Agent: Pull Request Router and Approver
Replace technical-kind domain/schema and domain/types folders with
concept-owned modules so schemas and rules live with the concept they
describe. Record the decision in ADR 0020.
WidgetConfigService exclusively owns one normalization pass and the
current value stream so valid Host Configuration updates apply without
remounting. Record the decision in ADR 0021 and supersede mount-time
Application Runtime Identity for API identity and borrowEnabled.
Keep the wallet runtime alive when comparable wallet fields change after
bootstrap; log and ignore those updates so host config can keep syncing.
Also remove the unused disableGasCheck host setting.
Match allow, block, and preferred rules with network-sensitive address
identity, and commit Earn Selection when Host Configuration updates
invalidate the current validators.
Replace the staged Earn state machine with Entry Intent, pure
reconciliation, and a non-paginated Earn Catalog per ADR-0022. Drop
token pagination, stage-specific retry, and selection facades.
Move validator policy normalization into WidgetConfig so all Earn consumers
share the same Map/Set representation. Remove the feature-local adapter while
preserving network-specific wildcard identity handling in filterValidators.
Keep window and Vite environment augmentations in one package-owned declaration file.
Update the test-only export configuration to track the consolidated entry.
Keep Borrow wallet interpretation with the feature as a pure view projection.
Derive it from the shared wallet selector.
Remove the unused bridge payload and domain wallet schema.
Remove the redundant guard hook and obsolete chain exports.
Move architecture enforcement into the widget package and keep the root hygiene command as a thin
Turbo entrypoint. Replace manual interface and export checks with dependency-cruiser, Knip, and
ast-grep while removing obsolete fixtures and configs.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@coinbase/cdp-sdk@1.52.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Warn
Obfuscated code: npm @mixpanel/rrweb-snapshot is 90.0% likely obfuscated
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@mixpanel/rrweb-snapshot@2.0.0-alpha.18.5. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Warn
Obfuscated code: npm @solana-program/system is 90.0% likely obfuscated
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@solana-program/system@0.10.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Warn
Obfuscated code: npm @walletconnect/sign-client is 90.0% likely obfuscated
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@walletconnect/sign-client@2.23.7. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Warn
High CVE: npm brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/brace-expansion@1.1.15. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Warn
High CVE: npm brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/brace-expansion@1.1.15. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Warn
High CVE: npm brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/brace-expansion@1.1.15. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Warn
Obfuscated code: npm data-urls is 90.0% likely obfuscated
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/data-urls@7.0.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Warn
Obfuscated code: npm formatly is 90.0% likely obfuscated
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/formatly@0.3.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Warn
Obfuscated code: npm jsdom is 90.0% likely obfuscated
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/jsdom@30.0.1. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Warn
Obfuscated code: npm libsodium-sumo is 90.0% likely obfuscated
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/libsodium-sumo@0.8.4. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Warn
Obfuscated code: npm libsodium-sumo is 90.0% likely obfuscated
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/libsodium-sumo@0.8.4. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Warn
Telemetry collection: npm mixpanel-browser
Note: The package dist/mixpanel.module.js is a DOM/session recording and analytics library that captures user interactions, DOM state, inputs, and other events, and transmits data to external endpoints using token-based authorization. It may monkey-patch browser APIs and process data via a base64-encoded Web Worker, with persistence of recording queues/flags. This creates a high privacy risk and requires masking, user consent, endpoint allow-listing, auditing, and strict privacy/configuration controls.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Most telemetry comes with settings to disable it. Consider disabling telemetry if you do not want to be tracked.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/mixpanel-browser@2.81.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Warn
Telemetry collection: npm mixpanel-browser
Note: The package dist/mixpanel.module.js is a DOM/session recording and analytics library that captures user interactions, DOM state, inputs, and other events, and transmits data to external endpoints using token-based authorization. It may monkey-patch browser APIs and process data via a base64-encoded Web Worker, with persistence of recording queues/flags. This creates a high privacy risk and requires masking, user consent, endpoint allow-listing, auditing, and strict privacy/configuration controls.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Most telemetry comes with settings to disable it. Consider disabling telemetry if you do not want to be tracked.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/mixpanel-browser@2.81.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Warn
