Repository navigation
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
efe0d03 to
975e059
Compare
mgrabina
changed the title
|
📦 Next.js Bundle Analysis for aave-uiThis analysis was generated by the Next.js Bundle Analysis action. 🤖
|
| Page | Size (compressed) |
|---|---|
global |
1.34 MB (🟡 +511 B) |
Details
The global bundle is the javascript bundle that loads alongside every page. It is in its own category because its impact is much higher - an increase to its size means that every page on your website loads slower, and a decrease means every page loads faster.
Any third party scripts you have added directly to your app using the <script> tag are not accounted for in this analysis
If you want further insight into what is behind the changes, give @next/bundle-analyzer a try!
975e059 to
6c34e35
Compare
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Moves the adapter and factory addresses to the suite deployed from cow-swap-adapters@12a8bb5a and adds the leverage adapter. Linea has its own factory; every other chain uses the shared Core factory. The new factories verify adapter orders under the EIP-712 name AaveV3AdapterV3Factory, which the SDK now takes as adapterDomainName. An instance can only be cancelled on the factory that created it, so each saved order now records its factory, and orders saved before this change cancel on the previous factory, the only one used before.
6c34e35 to
db65420
Compare
|
Codex Review: Didn't find any major issues. More of your lovely PRs please. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
@cowprotocol/sdk-flash-loans 4.0.0 adds adapterDomainName and the Leverage flash-loan type. cow-sdk and the ethers-v5 adapter move with it so there is one copy of each internal sdk-* package. The release is younger than the 7-day minimumReleaseAge, so its exact versions are excluded until 2026-10-20. Exact-version excludes need pnpm 10.19, hence the packageManager bump.
|
📦 Next.js Bundle Analysis for aave-uiThis analysis was generated by the Next.js Bundle Analysis action. 🤖
|
| Page | Size (compressed) |
|---|---|
global |
1.34 MB (🟡 +837 B) |
Details
The global bundle is the javascript bundle that loads alongside every page. It is in its own category because its impact is much higher - an increase to its size means that every page on your website loads slower, and a decrease means every page loads faster.
Any third party scripts you have added directly to your app using the <script> tag are not accounted for in this analysis
If you want further insight into what is behind the changes, give @next/bundle-analyzer a try!
![aave-code-review[bot]](https://avatars.githubusercontent.com/u/47617460?s=60&v=4){kind=small}
There was a problem hiding this comment.
Automated review
Commit b0b12a9f. This review replaces any earlier review on this pull request.
Verdict: minor issues
1 finding(s) are commented on the lines below.
Full detail, other severities, and the accept/reject controls are on the scan page.
Findings you reject there stop being reported for this repository.
| minimumReleaseAgeExclude: | ||
| - '@aave/*' | ||
| - '@aave-dao/*' | ||
| # TODO: cow-sdk release from 2026-10-13, remove once it clears the 7-day window on 2026-10-20 |
There was a problem hiding this comment.
New exclusions bypass the 7-day release quarantine for ten CoW packages
medium · security
The diff adds ten exact @cowprotocol/* versions to minimumReleaseAgeExclude. The TODO says these versions were published on 2026-10-13, so they are new today. The exclusion turns off the supply-chain quarantine for packages that build order data and transaction targets in signing flows. If one of these releases is malicious, nothing delays installs until the community finds the problem. The exact version pins and the TODO limit the exposure, but nothing enforces removal after 2026-10-20. Reviewer confidence: high that the control is bypassed. Reviewer confidence is lower that a compromise is likely.
Why this severity: The diff disables an active supply-chain control for wallet-signing dependencies. Exact version pins and a short time window reduce the risk. An attacker must also control one of these specific releases.
How it is reached: An attacker compromises a CoW npm publisher and ships one of these exact versions with malicious code. CI and developers install it at once because the exclusion skips minimumReleaseAge. The code runs at build time or in the browser. It changes order data or transaction targets, and the user signs a request that drains funds.
Suggested fix: Wait until the versions clear the 7-day window, then merge without the exclusions. The PR is still a draft, so this costs little. If the bypass must stay, verify the lockfile integrity hashes against the upstream release artifacts. Also add a CI check that fails after 2026-10-20 while these entries remain.
Review harness · reply here to accept or reject this finding
This branch was successfully deployed
1 participant
General Changes
0xD2CC30cB0e77B80a34b879ccB6da67799e4ecD83, except Linea, which uses0x3171FC716942a40DEDe8dD0B7885dd9f44eca176.0xa1138627412212e53C208e220696f14b0185a82c.0xC898f87b572018ED25F501FFD620894a32dCa1AC.0x4AE46995af9ED4f4EdFC6FF1523b114EE4D7053a.0xaEE8B0666BF8a584e9D67bFaa65007E74c70b26a.AaveV3AdapterV3Factory, which is passed to the SDK asadapterDomainName.0xdeCC46a4b09162F5369c5C80383AAa9159bCf192, the only factory the interface used before. Without this, cancelling an older order would mark it cancelled in the UI while it stayed fillable.Developer Notes
adapterDomainNameandAaveFlashLoanType.Leverageto@cowprotocol/sdk-flash-loans. Bump the package once it's released. Until then CI typecheck fails against 3.3.4.deployAndTransferFlashLoanunless a real flash loan is running. If CoW's orderbook simulates EIP-1271 orders when they are created, it will reject them.Reviewer Checklist
Please ensure you, as the reviewer(s), have gone through this checklist to ensure that the code changes are ready to ship safely and to help mitigate any downstream issues that may occur.
.env.examplefile as well as the pertinant.github/actions/*files