* DApps: the Dijital Kurdistan Ecosystem Hub, a native screen
Tapping "Dijital Kurdistan" in the DApps tab used to open pezkuwichain.io in the
browser. It now opens the hub first, inside the DApps tab so the wallet's bottom
bar stays in view; the user picks an app there and it opens in the DApp browser.
- Four sections: Finance (8), Governance (9), Education (4), Social (8). Each is
a card with a glowing border in its colour (green, red, amber, blue), a header
band with its name and app count, and a four-column grid of apps.
- Apps open the same pages the web app's mobile home links to, at
app.pezkuwichain.io, or their own sites: Wallet and Validators the explorer,
Exchange pex.network, Delegation wekil.pex.mom, KurdAI kurdishtts.dks.news,
Games games.pex.mom, Rewshenbir rewshenbir.pezkiwi.app. Music has no page yet:
it is shown dimmed and does nothing when tapped.
- The entry is recognised by its URL (pezkuwichain.io root, from
wallet-utils dapps_full.json), so favourites open the hub too. Back, from the
arrow or the system, closes the hub before it leaves the tab.
- Strings in English, Turkish and Kurmanji, worded as the web app words them;
other languages fall back to English.
* DApps hub: open Music at music.dks.news
Every app in the hub now has an address, so the dimmed, inert state for an app
without one is gone along with its string.
* DApps hub: open KurdMedia at dks.news
---------
Co-authored-by: Claude <noreply@anthropic.com>
* build(rust): bump vulnerable crates in native binding lockfiles
- rand 0.8.5 -> 0.8.6 (GHSA-cq8v-f236-94qc) in hydra-dx-math and sr25519-bizinikiwi
- keccak 0.1.5 -> 0.1.6 (GHSA-3288-p39f-rqpv) in hydra-dx-math and sr25519-bizinikiwi
- bytes -> 1.11.1 (GHSA-434x-w66g-qw3r) in hydra-dx-math and metadata_shortener
- time 0.3.41 -> 0.3.47 (GHSA-r6v5-fh4h-64xc) in hydra-dx-math
- tracing-subscriber 0.3.19 -> 0.3.20 (GHSA-xwfj-jgwm-7wp5) in hydra-dx-math
Lockfile-only updates via cargo update --precise; Cargo.toml requirements
are unchanged. time 0.3.47 pulls serde 1.0.229/serde_core and requires
rustc 1.88, which the stable toolchain used by CI satisfies.
* ci: restrict default GITHUB_TOKEN permissions to contents: read
None of these workflows write through GITHUB_TOKEN: artifact upload,
Firebase, S3, Play Store, gh-pages and the Appium dispatch all use their
own credentials. Reusable workflows they call inherit the same cap.
* fix(dapp): send only fixed, JSON-quoted error messages to dApp pages
The polkadot.js responder forwarded Throwable.message of any rejection
error to the page and both responders interpolated the message into
JavaScript without escaping. Map polkadot.js rejections to a fixed public
message (unknown errors become "Request failed"), give MetamaskError an
explicit publicMessage, and quote both with JSONObject.quote so a message
can no longer break out of the string literal.
* ci: stop installing the removed legacy SDK 'tools' package
android-actions/setup-android installs 'tools platform-tools' by default.
sdkmanager now fails with "Failed to find package 'tools'", which aborts
dependency installation for every build and lint job. Only platform-tools
is needed; nothing in the workflows uses the legacy tools directory.
