The three open Dependabot alerts (http-cache-semantics, serialize-
javascript) matched versions the lockfile still held. `yarn up -R` moves
http-cache-semantics to a fixed version within range, and
terser-webpack-plugin 5.6 no longer depends on serialize-javascript.
- @pezkuwi/dev, dev-test, dev-ts ^0.86.2
- addrcheck.spec: optional call instead of a guard expression
(@typescript-eslint/prefer-optional-chain)
- checkRepoMeta: drop the initial value every path overwrites
(no-useless-assignment)
- ipfsUpload: drop a disable directive for a rule the toolchain no
longer reports
Nothing proposes updates to the workflow actions: several still declare
the Node 20 runtime, which runners already force to Node 24 with a warning
on every run. Dependabot now checks them monthly and groups all action
updates into one pull request.
`yarn up -R` for every package with an open Dependabot alert, without
changing any declared range: tar, minimatch, brace-expansion, ip-address,
form-data, bn.js, fast-uri, js-yaml, lodash, postcss, rollup, ws and others.
Of the 117 open alerts, 14 still match a locked version afterwards. All of
them come from @pezkuwi/dev's toolchain (webpack-dev-server 4,
typescript-eslint 6, terser-webpack-plugin, express, sockjs, latest-version)
and need a major upgrade there; none is in the published @pezkuwi/phishing,
which depends only on @pezkuwi/util, util-crypto, x-fetch, tldts and tslib.
@pezkuwi/util, util-crypto and x-fetch now require ^14.0.26, which brings
@pezkuwi/wasm-crypto 7.5.20 in place of 7.5.17. The lockfile moves with it.
axios moves to ^1.20.0 in resolutions, with the lockfile entries that the
Dependabot PR for it (#11) left out; without them `yarn install --immutable`
refused to run and every check on that PR failed.
Lock Threads has failed on every scheduled run: lock-threads v4 rejects a
github-token longer than 100 characters, and GitHub's tokens now are. v6.0.2
fixes the validation. Since v5 the action also locks discussions by default;
process-only keeps it to issues and pull requests, as before and as the job's
permissions allow.
The build rewrites every @pezkuwi import into a deno.land URL, so @pezkuwi/util
becomes https://deno.land/x/pezkuwi/util/mod.ts. Upstream can do that because
deno.land/x/polkadot is published. Our fork renamed the prefix to x/pezkuwi and
never published there: deno.land/x/pezkuwi answers 404, and `deno check` has
failed on three modules ever since. Reproduced locally with the same Deno the
workflow installs, 2.9.7:
TS2307 Cannot find module 'https://deno.land/x/pezkuwi/util/mod.ts'
TS2307 Cannot find module 'https://deno.land/x/pezkuwi/util-crypto/mod.ts'
TS2307 Cannot find module 'https://deno.land/x/pezkuwi/x-fetch/mod.ts'
import_map.in.json is the tooling's own hook for exactly this —
pezkuwi-dev-deno-map merges its entries into the generated import_map.json. All
three are mapped to npm: specifiers, which Deno resolves natively, at the same
version ranges the node build uses. The three packages are already on npm, so
nothing new is published and the Deno build now checks against the very code we
ship. `yarn deno` exits 0.
This deliberately does not decide whether we ever claim deno.land/x/pezkuwi. If
we do, the mappings come out again; until then the build works with what we have.
The reason none of this was noticed is the second half of the change. The PR job
carried continue-on-error from upstream, so its four steps could never turn a
pull request red: build had been failing since 2026-09-13 and deno for far
longer, and the job reported success throughout. All four pass now — verified
locally, lint included, on a clean tree — so the flag is gone and they are gates
again.
deno.lock joins mod.ts and import_map.json in .gitignore: same check, same kind
of generated artifact. package.json carries the key order its own build:before
step produces.
Gate: scripts/checkDenoMap.mjs, in the Lists workflow so it runs even when the
toolchain cannot be installed. Nails: removing the map, bumping a dependency
without the map, adding a @pezkuwi dependency with no mapping, and leaving a
mapping behind after its dependency goes — each turns it red.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Say where this repository actually is
On 2026-04-21 a commit pointed repository, homepage and bugs at our Gitea
instance — "migrate git dependencies to Gitea mirror". Nothing else moved.
origin is still GitHub, the published @pezkuwi/phishing still says GitHub, and
git.pezkuwichain.io/pezkuwichain/phishing answers 500, so everyone who installs
the package has been given a dead homepage and a dead bug tracker.
It also broke the Master build on 2026-09-13, when the toolchain began reading
the field. @pezkuwi/dev, which is ours, does this:
const repoPath = pkg.repository.url
.split('https://github.com/')[1]
.split('.git')[0];
A URL from any other host makes [1] undefined and the build dies with "Cannot
read properties of undefined (reading 'split')" — a message that names neither
the field nor the file. Three runs failed that way and master has had no green
build since.
The metadata now says what is true today. This is not a decision about where
the project should live: it is an alignment with where the code already is and
with what we already publish.
That migration is still worth finishing, and this is the sequencing it needs.
