Issues

• The CSP nonce is base64 of a UUID string rather than of random bytes, encoding 122 bits of entropy into 48 characters

  enhancement
  MergeFi/frontend#952 · Filter by author chonilius opened on Nov 12, 2026
  1

• Passing a custom signal to request() or apiRequest() silently disables the 20-second timeout

  bug
  MergeFi/frontend#951 · Filter by author chonilius opened on Nov 12, 2026
  1

• WalletConnection.network reports the app's configured network, not the network Freighter is actually on

  bug
  MergeFi/frontend#950 · Filter by author chonilius opened on Nov 12, 2026
  1

• daysUntil returns NaN for an unparseable deadline, which formatDaysUntil renders as "Deadline passed"

  bug
  MergeFi/frontend#949 · Filter by author chonilius opened on Nov 12, 2026
  1

• validateTeamSplits returns valid: true for an empty split list, so a team with no members passes validation

  bug
  MergeFi/frontend#948 · Filter by author chonilius opened on Nov 12, 2026
  1

• coerceNonNegative silently replaces a negative value with the fallback, hiding a negative amount from the backend

  bug
  MergeFi/frontend#947 · Filter by author chonilius opened on Nov 12, 2026
  1

• The adapters substitute plausible placeholder strings for missing data, so a broken response renders as normal content

  bug
  MergeFi/frontend#946 · Filter by author chonilius opened on Nov 12, 2026
  1

• fetchMyRepositories declares a different raw repository shape than adapters.ts uses for the same backend entity

  bug
  MergeFi/frontend#945 · Filter by author chonilius opened on Nov 12, 2026
  1

• No test asserts that the three roles' dashboards fall back to mock data only when degraded is false

  testing
  MergeFi/frontend#944 · Filter by author chonilius opened on Nov 12, 2026
  1

• No test covers parseMoneyInput against non-dot-decimal locales, the case the function was rewritten for

  testing
  MergeFi/frontend#943 · Filter by author chonilius opened on Nov 12, 2026
  1

• No test asserts the CSP nonce reaches the inline theme and locale init scripts

  testing
  MergeFi/frontend#942 · Filter by author chonilius opened on Nov 12, 2026
  1

• No test covers the mock-vs-live fallback contract that every fetcher in api.ts implements

  testing
  MergeFi/frontend#941 · Filter by author chonilius opened on Nov 12, 2026
  1

• No test asserts that every CSP directive the app sends has a corresponding allowlist entry in images.remotePatterns

  testing
  MergeFi/frontend#940 · Filter by author chonilius opened on Nov 12, 2026
  1

• logFetchError console.errors on every fallback, so a backend outage floods server logs with one line per fetch

  enhancement
  MergeFi/frontend#939 · Filter by author chonilius opened on Nov 12, 2026
  1

• wallet.ts's isFreighterInstalled reports connection state, not installation

  documentation
  MergeFi/frontend#938 · Filter by author chonilius opened on Nov 12, 2026
  1

• connectWallet checks the network only after Freighter has already granted access and returned an address

  enhancement
  MergeFi/frontend#937 · Filter by author chonilius opened on Nov 12, 2026
  1

• useCrossTabStorage re-subscribes whenever the onChange callback changes identity

  performance
  MergeFi/frontend#936 · Filter by author chonilius opened on Nov 12, 2026
  1

• AuthContext retries non-auth failures three times with 600ms of total backoff and no jitter

  enhancement
  MergeFi/frontend#935 · Filter by author chonilius opened on Nov 12, 2026
  1

• jest.config.ts's coverage threshold is a single 50% global with no per-file floor

  testing
  MergeFi/frontend#934 · Filter by author chonilius opened on Nov 12, 2026
  1

• jest.config.ts's transformIgnorePatterns is a 20-package hand-maintained negative lookahead

  enhancement
  MergeFi/frontend#933 · Filter by author chonilius opened on Nov 12, 2026
  1

• jest.config.ts forces coverage collection on every run, including watch mode

  enhancement
  MergeFi/frontend#931 · Filter by author chonilius opened on Nov 12, 2026
  1

• package.json's engines allows Node 20.0 while Next 16 requires 20.9+

  bug
  MergeFi/frontend#932 · Filter by author chonilius opened on Nov 12, 2026
  1

• Strict-Transport-Security is pinned at max-age=86400 with nothing tracking the documented graduation

  enhancement
  MergeFi/frontend#930 · Filter by author chonilius opened on Nov 12, 2026
  1

• next.config.ts enables images.dangerouslyAllowSVG globally to serve DiceBear identicons

  security
  MergeFi/frontend#929 · Filter by author chonilius opened on Nov 12, 2026
  1

• The sitemap's in-process cache gives no cache hits on a serverless deployment

  performance
  MergeFi/frontend#928 · Filter by author chonilius opened on Nov 12, 2026
  1