feat: supply chain audit by C0mberry · Pull Request #1211 · solana-foundation/explorer

C0mberry · 2026-08-17T10:44:42Z

Description

adding pnpm audit to ci
adding dependabot for the github actions
pinned third-party GitHub Actions to commit SHAs
pinned pnpm registry resolution explicitly

Type of change

Protocol integration

Related Issues

HOO-857

Checklist

I have updated documentation as needed
CI/CD checks pass on the PR
For security-related features, I have included links to related information

vercel · 2026-08-17T10:44:46Z

@C0mberry is attempting to deploy a commit to the Solana Foundation Team on Vercel.

A member of the Team first needs to authorize it.

vercel · 2026-08-17T10:45:20Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
explorer	Ready	Preview	Aug 17, 2026 1:04pm

greptile-apps · 2026-08-17T10:46:39Z

Greptile Summary

The PR adds a production-dependency audit gate and supply-chain configuration for dependency and GitHub Action updates.

Adds a standalone critical-severity pnpm audit CI job.
Pins pnpm setup and pull-request actions to commit revisions.
Configures Dependabot updates and explicit public npm registry resolution.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
.github/dependabot.yml	Adds weekly grouped update configuration for GitHub Actions and npm dependencies with a 14-day cooldown.
.github/workflows/ci.yaml	Adds an independent production-dependency audit job and pins pnpm setup invocations to a fixed revision.
.github/workflows/update-feature-gates.yml	Pins third-party workflow actions while preserving the existing feature-gate update flow.
.github/workflows/update-verified-programs.yaml	Pins pnpm setup while retaining the existing verified-program update workflow.
package.json	Adds a CI audit command limited to critical advisories in production dependencies.
pnpm-workspace.yaml	Explicitly selects the public npm registry for default package resolution.

_{Reviews (3): Last reviewed commit: "added cooldown" | Re-trigger Greptile}

rogaldh · 2026-08-17T13:29:03Z

+  # into one PR; majors are split out so each can be reviewed on its own. `cooldown` mirrors
+  # the 14-day `minimumReleaseAge` gate in pnpm-workspace.yaml so freshly published versions
+  # aren't proposed until they've aged the same amount.
+  - package-ecosystem: npm


Are you sure we need npm here and not pnpm?

Potentially we could drop it

@rogaldh
dependabot doesn't have a separate pnpm ecosystem
I'd keep it, it's what patches our runtime deps (root + workspace), which is the point of this supply-chain PR

rogaldh · 2026-08-17T13:31:15Z

    "private": true,
    "scripts": {
        "audit": "pnpm audit --audit-level high",
+        "audit:ci": "pnpm audit --audit-level critical",


Suggested change

"audit:ci": "pnpm audit --audit-level critical",

"audit:ci": "pnpm audit --prod --audit-level critical",

I'd focus on the production packages, as they are the most critical

rogaldh · 2026-08-17T13:31:49Z

+# Pin resolution to the public npm registry so it can't silently inherit a
+# global/org .npmrc mirror. Scoped keys (e.g. '@my-org') can be added here.
+registries:
+  default: https://registry.npmjs.org/


rogaldh · 2026-08-17T13:50:23Z

needs: Build-And-Test for Security Audit could be dropped, imo.

rogaldh · 2026-08-17T14:00:18Z

I'd also add a cooldown to gituhb-actions section in Dependabot.yml to keep them in sync

