QA-Test -> Stable-Test - v2.1.2 by Luisfc68 · Pull Request #684 · rsksmart/liquidity-provider-server

Luisfc68 · 2025-04-25T10:18:05Z

v2.1.2 changes sync

feat: version endpoint

feat: add btc wallet reconnection

fix: order of ranges management ui in general tab

* feat: add script to refund user pegout * refactor: move scripts common behavior to a separate package * refactor: rename refund pegout script dir * feat: add register pegin script * test: add tests for register pegin script * feat: refactor refund user pegout script - add tests * fix: address sonarcloud issues of duplicate code * feat: refactor refund user pegout script to receive a parse function - add documentation - modify Makefile * feat: add validation for quote hash in RefundUserPegOut - add tests * fix: sonarcloud issues * fix: sonar warnings * refactor: remove duplicated code from refund_user_pegout - add usage message in refund_user_pegout * Update cmd/utils/refund_user_pegout/refund_user_pegout.go Co-authored-by: Luisfc68 <60527258+Luisfc68@users.noreply.github.com> --------- Co-authored-by: AndresQuijano <andres.quijano@iovlabs.org> Co-authored-by: AndresQuijano <66392159+AndresQuijano@users.noreply.github.com>

* feat: update wei to sat conversion * fix: update test assertion * ci: run codeql in every PR

feat: GBI-2291 | ability to full modify confirmation block ranges

feat: add key conversion script

feat: split up management file

feat: sort confirmations upon saving configuration

Co-authored-by: Luisfc68 <60527258+Luisfc68@users.noreply.github.com>

fix: confirmation sorting | LPS-UI

fix: GBI-2392 | Add error messages on local env autoconfiguration

feat: change pegout liquidity unit in liquidity endpoint

Flyover 2.1.2 -> QA-Test

Update sed usage based on OS

v2.1.2 RC - Security feedback

github-actions · 2025-04-25T10:18:19Z

Dependency Review

The following issues were found:

✅ 0 vulnerable package(s)
✅ 0 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
⚠️ 8 package(s) with unknown licenses.

See the Details below.

License Issues

docker-compose/monitoring/package.json

Package	Version	License	Issue Type
@rsksmart/rsk-monitor	^0.1.0	Null	Unknown License
@types/node	^20.11.19	Null	Unknown License

go.mod

Package	Version	License	Issue Type
golang.org/x/crypto	0.37.0	Null	Unknown License
golang.org/x/net	0.39.0	Null	Unknown License
golang.org/x/sync	0.13.0	Null	Unknown License
golang.org/x/sys	0.32.0	Null	Unknown License
golang.org/x/term	0.31.0	Null	Unknown License
golang.org/x/text	0.24.0	Null	Unknown License

OpenSSF Scorecard

Scorecard details

Package

Version

Score

Details

npm/@mempool/mempool.js

^2.3.0

🟢 3.7

Details

Check	Score	Reason
Maintained	⚠️ 0	0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Code-Review	🟢 5	Found 7/12 approved changesets -- score normalized to 5
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	⚠️ -1	no workflows found
Token-Permissions	⚠️ -1	No tokens found
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ -1	no dependencies found
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities	🟢 5	5 existing vulnerabilities detected

npm/@rsksmart/rsk-monitor

^0.1.0

Unknown

npm/@types/node

^20.11.19

🟢 6.9

Details

Check	Score	Reason
Code-Review	🟢 8	Found 25/29 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
License	🟢 9	license file detected
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	⚠️ 0	project is not fuzzed

npm/ts-node

^10.9.2

🟢 4.2

Details

Check	Score	Reason
Code-Review	⚠️ 1	Found 5/30 approved changesets -- score normalized to 1
Maintained	⚠️ 0	0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Security-Policy	🟢 10	security policy file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
License	🟢 10	license file detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Signed-Releases	⚠️ -1	no releases found
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities	⚠️ 0	52 existing vulnerabilities detected

npm/typescript

^5.3.3

🟢 8.4

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Dependency-Update-Tool	🟢 10	update tool detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Security-Policy	🟢 10	security policy file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
License	🟢 10	license file detected
Branch-Protection	🟢 6	branch protection is not maximal on development and all release branches
Binary-Artifacts	🟢 10	no binaries found in the repo
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Pinned-Dependencies	🟢 6	dependency not pinned by hash detected -- score normalized to 6
SAST	🟢 9	SAST tool detected but not run on all commits
Fuzzing	🟢 10	project is fuzzed
CI-Tests	🟢 9	29 out of 30 merged PRs checked by a CI test -- score normalized to 9
Contributors	🟢 10	project has 36 contributing companies or organizations

