perf(dashboard): drop 12.7k lines of mocked datasets from the client bundle - #2095
perf(dashboard): drop 12.7k lines of mocked datasets from the client bundle#2095pikonha wants to merge 3 commits into
Conversation
…bundle Delete the unreferenced token-distribution dataset (6,884 lines) and load the attack-profitability dataset dynamically, only when the research-pending blur is active. Replace the wildcard next/image remotePatterns with an explicit host allowlist and drop the deprecated domains key. DEV-834 Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
1 Skipped Deployment
|
|
🚅 Deployed to the anticapture-pr-2095 environment in anticapture-infra
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.
Bugbot Autofix prepared fixes for both issues found in the latest run.
- ✅ Fixed: OAuth avatar hosts missing
- Added lh3.googleusercontent.com and avatars.githubusercontent.com to next/image remotePatterns so Google and GitHub OAuth profile images pass Next.js validation.
- ✅ Fixed: Blur shows empty chart briefly
- Preload mocked datasets on mount and extend the loading state until they resolve so the chart never renders empty under the research-pending blur.
Or push these changes by commenting:
@cursor push 2859a26171
Preview (2859a26171)
diff --git a/apps/dashboard/features/attack-profitability/components/MultilineChartAttackProfitability.tsx b/apps/dashboard/features/attack-profitability/components/MultilineChartAttackProfitability.tsx
--- a/apps/dashboard/features/attack-profitability/components/MultilineChartAttackProfitability.tsx
+++ b/apps/dashboard/features/attack-profitability/components/MultilineChartAttackProfitability.tsx
@@ -98,7 +98,7 @@
> | null>(null);
useEffect(() => {
- if (!mocked || mockedDatasets !== null) return;
+ if (mockedDatasets !== null) return;
let mounted = true;
import("@/shared/constants/mocked-data/mocked-attack-profitability-datasets")
.then((m) => {
@@ -110,7 +110,7 @@
return () => {
mounted = false;
};
- }, [mocked, mockedDatasets]);
+ }, [mockedDatasets]);
const quorumValue = Number(
formatUnits(daoData?.quorum || 0n, daoConfig.decimals),
@@ -254,7 +254,9 @@
}, [chartData, mocked, setCsvData]);
const isLoading =
- isLoadingDaoTokenPriceHistoricalData || isLoadingTimeSeriesData;
+ isLoadingDaoTokenPriceHistoricalData ||
+ isLoadingTimeSeriesData ||
+ (mocked && mockedDatasets === null);
if (isLoading) {
return (
diff --git a/apps/dashboard/next.config.ts b/apps/dashboard/next.config.ts
--- a/apps/dashboard/next.config.ts
+++ b/apps/dashboard/next.config.ts
@@ -9,6 +9,8 @@
{ protocol: "https", hostname: "static.ricmoo.com" },
{ protocol: "https", hostname: "www.ricmoo.com" },
{ protocol: "https", hostname: "raw.githubusercontent.com" },
+ { protocol: "https", hostname: "lh3.googleusercontent.com" },
+ { protocol: "https", hostname: "avatars.githubusercontent.com" },
],
dangerouslyAllowSVG: true,
contentDispositionType: "attachment",You can send follow-ups to the cloud agent here.
Reviewed by Cursor Bugbot for commit 45bf07e. Configure here.
| { protocol: "https", hostname: "ensdata.net" }, | ||
| { protocol: "https", hostname: "static.ricmoo.com" }, | ||
| { protocol: "https", hostname: "www.ricmoo.com" }, | ||
| { protocol: "https", hostname: "raw.githubusercontent.com" }, |
There was a problem hiding this comment.
OAuth avatar hosts missing
Medium Severity
Replacing wildcard remotePatterns with a five-host allowlist leaves out common OAuth profile image hosts (e.g. lh3.googleusercontent.com, avatars.githubusercontent.com). SessionAccountButton passes user.image to next/image without unoptimized, so provider avatars for Google or GitHub sign-in can fail Next.js remote-image validation.