cooldown:
      default-days: 14

rogaldh

LGTM

… sticks (#1226) ## Description Switching the cluster to **Mainnet Beta** does not stick. The Explorer snaps back to the cluster the page was first loaded with. ``` open /?cluster=devnet → click Testnet → /?cluster=testnet ✅ → click Mainnet → /?cluster=devnet ❌ ``` It reverts to the URL of the **initial page load**, not the previous one. Only Mainnet Beta is affected, and only on a production build. ### Why Mainnet Beta only The default cluster is expressed by the *absence* of the param, so Mainnet Beta is the one pill whose href carries no query string (`use-cluster-href.ts`): ```ts if (cluster === DEFAULT_CLUSTER) params.delete('cluster'); else params.set('cluster', clusterSlug(cluster)); ``` Testnet and Devnet navigate to `?cluster=…`, which misses the client route cache and forces a real fetch. Mainnet navigates to a bare pathname, and that is the case Next 16.2 gets wrong. ### Root cause — Next.js 16.2 Two places in Next's client router, one bug: - `router-reducer/create-initial-router-state.js` seeds a route-cache entry on first load. It keys the entry by `location.pathname` — **no search** — while storing `createHrefFromUrl(location)`, the full initial URL **including the query**, as that entry's `canonicalUrl`. - `segment-cache/navigation.js` reads it back on a cache hit: `const canonicalUrl = route.canonicalUrl + url.hash`. So a navigation to `/` hits the entry seeded for `/?cluster=devnet` and adopts its canonical URL. `app-router.js` then `replaceState`s the browser to it. No RSC request is made — the whole thing is served from the poisoned cache entry, which is why the URL flips with no network activity to explain it. Next fixed this in **16.3.0** by threading the search through: ```diff -discoverKnownRoute(Date.now(), location.pathname, null, null, …, canonicalUrl, …) +discoverKnownRoute(Date.now(), location.pathname, location.search, null, null, …, canonicalUrl, …) ``` ### Two more symptoms, same cause - **A custom endpoint cannot be left.** From `?cluster=custom&customUrl=…`, the Mainnet pill lands on `/?customUrl=…`, then the strip effect in `useClusterUrl` calls `router.replace('/')` — query-less, so it bounces straight back to the custom cluster. - **Cancel on the consent prompt does nothing.** `PendingCustomUrlConsent` replaces to `/`, Next restores the original URL, and the prompt re-opens. The safe outcome was unreachable: Connect or leaving the page were the only exits. ### The fix `next` and `eslint-config-next` 16.2.11 → 16.3.0. No app code changes — the href-building code is unchanged since the 2023 App Router port, and it is correct. 16.3.0 rather than 16.3.1 (current latest) because 16.3.1 was published 2026-08-13 and is inside the 14-day `minimumReleaseAge` window from #1211. 16.3.0 shipped 2026-08-03, carries the same fix, and needs no `minimumReleaseAgeExclude` entry. `bench/BUILD.md` moves with it: first-load JS drops ~20 kB on every route. ## Type of change - [x] Bug fix ## Testing Manual testing on the preview deployment. Each one is broken on `master` and fixed here. - [Home on devnet — open the switcher, click Testnet, then Mainnet Beta](https://explorer-git-fork-hoodieshq-fix-next-1-703a39-solana-foundation.vercel.app/?cluster=devnet) — the URL must end at `/` and the navbar must read Mainnet Beta. Clicking Mainnet Beta straight away must do the same. - [Custom endpoint — Connect, then Mainnet Beta](https://explorer-git-fork-hoodieshq-fix-next-1-703a39-solana-foundation.vercel.app/?cluster=custom&customUrl=https://example.com/rpc) — after Connect the switcher must be able to leave the custom cluster. On `master` it snaps back to `?cluster=custom&customUrl=…`. - [Custom endpoint — Cancel the prompt](https://explorer-git-fork-hoodieshq-fix-next-1-703a39-solana-foundation.vercel.app/?cluster=custom&customUrl=https://example.com/rpc) — must land on mainnet with the prompt gone and the param dropped. - [Ordinary mainnet page — unchanged](https://explorer-git-fork-hoodieshq-fix-next-1-703a39-solana-foundation.vercel.app) ## Related Issues Closes [HOO-1153](https://linear.app/solana-fndn/issue/HOO-1153/cluster-gets-stuck) ## Checklist - [x] My code follows the project's style guidelines - [x] All checks pass locally (`pnpm test`, `pnpm lint`, `pnpm typecheck`) - [x] I have run `build:info` script to update build information ## Additional Notes **No regression test.** The symptom needs a production build — the bug does not reproduce under `pnpm dev`, and `playwright.config.ts` starts the suite with `pnpm dev`. CI does not run `test:e2e` at all. A test there could not fail, so the guard is the exact version pin. **Why no app-side workaround.** Emitting `cluster=mainnet-beta` explicitly would dodge the bug, but it gives up clean mainnet URLs everywhere and does not cover the strip effect, which must be able to remove the last query param. The upstream fix covers every call site, including the latent ones: on 16.2, any bare-pathname link back to the initially loaded pathname bounces the same way.

