Merge branch 'main' into legal/disclaimer-update

Author: 0xAlunara

.github/copilot-instructions.md

@@ -73,7 +73,7 @@ src/[domain]/
 - React 19 with TypeScript
 - TanStack Router for routing
 - TanStack Query for data fetching
-- Node.js 22 (required)
+- Node.js LTS version (required)
 - Yarn 4 workspaces
 
 **State & Data:**
@@ -106,7 +106,6 @@ Routes are defined in `/apps/main/src/routes/` with a hierarchical structure:
 // Root route with global layout
 export const rootRoute = createRootRoute({
   component: RootLayout,
-  loader: getNetworkDefs,
 })
 
 // Domain layout route
@@ -119,7 +118,7 @@ export const dexLayoutRoute = createRoute({
 // Feature route
 export const poolRoute = createRoute({
   getParentRoute: () => dexLayoutRoute,
-  path: '$network/pool/$poolId',
+  path: '$network/pool/$poolIdOrAddress',
   component: PagePool,
   head: () => ({ meta: [{ title: 'Pool - Curve' }] }),
 })

.github/workflows/ci.yaml

@@ -59,6 +59,14 @@ jobs:
           ELECTRON_ENABLE_LOGGING: true # send console logs to stdout in electron browser
           NODE_ENV: test
 
+      - uses: actions/upload-artifact@v4
+        if: failure()
+        with:
+          name: cypress-component-${{ matrix.browser }}-${{ matrix.count }}
+          path: tests/cypress/screenshots
+          retention-days: 3
+          if-no-files-found: error
+
   cypress-component-rpc:
     name: Cypress component tests with RPC
     if: github.ref_name == 'main'
@@ -88,6 +96,8 @@ jobs:
         with:
           name: cypress-rpc
           path: tests/cypress/screenshots
+          retention-days: 3
+          if-no-files-found: error
 
   cypress-e2e:
     strategy:
@@ -98,7 +108,7 @@ jobs:
         include:
           - browser: chrome
             count: 2
-    name: Cypress in ${{ matrix.browser }} ${{ matrix.count }}
+    name: Cypress e2e tests in ${{ matrix.browser }} ${{ matrix.count }}
     timeout-minutes: 15
     runs-on: ubuntu-latest
     steps:
@@ -114,26 +124,39 @@ jobs:
       - run: yarn build
 
       - name: Start dev server
-        run: yarn start 2>&1 | tee dev-server.log &
+        run: yarn start 2>&1 | tee ../../e2e-dev-${{ matrix.browser }}-${{ matrix.count }}.log &
         working-directory: apps/main
 
-      - run: yarn run cy:run:e2e --browser ${{ matrix.browser }}
+      - name: Start api server
+        run: yarn dev 2>&1 | tee ../../e2e-api-${{ matrix.browser }}-${{ matrix.count }}.log &
+        working-directory: apps/router-api
+
+      - name: e2e tests
         working-directory: tests
+        run: |
+          set -o pipefail # fail tee if the main command fails
+          yarn run cy:run:e2e --browser ${{ matrix.browser }} 2>&1 | tee ../e2e-cypress-${{ matrix.browser }}-${{ matrix.count }}.log
         env:
           ELECTRON_ENABLE_LOGGING: true # send console logs to stdout in electron browser
           NODE_ENV: test
+          CYPRESS_VIDEO: ${{ matrix.browser == 'firefox' && 'false' || 'true' }}  # Firefox doesn't support recording
+
+      - name: Check runtime errors
+        if: always()
+        # todo: add `Cannot destructure .. as it is undefined`
+        run: if grep --ignore-case --extended-regexp "update depth exceeded|many re-renders|unmounted component|non-unique keys|uncontrolled to controlled|properties of undefined" e2e-*.log; then exit 1; fi
 
       - uses: actions/upload-artifact@v4
         if: failure()
         with:
-          name: cypress-main-${{ matrix.browser }}-${{ matrix.count }}
+          name: cypress-e2e-${{ matrix.browser }}-${{ matrix.count }}
           path: tests/cypress/screenshots
-          retention-days: 1
+          retention-days: 3
           if-no-files-found: error
 
       - uses: actions/upload-artifact@v4
         if: failure()
         with:
           name: dev-server-log-${{ matrix.browser }}-${{ matrix.count }}
           if-no-files-found: error
-          path: apps/main/dev-server.log
+          path: e2e-*.log

.github/workflows/prices-api.yaml

@@ -15,7 +15,7 @@ jobs:
       - name: Setup NPM registry in Yarn
         uses: actions/setup-node@v4
         with:
-          node-version: '22'
+          node-version: 22
           cache: yarn
           registry-url: 'https://registry.npmjs.org'
 

.gitignore

@@ -17,11 +17,10 @@ node_modules
 coverage
 cypress.env.json
 tests/cypress/screenshots
+artifacts/
 
-# next.js
-.next/
-out/
-build
+# Vercel deployment files, generated by vite-plugin-vercel
+/apps/main/.vercel/
 
