Cardano Updates

Signed-off-by: cryptodj413 <[email protected]>

Signed-off-by: cryptodj413 <[email protected]>

Signed-off-by: cryptodj413 <[email protected]>

Signed-off-by: Chris Gianelloni <[email protected]>

- Remove network label selector from badger cache metric queries
- Remove disk I/O panels from block-production (already in resources)
- Add network/instance filters to all event bus metric queries
- Add network label guard to Prometheus alert expressions
- Update README: Grafana 12+ minimum, provisioning overwrite warning, file extension consistency

Signed-off-by: wcatz <[email protected]>

Partition dead links into two buckets with different CI treatment:

  Actionable (FAILS CI) — CHaP packages the probe couldn't resolve
    to any doc site. Usually a gap in IOG_DOC_BASES. Fix by adding
    the doc site, or by adding the package to KNOWN_UNDOCUMENTED
    if it genuinely has no published Haddocks anywhere.

  Unfixable (logged for visibility, does NOT fail CI) — three sub-
    causes, all outside this repo:
      a. Module-level 404s on otherwise-valid upstream sites.
         Empirically the cause is upstream publishing only their
         umbrella "exposed-modules" (e.g. Cardano-Binary.html) while
         Haddock generates hrefs to the defining sub-module (e.g.
         Cardano-Binary-FromCBOR.html).
      b. Packages in KNOWN_UNDOCUMENTED with no published Haddocks
         anywhere (currently kes-agent and kes-agent-crypto —
         verified no gh-pages branch, no CloudFront deployment).
      c. Haddock-emitted versionless Hackage URLs that Hackage's
         routing doesn't accept.

Add typed-protocols to IOG_DOC_BASES: its Haddocks are published at
input-output-hk.github.io/typed-protocols, which the heuristic now
reaches via the fallback list.

In GitHub Actions, actionable entries emit ::warning:: annotations so
they surface in the job UI; unfixable entries are plain log lines so
they don't flood the annotations panel. Env escape
FIX_HADDOCK_LINKS_ALLOW_DEAD=1 forces exit 0 regardless.

Rewrite the preamble to summarise the pipeline, the doc-site
resolution strategy, the rationale for skipping non-CHaP packages,
and the two-bucket CI policy with empirical justification.

Haddock resolves re-exports to the local re-export page (e.g. a reference
to cardano-ledger-byron's Address via Cardano.Api.Byron becomes
href="Cardano-Api-Byron.html#t:Address", not an external link). The
Haddock-emitted "Source" link, however, points to the cabal store path
for the original defining package. Phase 2b uses that as ground truth to
rewrite local re-export hrefs to the upstream doc site.

Also extend dead-link handling in Phase 3: before annotating a 404 as
unclickable, probe for the page under doc-site subdirectories (api/,
protocols/, framework/ — ouroboros-network's layout) and under parent
modules (Cardano-Ledger-Api-State-Query-CommitteeMembersState.html ->
Cardano-Ledger-Api-State-Query.html#t:CommitteeMembersState). If the
parent resolves, rewrite to it with a reconstructed #t: fragment so the
browser still scrolls to the definition.

On a full cardano-api build this rewrites 205 of 208 re-exported types
(up from 0) and rescues 182 of 233 previously-annotated dead links.

Fixes #601. Cross-package hrefs emitted by cabal haddock-project are
relative paths (e.g. href="../cardano-ledger-api-1.2.3-hash/Foo.html")
that don't resolve on the published site — we only host cardano-api's
own output, not its dependencies, so every cross-package reference
404s by default.

Add scripts/fix-haddock-links.sh and wire it into the github-page
workflow between haddock-project and the artifact upload. The script
replaces each cross-package href with either an absolute URL on the
upstream doc site or a tooltip-annotated unclickable <span>, so the
published site has zero clickable 404s.

Pipeline
  Phase 1: Scan filesystem, symlink versioned directories, fetch the
           CHaP index, grep HTML for cross-package link targets.
  Phase 2: Resolve each target and rewrite in place, or convert to an
           unclickable span if unresolvable.
  Phase 3: HEAD-validate rewritten URLs and annotate 404s as spans.

Doc-site resolution for CHaP packages: two lookups, first hit wins:
  1. Name-suffix heuristic under *.cardano.intersectmbo.org — strip
     trailing '-token' segments of the package name and HEAD-probe
     each candidate's doc-index.html. Covers cardano-ledger-*,
     plutus-*, ouroboros-*, etc.
  2. Fixed fallback against a small IOG_DOC_BASES list — covers
     packages whose subdomain isn't a suffix of the package name
     (e.g. cardano-base at base.cardano.intersectmbo.org).