gomod/github.com/bits-and-blooms/bitset

1.13.0

🟢 7.4

Details

Check	Score	Reason
Maintained	🟢 7	9 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 7
Packaging	⚠️ -1	packaging workflow not detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Code-Review	🟢 7	Found 8/11 approved changesets -- score normalized to 7
Dependency-Update-Tool	🟢 10	update tool detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Pinned-Dependencies	🟢 10	all dependencies are pinned
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Signed-Releases	⚠️ -1	no releases found
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
CI-Tests	🟢 10	10 out of 10 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 17 contributing companies or organizations

gomod/github.com/crate-crypto/go-ipa

0.0.0-20240223125850-b1e8a79f509c

🟢 5.5

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	⚠️ 0	0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	⚠️ 0	security policy file not detected
Fuzzing	🟢 10	project is fuzzed
Signed-Releases	⚠️ -1	no releases found
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

gomod/github.com/ethereum/go-ethereum

1.14.13

🟢 6.7

Details

Check	Score	Reason
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 16 issue activity found in the last 90 days -- score normalized to 10
Security-Policy	🟢 10	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	🟢 8	Found 25/30 approved changesets -- score normalized to 8
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 9	binaries present in source code
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Fuzzing	🟢 10	project is fuzzed
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities	🟢 8	2 existing vulnerabilities detected

gomod/github.com/ethereum/go-verkle

0.1.1-0.20240829091221-dffa7562dbe9

🟢 4.7

Details

Check	Score	Reason
Packaging	⚠️ -1	packaging workflow not detected
Maintained	⚠️ 0	0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Code-Review	🟢 8	Found 24/30 approved changesets -- score normalized to 8
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	⚠️ 0	security policy file not detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
SAST	🟢 8	SAST tool detected but not run on all commits

gomod/github.com/holiman/uint256

1.3.1

🟢 4.4

Details

Check	Score	Reason
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ -1	No tokens found
Maintained	⚠️ 0	1 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Dangerous-Workflow	⚠️ -1	no workflows found
Binary-Artifacts	🟢 10	no binaries found in the repo
Code-Review	🟢 7	Found 23/30 approved changesets -- score normalized to 7
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	⚠️ 0	security policy file not detected
Fuzzing	🟢 10	project is fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

gomod/github.com/supranational/blst

0.3.13

🟢 6.2

Details

Check	Score	Reason
Code-Review	⚠️ 0	Found 0/30 approved changesets -- score normalized to 0
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 9	security policy file detected
Maintained	🟢 10	22 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
SAST	🟢 10	SAST tool detected: CodeQL
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	🟢 10	project is fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Vulnerabilities	🟢 10	0 existing vulnerabilities detected

gomod/golang.org/x/crypto

0.37.0

Unknown

gomod/golang.org/x/net

0.39.0

Unknown

gomod/golang.org/x/sync

0.13.0

Unknown

gomod/golang.org/x/sys

0.32.0

Unknown

gomod/golang.org/x/term

0.31.0

Unknown

gomod/golang.org/x/text

0.24.0

Unknown

Scanned Files

docker-compose/monitoring/package.json
go.mod

chore: update vulnerable dependencies

Luisfc68 and others added 30 commits October 8, 2024 23:27

feat: version endpoint

b964e1f

ci: run tests in all PRs

a9cdc45

Merge branch 'QA-Test' into feature/GBI-2137

c489e49

test: fix test name

0009312

Merge pull request #541 from rsksmart/feature/GBI-2137

d5ede3d

feat: version endpoint

fix: order of ranges management ui in general tab

d756873

feat: add btc wallet reconnection

fd18e8e

Merge pull request #577 from rsksmart/feature/GBI-2152

4803852

feat: add btc wallet reconnection

Merge pull request #575 from rsksmart/bugfix/GBI-2290

a0f2e69

fix: order of ranges management ui in general tab

feat: add key conversion script

e9f7b42

test: move file name template to constant

4f2eff8

test: fix write test file function

c50cc24

test: increase timeout

f5b9b5d

feat: GBI-2291 | ability to full modify confirmation block ranges

f5772d4

fix: whitespace for review

0c5e896

feat: update wei to sat conversion (#584)