Reviewed by Cursor Bugbot for commit 45bf07e. Configure here.
| return () => { | ||
| mounted = false; | ||
| }; | ||
| }, [mocked, mockedDatasets]); |
There was a problem hiding this comment.
Blur shows empty chart briefly
Low Severity
In research-pending mode, chartData uses mockedDatasets ?? {} while the dynamic import is still in flight, so the chart renders with no series until the chunk resolves. The blur overlay appears immediately, but placeholder lines that used to ship synchronously are missing for that window.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 45bf07e. Configure here.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 45bf07efed
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| { protocol: "https", hostname: "euc.li" }, | ||
| { protocol: "https", hostname: "ensdata.net" }, | ||
| { protocol: "https", hostname: "static.ricmoo.com" }, | ||
| { protocol: "https", hostname: "www.ricmoo.com" }, | ||
| { protocol: "https", hostname: "raw.githubusercontent.com" }, |
There was a problem hiding this comment.
When a user signs in through Google, Better Auth stores the OIDC picture in user.image, and SessionAccountButton.tsx:69-74 passes that typically lh3.googleusercontent.com URL to optimized next/image. Because this allowlist omits that host, Next throws a “hostname is not configured” error while rendering the account button. It also omits metadata.ens.domains, the documented ENS avatar source emitted by address enrichment and rendered by EnsAvatar.tsx:170-180, so holder and delegate rows can fail similarly. Add or proxy these dynamic avatar hosts, or render those images unoptimized, before removing the wildcard patterns.
Useful? React with 👍 / 👎.
🎨 UI Review
Global —
|
…cked data loads Restricting remotePatterns broke OAuth profile images: user.image comes from the social provider (Google avatars are served from googleusercontent subdomains), so the host can't be allowlisted at build time. Mark that image unoptimized, matching how service-provider avatars already handle config-driven hosts. Also fold the in-flight mocked-dataset import into the existing loading condition, so research-pending charts show the loader instead of an empty chart while the lazy chunk resolves. Both raised by Cursor Bugbot on #2095. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
|
🔍 Vercel preview: https://anticapture-dwtkc3jjg-ful.vercel.app |
ens.avatar passes through the ENS avatar text record, which any name owner can point at any host, so the remotePatterns allowlist can never cover it. Mark the image unoptimized, after the imageProps spread so a caller can't re-enable optimization for a host we can't validate. Raised by chatgpt-codex-connector on #2095. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Automated review pass complete — ready for human reviewThree commits. Both automated reviewers were addressed; the loop is now handing off. Review feedback addressed
Note on the P1The review named The Google half of that P1 was already fixed in All three avatar surfaces in this app now render Verification
Bundle claim re-verified after every commit: the dataset chunk Still open for a humanE2E was never run successfully. The suite fails 55/59 locally because The ticket's DoD line "all images across DAO pages still render (E2E green)" remains unverified. Given this PR narrowed image host validation and three separate components needed fixes for it, please confirm avatars render on holders/delegates rows, the account button, service-provider tables, and the transfer-modal token logos in a working environment. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0308f41985
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| { protocol: "https", hostname: "euc.li" }, | ||
| { protocol: "https", hostname: "ensdata.net" }, | ||
| { protocol: "https", hostname: "static.ricmoo.com" }, | ||
| { protocol: "https", hostname: "www.ricmoo.com" }, | ||
| { protocol: "https", hostname: "raw.githubusercontent.com" }, |
There was a problem hiding this comment.
When a connected wallet has an ENS avatar stored on any host outside this list, RainbowKit passes the resolved record URL through account.ensAvatar, and the optimized next/image instances in ConnectWallet.tsx:112-119, ConnectWalletCustom.tsx:86-93, and WhitelabelConnectWallet.tsx:80-87 throw the unconfigured-host error while rendering wallet controls. Fresh evidence after the prior avatar fixes is that these three renderers remain optimized; Viem preserves arbitrary HTTPS avatar URLs and maps IPFS/Arweave records to ipfs.io/arweave.net, neither of which is allowed here. Render these dynamic wallet avatars unoptimized or proxy/allow their sources.