 # misc
 .DS_Store
@@ -58,9 +57,6 @@ dist
 # crash report
 report.*.json
 
-# hardhat
-tests/cache
-
 # storybook
 storybook-static
 *storybook.log

CLAUDE.md

@@ -106,7 +106,6 @@ Routes are defined in `/apps/main/src/routes/` with a hierarchical structure:
 // Root route with global layout
 export const rootRoute = createRootRoute({
   component: RootLayout,
-  loader: getNetworkDefs,
 })
 
 // Domain layout route
@@ -119,7 +118,7 @@ export const dexLayoutRoute = createRoute({
 // Feature route
 export const poolRoute = createRoute({
   getParentRoute: () => dexLayoutRoute,
-  path: '$network/pool/$poolId',
+  path: '$network/pool/$poolIdOrAddress',
   component: PagePool,
   head: () => ({ meta: [{ title: 'Pool - Curve' }] }),
 })

DEVELOPMENT_GUIDE.md

@@ -44,10 +44,6 @@ This repository is organized as follows:
 - `/packages/prices-api`: Package for consuming the Prices API, mapped as `@curvefi/prices-api`. Soon to be to separated its own NPM package.
 - `/tests`: Cypress tests
 
-## Development Guide
-
-For detailed information on development practices and usage of new libraries, please refer to our [Development Guide](./DEVELOPMENT_GUIDE.md).
-
 ## Testing
 
 Check the [README](./tests/README.md) in the `tests` directory for instructions on how to run end-to-end tests using Cypress.

README.md

@@ -0,0 +1,8 @@
+# Security Policy
+
+This document reflects the security contact details published in [https://www.curve.finance/.well-known/security.txt](https://www.curve.finance/.well-known/security.txt).
+
+## Reporting a Vulnerability
+
+- Contact: [security@curve.finance](mailto:security@curve.finance)
+- Preferred language: English (`en`)

SECURITY.md

@@ -0,0 +1,23 @@
+import { type IncomingMessage, ServerResponse } from 'http'
+import { createRouterApiServer } from 'router-api/src/server'
+
+const server = createRouterApiServer()
+
+/**
+ * Vercel handler for API routes, using fastify under the hood. This is only used when deployed to Vercel.
+ * While in development, vite's dev server redirects /api/* calls to the router-api dev server.
+ * This file is automatically detected by vite-plugin-vercel because it is in the "_api" folder.
+ */
+export default async function handler(request: IncomingMessage, response: ServerResponse) {
+  const start = Date.now()
+  await server.ready()
+  server.server.emit('request', request, response)
+  response.on('finish', () =>
+    server.log.info({
+      message: 'request finished',
+      method: request.method,
+      path: request.url,
+      runtimeMs: Date.now() - start,
+    }),
+  )
+}

apps/main/_api/router.ts

@@ -17,28 +17,31 @@
     "postpublish": "pinst --enable"
   },
   "dependencies": {
-    "@curvefi/api": "2.68.10",
-    "@curvefi/llamalend-api": "1.0.33",
+    "@curvefi/llamalend-api": "1.0.40",
     "@ethersproject/abi": "^5.8.0",
     "@hookform/error-message": "^2.0.1",
-    "@hookform/resolvers": "^5.2.1",
+    "@hookform/resolvers": "^5.2.2",
     "@supercharge/promise-pool": "^3.2.0",
-    "@tanstack/react-router": "^1.131.31",
-    "@tanstack/react-router-devtools": "^1.131.31",
+    "@tanstack/react-router": "^1.139.14",
+    "@tanstack/react-router-devtools": "^1.139.14",
     "@types/memoizee": "^0.4.12",
     "curve-ui-kit": "*",
+    "echarts": "^6.0.0",
+    "echarts-for-react": "^3.0.5",
     "external-rewards": "*",
     "fuse.js": "^7.1.0",
-    "lightweight-charts": "^5.0.8",
+    "lightweight-charts": "^5.0.9",
     "memoizee": "^0.4.17",
-    "react-hook-form": "7.62.0",
+    "react-hook-form": "7.68.0",
     "recharts": "2.15.4",
+    "solid-js": "^1.9.10",
     "ui": "*",
     "vest": "^5.4.6",
     "vite-plugin-svgr": "^4.5.0",
-    "vite-plugin-vercel": "9.0.7"
+    "vite-plugin-vercel": "9.0.8"
   },
   "peerDependencies": {
+    "@curvefi/api": "*",
     "bignumber.js": "*",
     "ethers": "*",
     "immer": "*",
@@ -49,20 +52,21 @@
     "zustand": "*"
   },
   "devDependencies": {
+    "@curvefi/api": "*",
     "@eslint/js": "*",
-    "@types/lodash": "^4.17.20",
+    "@types/lodash": "^4.17.21",
     "@types/memoizee": "^0.4.12",
-    "@types/node": "24.3.0",
+    "@types/node": "*",
     "@types/react": "*",
     "@types/react-dom": "*",
-    "@vitejs/plugin-react": "^5.0.1",
+    "@vitejs/plugin-react": "*",
     "babel-plugin-styled-components": "^2.1.4",
     "eslint": "*",
     "eslint-config-custom": "*",
-    "globals": "^16.3.0",
+    "globals": "^16.5.0",
     "pinst": "^3.0.0",
     "typescript": "*",
-    "typescript-eslint": "^8.41.0",
+    "typescript-eslint": "^8.48.1",
     "vite": "*"
   }
 }