All pull requests

Pull requests

• Fix/stream delete guards

  #1866·Opulencechuks opened Oct 25, 2026Contributor·

  ·

• fix(idempotency): reserve keys before execution and never cache 5xx

  #1865·devogechukwu opened Oct 25, 2026·

  ·
  1

• fix(security): add outbound URL guard for stream webhooks

  #1864·devogechukwu opened Oct 25, 2026·11 tasks done·

  ·
  1

• fix(settle): persist chain tx hash and commit only after success

  #1860·chuks68 opened Oct 24, 2026Contributor·

  ·
  1

  2

• fix: server-render list with client filter island

  #1859·chuks68 opened Oct 24, 2026Contributor·

  ·
  1

  2

• fix: New AuthSessionProvider: bearer attachment + 401 recovery, wired into the root layout.

  #1856·AminMG044 opened Oct 22, 2026Contributor·

  ·
  1

  1

• fix: Purge/deep-archive now anchor the chain with keyed checkpoints instead of rebasing hashes.

  #1855·AminMG044 opened Oct 22, 2026Contributor·

  ·
  1

  1

• fix: Unknown /api/* paths return the JSON NOT_FOUND envelope via a catch-all route.

  #1854·AminMG044 opened Oct 22, 2026Contributor·

  ·
  1

  1

• fix: Removed region-level aria-live so state changes announce once via the sr-only status line.

  #1853·AminMG044 opened Oct 22, 2026Contributor·

  ·
  1

  1

• fix: Contact saves verify the resolved Stellar account id and enforce federation-required memos.

  #1852·AminMG044 opened Oct 22, 2026Contributor·

  ·
  1

  1

• fix: /templates is now a streamed Server Component wrapped in a route-level Suspense boundary.

  #1851·AminMG044 opened Oct 22, 2026Contributor·

  ·
  1

  1

• fix: Idempotency keys are reserved before execution; 5xx responses are never cached for replay.

  #1850·AminMG044 opened Oct 22, 2026Contributor·

  ·
  1

  1

• fix: Settle now commits the stream only after the on-chain settlement succeeds and records the real tx hash.

  #1849·AminMG044 opened Oct 22, 2026Contributor·

  ·
  1

  1

• fix: New SSRF guard now blocks private/loopback/metadata hosts on the webhook test endpoint and on webhook_url.

  #1848·AminMG044 opened Oct 22, 2026Contributor·

  ·
  1

  1

• fix: Multi-recipient fan-out legs now enforce integer stroop amounts and schema-valid rate/schedule fields.

  #1847·AminMG044 opened Oct 22, 2026Contributor·

  ·
  1

  1

• Fix/cors same origin

  #1846·amonehin opened Oct 22, 2026Contributor·

  ·
  1

  2

• fix(errors): stop calling async headers() synchronously

  #1844·code-cannot-be-blank opened Oct 22, 2026Contributor·

  ·
  1

  2

• fix(notifications): un-quarantine preferences route suite and align GET/PUT

  #1825·darkwalker2 opened Oct 20, 2026Contributor·

  ·
  1

  5

• fix(v2): apply batch status changes via transition() with side fields

  #1821·PHADAR6 opened Oct 20, 2026·

  ·
  1

  6

• feat(i18n): add locale resolver, typed message catalog, and layout wiring

  #1817·PHADAR6 opened Oct 20, 2026·

  ·
  1

  6

• fix(sse): cap concurrent indexer SSE streams per identity

  #1813·rajesetavie-maker opened Oct 20, 2026·

  ·
  1

  6

• feat: add installable PWA shell

  #1810·Jo-anny opened Oct 20, 2026Contributor·

  ·
  1

  2

• fix(v2): validate create body, honour token, fingerprint idempotency

  #1808·Dev-Savio-hub opened Oct 20, 2026Contributor·

  ·
  1

  3

• perf(layout): lazy-load command palette and shortcuts overlay

  #1801·Devadakene opened Oct 19, 2026Contributor·17 of 36 tasks·

  ·
  1

  2

• fix(streams): guard and audit stream deletion

  #1798·EmperorNexus opened Oct 19, 2026·

  ·
  1

  5