Telemetry collection: npm mixpanel-browser
Note: The file package/dist/mixpanel-recorder.min.js is a telemetry library that instruments user interactions (mouse, touch, scroll, input, canvas, DOM events) for session-replay analytics, batching and persisting data in IndexedDB/localStorage/cookies, and sending compressed payloads to a remote analytics endpoint (e.g., Mixpanel). It also intercepts XMLHttpRequest and fetch calls, captures request/response headers and optionally bodies, and transmits data to a remote analytics service, raising privacy and data-exfiltration concerns if misconfigured or misused.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Most telemetry comes with settings to disable it. Consider disabling telemetry if you do not want to be tracked.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/mixpanel-browser@2.81.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Warn
Telemetry collection: npm mixpanel-browser
Note: The file package/dist/mixpanel-recorder.min.js is a telemetry library that instruments user interactions (mouse, touch, scroll, input, canvas, DOM events) for session-replay analytics, batching and persisting data in IndexedDB/localStorage/cookies, and sending compressed payloads to a remote analytics endpoint (e.g., Mixpanel). It also intercepts XMLHttpRequest and fetch calls, captures request/response headers and optionally bodies, and transmits data to a remote analytics service, raising privacy and data-exfiltration concerns if misconfigured or misused.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Most telemetry comes with settings to disable it. Consider disabling telemetry if you do not want to be tracked.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/mixpanel-browser@2.81.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Warn
Obfuscated code: npm mixpanel-browser is 90.0% likely obfuscated
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/mixpanel-browser@2.81.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Warn
Obfuscated code: npm mixpanel-browser is 90.0% likely obfuscated
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/mixpanel-browser@2.81.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Warn
High CVE: npm nanoid: custom generators can loop indefinitely when size is zero
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/nanoid@3.3.15. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Warn
High CVE: npm nanoid: non-secure generators can loop indefinitely with negative size
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/nanoid@3.3.15. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Unpopular packages may have less maintenance and contain other problems.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@dedot/cli@0.16.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Unpopular packages may have less maintenance and contain other problems.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@dedot/codegen@0.16.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Unpopular packages may have less maintenance and contain other problems.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@dedot/merkleized-metadata@0.16.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Unpopular packages may have less maintenance and contain other problems.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@dedot/smoldot@0.16.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Unpopular packages may have less maintenance and contain other problems.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/dedot@0.16.0. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
The reason will be displayed to describe this comment to others. Learn more.
Risk: high. Not approving: this large earn/borrow refactor exceeds the low-risk approval threshold, and Cursor Security Agent still has unresolved high and medium findings that need human review. No new reviewers assigned; two reviewers are already requested.
Sent by Cursor Approval Agent: Pull Request Router and Approver
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Note
High Risk
Large new DeFi borrow path with wallet signing, transaction submission, and LTV validation touches money-moving flows; earn routing/state refactor could regress staking if mis-wired.
Overview
Adds a feature-flagged borrow experience in the dashboard (form → review → steps → complete, plus borrow position management), backed by a new
borrowmodule: Effect Schema domain models, OpenAPI-generatedBorrowApiclient, and@effect/atom-reactatoms for markets/positions, form state, action execution (sign/submit/confirm), and post-tx cache refresh.Earn flow cleanup: drops
EarnPageStateUsageBoundaryProvider/@xstate/store, removescommon/get-token-balances.tsandgetInitialTokenfrom stake types, and tightens validator handling via a compositeValidator.key(address + optional subnet) used in select-validator and position balance keys.Tooling/config: OpenAPI generator gains
BorrowApi(fullhttpclient+ spec prep), optional CLI spec selection,VITE_BORROW_API_URL/VITE_FORCE_BORROW, and rootpnpm.patchedDependenciesremoved; adds skeleton line/circle loaders for borrow UI loading states.Reviewed by Cursor Bugbot for commit 6cf3187. Configure here.