Repository navigation
chore: release v1.9.0 - #109
Merged
Merged
Conversation
The live embed failed QA; keep it off so the rest of the page can ship. Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(csp): allow the swap widget's RPC, mempool and Solana endpoints on /developers The widget polls EVM transaction status through viem clients pointed at ShapeShift's per-chain RPC proxies (api.<chain>.shapeshift.com) and at viem's default RPCs for Monad, MegaETH, HyperEVM, Plasma and Katana. It reads Bitcoin balances and tx status from mempool.space, and falls back to api.mainnet-beta.solana.com for Solana when AppKit has no connection. None of those origins were in connect-src, so every status poll failed and was retried forever (the widget maps RPC errors to 'pending'), leaving a swap that had already confirmed on-chain stuck on 'Confirming Transaction'. BTC and SOL balances failed the same way and rendered as nothing. Allow *.shapeshift.com so new chain proxies don't need a CSP change each time, and list the remaining third-party RPCs explicitly. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(csp): restore the Onramper iframe on /trade The Buy Crypto card on /trade embeds buy.onramper.com. Its frame-src allowance lived in a route-level Content-Security-Policy header in next.config.ts, which only ever took effect because the middleware's own CSP header was being dropped on the /trade -> /en/trade rewrite. #104 fixed that header loss, so the middleware CSP (chatwoot-only frame-src) now reaches /trade and replaces the next.config one, and the iframe is blocked with a broken-page glyph on develop. Move the Onramper origins into the middleware CSP, scoped to /trade with or without a locale prefix, and drop the now-dead CSP entries from next.config.ts (the COOP header there still does its job). Co-authored-by: Cursor <cursoragent@cursor.com> * feat(developers): initialise AppKit host-side with chain icons and ShapeShift RPCs Let the page own the Reown AppKit instance instead of the swap widget's self-init. The widget documents this mode (it detects the singleton and reuses its wagmi config), and it gives us two knobs the widget doesn't expose: - chainImages: AppKit has no preset icons for MegaETH, HyperEVM, Plasma or Katana, so its network picker showed a generic globe for them. Feed it the same icon set the widget draws in its own chain sidebar so both surfaces match. - customRpcUrls: route wallet balance reads and the Solana connection through ShapeShift's RPC proxies (api.<chain>.shapeshift.com), the same endpoints the widget already uses for status polling, with Reown's Blockchain API kept as the fallback. The network list, adapters and features mirror the widget's own config/appkit.ts so wallet support is unchanged. Co-authored-by: Cursor <cursoragent@cursor.com> * docs(developers): spell out the Reown allowed-origins requirement The blank WalletConnect QR on staging is the relay rejecting the origin: the Reown project's allowlist only contains the *-widget.shapeshift.com demo hosts, and the same project ID is baked into the website bundle. Nothing in this repo can fix that; document exactly what to add and how to check the current list, and note the new host-owned AppKit init. Co-authored-by: Cursor <cursoragent@cursor.com> * docs(developers): note the website origins are now on the Reown allowlist Co-authored-by: Cursor <cursoragent@cursor.com> * fix(developers): let the widget own AppKit and unblock WalletConnect signing Host-side AppKit plus a pinned WC CSP dropped echo/secure-mobile hosts, so session requests never reached the wallet. Match the stock embed path and allow WalletConnect/Reown wildcards on /developers. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>
Contributor
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: trueThanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Merge was re-deriving regular vs hotfix from develop..release, which misfires when the same change exists on both branches as different SHAs. Co-authored-by: Cursor <cursoragent@cursor.com>
railway-app
Bot
temporarily deployed
to
website-frontend / develop
September 18, 2026 04:35
Inactive
Member
Author
CSP stays with the first document, so a /trade-only frame-src never applied when Trade was opened from another page. Co-authored-by: Cursor <cursoragent@cursor.com>
railway-app
Bot
temporarily deployed
to
website-frontend / production
September 23, 2026 00:59
Inactive
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
fix(developers): address swap widget QA findings (#108)
Merge branch 'main' into develop
fix: hide the /developers swap widget behind a feature flag (#107)