[JOY (JOY)]

Upstream Sync - v12.0.4

Auto-merge with upstream v12.0.4 failed. Version/workflow conflicts were auto-resolved,
but the following files have code conflicts that need manual resolution:

apps/explorer/lib/explorer/migrator/delete_zero_value_internal_transactions.ex
docker-compose/envs/common-blockscout.env
docker/Dockerfile
mix.lock
types-package/package-lock.json

To resolve:

1. Check out this branch locally
2. Resolve remaining conflicts
3. Push and merge this PR
4. Then create tag v12.0.4 to trigger Docker build

Upstream release notes

[claude]

⚠️ Code review skipped — your organization has no extra usage available to pay for this review.

If your organization's extra usage balance is empty, an organization admin can add extra usage credits at claude.ai/admin-settings/usage. If its monthly spend limit was reached, an admin can raise it on the same page. If neither applies, contact Anthropic support.

Once extra usage is available, someone with write access to this repository can comment @claude review on this pull request to trigger a review.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-11-02T14:03:13.460701Z We couldn’t complete this review. Comment @codex review to try again.	d6b057c	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "Codex (@codex) review" or "Codex (@codex) security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Walkthrough

Warning

Review details and warnings were omitted to fit the comment limit.

[gemini-code-assist]

Code Review

This pull request upgrades the codebase to Elixir 1.20 and Erlang/OTP 28, replaces Poison/Jason with the built-in JSON module, adds support for ERC-8056 tokens, and refactors pagination across API v2. The review feedback correctly identifies three critical issues: a potential FunctionClauseError in notifier.ex due to missing keys in a TransactionView.render/2 call, a crash risk in address_controller.ex if BlockNumber.get_max/0 returns nil, and an unsafe log.block.hash access in transaction_view.ex when the block association is not preloaded.

[gemini-code-assist]

TransactionView.render("token_transfers.json", ...) expects decoded_transactions_map and next_page_params in its assigns map. Calling it with only token_transfers and conn will fail to match any clause and raise a FunctionClauseError at runtime. Please pass decoded_transactions_map: %{} and next_page_params: nil to satisfy the pattern match.

          TransactionView.render("token_transfers.json", %{
            token_transfers: relevant_token_transfers,
            decoded_transactions_map: %{},
            next_page_params: nil,
            conn: nil
          })

[gemini-code-assist]

If BlockNumber.get_max() returns nil (which can happen if the block number cache is empty or during initial sync/testing), evaluating head_block_number - tolerance will raise an ArithmeticError and crash the request. We should safely handle the nil case.

      case BlockNumber.get_max() do
        nil ->
          end_block_number

        head_block_number ->
          if is_nil(end_block_number) or end_block_number >= head_block_number do
            max(head_block_number - tolerance, 0)
          else
            end_block_number
          end
      end

[gemini-code-assist]

Using log.block.hash is unsafe because if the block association is not loaded (i.e., %NotLoaded{}) or is nil (e.g., for pending logs), this will raise a KeyError or BadMapError at runtime. Since block_hash is a direct field on the Log struct, we should continue using log.block_hash which is always safe and avoids unnecessary association loading.

      "block_hash" => log.block_hash,

[claude]

⚠️ Code review skipped — your organization has no extra usage available to pay for this review.

If your organization's extra usage balance is empty, an organization admin can add extra usage credits at claude.ai/admin-settings/usage. If its monthly spend limit was reached, an admin can raise it on the same page. If neither applies, contact Anthropic support.

Once extra usage is available, someone with write access to this repository can comment @claude review on this pull request to trigger a review.

[claude]

⚠️ Code review skipped — your organization has no extra usage available to pay for this review.

If your organization's extra usage balance is empty, an organization admin can add extra usage credits at claude.ai/admin-settings/usage. If its monthly spend limit was reached, an admin can raise it on the same page. If neither applies, contact Anthropic support.

Once extra usage is available, someone with write access to this repository can comment @claude review on this pull request to trigger a review.

[cursor]

Stale comment

Agentic security review of the v12.0.4 upstream sync found one medium issue: a newly accepted scoped reCAPTCHA bypass token in the query string is not redacted from API access logs.

  

_{Sent by Cursor Security Agent: Security Reviewer}

[cursor]

🔒 Agentic Security Review
Severity: MEDIUM

This PR newly accepts the scoped reCAPTCHA bypass token from the scoped_recaptcha_bypass_token query parameter (header still takes precedence). That value is an operator-issued shared secret used to skip CAPTCHA on privileged actions such as NFT metadata refetch.

BlockScoutWeb.Plug.Logger logs request_path?query_string and RPCTranslator.redact_apikey/1 only redacts apikey=. A query-string bypass therefore lands in application logs, and typically also in reverse-proxy/CDN logs, Referer headers, and browser history. Tests and OpenAPI now document the query form, which steers trusted clients into this leak. Header-only submission remains safer.

Impact: Anyone with access to those logs (or a leaked Referer) can reuse the token to bypass CAPTCHA on scoped endpoints.

 

^{Reviewed by Cursor Security Reviewer for commit beebe4f. Configure here.}