vercel Bot deployed to Preview August 17, 2026 10:46 View deployment

C0mberry added 4 commits August 17, 2026 17:01

adding pnpm audit

e4ca905

adding dependabot for the github-actions

3cb701b

pinned third-party GitHub Actions to commit SHAs

df91dc9

pinned pnpm registry resolution explicitly

494c18a

C0mberry force-pushed the feat/hoo-857-supply-chain-audit branch from 3ae28f9 to 494c18a Compare August 17, 2026 13:02

vercel Bot deployed to Preview August 17, 2026 13:04 View deployment

Woody4618 previously approved these changes Aug 17, 2026

View reviewed changes

rogaldh reviewed Aug 17, 2026

View reviewed changes

updating to check prod packages only

8105ba7

dropped the needs for audit

8be260a

C0mberry dismissed Woody4618’s stale review via 8be260a August 17, 2026 14:03

added cooldown

89cb2a5

rogaldh approved these changes Aug 17, 2026

View reviewed changes

Woody4618 approved these changes Aug 18, 2026

View reviewed changes

Woody4618 merged commit 6b589bd into solana-foundation:master Aug 18, 2026
8 checks passed

askov mentioned this pull request Aug 19, 2026

fix(deps): upgrade Next to 16.3.0 so a cluster switch to Mainnet Beta sticks #1226

Merged

4 tasks

Navigation Menu

Uh oh!

feat: supply chain audit - #1211

feat: supply chain audit#1211
Woody4618 merged 7 commits into
solana-foundation:masterfrom
hoodieshq:feat/hoo-857-supply-chain-audit

C0mberry commented Aug 17, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Aug 17, 2026

Uh oh!

vercel Bot commented Aug 17, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Aug 17, 2026 •

edited

Loading

Uh oh!

rogaldh Aug 17, 2026 •

edited

Loading

Uh oh!

rogaldh Aug 17, 2026

Uh oh!

C0mberry Aug 17, 2026

Uh oh!

rogaldh Aug 17, 2026

Uh oh!

C0mberry Aug 17, 2026

Uh oh!

rogaldh Aug 17, 2026

Uh oh!

rogaldh commented Aug 17, 2026

Uh oh!

rogaldh commented Aug 17, 2026

Uh oh!

rogaldh left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	"audit:ci": "pnpm audit --audit-level critical",
	"audit:ci": "pnpm audit --prod --audit-level critical",

Uh oh!

Conversation

C0mberry commented Aug 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Type of change

Related Issues

Checklist

Uh oh!

vercel Bot commented Aug 17, 2026

Uh oh!

vercel Bot commented Aug 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greptile-apps Bot commented Aug 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

rogaldh Aug 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rogaldh Aug 17, 2026

Choose a reason for hiding this comment

Uh oh!

C0mberry Aug 17, 2026

Choose a reason for hiding this comment

Uh oh!

rogaldh Aug 17, 2026

Choose a reason for hiding this comment

Uh oh!

C0mberry Aug 17, 2026

Choose a reason for hiding this comment

Uh oh!

rogaldh Aug 17, 2026

Choose a reason for hiding this comment

Uh oh!

rogaldh commented Aug 17, 2026

Uh oh!

rogaldh commented Aug 17, 2026

Uh oh!

rogaldh left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

C0mberry commented Aug 17, 2026 •

edited

Loading

vercel Bot commented Aug 17, 2026 •

edited

Loading

greptile-apps Bot commented Aug 17, 2026 •

edited

Loading

rogaldh Aug 17, 2026 •

edited

Loading