Moving the repository to Gitea for real means fixing @pezkuwi/dev first, so a
toolchain built for a state that hosts its own git stops assuming github.com.
scripts/checkRepoMeta.mjs is the tripwire: it fails the metadata here rather
than letting it surface as an unreadable stack trace or ship as a dead link.
The check runs in the Lists workflow, which has no toolchain to install and so
still runs when the build does not. Nails: restoring the April commit turns
three cases red, migrating only half the repository turns two red, and leaving
homepage behind on the old host turns one red.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Hold the new check to the repository's own lint rules
The file I added failed all seven of them and lint had been green: the licence
header every file here carries, import order, an optional chain, object keys in
ascending order and an argument on its own line. Verified with eslint run the
way CI runs it, without --fix.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(sync): open an issue when any step fails, not only when the sync refuses
A failed check, commit or push used to end the job red and nothing else. A
sync that stops without anyone told is how these lists went eight months
stale, so any failure now opens (or comments on) the same issue a refusal
does.
* fix(sync): use the committed GitHub host keys as they are
pezkuwi/github_host_keys already names github.com on every line. The push
step prefixed it again, ssh read "github.com github.com ssh-ed25519 ..." as a
parse error, found no host key, and would have refused every push the sync
made.
The first publish on phishing.pezkuwichain.io copied the stage directory's
0700 mode onto the web root with rsync -a, and every list answered 403 until
the modes were put back by hand, about three minutes later. The publish script
now sets modes (--chmod=D755,F644), and test-publish.sh checks the web root's
directories are 755 and the lists 644; without --chmod it fails.
master is now protected by a ruleset (pull request, "lists" required). GitHub
refuses the Actions app as a bypass actor, so the sync's github.token push
would have been rejected. The sync now pushes over a write deploy key, the
repository's only one, kept as a secret of a "sync" environment that runs for
master only; the ruleset exempts deploy keys. GitHub's host keys are pinned
in pezkuwi/github_host_keys, and the job's token drops to contents: read.
* feat: sync the lists with polkadot-js/phishing daily, and check them before publishing
The lists had not moved since January 2026, the site that serves them was
copied by hand, and the rebrand had turned five real phishing domains into
pezkuwichain.* names, unblocking them.
- scripts/syncUpstream.mjs and sync-upstream.yml take upstream's lists every
day, lay pezkuwi/overlay.json over them, and commit to master. A day out of
bounds (too many sites unblocked or added, scam addresses dropped, one of our
domains blocked, one of our entries lost) writes nothing and opens an issue.
- pezkuwi/overlay.json holds our own entries with their reasons: the five
pezkuwichain.* names stay blocked on purpose, and our domains are protected.
- scripts/lists.mjs holds the rules; scripts/lists.test.mjs tests them and the
sync end to end; scripts/checkLists.mjs checks the committed files, including
that they are what sortAll writes. lists.yml runs all three.
- pezkuwi/host/ is what phishing.pezkuwichain.io runs: it pulls master hourly
and refuses a rewritten history, a blocked own domain, a shrink over 2%, or
shards that disagree, with a sandbox test of each refusal.
- sortAll strips a trailing dot. Upstream's 817 "scam.xyz." entries were filed
under an empty top-level domain in all/all.json, where checkIfDenied never
looks; 816 repeated a listed name, and prenads.xyz was blocked nowhere else.
- sortAll uses Node's own directory functions instead of @pezkuwi/dev, so the
sync and the checks run without installing the build toolchain.
- The auto-approve, auto-merge and crosscheck workflows, and the IPFS job,
depended on tokens and secrets this repository does not have; removed. The
remaining workflows are pinned to commits, with no default permissions and
a timeout on every job.
* chore(lists): first sync with polkadot-js/phishing
Written by scripts/syncUpstream.mjs from upstream bf5e7c6:
658 sites added; nodelinkapp.xyz, org.in and terra-claim.com unblocked by
upstream; the five polkadot-js domains the rebrand had renamed blocked again;
816 duplicate "scam.xyz." entries folded into their names and the stray
all/all.json gone. 54,051 blocked sites, 279 scam addresses.
* fix(lists): commit the .build shard, and refuse a shard git ignores
.gitignore held "build/", which also matched all/build/all.json, the shard of
the .build top-level domain. Every sort wrote it and no commit held it, so the
eight .build scam sites were never published; upstream has the same gap. The
directory is excluded from the ignore rule, the shard is committed, and
checkLists.mjs now fails on any shard git would ignore (with the old rule
restored it does).
Also clears the repository's lint on lists.test.mjs: imports sorted, and
node:test's describe and it calls marked void.
* test(lists): await describe and it, as the repository's lint requires
no-floating-promises requires the promises node:test's describe and it return
to be handled, and no-void forbids handling them with void. Awaited, the 25
cases run as before.
- Update phishing URL to phishing.pezkuwichain.io
- Update author to Dijital Kurdistan Tech Inst
- Update README with Pezkuwi project references
- Update IPFS reference to pezkuwichain.io
- Rebrand all package references from @polkadot to @pezkuwi
