v1.7.0 — Protocol Roadmap & Security Hardening

New Features

Protocol Roadmap Tracker

• New /roadmap page tracking GIPs, protocol milestones, and product features across three layers: Product, Protocol, and Economics
• Every item is clickable — opens a detail drawer with full overview, Indexer Impact, Delegator Impact, official status, and Lodestar's own assessment
• Lodestar assessment is editable by the team; all claims are attributed to sources (official blog, GIP forum threads, Messari reports, GraphOps forum updates)
• Filter bar: All / Shipped / In Progress / Planned / Experimental
• Accessible via sidebar and mobile nav "More" menu

Bug Fixes

• Thawing token inflation on indexer pages: delegatedTokens from the subgraph includes thawing amounts — these are now subtracted before display on the indexer detail page, delegate sub-page, and DelegationCalculator
• This is a companion fix to the v1.6.0 delegator portfolio correction; the same class of bug was present on the indexer side

Performance

• Parallelised subgraph batch fetching — reduces cold load times on pages with multiple subgraph queries
• Dynamic chart imports to reduce initial JS bundle size
• Tuned refetch intervals across React Query hooks

Security

• Rate limiting via Upstash Redis on all API routes
• Security headers hardened (CSP, X-Frame-Options, HSTS, etc.)
• Input validation and sanitisation on all user-supplied parameters
• Fail-closed cron authentication — unauthenticated cron calls now return 401 rather than silently succeeding
• SSRF prevention on outbound fetch calls

Testing

• Comprehensive test suite added; coverage above 80% on all metrics