Non-CHaP packages (bootlibs like base, bytestring, time) are NOT
linked. Haddock's per-module URL structure doesn't line up cleanly
with Hackage's (src/ source views, -inplace version suffixes from
local rebuilds) so Hackage rewrites mostly produce 404s, and readers
of cardano-api docs rarely click into bootlib internals. Rendered as
unclickable spans, no outbound link, no validation noise.

Fixes #601. Cross-package hrefs emitted by cabal haddock-project are
relative paths (e.g. href="../cardano-ledger-api-1.2.3-hash/Foo.html")
that don't resolve on the published site — we only host cardano-api's
own output, not its dependencies, so every cross-package reference
404s by default.

Add scripts/fix-haddock-links.sh and wire it into the github-page
workflow between haddock-project and the artifact upload. The script
replaces each cross-package href with one of:

  * an absolute URL on the upstream doc site, when the package is on
    CHaP and we find a valid hosted module page for it;
  * a tooltip-annotated, unclickable <span>, when the package is not
    on CHaP (bootlibs like base, bytestring, time are deliberately
    not linked — Haddock's URL shapes don't match Hackage's well and
    readers rarely follow the links anyway), or is on CHaP but has
    no known doc site, or the upstream module page itself 404s.

The published site thus has zero clickable 404s.

Doc-site resolution
  For each CHaP package, two lookups in order, first hit wins:
    1. Name-suffix heuristic under *.cardano.intersectmbo.org: drop
       trailing "-token" segments of the package name, HEAD-probe
       each candidate's doc-index.html. Covers cardano-ledger-*,
       plutus-*, ouroboros-*, etc.
    2. Fixed fallback against IOG_DOC_BASES: a six-entry list of
       known IOG doc-site roots for families whose subdomain isn't a
       name-suffix (cardano-base at base.cardano…, network-mux at
       ouroboros-network.cardano…, io-classes at io-sim, etc.).
  Misses become "Unmapped CHaP" and fall into the CI policy below.

Post-rewrite: Phase 2b uses Haddock's emitted "Source" cabal-store
links as ground truth to rewrite local re-export pages back to the
defining upstream package (e.g. references to cardano-ledger-byron's
Address via Cardano.Api.Byron). Phase 3 HEAD-validates each rewritten
URL and rescues dead ones by probing subdirectories (api/, protocols/,
framework/) and parent-module fallbacks with #t: fragment
reconstruction.

Dead-link CI policy (two buckets)
  Actionable (FAILS CI) — CHaP packages the probe couldn't resolve.
    Usually a gap in IOG_DOC_BASES; fix by adding the doc site or
    adding the package to KNOWN_UNDOCUMENTED if genuinely unpublished.
  Unfixable (logs only, does NOT fail CI) — three sub-causes, all
    outside this repo:
      a. Module-level 404s on valid upstream sites; empirically
         upstream publishes only umbrella modules (Cardano-Binary.html)
         while Haddock generates hrefs to the defining sub-module
         (Cardano-Binary-FromCBOR.html).
      b. Packages in KNOWN_UNDOCUMENTED (no published Haddocks
         anywhere — currently kes-agent and kes-agent-crypto).
      c. Haddock-emitted versionless Hackage URLs that Hackage's
         routing doesn't accept.
  GitHub Actions actionable entries emit ::warning:: annotations;
  unfixable ones are plain log lines so they don't flood the UI.
  Env escape FIX_HADDOCK_LINKS_ALLOW_DEAD=1 forces exit 0 anyway.

Signed-off-by: Chris Guiney <[email protected]>

Signed-off-by: William Hankins <[email protected]>

- Upgrade rand 0.8.5→0.8.6 in crypto-benchmarks.rs (GHSA unsound with custom logger)
- Upgrade rand 0.8.5→0.8.6 and 0.9.2→0.9.3 in sim-rs
- Upgrade nbconvert 7.16.6→7.17.1 (path traversal in HTMLExporter and attachments)
- Upgrade tornado 6.5.1→6.5.5 (cookie attribute injection)
- Upgrade Pygments 2.19.2→2.20.0 (ReDoS via GUID matching)

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

Upgrade dependencies and add overrides to resolve 20 open Dependabot
alerts for postcss, vite, serialize-javascript, uuid, lodash,
follow-redirects, brace-expansion, path-to-regexp, and node-forge
across site/, ui/, cost-dashboard/, and post-cip/mempool-sim-viz/.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

Signed-off-by: Chris Gianelloni <[email protected]>

Co-authored-by: sg-doc-holiday[bot] <219201796+sg-doc-holiday[bot]@users.noreply.github.com>

Signed-off-by: Matthieu Pizenberg <[email protected]>