04d1a25

* feat: update wei to sat conversion * fix: update test assertion * ci: run codeql in every PR

fix: feedback | remove unused value & improve indexing

788d1da

feat: add quote hash validation inside repository (#586)

a552630

ci: run code ql in version branches

665512b

ci: change dependency review permissions (#587)

af53e53

Merge pull request #582 from rsksmart/feat-GBI-2291

d4856b2

feat: GBI-2291 | ability to full modify confirmation block ranges

feat: split up management file

db2fd11

Merge pull request #581 from rsksmart/feature/GBI-2328

2b8bf8f

feat: add key conversion script

Merge pull request #592 from rsksmart/feat-GBI-2370

0d6558d

feat: split up management file

feat: sort blocks to deliver upon saving configuration

b3a0661

feat: GBI-2379 & GBI-2378

8c1792e

Merge pull request #594 from rsksmart/feat-GBI-2380-sort-entries

7ad71f9

feat: sort confirmations upon saving configuration

Merge branch 'flyover-2.1.1' into feat-GBI-2378&GBI-2379

613324b

Update management.js

cb38793

Dominikkq and others added 20 commits February 21, 2025 15:45

fix: Force Management API to be enabled in lps-env.sh

c4a8e60

remove white space

d4e1c8d

Co-authored-by: Luisfc68 <60527258+Luisfc68@users.noreply.github.com>

Merge pull request #635 from rsksmart/fix-confirmation-sorting

13d76e8

fix: confirmation sorting | LPS-UI

Merge pull request #629 from rsksmart/fix-GBI-2392

bb3cf7e

fix: GBI-2392 | Add error messages on local env autoconfiguration

Merge pull request #630 from rsksmart/feature/GBI-2333

117e8da

feat: change pegout liquidity unit in liquidity endpoint

Merge branch 'master' into flyover-2.1.1

c997a37

chore: update vulnerable packages

454b9e6

fix: sed usage to run in pipeline

b979b5d

fix: loop in local script

31ec2d8

fix: change substitution syntax in local script

40425d7

Merge pull request #667 from rsksmart/flyover-2.1.2

4ed5395

Flyover 2.1.2 -> QA-Test

chore: update sed usage in local script

208bec2

chore: add codeowners file

cd30b29

ci: set shell used in action

469b3cf

ci: fix action command syntax

57a4892

Merge pull request #675 from rsksmart/local-script-fix

401c38f

Update sed usage based on OS

feat: add memguard purge to main application

d4d75d0

feat: add memguard to the utility scripts

2ac5e7b

fix: pass error message with textContent in management ui

47b5d29

Merge pull request #682 from rsksmart/feature/v2.1.2-sec-feedback

2f134a8

v2.1.2 RC - Security feedback

Luisfc68 changed the title ~~QA-Test -> Stable-Test~~ QA-Test -> Stable-Test - v2.1.2 Apr 25, 2025

Luisfc68 and others added 4 commits April 25, 2025 12:27

chore: update vulnerable dependencies

96e3d1b

chore: update go version in Dockerfiles

a621d48

chore: revert gorilla csrf version

b32ea65

Merge pull request #685 from rsksmart/dependencies-update

3453249

chore: update vulnerable dependencies

Luisfc68 temporarily deployed to dev April 25, 2025 12:05 — with GitHub Actions Inactive

Luisfc68 marked this pull request as ready for review April 25, 2025 12:05

MaximStanciu8 approved these changes Apr 25, 2025

View reviewed changes

Luisfc68 merged commit 596dd78 into Stable-Test Apr 25, 2025
14 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

QA-Test -> Stable-Test - v2.1.2#684

QA-Test -> Stable-Test - v2.1.2#684
Luisfc68 merged 94 commits intoStable-Testfrom
QA-Test

Luisfc68 commented Apr 25, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Apr 25, 2025 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

Luisfc68 commented Apr 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Apr 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

License Issues

docker-compose/monitoring/package.json

go.mod

OpenSSF Scorecard

Scanned Files

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Luisfc68 commented Apr 25, 2025 •

edited

Loading

github-actions bot commented Apr 25, 2025 •

edited

Loading