Useful? React with 👍 / 👎.
2 participants
Description
Two dashboard bundle/perf items from the 2026-06-11 repo audit (DEV-834).
1. Mocked chart datasets (12,746 lines) no longer ship to every DAO.
mocked-token-dist-datasets.ts(6,884 lines / 161.6K) had zero references anywhere in source — it was dead code, not a lazy-load candidate. Deleted outright rather than dynamically imported.mocked-attack-profitability-datasets.ts(5,862 lines) is now loaded with a dynamicimport(), only when the research-pending blur is active. It was read inside auseMemogated on async SWR data, soawait import()couldn't live there — it neededuseState+useEffectwith an unmount guard.2.
next/imageno longer accepts arbitrary remote hosts.remotePatterns: [{ https, ** }, { http, ** }]with an explicit five-host allowlist.domainskey (its hosts are now covered byremotePatterns).httpentirely — no image src in the app uses it.Allowed hosts, each justified:
euc.li,ensdata.net,static.ricmoo.com,www.ricmoo.com(previously indomains), andraw.githubusercontent.com(Trust Wallet token logos,features/create-proposal/constants.ts:25→AddTransferModal.tsx:350). Service-provider avatars come from remote config and already render withunoptimized, so they are unaffected.Steps to reproduce
Open any DAO's attack-profitability page. For a DAO with real data the mocked dataset is never fetched; for a DAO in research-pending state it loads on demand behind the existing blur.
Related Issue
DEV-834 — https://app.clickup.com/t/86aj0kb5t
Changes
Changes to Core Features:
Verification
pnpm typecheckpnpm lintpnpm test(jest)pnpm buildpnpm test:e2eBundle evidence (DoD item 1). No bundle analyzer is installed, so this uses build output —
.next/diagnostics/route-bundle-stats.json, which listsfirstLoadChunkPathsper route:0xs7ldph~44hu.js(66KB, all 366treasuryNonDAOdatapoints), and that chunk appears in no route'sfirstLoadChunkPathsacross all 37 routes.mockedAttackProfitabilityDatasetscontain only the call site — 3 incidental occurrences each, visible in the minified output ase.A(283768).then(e => F(e.mockedAttackProfitabilityDatasets)).E2E is blocked in this environment (DoD item 2 is NOT verified). The suite fails 55/59 with
toBeVisible()timeouts on headings, tables, and tabs — every page renders empty becauseapps/dashboard/.envis missingANTICAPTURE_API_URL(plusERPC_URL,COINGECKO_API_KEY, and 9 others). No failure mentions images, but that is not evidence images work — those tests never got far enough to load one.A reviewer with a working environment should confirm images still render across DAO pages, particularly service-provider avatars and the Trust Wallet token logos in the transfer modal. That is the one DoD line this PR cannot self-certify.
Additional Notes
.gitignoregains.work/— local run state for the tooling that produced this PR, never committed.Note
Medium Risk
Tightening
remotePatternscan break remote images if any production URL uses a host not on the allowlist; mocked-chart behavior depends on the dynamic import path when research-pending.Overview
Shrinks the dashboard client bundle by removing ~12.7k lines of static mocked chart data and tightening image remote configuration.
Mocked chart data: Deletes the unused
mocked-token-dist-datasetsmodule entirely. For attack profitability, removes the static import ofmocked-attack-profitability-datasetsand dynamically imports it only when time-series data is empty (research-pending / blur state), usinguseState+useEffectwith an unmount guard so the chart uses{}until the chunk loads.next/image: Replaces wildcardhttps/httpremotePatternswith a five-host HTTPS allowlist (euc.li,ensdata.net, Ricmoo static hosts,raw.githubusercontent.com) and removes the deprecateddomainskey and plaintexthttp.Also ignores local
.work/in.gitignore.Reviewed by Cursor Bugbot for commit 45bf07e. Configure here.